169 files changed, 7304 insertions, 2158 deletions

diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 4ad8675f5a16..d8046a113c37 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -309,7 +309,7 @@ config PATA_HPT3X2N
           If unsure, say N.
 
 config PATA_HPT3X3
-        tristate "HPT 343/363 PATA support (Experimental)"
+        tristate "HPT 343/363 PATA support"
         depends on PCI
         help
           This option enables support for the HPT 343/363
@@ -317,6 +317,14 @@ config PATA_HPT3X3
 
           If unsure, say N.
 
+config PATA_HPT3X3_DMA
+        bool "HPT 343/363 DMA support (Experimental)"
+        depends on PATA_HPT3X3
+        help
+          This option enables DMA support for the HPT343/363
+          controllers. Enable with care as there are still some
+          problems with DMA on this chipset.
+
 config PATA_ISAPNP
         tristate "ISA Plug and Play PATA support (Experimental)"
         depends on EXPERIMENTAL && ISAPNP
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 2610db75f984..d9fa329fd157 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -414,7 +414,7 @@ static const struct piix_map_db ich6m_map_db = {
          */
         .map = {
                 /* PM   PS   SM   SS       MAP */
-                {  P0,  P2,  RV,  RV }, /* 00b */
+                {  P0,  P2,  NA,  NA }, /* 00b */
                 { IDE, IDE,  P1,  P3 }, /* 01b */
                 {  P0,  P2, IDE, IDE }, /* 10b */
                 {  RV,  RV,  RV,  RV },
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 5b25311ba885..88e2dd0983b5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -71,6 +71,7 @@ static unsigned int ata_dev_init_params(struct ata_device *dev,
                                         u16 heads, u16 sectors);
 static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
 static void ata_dev_xfermask(struct ata_device *dev);
+static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
 
 unsigned int ata_print_id = 1;
 static struct workqueue_struct *ata_wq;
@@ -1283,18 +1284,11 @@ static unsigned int ata_id_xfermask(const u16 *id)
 void ata_port_queue_task(struct ata_port *ap, work_func_t fn, void *data,
                          unsigned long delay)
 {
-        int rc;
-
-        if (ap->pflags & ATA_PFLAG_FLUSH_PORT_TASK)
-                return;
-
         PREPARE_DELAYED_WORK(&ap->port_task, fn);
         ap->port_task_data = data;
 
-        rc = queue_delayed_work(ata_wq, &ap->port_task, delay);
-
-        /* rc == 0 means that another user is using port task */
-        WARN_ON(rc == 0);
+        /* may fail if ata_port_flush_task() in progress */
+        queue_delayed_work(ata_wq, &ap->port_task, delay);
 }
 
 /**
@@ -1309,32 +1303,9 @@ void ata_port_queue_task(struct ata_port *ap, work_func_t fn, void *data,
  */
 void ata_port_flush_task(struct ata_port *ap)
 {
-        unsigned long flags;
-
         DPRINTK("ENTER\n");
 
-        spin_lock_irqsave(ap->lock, flags);
-        ap->pflags |= ATA_PFLAG_FLUSH_PORT_TASK;
-        spin_unlock_irqrestore(ap->lock, flags);
-
-        DPRINTK("flush #1\n");
-        cancel_work_sync(&ap->port_task.work); /* akpm: seems unneeded */
-
-        /*
-         * At this point, if a task is running, it's guaranteed to see
-         * the FLUSH flag; thus, it will never queue pio tasks again.
-         * Cancel and flush.
-         */
-        if (!cancel_delayed_work(&ap->port_task)) {
-                if (ata_msg_ctl(ap))
-                        ata_port_printk(ap, KERN_DEBUG, "%s: flush #2\n",
-                                        __FUNCTION__);
-                cancel_work_sync(&ap->port_task.work);
-        }
-
-        spin_lock_irqsave(ap->lock, flags);
-        ap->pflags &= ~ATA_PFLAG_FLUSH_PORT_TASK;
-        spin_unlock_irqrestore(ap->lock, flags);
+        cancel_rearming_delayed_work(&ap->port_task);
 
         if (ata_msg_ctl(ap))
                 ata_port_printk(ap, KERN_DEBUG, "%s: EXIT\n", __FUNCTION__);
@@ -1814,7 +1785,7 @@ static void ata_dev_config_ncq(struct ata_device *dev,
                 desc[0] = '\0';
                 return;
         }
-        if (ata_device_blacklisted(dev) & ATA_HORKAGE_NONCQ) {
+        if (dev->horkage & ATA_HORKAGE_NONCQ) {
                 snprintf(desc, desc_sz, "NCQ (not used)");
                 return;
         }
@@ -1863,6 +1834,9 @@ int ata_dev_configure(struct ata_device *dev)
         if (ata_msg_probe(ap))
                 ata_dev_printk(dev, KERN_DEBUG, "%s: ENTER\n", __FUNCTION__);
 
+        /* set horkage */
+        dev->horkage |= ata_dev_blacklisted(dev);
+
         /* let ACPI work its magic */
         rc = ata_acpi_on_devcfg(dev);
         if (rc)
@@ -2038,7 +2012,7 @@ int ata_dev_configure(struct ata_device *dev)
                 dev->max_sectors = ATA_MAX_SECTORS;
         }
 
-        if (ata_device_blacklisted(dev) & ATA_HORKAGE_MAX_SEC_128)
+        if (dev->horkage & ATA_HORKAGE_MAX_SEC_128)
                 dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
                                          dev->max_sectors);
 
@@ -3190,9 +3164,6 @@ void ata_bus_reset(struct ata_port *ap)
         if ((slave_possible) && (err != 0x81))
                 ap->device[1].class = ata_dev_try_classify(ap, 1, &err);
 
-        /* re-enable interrupts */
-        ap->ops->irq_on(ap);
-
         /* is double-select really necessary? */
         if (ap->device[1].class != ATA_DEV_NONE)
                 ap->ops->dev_select(ap, 1);
@@ -3577,10 +3548,6 @@ void ata_std_postreset(struct ata_port *ap, unsigned int *classes)
         if (sata_scr_read(ap, SCR_ERROR, &serror) == 0)
                 sata_scr_write(ap, SCR_ERROR, serror);
 
-        /* re-enable interrupts */
-        if (!ap->ops->error_handler)
-                ap->ops->irq_on(ap);
-
         /* is double-select really necessary? */
         if (classes[0] != ATA_DEV_NONE)
                 ap->ops->dev_select(ap, 1);
@@ -3770,6 +3737,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SAMSUNG CD-ROM SN-124","N001",       ATA_HORKAGE_NODMA },
         { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
         { "IOMEGA  ZIP 250       ATAPI", NULL,  ATA_HORKAGE_NODMA }, /* temporary fix */
+        { "IOMEGA  ZIP 250       ATAPI       Floppy",
+                                NULL,           ATA_HORKAGE_NODMA },
 
         /* Weird ATAPI devices */
         { "TORiSAN DVD-ROM DRD-N216", NULL,     ATA_HORKAGE_MAX_SEC_128 },
@@ -3783,7 +3752,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "FUJITSU MHT2060BH",  NULL,           ATA_HORKAGE_NONCQ },
         /* NCQ is broken */
         { "Maxtor 6L250S0",     "BANC1G10",     ATA_HORKAGE_NONCQ },
+        { "Maxtor 6B200M0",     "BANC1BM0",     ATA_HORKAGE_NONCQ },
         { "Maxtor 6B200M0",     "BANC1B10",     ATA_HORKAGE_NONCQ },
+        { "HITACHI HDS7250SASUN500G 0621KTAWSD", "K2AOAJ0AHITACHI",
+         ATA_HORKAGE_NONCQ },
         /* NCQ hard hangs device under heavier load, needs hard power cycle */
         { "Maxtor 6B250S0",     "BANC1B70",     ATA_HORKAGE_NONCQ },
         /* Blacklist entries taken from Silicon Image 3124/3132
@@ -3796,6 +3768,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "HTS541612J9SA00",    "SBDIC7JP",     ATA_HORKAGE_NONCQ, },
         { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
         { "WDC WD740ADFD-00NLR1", NULL,         ATA_HORKAGE_NONCQ, },
+        { "FUJITSU MHV2080BH",  "00840028",     ATA_HORKAGE_NONCQ, },
 
         /* Devices with NCQ limits */
 
@@ -3803,7 +3776,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { }
 };
 
-unsigned long ata_device_blacklisted(const struct ata_device *dev)
+static unsigned long ata_dev_blacklisted(const struct ata_device *dev)
 {
         unsigned char model_num[ATA_ID_PROD_LEN + 1];
         unsigned char model_rev[ATA_ID_FW_REV_LEN + 1];
@@ -3833,7 +3806,7 @@ static int ata_dma_blacklisted(const struct ata_device *dev)
         if ((dev->ap->flags & ATA_FLAG_PIO_POLLING) &&
             (dev->flags & ATA_DFLAG_CDB_INTR))
                 return 1;
-        return (ata_device_blacklisted(dev) & ATA_HORKAGE_NODMA) ? 1 : 0;
+        return (dev->horkage & ATA_HORKAGE_NODMA) ? 1 : 0;
 }
 
 /**
@@ -6557,13 +6530,7 @@ void ata_port_detach(struct ata_port *ap)
         spin_unlock_irqrestore(ap->lock, flags);
 
         ata_port_wait_eh(ap);
-
-        /* Flush hotplug task.  The sequence is similar to
-         * ata_port_flush_task().
-         */
-        cancel_work_sync(&ap->hotplug_task.work); /* akpm: why? */
-        cancel_delayed_work(&ap->hotplug_task);
-        cancel_work_sync(&ap->hotplug_task.work);
+        cancel_rearming_delayed_work(&ap->hotplug_task);
 
  skip_eh:
         /* remove the associated SCSI host */
@@ -6952,7 +6919,6 @@ EXPORT_SYMBOL_GPL(ata_host_resume);
 EXPORT_SYMBOL_GPL(ata_id_string);
 EXPORT_SYMBOL_GPL(ata_id_c_string);
 EXPORT_SYMBOL_GPL(ata_id_to_dma_mode);
-EXPORT_SYMBOL_GPL(ata_device_blacklisted);
 EXPORT_SYMBOL_GPL(ata_scsi_simulate);
 
 EXPORT_SYMBOL_GPL(ata_pio_need_iordy);
@@ -6961,9 +6927,9 @@ EXPORT_SYMBOL_GPL(ata_timing_merge);
 
 #ifdef CONFIG_PCI
 EXPORT_SYMBOL_GPL(pci_test_config_bits);
-EXPORT_SYMBOL_GPL(ata_pci_init_native_host);
+EXPORT_SYMBOL_GPL(ata_pci_init_sff_host);
 EXPORT_SYMBOL_GPL(ata_pci_init_bmdma);
-EXPORT_SYMBOL_GPL(ata_pci_prepare_native_host);
+EXPORT_SYMBOL_GPL(ata_pci_prepare_sff_host);
 EXPORT_SYMBOL_GPL(ata_pci_init_one);
 EXPORT_SYMBOL_GPL(ata_pci_remove_one);
 #ifdef CONFIG_PM
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 9ee0a8c08d96..9aa62a0754f6 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -1897,6 +1897,57 @@ static int ata_eh_skip_recovery(struct ata_port *ap)
         return 1;
 }
 
+static void ata_eh_handle_dev_fail(struct ata_device *dev, int err)
+{
+        struct ata_port *ap = dev->ap;
+        struct ata_eh_context *ehc = &ap->eh_context;
+
+        ehc->tries[dev->devno]--;
+
+        switch (err) {
+        case -ENODEV:
+                /* device missing or wrong IDENTIFY data, schedule probing */
+                ehc->i.probe_mask |= (1 << dev->devno);
+        case -EINVAL:
+                /* give it just one more chance */
+                ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
+        case -EIO:
+                if (ehc->tries[dev->devno] == 1) {
+                        /* This is the last chance, better to slow
+                         * down than lose it.
+                         */
+                        sata_down_spd_limit(ap);
+                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
+                }
+        }
+
+        if (ata_dev_enabled(dev) && !ehc->tries[dev->devno]) {
+                /* disable device if it has used up all its chances */
+                ata_dev_disable(dev);
+
+                /* detach if offline */
+                if (ata_port_offline(ap))
+                        ata_eh_detach_dev(dev);
+
+                /* probe if requested */
+                if ((ehc->i.probe_mask & (1 << dev->devno)) &&
+                    !(ehc->did_probe_mask & (1 << dev->devno))) {
+                        ata_eh_detach_dev(dev);
+                        ata_dev_init(dev);
+
+                        ehc->tries[dev->devno] = ATA_EH_DEV_TRIES;
+                        ehc->did_probe_mask |= (1 << dev->devno);
+                        ehc->i.action |= ATA_EH_SOFTRESET;
+                }
+        } else {
+                /* soft didn't work?  be haaaaard */
+                if (ehc->i.flags & ATA_EHI_DID_RESET)
+                        ehc->i.action |= ATA_EH_HARDRESET;
+                else
+                        ehc->i.action |= ATA_EH_SOFTRESET;
+        }
+}
+
 /**
  *      ata_eh_recover - recover host port after error
  *      @ap: host port to recover
@@ -1997,50 +2048,7 @@ static int ata_eh_recover(struct ata_port *ap, ata_prereset_fn_t prereset,
         goto out;
 
  dev_fail:
-        ehc->tries[dev->devno]--;
-
-        switch (rc) {
-        case -ENODEV:
-                /* device missing or wrong IDENTIFY data, schedule probing */
-                ehc->i.probe_mask |= (1 << dev->devno);
-        case -EINVAL:
-                /* give it just one more chance */
-                ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
-        case -EIO:
-                if (ehc->tries[dev->devno] == 1) {
-                        /* This is the last chance, better to slow
-                         * down than lose it.
-                         */
-                        sata_down_spd_limit(ap);
-                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
-                }
-        }
-
-        if (ata_dev_enabled(dev) && !ehc->tries[dev->devno]) {
-                /* disable device if it has used up all its chances */
-                ata_dev_disable(dev);
-
-                /* detach if offline */
-                if (ata_port_offline(ap))
-                        ata_eh_detach_dev(dev);
-
-                /* probe if requested */
-                if ((ehc->i.probe_mask & (1 << dev->devno)) &&
-                    !(ehc->did_probe_mask & (1 << dev->devno))) {
-                        ata_eh_detach_dev(dev);
-                        ata_dev_init(dev);
-
-                        ehc->tries[dev->devno] = ATA_EH_DEV_TRIES;
-                        ehc->did_probe_mask |= (1 << dev->devno);
-                        ehc->i.action |= ATA_EH_SOFTRESET;
-                }
-        } else {
-                /* soft didn't work?  be haaaaard */
-                if (ehc->i.flags & ATA_EHI_DID_RESET)
-                        ehc->i.action |= ATA_EH_HARDRESET;
-                else
-                        ehc->i.action |= ATA_EH_SOFTRESET;
-        }
+        ata_eh_handle_dev_fail(dev, rc);
 
         if (ata_port_nr_enabled(ap)) {
                 ata_port_printk(ap, KERN_WARNING, "failed to recover some "
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index fa1c22c7b38f..ca7d2245d684 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -604,13 +604,17 @@ int ata_pci_init_bmdma(struct ata_host *host)
 }
 
 /**
- *      ata_pci_init_native_host - acquire native ATA resources and init host
+ *      ata_pci_init_sff_host - acquire native PCI ATA resources and init host
  *      @host: target ATA host
  *
  *      Acquire native PCI ATA resources for @host and initialize the
  *      first two ports of @host accordingly.  Ports marked dummy are
  *      skipped and allocation failure makes the port dummy.
  *
+ *      Note that native PCI resources are valid even for legacy hosts
+ *      as we fix up pdev resources array early in boot, so this
+ *      function can be used for both native and legacy SFF hosts.
+ *
  *      LOCKING:
  *      Inherited from calling layer (may sleep).
  *
@@ -618,7 +622,7 @@ int ata_pci_init_bmdma(struct ata_host *host)
  *      0 if at least one port is initialized, -ENODEV if no port is
  *      available.
  */
-int ata_pci_init_native_host(struct ata_host *host)
+int ata_pci_init_sff_host(struct ata_host *host)
 {
         struct device *gdev = host->dev;
         struct pci_dev *pdev = to_pci_dev(gdev);
@@ -673,7 +677,7 @@ int ata_pci_init_native_host(struct ata_host *host)
 }
 
 /**
- *      ata_pci_prepare_native_host - helper to prepare native PCI ATA host
+ *      ata_pci_prepare_sff_host - helper to prepare native PCI ATA host
  *      @pdev: target PCI device
  *      @ppi: array of port_info, must be enough for two ports
  *      @r_host: out argument for the initialized ATA host
@@ -687,9 +691,9 @@ int ata_pci_init_native_host(struct ata_host *host)
  *      RETURNS:
  *      0 on success, -errno otherwise.
  */
-int ata_pci_prepare_native_host(struct pci_dev *pdev,
-                                const struct ata_port_info * const * ppi,
-                                struct ata_host **r_host)
+int ata_pci_prepare_sff_host(struct pci_dev *pdev,
+                             const struct ata_port_info * const * ppi,
+                             struct ata_host **r_host)
 {
         struct ata_host *host;
         int rc;
@@ -705,7 +709,7 @@ int ata_pci_prepare_native_host(struct pci_dev *pdev,
                 goto err_out;
         }
 
-        rc = ata_pci_init_native_host(host);
+        rc = ata_pci_init_sff_host(host);
         if (rc)
                 goto err_out;
 
@@ -730,221 +734,6 @@ int ata_pci_prepare_native_host(struct pci_dev *pdev,
         return rc;
 }
 
-struct ata_legacy_devres {
-        unsigned int    mask;
-        unsigned long   cmd_port[2];
-        void __iomem *  cmd_addr[2];
-        void __iomem *  ctl_addr[2];
-        unsigned int    irq[2];
-        void *          irq_dev_id[2];
-};
-
-static void ata_legacy_free_irqs(struct ata_legacy_devres *legacy_dr)
-{
-        int i;
-
-        for (i = 0; i < 2; i++) {
-                if (!legacy_dr->irq[i])
-                        continue;
-
-                free_irq(legacy_dr->irq[i], legacy_dr->irq_dev_id[i]);
-                legacy_dr->irq[i] = 0;
-                legacy_dr->irq_dev_id[i] = NULL;
-        }
-}
-
-static void ata_legacy_release(struct device *gdev, void *res)
-{
-        struct ata_legacy_devres *this = res;
-        int i;
-
-        ata_legacy_free_irqs(this);
-
-        for (i = 0; i < 2; i++) {
-                if (this->cmd_addr[i])
-                        ioport_unmap(this->cmd_addr[i]);
-                if (this->ctl_addr[i])
-                        ioport_unmap(this->ctl_addr[i]);
-                if (this->cmd_port[i])
-                        release_region(this->cmd_port[i], 8);
-        }
-}
-
-static int ata_init_legacy_port(struct ata_port *ap,
-                                struct ata_legacy_devres *legacy_dr)
-{
-        struct ata_host *host = ap->host;
-        int port_no = ap->port_no;
-        unsigned long cmd_port, ctl_port;
-
-        if (port_no == 0) {
-                cmd_port = ATA_PRIMARY_CMD;
-                ctl_port = ATA_PRIMARY_CTL;
-        } else {
-                cmd_port = ATA_SECONDARY_CMD;
-                ctl_port = ATA_SECONDARY_CTL;
-        }
-
-        /* request cmd_port */
-        if (request_region(cmd_port, 8, "libata"))
-                legacy_dr->cmd_port[port_no] = cmd_port;
-        else {
-                dev_printk(KERN_WARNING, host->dev,
-                           "0x%0lX IDE port busy\n", cmd_port);
-                return -EBUSY;
-        }
-
-        /* iomap cmd and ctl ports */
-        legacy_dr->cmd_addr[port_no] = ioport_map(cmd_port, 8);
-        legacy_dr->ctl_addr[port_no] = ioport_map(ctl_port, 1);
-        if (!legacy_dr->cmd_addr[port_no] || !legacy_dr->ctl_addr[port_no]) {
-                dev_printk(KERN_WARNING, host->dev,
-                           "failed to map cmd/ctl ports\n");
-                return -ENOMEM;
-        }
-
-        /* init IO addresses */
-        ap->ioaddr.cmd_addr = legacy_dr->cmd_addr[port_no];
-        ap->ioaddr.altstatus_addr = legacy_dr->ctl_addr[port_no];
-        ap->ioaddr.ctl_addr = legacy_dr->ctl_addr[port_no];
-        ata_std_ports(&ap->ioaddr);
-
-        return 0;
-}
-
-/**
- *      ata_init_legacy_host - acquire legacy ATA resources and init ATA host
- *      @host: target ATA host
- *      @was_busy: out parameter, indicates whether any port was busy
- *
- *      Acquire legacy ATA resources for the first two ports of @host
- *      and initialize it accordingly.  Ports marked dummy are skipped
- *      and resource acquistion failure makes the port dummy.
- *
- *      LOCKING:
- *      Inherited from calling layer (may sleep).
- *
- *      RETURNS:
- *      0 if at least one port is initialized, -ENODEV if no port is
- *      available.
- */
-static int ata_init_legacy_host(struct ata_host *host, int *was_busy)
-{
-        struct device *gdev = host->dev;
-        struct ata_legacy_devres *legacy_dr;
-        int i, rc;
-
-        if (!devres_open_group(gdev, NULL, GFP_KERNEL))
-                return -ENOMEM;
-
-        rc = -ENOMEM;
-        legacy_dr = devres_alloc(ata_legacy_release, sizeof(*legacy_dr),
-                                 GFP_KERNEL);
-        if (!legacy_dr)
-                goto err_out;
-        devres_add(gdev, legacy_dr);
-
-        for (i = 0; i < 2; i++) {
-                if (ata_port_is_dummy(host->ports[i]))
-                        continue;
-
-                rc = ata_init_legacy_port(host->ports[i], legacy_dr);
-                if (rc == 0)
-                        legacy_dr->mask |= 1 << i;
-                else {
-                        if (rc == -EBUSY)
-                                (*was_busy)++;
-                        host->ports[i]->ops = &ata_dummy_port_ops;
-                }
-        }
-
-        if (!legacy_dr->mask) {
-                dev_printk(KERN_ERR, gdev, "no available legacy port\n");
-                return -ENODEV;
-        }
-
-        devres_remove_group(gdev, NULL);
-        return 0;
-
- err_out:
-        devres_release_group(gdev, NULL);
-        return rc;
-}
-
-/**
- *      ata_request_legacy_irqs - request legacy ATA IRQs
- *      @host: target ATA host
- *      @handler: array of IRQ handlers
- *      @irq_flags: array of IRQ flags
- *      @dev_id: array of IRQ dev_ids
- *
- *      Request legacy IRQs for non-dummy legacy ports in @host.  All
- *      IRQ parameters are passed as array to allow ports to have
- *      separate IRQ handlers.
- *
- *      LOCKING:
- *      Inherited from calling layer (may sleep).
- *
- *      RETURNS:
- *      0 on success, -errno otherwise.
- */
-static int ata_request_legacy_irqs(struct ata_host *host,
-                                   irq_handler_t const *handler,
-                                   const unsigned int *irq_flags,
-                                   void * const *dev_id)
-{
-        struct device *gdev = host->dev;
-        struct ata_legacy_devres *legacy_dr;
-        int i, rc;
-
-        legacy_dr = devres_find(host->dev, ata_legacy_release, NULL, NULL);
-        BUG_ON(!legacy_dr);
-
-        for (i = 0; i < 2; i++) {
-                unsigned int irq;
-
-                /* FIXME: ATA_*_IRQ() should take generic device not pci_dev */
-                if (i == 0)
-                        irq = ATA_PRIMARY_IRQ(to_pci_dev(gdev));
-                else
-                        irq = ATA_SECONDARY_IRQ(to_pci_dev(gdev));
-
-                if (!(legacy_dr->mask & (1 << i)))
-                        continue;
-
-                if (!handler[i]) {
-                        dev_printk(KERN_ERR, gdev,
-                                   "NULL handler specified for port %d\n", i);
-                        rc = -EINVAL;
-                        goto err_out;
-                }
-
-                rc = request_irq(irq, handler[i], irq_flags[i], DRV_NAME,
-                                 dev_id[i]);
-                if (rc) {
-                        dev_printk(KERN_ERR, gdev,
-                                "irq %u request failed (errno=%d)\n", irq, rc);
-                        goto err_out;
-                }
-
-                /* record irq allocation in legacy_dr */
-                legacy_dr->irq[i] = irq;
-                legacy_dr->irq_dev_id[i] = dev_id[i];
-
-                /* only used to print info */
-                if (i == 0)
-                        host->irq = irq;
-                else
-                        host->irq2 = irq;
-        }
-
-        return 0;
-
- err_out:
-        ata_legacy_free_irqs(legacy_dr);
-        return rc;
-}
-
 /**
  *      ata_pci_init_one - Initialize/register PCI IDE host controller
  *      @pdev: Controller to be initialized
@@ -1029,35 +818,11 @@ int ata_pci_init_one(struct pci_dev *pdev,
 #endif
         }
 
-        /* alloc and init host */
-        host = ata_host_alloc_pinfo(dev, ppi, 2);
-        if (!host) {
-                dev_printk(KERN_ERR, &pdev->dev,
-                           "failed to allocate ATA host\n");
-                rc = -ENOMEM;
+        /* prepare host */
+        rc = ata_pci_prepare_sff_host(pdev, ppi, &host);
+        if (rc)
                 goto err_out;
-        }
 
-        if (!legacy_mode) {
-                rc = ata_pci_init_native_host(host);
-                if (rc)
-                        goto err_out;
-        } else {
-                int was_busy = 0;
-
-                rc = ata_init_legacy_host(host, &was_busy);
-                if (was_busy)
-                        pcim_pin_device(pdev);
-                if (rc)
-                        goto err_out;
-
-                /* request respective PCI regions, may fail */
-                rc = pci_request_region(pdev, 1, DRV_NAME);
-                rc = pci_request_region(pdev, 3, DRV_NAME);
-        }
-
-        /* init BMDMA, may fail */
-        ata_pci_init_bmdma(host);
         pci_set_master(pdev);
 
         /* start host and request IRQ */
@@ -1068,17 +833,28 @@ int ata_pci_init_one(struct pci_dev *pdev,
         if (!legacy_mode) {
                 rc = devm_request_irq(dev, pdev->irq, pi->port_ops->irq_handler,
                                       IRQF_SHARED, DRV_NAME, host);
+                if (rc)
+                        goto err_out;
                 host->irq = pdev->irq;
         } else {
-                irq_handler_t handler[2] = { host->ops->irq_handler,
-                                             host->ops->irq_handler };
-                unsigned int irq_flags[2] = { IRQF_SHARED, IRQF_SHARED };
-                void *dev_id[2] = { host, host };
+                if (!ata_port_is_dummy(host->ports[0])) {
+                        host->irq = ATA_PRIMARY_IRQ(pdev);
+                        rc = devm_request_irq(dev, host->irq,
+                                              pi->port_ops->irq_handler,
+                                              IRQF_SHARED, DRV_NAME, host);
+                        if (rc)
+                                goto err_out;
+                }
 
-                rc = ata_request_legacy_irqs(host, handler, irq_flags, dev_id);
+                if (!ata_port_is_dummy(host->ports[1])) {
+                        host->irq2 = ATA_SECONDARY_IRQ(pdev);
+                        rc = devm_request_irq(dev, host->irq2,
+                                              pi->port_ops->irq_handler,
+                                              IRQF_SHARED, DRV_NAME, host);
+                        if (rc)
+                                goto err_out;
+                }
         }
-        if (rc)
-                goto err_out;
 
         /* register */
         rc = ata_host_register(host, pi->sht);
diff --git a/drivers/ata/pata_hpt3x3.c b/drivers/ata/pata_hpt3x3.c
index d928c9105034..be0f05efac6d 100644
--- a/drivers/ata/pata_hpt3x3.c
+++ b/drivers/ata/pata_hpt3x3.c
@@ -23,7 +23,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt3x3"
-#define DRV_VERSION     "0.4.3"
+#define DRV_VERSION     "0.5.3"
 
 /**
  *      hpt3x3_set_piomode              -       PIO setup
@@ -52,6 +52,7 @@ static void hpt3x3_set_piomode(struct ata_port *ap, struct ata_device *adev)
         pci_write_config_dword(pdev, 0x48, r2);
 }
 
+#if defined(CONFIG_PATA_HPT3X3_DMA)
 /**
  *      hpt3x3_set_dmamode              -       DMA timing setup
  *      @ap: ATA interface
@@ -59,6 +60,9 @@ static void hpt3x3_set_piomode(struct ata_port *ap, struct ata_device *adev)
  *
  *      Set up the channel for MWDMA or UDMA modes. Much the same as with
  *      PIO, load the mode number and then set MWDMA or UDMA flag.
+ *
+ *      0x44 : bit 0-2 master mode, 3-5 slave mode, etc
+ *      0x48 : bit 4/0 DMA/UDMA bit 5/1 for slave etc
  */
 
 static void hpt3x3_set_dmamode(struct ata_port *ap, struct ata_device *adev)
@@ -76,13 +80,26 @@ static void hpt3x3_set_dmamode(struct ata_port *ap, struct ata_device *adev)
         r2 &= ~(0x11 << dn);    /* Clear MWDMA and UDMA bits */
 
         if (adev->dma_mode >= XFER_UDMA_0)
-                r2 |= 0x01 << dn;       /* Ultra mode */
+                r2 |= (0x10 << dn);     /* Ultra mode */
         else
-                r2 |= 0x10 << dn;       /* MWDMA */
+                r2 |= (0x01 << dn);     /* MWDMA */
 
         pci_write_config_dword(pdev, 0x44, r1);
         pci_write_config_dword(pdev, 0x48, r2);
 }
+#endif /* CONFIG_PATA_HPT3X3_DMA */
+
+/**
+ *      hpt3x3_atapi_dma        -       ATAPI DMA check
+ *      @qc: Queued command
+ *
+ *      Just say no - we don't do ATAPI DMA
+ */
+
+static int hpt3x3_atapi_dma(struct ata_queued_cmd *qc)
+{
+        return 1;
+}
 
 static struct scsi_host_template hpt3x3_sht = {
         .module                 = THIS_MODULE,
@@ -105,7 +122,9 @@ static struct scsi_host_template hpt3x3_sht = {
 static struct ata_port_operations hpt3x3_port_ops = {
         .port_disable   = ata_port_disable,
         .set_piomode    = hpt3x3_set_piomode,
+#if defined(CONFIG_PATA_HPT3X3_DMA)
         .set_dmamode    = hpt3x3_set_dmamode,
+#endif
         .mode_filter    = ata_pci_default_filter,
 
         .tf_load        = ata_tf_load,
@@ -124,6 +143,7 @@ static struct ata_port_operations hpt3x3_port_ops = {
         .bmdma_start    = ata_bmdma_start,
         .bmdma_stop     = ata_bmdma_stop,
         .bmdma_status   = ata_bmdma_status,
+        .check_atapi_dma= hpt3x3_atapi_dma,
 
         .qc_prep        = ata_qc_prep,
         .qc_issue       = ata_qc_issue_prot,
@@ -158,32 +178,79 @@ static void hpt3x3_init_chipset(struct pci_dev *dev)
                 pci_write_config_byte(dev, PCI_LATENCY_TIMER, 0x20);
 }
 
-
 /**
  *      hpt3x3_init_one         -       Initialise an HPT343/363
- *      @dev: PCI device
+ *      @pdev: PCI device
  *      @id: Entry in match table
  *
- *      Perform basic initialisation. The chip has a quirk that it won't
- *      function unless it is at XX00. The old ATA driver touched this up
- *      but we leave it for pci quirks to do properly.
+ *      Perform basic initialisation. We set the device up so we access all
+ *      ports via BAR4. This is neccessary to work around errata.
  */
 
-static int hpt3x3_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+static int hpt3x3_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
+        static int printed_version;
         static const struct ata_port_info info = {
                 .sht = &hpt3x3_sht,
                 .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
+#if defined(CONFIG_PATA_HPT3X3_DMA)
+                /* Further debug needed */
                 .mwdma_mask = 0x07,
                 .udma_mask = 0x07,
+#endif
                 .port_ops = &hpt3x3_port_ops
         };
+        /* Register offsets of taskfiles in BAR4 area */
+        static const u8 offset_cmd[2] = { 0x20, 0x28 };
+        static const u8 offset_ctl[2] = { 0x36, 0x3E };
         const struct ata_port_info *ppi[] = { &info, NULL };
-
-        hpt3x3_init_chipset(dev);
-        /* Now kick off ATA set up */
-        return ata_pci_init_one(dev, ppi);
+        struct ata_host *host;
+        int i, rc;
+        void __iomem *base;
+
+        hpt3x3_init_chipset(pdev);
+
+        if (!printed_version++)
+                dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
+
+        host = ata_host_alloc_pinfo(&pdev->dev, ppi, 2);
+        if (!host)
+                return -ENOMEM;
+        /* acquire resources and fill host */
+        rc = pcim_enable_device(pdev);
+        if (rc)
+                return rc;
+
+        /* Everything is relative to BAR4 if we set up this way */
+        rc = pcim_iomap_regions(pdev, 1 << 4, DRV_NAME);
+        if (rc == -EBUSY)
+                pcim_pin_device(pdev);
+        if (rc)
+                return rc;
+        host->iomap = pcim_iomap_table(pdev);
+        rc = pci_set_dma_mask(pdev, ATA_DMA_MASK);
+        if (rc)
+                return rc;
+        rc = pci_set_consistent_dma_mask(pdev, ATA_DMA_MASK);
+        if (rc)
+                return rc;
+
+        base = host->iomap[4];  /* Bus mastering base */
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_ioports *ioaddr = &host->ports[i]->ioaddr;
+
+                ioaddr->cmd_addr = base + offset_cmd[i];
+                ioaddr->altstatus_addr =
+                ioaddr->ctl_addr = base + offset_ctl[i];
+                ioaddr->scr_addr = NULL;
+                ata_std_ports(ioaddr);
+                ioaddr->bmdma_addr = base + 8 * i;
+        }
+        pci_set_master(pdev);
+        return ata_host_activate(host, pdev->irq, ata_interrupt, IRQF_SHARED,
+                                 &hpt3x3_sht);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 368fac7d168b..182e83c9047b 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -467,13 +467,27 @@ mpc52xx_ata_remove(struct of_device *op)
 static int
 mpc52xx_ata_suspend(struct of_device *op, pm_message_t state)
 {
-        return 0;       /* FIXME : What to do here ? */
+        struct ata_host *host = dev_get_drvdata(&op->dev);
+
+        return ata_host_suspend(host, state);
 }
 
 static int
 mpc52xx_ata_resume(struct of_device *op)
 {
-        return 0;       /* FIXME : What to do here ? */
+        struct ata_host *host = dev_get_drvdata(&op->dev);
+        struct mpc52xx_ata_priv *priv = host->private_data;
+        int rv;
+
+        rv = mpc52xx_ata_hw_init(priv);
+        if (rv) {
+                printk(KERN_ERR DRV_NAME ": Error during HW init\n");
+                return rv;
+        }
+
+        ata_host_resume(host);
+
+        return 0;
 }
 
 #endif
diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
index 61502bc7bf1d..c55667e0eb65 100644
--- a/drivers/ata/pata_scc.c
+++ b/drivers/ata/pata_scc.c
@@ -238,6 +238,12 @@ static void scc_set_dmamode (struct ata_port *ap, struct ata_device *adev)
         else
                 offset = 0;     /* 100MHz */
 
+        /* errata A308 workaround: limit ATAPI UDMA mode to UDMA4 */
+        if (adev->class == ATA_DEV_ATAPI && speed > XFER_UDMA_4) {
+                printk(KERN_INFO "%s: limit ATAPI UDMA to UDMA4\n", DRV_NAME);
+                speed = XFER_UDMA_4;
+        }
+
         if (speed >= XFER_UDMA_0)
                 idx = speed - XFER_UDMA_0;
         else
@@ -724,22 +730,36 @@ static void scc_bmdma_stop (struct ata_queued_cmd *qc)
 
 static u8 scc_bmdma_status (struct ata_port *ap)
 {
-        u8 host_stat;
         void __iomem *mmio = ap->ioaddr.bmdma_addr;
-
-        host_stat = in_be32(mmio + SCC_DMA_STATUS);
-
-        /* Workaround for PTERADD: emulate DMA_INTR when
-         * - IDE_STATUS[ERR] = 1
-         * - INT_STATUS[INTRQ] = 1
-         * - DMA_STATUS[IORACTA] = 1
-         */
-        if (!(host_stat & ATA_DMA_INTR)) {
-                u32 int_status = in_be32(mmio + SCC_DMA_INTST);
-                if (ata_altstatus(ap) & ATA_ERR &&
-                    int_status & INTSTS_INTRQ &&
-                    host_stat & ATA_DMA_ACTIVE)
-                        host_stat |= ATA_DMA_INTR;
+        u8 host_stat = in_be32(mmio + SCC_DMA_STATUS);
+        u32 int_status = in_be32(mmio + SCC_DMA_INTST);
+        struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->active_tag);
+        static int retry = 0;
+
+        /* return if IOS_SS is cleared */
+        if (!(in_be32(mmio + SCC_DMA_CMD) & ATA_DMA_START))
+                return host_stat;
+
+        /* errata A252,A308 workaround: Step4 */
+        if (ata_altstatus(ap) & ATA_ERR && int_status & INTSTS_INTRQ)
+                return (host_stat | ATA_DMA_INTR);
+
+        /* errata A308 workaround Step5 */
+        if (int_status & INTSTS_IOIRQS) {
+                host_stat |= ATA_DMA_INTR;
+
+                /* We don't check ATAPI DMA because it is limited to UDMA4 */
+                if ((qc->tf.protocol == ATA_PROT_DMA &&
+                     qc->dev->xfer_mode > XFER_UDMA_4)) {
+                        if (!(int_status & INTSTS_ACTEINT)) {
+                                printk(KERN_WARNING "ata%u: data lost occurred. (ACTEINT==0, retry:%d)\n",
+                                       ap->print_id, retry);
+                                host_stat |= ATA_DMA_ERR;
+                                if (retry++)
+                                        ap->udma_mask >>= 1;
+                        } else
+                                retry = 0;
+                }
         }
 
         return host_stat;
@@ -892,10 +912,6 @@ static void scc_std_postreset (struct ata_port *ap, unsigned int *classes)
 {
         DPRINTK("ENTER\n");
 
-        /* re-enable interrupts */
-        if (!ap->ops->error_handler)
-                ap->ops->irq_on(ap);
-
         /* is double-select really necessary? */
         if (classes[0] != ATA_DEV_NONE)
                 ap->ops->dev_select(ap, 1);
diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
index 74a021124f3c..9a829a7cbc60 100644
--- a/drivers/ata/pata_sis.c
+++ b/drivers/ata/pata_sis.c
@@ -149,6 +149,9 @@ static int sis_pre_reset(struct ata_port *ap, unsigned long deadline)
         if (!pci_test_config_bits(pdev, &sis_enable_bits[ap->port_no]))
                 return -ENOENT;
 
+        /* Clear the FIFO settings. We can't enable the FIFO until
+           we know we are poking at a disk */
+        pci_write_config_byte(pdev, 0x4B, 0);
         return ata_std_prereset(ap, deadline);
 }
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 6dcfc628aab1..5d576435fccc 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -29,11 +29,6 @@
   I distinctly remember a couple workarounds (one related to PCI-X)
   are still needed.
 
-  2) Convert to LibATA new EH.  Required for hotplug, NCQ, and sane
-  probing/error handling in general.  MUST HAVE.
-
-  3) Add hotplug support (easy, once new-EH support appears)
-
   4) Add NCQ support (easy to intermediate, once new-EH support appears)
 
   5) Investigate problems with PCI Message Signalled Interrupts (MSI).
@@ -108,8 +103,6 @@ enum {
         MV_SATAHC_ARBTR_REG_SZ  = MV_MINOR_REG_AREA_SZ,         /* arbiter */
         MV_PORT_REG_SZ          = MV_MINOR_REG_AREA_SZ,
 
-        MV_USE_Q_DEPTH          = ATA_DEF_QUEUE,
-
         MV_MAX_Q_DEPTH          = 32,
         MV_MAX_Q_DEPTH_MASK     = MV_MAX_Q_DEPTH - 1,
 
@@ -133,18 +126,22 @@ enum {
         /* Host Flags */
         MV_FLAG_DUAL_HC         = (1 << 30),  /* two SATA Host Controllers */
         MV_FLAG_IRQ_COALESCE    = (1 << 29),  /* IRQ coalescing capability */
-        MV_COMMON_FLAGS         = (ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
-                                   ATA_FLAG_SATA_RESET | ATA_FLAG_MMIO |
-                                   ATA_FLAG_NO_ATAPI | ATA_FLAG_PIO_POLLING),
+        MV_COMMON_FLAGS         = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_MMIO | ATA_FLAG_NO_ATAPI |
+                                  ATA_FLAG_PIO_POLLING,
         MV_6XXX_FLAGS           = MV_FLAG_IRQ_COALESCE,
 
         CRQB_FLAG_READ          = (1 << 0),
         CRQB_TAG_SHIFT          = 1,
+        CRQB_IOID_SHIFT         = 6,    /* CRQB Gen-II/IIE IO Id shift */
+        CRQB_HOSTQ_SHIFT        = 17,   /* CRQB Gen-II/IIE HostQueTag shift */
         CRQB_CMD_ADDR_SHIFT     = 8,
         CRQB_CMD_CS             = (0x2 << 11),
         CRQB_CMD_LAST           = (1 << 15),
 
         CRPB_FLAG_STATUS_SHIFT  = 8,
+        CRPB_IOID_SHIFT_6       = 5,    /* CRPB Gen-II IO Id shift */
+        CRPB_IOID_SHIFT_7       = 7,    /* CRPB Gen-IIE IO Id shift */
 
         EPRD_FLAG_END_OF_TBL    = (1 << 31),
 
@@ -236,8 +233,10 @@ enum {
         EDMA_ERR_DEV_DCON       = (1 << 3),
         EDMA_ERR_DEV_CON        = (1 << 4),
         EDMA_ERR_SERR           = (1 << 5),
-        EDMA_ERR_SELF_DIS       = (1 << 7),
+        EDMA_ERR_SELF_DIS       = (1 << 7),     /* Gen II/IIE self-disable */
+        EDMA_ERR_SELF_DIS_5     = (1 << 8),     /* Gen I self-disable */
         EDMA_ERR_BIST_ASYNC     = (1 << 8),
+        EDMA_ERR_TRANS_IRQ_7    = (1 << 8),     /* Gen IIE transprt layer irq */
         EDMA_ERR_CRBQ_PAR       = (1 << 9),
         EDMA_ERR_CRPB_PAR       = (1 << 10),
         EDMA_ERR_INTRL_PAR      = (1 << 11),
@@ -248,13 +247,33 @@ enum {
         EDMA_ERR_LNK_CTRL_TX    = (0x1f << 21),
         EDMA_ERR_LNK_DATA_TX    = (0x1f << 26),
         EDMA_ERR_TRANS_PROTO    = (1 << 31),
-        EDMA_ERR_FATAL          = (EDMA_ERR_D_PAR | EDMA_ERR_PRD_PAR |
-                                   EDMA_ERR_DEV_DCON | EDMA_ERR_CRBQ_PAR |
-                                   EDMA_ERR_CRPB_PAR | EDMA_ERR_INTRL_PAR |
-                                   EDMA_ERR_IORDY | EDMA_ERR_LNK_CTRL_RX_2 |
-                                   EDMA_ERR_LNK_DATA_RX |
-                                   EDMA_ERR_LNK_DATA_TX |
-                                   EDMA_ERR_TRANS_PROTO),
+        EDMA_ERR_OVERRUN_5      = (1 << 5),
+        EDMA_ERR_UNDERRUN_5     = (1 << 6),
+        EDMA_EH_FREEZE          = EDMA_ERR_D_PAR |
+                                  EDMA_ERR_PRD_PAR |
+                                  EDMA_ERR_DEV_DCON |
+                                  EDMA_ERR_DEV_CON |
+                                  EDMA_ERR_SERR |
+                                  EDMA_ERR_SELF_DIS |
+                                  EDMA_ERR_CRBQ_PAR |
+                                  EDMA_ERR_CRPB_PAR |
+                                  EDMA_ERR_INTRL_PAR |
+                                  EDMA_ERR_IORDY |
+                                  EDMA_ERR_LNK_CTRL_RX_2 |
+                                  EDMA_ERR_LNK_DATA_RX |
+                                  EDMA_ERR_LNK_DATA_TX |
+                                  EDMA_ERR_TRANS_PROTO,
+        EDMA_EH_FREEZE_5        = EDMA_ERR_D_PAR |
+                                  EDMA_ERR_PRD_PAR |
+                                  EDMA_ERR_DEV_DCON |
+                                  EDMA_ERR_DEV_CON |
+                                  EDMA_ERR_OVERRUN_5 |
+                                  EDMA_ERR_UNDERRUN_5 |
+                                  EDMA_ERR_SELF_DIS_5 |
+                                  EDMA_ERR_CRBQ_PAR |
+                                  EDMA_ERR_CRPB_PAR |
+                                  EDMA_ERR_INTRL_PAR |
+                                  EDMA_ERR_IORDY,
 
         EDMA_REQ_Q_BASE_HI_OFS  = 0x10,
         EDMA_REQ_Q_IN_PTR_OFS   = 0x14,         /* also contains BASE_LO */
@@ -282,18 +301,18 @@ enum {
         MV_HP_ERRATA_60X1B2     = (1 << 3),
         MV_HP_ERRATA_60X1C0     = (1 << 4),
         MV_HP_ERRATA_XX42A0     = (1 << 5),
-        MV_HP_50XX              = (1 << 6),
-        MV_HP_GEN_IIE           = (1 << 7),
+        MV_HP_GEN_I             = (1 << 6),
+        MV_HP_GEN_II            = (1 << 7),
+        MV_HP_GEN_IIE           = (1 << 8),
 
         /* Port private flags (pp_flags) */
         MV_PP_FLAG_EDMA_EN      = (1 << 0),
         MV_PP_FLAG_EDMA_DS_ACT  = (1 << 1),
+        MV_PP_FLAG_HAD_A_RESET  = (1 << 2),
 };
 
-#define IS_50XX(hpriv) ((hpriv)->hp_flags & MV_HP_50XX)
-#define IS_60XX(hpriv) (((hpriv)->hp_flags & MV_HP_50XX) == 0)
-#define IS_GEN_I(hpriv) IS_50XX(hpriv)
-#define IS_GEN_II(hpriv) IS_60XX(hpriv)
+#define IS_GEN_I(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_I)
+#define IS_GEN_II(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_II)
 #define IS_GEN_IIE(hpriv) ((hpriv)->hp_flags & MV_HP_GEN_IIE)
 
 enum {
@@ -352,6 +371,10 @@ struct mv_port_priv {
         dma_addr_t              crpb_dma;
         struct mv_sg            *sg_tbl;
         dma_addr_t              sg_tbl_dma;
+
+        unsigned int            req_idx;
+        unsigned int            resp_idx;
+
         u32                     pp_flags;
 };
 
@@ -384,14 +407,15 @@ static u32 mv_scr_read(struct ata_port *ap, unsigned int sc_reg_in);
 static void mv_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val);
 static u32 mv5_scr_read(struct ata_port *ap, unsigned int sc_reg_in);
 static void mv5_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val);
-static void mv_phy_reset(struct ata_port *ap);
-static void __mv_phy_reset(struct ata_port *ap, int can_sleep);
 static int mv_port_start(struct ata_port *ap);
 static void mv_port_stop(struct ata_port *ap);
 static void mv_qc_prep(struct ata_queued_cmd *qc);
 static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
 static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
-static void mv_eng_timeout(struct ata_port *ap);
+static void mv_error_handler(struct ata_port *ap);
+static void mv_post_int_cmd(struct ata_queued_cmd *qc);
+static void mv_eh_freeze(struct ata_port *ap);
+static void mv_eh_thaw(struct ata_port *ap);
 static int mv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 
 static void mv5_phy_errata(struct mv_host_priv *hpriv, void __iomem *mmio,
@@ -415,14 +439,31 @@ static void mv6_reset_flash(struct mv_host_priv *hpriv, void __iomem *mmio);
 static void mv_reset_pci_bus(struct pci_dev *pdev, void __iomem *mmio);
 static void mv_channel_reset(struct mv_host_priv *hpriv, void __iomem *mmio,
                              unsigned int port_no);
-static void mv_stop_and_reset(struct ata_port *ap);
 
-static struct scsi_host_template mv_sht = {
+static struct scsi_host_template mv5_sht = {
+        .module                 = THIS_MODULE,
+        .name                   = DRV_NAME,
+        .ioctl                  = ata_scsi_ioctl,
+        .queuecommand           = ata_scsi_queuecmd,
+        .can_queue              = ATA_DEF_QUEUE,
+        .this_id                = ATA_SHT_THIS_ID,
+        .sg_tablesize           = MV_MAX_SG_CT,
+        .cmd_per_lun            = ATA_SHT_CMD_PER_LUN,
+        .emulated               = ATA_SHT_EMULATED,
+        .use_clustering         = 1,
+        .proc_name              = DRV_NAME,
+        .dma_boundary           = MV_DMA_BOUNDARY,
+        .slave_configure        = ata_scsi_slave_config,
+        .slave_destroy          = ata_scsi_slave_destroy,
+        .bios_param             = ata_std_bios_param,
+};
+
+static struct scsi_host_template mv6_sht = {
         .module                 = THIS_MODULE,
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .can_queue              = MV_USE_Q_DEPTH,
+        .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = MV_MAX_SG_CT,
         .cmd_per_lun            = ATA_SHT_CMD_PER_LUN,
@@ -444,19 +485,21 @@ static const struct ata_port_operations mv5_ops = {
         .exec_command           = ata_exec_command,
         .dev_select             = ata_std_dev_select,
 
-        .phy_reset              = mv_phy_reset,
         .cable_detect           = ata_cable_sata,
 
         .qc_prep                = mv_qc_prep,
         .qc_issue               = mv_qc_issue,
         .data_xfer              = ata_data_xfer,
 
-        .eng_timeout            = mv_eng_timeout,
-
         .irq_clear              = mv_irq_clear,
         .irq_on                 = ata_irq_on,
         .irq_ack                = ata_irq_ack,
 
+        .error_handler          = mv_error_handler,
+        .post_internal_cmd      = mv_post_int_cmd,
+        .freeze                 = mv_eh_freeze,
+        .thaw                   = mv_eh_thaw,
+
         .scr_read               = mv5_scr_read,
         .scr_write              = mv5_scr_write,
 
@@ -473,19 +516,21 @@ static const struct ata_port_operations mv6_ops = {
         .exec_command           = ata_exec_command,
         .dev_select             = ata_std_dev_select,
 
-        .phy_reset              = mv_phy_reset,
         .cable_detect           = ata_cable_sata,
 
         .qc_prep                = mv_qc_prep,
         .qc_issue               = mv_qc_issue,
         .data_xfer              = ata_data_xfer,
 
-        .eng_timeout            = mv_eng_timeout,
-
         .irq_clear              = mv_irq_clear,
         .irq_on                 = ata_irq_on,
         .irq_ack                = ata_irq_ack,
 
+        .error_handler          = mv_error_handler,
+        .post_internal_cmd      = mv_post_int_cmd,
+        .freeze                 = mv_eh_freeze,
+        .thaw                   = mv_eh_thaw,
+
         .scr_read               = mv_scr_read,
         .scr_write              = mv_scr_write,
 
@@ -502,19 +547,21 @@ static const struct ata_port_operations mv_iie_ops = {
         .exec_command           = ata_exec_command,
         .dev_select             = ata_std_dev_select,
 
-        .phy_reset              = mv_phy_reset,
         .cable_detect           = ata_cable_sata,
 
         .qc_prep                = mv_qc_prep_iie,
         .qc_issue               = mv_qc_issue,
         .data_xfer              = ata_data_xfer,
 
-        .eng_timeout            = mv_eng_timeout,
-
         .irq_clear              = mv_irq_clear,
         .irq_on                 = ata_irq_on,
         .irq_ack                = ata_irq_ack,
 
+        .error_handler          = mv_error_handler,
+        .post_internal_cmd      = mv_post_int_cmd,
+        .freeze                 = mv_eh_freeze,
+        .thaw                   = mv_eh_thaw,
+
         .scr_read               = mv_scr_read,
         .scr_write              = mv_scr_write,
 
@@ -530,38 +577,38 @@ static const struct ata_port_info mv_port_info[] = {
                 .port_ops       = &mv5_ops,
         },
         {  /* chip_508x */
-                .flags          = (MV_COMMON_FLAGS | MV_FLAG_DUAL_HC),
+                .flags          = MV_COMMON_FLAGS | MV_FLAG_DUAL_HC,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv5_ops,
         },
         {  /* chip_5080 */
-                .flags          = (MV_COMMON_FLAGS | MV_FLAG_DUAL_HC),
+                .flags          = MV_COMMON_FLAGS | MV_FLAG_DUAL_HC,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv5_ops,
         },
         {  /* chip_604x */
-                .flags          = (MV_COMMON_FLAGS | MV_6XXX_FLAGS),
+                .flags          = MV_COMMON_FLAGS | MV_6XXX_FLAGS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv6_ops,
         },
         {  /* chip_608x */
-                .flags          = (MV_COMMON_FLAGS | MV_6XXX_FLAGS |
-                                   MV_FLAG_DUAL_HC),
+                .flags          = MV_COMMON_FLAGS | MV_6XXX_FLAGS |
+                                  MV_FLAG_DUAL_HC,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv6_ops,
         },
         {  /* chip_6042 */
-                .flags          = (MV_COMMON_FLAGS | MV_6XXX_FLAGS),
+                .flags          = MV_COMMON_FLAGS | MV_6XXX_FLAGS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv_iie_ops,
         },
         {  /* chip_7042 */
-                .flags          = (MV_COMMON_FLAGS | MV_6XXX_FLAGS),
+                .flags          = MV_COMMON_FLAGS | MV_6XXX_FLAGS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &mv_iie_ops,
@@ -709,6 +756,46 @@ static void mv_irq_clear(struct ata_port *ap)
 {
 }
 
+static void mv_set_edma_ptrs(void __iomem *port_mmio,
+                             struct mv_host_priv *hpriv,
+                             struct mv_port_priv *pp)
+{
+        u32 index;
+
+        /*
+         * initialize request queue
+         */
+        index = (pp->req_idx & MV_MAX_Q_DEPTH_MASK) << EDMA_REQ_Q_PTR_SHIFT;
+
+        WARN_ON(pp->crqb_dma & 0x3ff);
+        writel((pp->crqb_dma >> 16) >> 16, port_mmio + EDMA_REQ_Q_BASE_HI_OFS);
+        writelfl((pp->crqb_dma & EDMA_REQ_Q_BASE_LO_MASK) | index,
+                 port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
+
+        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
+                writelfl((pp->crqb_dma & 0xffffffff) | index,
+                         port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
+        else
+                writelfl(index, port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
+
+        /*
+         * initialize response queue
+         */
+        index = (pp->resp_idx & MV_MAX_Q_DEPTH_MASK) << EDMA_RSP_Q_PTR_SHIFT;
+
+        WARN_ON(pp->crpb_dma & 0xff);
+        writel((pp->crpb_dma >> 16) >> 16, port_mmio + EDMA_RSP_Q_BASE_HI_OFS);
+
+        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
+                writelfl((pp->crpb_dma & 0xffffffff) | index,
+                         port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
+        else
+                writelfl(index, port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
+
+        writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) | index,
+                 port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+}
+
 /**
  *      mv_start_dma - Enable eDMA engine
  *      @base: port base address
@@ -720,9 +807,15 @@ static void mv_irq_clear(struct ata_port *ap)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_start_dma(void __iomem *base, struct mv_port_priv *pp)
+static void mv_start_dma(void __iomem *base, struct mv_host_priv *hpriv,
+                         struct mv_port_priv *pp)
 {
-        if (!(MV_PP_FLAG_EDMA_EN & pp->pp_flags)) {
+        if (!(pp->pp_flags & MV_PP_FLAG_EDMA_EN)) {
+                /* clear EDMA event indicators, if any */
+                writelfl(0, base + EDMA_ERR_IRQ_CAUSE_OFS);
+
+                mv_set_edma_ptrs(base, hpriv, pp);
+
                 writelfl(EDMA_EN, base + EDMA_CMD_OFS);
                 pp->pp_flags |= MV_PP_FLAG_EDMA_EN;
         }
@@ -739,14 +832,14 @@ static void mv_start_dma(void __iomem *base, struct mv_port_priv *pp)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_stop_dma(struct ata_port *ap)
+static int mv_stop_dma(struct ata_port *ap)
 {
         void __iomem *port_mmio = mv_ap_base(ap);
         struct mv_port_priv *pp = ap->private_data;
         u32 reg;
-        int i;
+        int i, err = 0;
 
-        if (MV_PP_FLAG_EDMA_EN & pp->pp_flags) {
+        if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
                 /* Disable EDMA if active.   The disable bit auto clears.
                  */
                 writelfl(EDMA_DS, port_mmio + EDMA_CMD_OFS);
@@ -758,16 +851,18 @@ static void mv_stop_dma(struct ata_port *ap)
         /* now properly wait for the eDMA to stop */
         for (i = 1000; i > 0; i--) {
                 reg = readl(port_mmio + EDMA_CMD_OFS);
-                if (!(EDMA_EN & reg)) {
+                if (!(reg & EDMA_EN))
                         break;
-                }
+
                 udelay(100);
         }
 
-        if (EDMA_EN & reg) {
+        if (reg & EDMA_EN) {
                 ata_port_printk(ap, KERN_ERR, "Unable to stop eDMA\n");
-                /* FIXME: Consider doing a reset here to recover */
+                err = -EIO;
         }
+
+        return err;
 }
 
 #ifdef ATA_DEBUG
@@ -884,12 +979,13 @@ static void mv_scr_write(struct ata_port *ap, unsigned int sc_reg_in, u32 val)
                 writelfl(val, mv_ap_base(ap) + ofs);
 }
 
-static void mv_edma_cfg(struct mv_host_priv *hpriv, void __iomem *port_mmio)
+static void mv_edma_cfg(struct ata_port *ap, struct mv_host_priv *hpriv,
+                        void __iomem *port_mmio)
 {
         u32 cfg = readl(port_mmio + EDMA_CFG_OFS);
 
         /* set up non-NCQ EDMA configuration */
-        cfg &= ~(1 << 9);       /* disable equeue */
+        cfg &= ~(1 << 9);       /* disable eQue */
 
         if (IS_GEN_I(hpriv)) {
                 cfg &= ~0x1f;           /* clear queue depth */
@@ -909,7 +1005,7 @@ static void mv_edma_cfg(struct mv_host_priv *hpriv, void __iomem *port_mmio)
                 cfg |= (1 << 18);       /* enab early completion */
                 cfg |= (1 << 17);       /* enab cut-through (dis stor&forwrd) */
                 cfg &= ~(1 << 16);      /* dis FIS-based switching (for now) */
-                cfg &= ~(EDMA_CFG_NCQ | EDMA_CFG_NCQ_GO_ON_ERR); /* clear NCQ */
+                cfg &= ~(EDMA_CFG_NCQ); /* clear NCQ */
         }
 
         writelfl(cfg, port_mmio + EDMA_CFG_OFS);
@@ -971,28 +1067,9 @@ static int mv_port_start(struct ata_port *ap)
         pp->sg_tbl = mem;
         pp->sg_tbl_dma = mem_dma;
 
-        mv_edma_cfg(hpriv, port_mmio);
+        mv_edma_cfg(ap, hpriv, port_mmio);
 
-        writel((pp->crqb_dma >> 16) >> 16, port_mmio + EDMA_REQ_Q_BASE_HI_OFS);
-        writelfl(pp->crqb_dma & EDMA_REQ_Q_BASE_LO_MASK,
-                 port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
-
-        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
-                writelfl(pp->crqb_dma & 0xffffffff,
-                         port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
-        else
-                writelfl(0, port_mmio + EDMA_REQ_Q_OUT_PTR_OFS);
-
-        writel((pp->crpb_dma >> 16) >> 16, port_mmio + EDMA_RSP_Q_BASE_HI_OFS);
-
-        if (hpriv->hp_flags & MV_HP_ERRATA_XX42A0)
-                writelfl(pp->crpb_dma & 0xffffffff,
-                         port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
-        else
-                writelfl(0, port_mmio + EDMA_RSP_Q_IN_PTR_OFS);
-
-        writelfl(pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK,
-                 port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+        mv_set_edma_ptrs(port_mmio, hpriv, pp);
 
         /* Don't turn on EDMA here...do it before DMA commands only.  Else
          * we'll be unable to send non-data, PIO, etc due to restricted access
@@ -1055,11 +1132,6 @@ static unsigned int mv_fill_sg(struct ata_queued_cmd *qc)
         return n_sg;
 }
 
-static inline unsigned mv_inc_q_index(unsigned index)
-{
-        return (index + 1) & MV_MAX_Q_DEPTH_MASK;
-}
-
 static inline void mv_crqb_pack_cmd(__le16 *cmdw, u8 data, u8 addr, unsigned last)
 {
         u16 tmp = data | (addr << CRQB_CMD_ADDR_SHIFT) | CRQB_CMD_CS |
@@ -1088,7 +1160,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
         u16 flags = 0;
         unsigned in_index;
 
-        if (ATA_PROT_DMA != qc->tf.protocol)
+        if (qc->tf.protocol != ATA_PROT_DMA)
                 return;
 
         /* Fill in command request block
@@ -1097,10 +1169,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
                 flags |= CRQB_FLAG_READ;
         WARN_ON(MV_MAX_Q_DEPTH <= qc->tag);
         flags |= qc->tag << CRQB_TAG_SHIFT;
+        flags |= qc->tag << CRQB_IOID_SHIFT;    /* 50xx appears to ignore this*/
 
-        /* get current queue index from hardware */
-        in_index = (readl(mv_ap_base(ap) + EDMA_REQ_Q_IN_PTR_OFS)
-                        >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+        /* get current queue index from software */
+        in_index = pp->req_idx & MV_MAX_Q_DEPTH_MASK;
 
         pp->crqb[in_index].sg_addr =
                 cpu_to_le32(pp->sg_tbl_dma & 0xffffffff);
@@ -1180,7 +1252,7 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
         unsigned in_index;
         u32 flags = 0;
 
-        if (ATA_PROT_DMA != qc->tf.protocol)
+        if (qc->tf.protocol != ATA_PROT_DMA)
                 return;
 
         /* Fill in Gen IIE command request block
@@ -1190,10 +1262,11 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
 
         WARN_ON(MV_MAX_Q_DEPTH <= qc->tag);
         flags |= qc->tag << CRQB_TAG_SHIFT;
+        flags |= qc->tag << CRQB_IOID_SHIFT;    /* "I/O Id" is -really-
+                                                   what we use as our tag */
 
-        /* get current queue index from hardware */
-        in_index = (readl(mv_ap_base(ap) + EDMA_REQ_Q_IN_PTR_OFS)
-                        >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+        /* get current queue index from software */
+        in_index = pp->req_idx & MV_MAX_Q_DEPTH_MASK;
 
         crqb = (struct mv_crqb_iie *) &pp->crqb[in_index];
         crqb->addr = cpu_to_le32(pp->sg_tbl_dma & 0xffffffff);
@@ -1241,83 +1314,41 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
  */
 static unsigned int mv_qc_issue(struct ata_queued_cmd *qc)
 {
-        void __iomem *port_mmio = mv_ap_base(qc->ap);
-        struct mv_port_priv *pp = qc->ap->private_data;
-        unsigned in_index;
-        u32 in_ptr;
+        struct ata_port *ap = qc->ap;
+        void __iomem *port_mmio = mv_ap_base(ap);
+        struct mv_port_priv *pp = ap->private_data;
+        struct mv_host_priv *hpriv = ap->host->private_data;
+        u32 in_index;
 
-        if (ATA_PROT_DMA != qc->tf.protocol) {
+        if (qc->tf.protocol != ATA_PROT_DMA) {
                 /* We're about to send a non-EDMA capable command to the
                  * port.  Turn off EDMA so there won't be problems accessing
                  * shadow block, etc registers.
                  */
-                mv_stop_dma(qc->ap);
+                mv_stop_dma(ap);
                 return ata_qc_issue_prot(qc);
         }
 
-        in_ptr   = readl(port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
-        in_index = (in_ptr >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+        mv_start_dma(port_mmio, hpriv, pp);
+
+        in_index = pp->req_idx & MV_MAX_Q_DEPTH_MASK;
 
         /* until we do queuing, the queue should be empty at this point */
         WARN_ON(in_index != ((readl(port_mmio + EDMA_REQ_Q_OUT_PTR_OFS)
                 >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK));
 
-        in_index = mv_inc_q_index(in_index);    /* now incr producer index */
+        pp->req_idx++;
 
-        mv_start_dma(port_mmio, pp);
+        in_index = (pp->req_idx & MV_MAX_Q_DEPTH_MASK) << EDMA_REQ_Q_PTR_SHIFT;
 
         /* and write the request in pointer to kick the EDMA to life */
-        in_ptr &= EDMA_REQ_Q_BASE_LO_MASK;
-        in_ptr |= in_index << EDMA_REQ_Q_PTR_SHIFT;
-        writelfl(in_ptr, port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
+        writelfl((pp->crqb_dma & EDMA_REQ_Q_BASE_LO_MASK) | in_index,
+                 port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
 
         return 0;
 }
 
 /**
- *      mv_get_crpb_status - get status from most recently completed cmd
- *      @ap: ATA channel to manipulate
- *
- *      This routine is for use when the port is in DMA mode, when it
- *      will be using the CRPB (command response block) method of
- *      returning command completion information.  We check indices
- *      are good, grab status, and bump the response consumer index to
- *      prove that we're up to date.
- *
- *      LOCKING:
- *      Inherited from caller.
- */
-static u8 mv_get_crpb_status(struct ata_port *ap)
-{
-        void __iomem *port_mmio = mv_ap_base(ap);
-        struct mv_port_priv *pp = ap->private_data;
-        unsigned out_index;
-        u32 out_ptr;
-        u8 ata_status;
-
-        out_ptr   = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
-        out_index = (out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
-
-        ata_status = le16_to_cpu(pp->crpb[out_index].flags)
-                                        >> CRPB_FLAG_STATUS_SHIFT;
-
-        /* increment our consumer index... */
-        out_index = mv_inc_q_index(out_index);
-
-        /* and, until we do NCQ, there should only be 1 CRPB waiting */
-        WARN_ON(out_index != ((readl(port_mmio + EDMA_RSP_Q_IN_PTR_OFS)
-                >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK));
-
-        /* write out our inc'd consumer index so EDMA knows we're caught up */
-        out_ptr &= EDMA_RSP_Q_BASE_LO_MASK;
-        out_ptr |= out_index << EDMA_RSP_Q_PTR_SHIFT;
-        writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
-
-        /* Return ATA status register for completed CRPB */
-        return ata_status;
-}
-
-/**
  *      mv_err_intr - Handle error interrupts on the port
  *      @ap: ATA channel to manipulate
  *      @reset_allowed: bool: 0 == don't trigger from reset here
@@ -1331,30 +1362,191 @@ static u8 mv_get_crpb_status(struct ata_port *ap)
  *      LOCKING:
  *      Inherited from caller.
  */
-static void mv_err_intr(struct ata_port *ap, int reset_allowed)
+static void mv_err_intr(struct ata_port *ap, struct ata_queued_cmd *qc)
 {
         void __iomem *port_mmio = mv_ap_base(ap);
-        u32 edma_err_cause, serr = 0;
+        u32 edma_err_cause, eh_freeze_mask, serr = 0;
+        struct mv_port_priv *pp = ap->private_data;
+        struct mv_host_priv *hpriv = ap->host->private_data;
+        unsigned int edma_enabled = (pp->pp_flags & MV_PP_FLAG_EDMA_EN);
+        unsigned int action = 0, err_mask = 0;
+        struct ata_eh_info *ehi = &ap->eh_info;
 
-        edma_err_cause = readl(port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
+        ata_ehi_clear_desc(ehi);
 
-        if (EDMA_ERR_SERR & edma_err_cause) {
+        if (!edma_enabled) {
+                /* just a guess: do we need to do this? should we
+                 * expand this, and do it in all cases?
+                 */
                 sata_scr_read(ap, SCR_ERROR, &serr);
                 sata_scr_write_flush(ap, SCR_ERROR, serr);
         }
-        if (EDMA_ERR_SELF_DIS & edma_err_cause) {
-                struct mv_port_priv *pp = ap->private_data;
-                pp->pp_flags &= ~MV_PP_FLAG_EDMA_EN;
+
+        edma_err_cause = readl(port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
+
+        ata_ehi_push_desc(ehi, "edma_err 0x%08x", edma_err_cause);
+
+        /*
+         * all generations share these EDMA error cause bits
+         */
+
+        if (edma_err_cause & EDMA_ERR_DEV)
+                err_mask |= AC_ERR_DEV;
+        if (edma_err_cause & (EDMA_ERR_D_PAR | EDMA_ERR_PRD_PAR |
+                        EDMA_ERR_CRBQ_PAR | EDMA_ERR_CRPB_PAR |
+                        EDMA_ERR_INTRL_PAR)) {
+                err_mask |= AC_ERR_ATA_BUS;
+                action |= ATA_EH_HARDRESET;
+                ata_ehi_push_desc(ehi, ", parity error");
+        }
+        if (edma_err_cause & (EDMA_ERR_DEV_DCON | EDMA_ERR_DEV_CON)) {
+                ata_ehi_hotplugged(ehi);
+                ata_ehi_push_desc(ehi, edma_err_cause & EDMA_ERR_DEV_DCON ?
+                        ", dev disconnect" : ", dev connect");
+        }
+
+        if (IS_GEN_I(hpriv)) {
+                eh_freeze_mask = EDMA_EH_FREEZE_5;
+
+                if (edma_err_cause & EDMA_ERR_SELF_DIS_5) {
+                        struct mv_port_priv *pp = ap->private_data;
+                        pp->pp_flags &= ~MV_PP_FLAG_EDMA_EN;
+                        ata_ehi_push_desc(ehi, ", EDMA self-disable");
+                }
+        } else {
+                eh_freeze_mask = EDMA_EH_FREEZE;
+
+                if (edma_err_cause & EDMA_ERR_SELF_DIS) {
+                        struct mv_port_priv *pp = ap->private_data;
+                        pp->pp_flags &= ~MV_PP_FLAG_EDMA_EN;
+                        ata_ehi_push_desc(ehi, ", EDMA self-disable");
+                }
+
+                if (edma_err_cause & EDMA_ERR_SERR) {
+                        sata_scr_read(ap, SCR_ERROR, &serr);
+                        sata_scr_write_flush(ap, SCR_ERROR, serr);
+                        err_mask = AC_ERR_ATA_BUS;
+                        action |= ATA_EH_HARDRESET;
+                }
         }
-        DPRINTK(KERN_ERR "ata%u: port error; EDMA err cause: 0x%08x "
-                "SERR: 0x%08x\n", ap->print_id, edma_err_cause, serr);
 
         /* Clear EDMA now that SERR cleanup done */
         writelfl(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
 
-        /* check for fatal here and recover if needed */
-        if (reset_allowed && (EDMA_ERR_FATAL & edma_err_cause))
-                mv_stop_and_reset(ap);
+        if (!err_mask) {
+                err_mask = AC_ERR_OTHER;
+                action |= ATA_EH_HARDRESET;
+        }
+
+        ehi->serror |= serr;
+        ehi->action |= action;
+
+        if (qc)
+                qc->err_mask |= err_mask;
+        else
+                ehi->err_mask |= err_mask;
+
+        if (edma_err_cause & eh_freeze_mask)
+                ata_port_freeze(ap);
+        else
+                ata_port_abort(ap);
+}
+
+static void mv_intr_pio(struct ata_port *ap)
+{
+        struct ata_queued_cmd *qc;
+        u8 ata_status;
+
+        /* ignore spurious intr if drive still BUSY */
+        ata_status = readb(ap->ioaddr.status_addr);
+        if (unlikely(ata_status & ATA_BUSY))
+                return;
+
+        /* get active ATA command */
+        qc = ata_qc_from_tag(ap, ap->active_tag);
+        if (unlikely(!qc))                      /* no active tag */
+                return;
+        if (qc->tf.flags & ATA_TFLAG_POLLING)   /* polling; we don't own qc */
+                return;
+
+        /* and finally, complete the ATA command */
+        qc->err_mask |= ac_err_mask(ata_status);
+        ata_qc_complete(qc);
+}
+
+static void mv_intr_edma(struct ata_port *ap)
+{
+        void __iomem *port_mmio = mv_ap_base(ap);
+        struct mv_host_priv *hpriv = ap->host->private_data;
+        struct mv_port_priv *pp = ap->private_data;
+        struct ata_queued_cmd *qc;
+        u32 out_index, in_index;
+        bool work_done = false;
+
+        /* get h/w response queue pointer */
+        in_index = (readl(port_mmio + EDMA_RSP_Q_IN_PTR_OFS)
+                        >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+
+        while (1) {
+                u16 status;
+
+                /* get s/w response queue last-read pointer, and compare */
+                out_index = pp->resp_idx & MV_MAX_Q_DEPTH_MASK;
+                if (in_index == out_index)
+                        break;
+
+                 
+                /* 50xx: get active ATA command */
+                if (IS_GEN_I(hpriv)) 
+                        qc = ata_qc_from_tag(ap, ap->active_tag);
+
+                /* 60xx: get active ATA command via tag, to enable support
+                 * for queueing.  this works transparently for queued and
+                 * non-queued modes.
+                 */
+                else {
+                        unsigned int tag;
+
+                        if (IS_GEN_II(hpriv))
+                                tag = (le16_to_cpu(pp->crpb[out_index].id)
+                                        >> CRPB_IOID_SHIFT_6) & 0x3f;
+                        else
+                                tag = (le16_to_cpu(pp->crpb[out_index].id)
+                                        >> CRPB_IOID_SHIFT_7) & 0x3f;
+
+                        qc = ata_qc_from_tag(ap, tag);
+                }
+
+                /* lower 8 bits of status are EDMA_ERR_IRQ_CAUSE_OFS
+                 * bits (WARNING: might not necessarily be associated
+                 * with this command), which -should- be clear
+                 * if all is well
+                 */
+                status = le16_to_cpu(pp->crpb[out_index].flags);
+                if (unlikely(status & 0xff)) {
+                        mv_err_intr(ap, qc);
+                        return;
+                }
+
+                /* and finally, complete the ATA command */
+                if (qc) {
+                        qc->err_mask |=
+                                ac_err_mask(status >> CRPB_FLAG_STATUS_SHIFT);
+                        ata_qc_complete(qc);
+                }
+
+                /* advance software response queue pointer, to 
+                 * indicate (after the loop completes) to hardware
+                 * that we have consumed a response queue entry.
+                 */
+                work_done = true;
+                pp->resp_idx++;
+        }
+
+        if (work_done)
+                writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) |
+                         (out_index << EDMA_RSP_Q_PTR_SHIFT),
+                         port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
 }
 
 /**
@@ -1377,10 +1569,8 @@ static void mv_host_intr(struct ata_host *host, u32 relevant, unsigned int hc)
 {
         void __iomem *mmio = host->iomap[MV_PRIMARY_BAR];
         void __iomem *hc_mmio = mv_hc_base(mmio, hc);
-        struct ata_queued_cmd *qc;
         u32 hc_irq_cause;
-        int shift, port, port0, hard_port, handled;
-        unsigned int err_mask;
+        int port, port0;
 
         if (hc == 0)
                 port0 = 0;
@@ -1389,79 +1579,95 @@ static void mv_host_intr(struct ata_host *host, u32 relevant, unsigned int hc)
 
         /* we'll need the HC success int register in most cases */
         hc_irq_cause = readl(hc_mmio + HC_IRQ_CAUSE_OFS);
-        if (hc_irq_cause)
-                writelfl(~hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
+        if (!hc_irq_cause)
+                return;
+
+        writelfl(~hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
 
         VPRINTK("ENTER, hc%u relevant=0x%08x HC IRQ cause=0x%08x\n",
                 hc,relevant,hc_irq_cause);
 
         for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
-                u8 ata_status = 0;
                 struct ata_port *ap = host->ports[port];
                 struct mv_port_priv *pp = ap->private_data;
+                int have_err_bits, hard_port, shift;
+
+                if ((!ap) || (ap->flags & ATA_FLAG_DISABLED))
+                        continue;
+
+                shift = port << 1;              /* (port * 2) */
+                if (port >= MV_PORTS_PER_HC) {
+                        shift++;        /* skip bit 8 in the HC Main IRQ reg */
+                }
+                have_err_bits = ((PORT0_ERR << shift) & relevant);
+
+                if (unlikely(have_err_bits)) {
+                        struct ata_queued_cmd *qc;
+
+                        qc = ata_qc_from_tag(ap, ap->active_tag);
+                        if (qc && (qc->tf.flags & ATA_TFLAG_POLLING))
+                                continue;
+
+                        mv_err_intr(ap, qc);
+                        continue;
+                }
 
                 hard_port = mv_hardport_from_port(port); /* range 0..3 */
-                handled = 0;    /* ensure ata_status is set if handled++ */
 
-                /* Note that DEV_IRQ might happen spuriously during EDMA,
-                 * and should be ignored in such cases.
-                 * The cause of this is still under investigation.
-                 */
                 if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
-                        /* EDMA: check for response queue interrupt */
-                        if ((CRPB_DMA_DONE << hard_port) & hc_irq_cause) {
-                                ata_status = mv_get_crpb_status(ap);
-                                handled = 1;
-                        }
+                        if ((CRPB_DMA_DONE << hard_port) & hc_irq_cause)
+                                mv_intr_edma(ap);
                 } else {
-                        /* PIO: check for device (drive) interrupt */
-                        if ((DEV_IRQ << hard_port) & hc_irq_cause) {
-                                ata_status = readb(ap->ioaddr.status_addr);
-                                handled = 1;
-                                /* ignore spurious intr if drive still BUSY */
-                                if (ata_status & ATA_BUSY) {
-                                        ata_status = 0;
-                                        handled = 0;
-                                }
-                        }
+                        if ((DEV_IRQ << hard_port) & hc_irq_cause)
+                                mv_intr_pio(ap);
                 }
+        }
+        VPRINTK("EXIT\n");
+}
 
-                if (ap && (ap->flags & ATA_FLAG_DISABLED))
-                        continue;
+static void mv_pci_error(struct ata_host *host, void __iomem *mmio)
+{
+        struct ata_port *ap;
+        struct ata_queued_cmd *qc;
+        struct ata_eh_info *ehi;
+        unsigned int i, err_mask, printed = 0;
+        u32 err_cause;
 
-                err_mask = ac_err_mask(ata_status);
+        err_cause = readl(mmio + PCI_IRQ_CAUSE_OFS);
 
-                shift = port << 1;              /* (port * 2) */
-                if (port >= MV_PORTS_PER_HC) {
-                        shift++;        /* skip bit 8 in the HC Main IRQ reg */
-                }
-                if ((PORT0_ERR << shift) & relevant) {
-                        mv_err_intr(ap, 1);
-                        err_mask |= AC_ERR_OTHER;
-                        handled = 1;
-                }
+        dev_printk(KERN_ERR, host->dev, "PCI ERROR; PCI IRQ cause=0x%08x\n",
+                   err_cause);
+
+        DPRINTK("All regs @ PCI error\n");
+        mv_dump_all_regs(mmio, -1, to_pci_dev(host->dev));
+
+        writelfl(0, mmio + PCI_IRQ_CAUSE_OFS);
 
-                if (handled) {
+        for (i = 0; i < host->n_ports; i++) {
+                ap = host->ports[i];
+                if (!ata_port_offline(ap)) {
+                        ehi = &ap->eh_info;
+                        ata_ehi_clear_desc(ehi);
+                        if (!printed++)
+                                ata_ehi_push_desc(ehi,
+                                        "PCI err cause 0x%08x", err_cause);
+                        err_mask = AC_ERR_HOST_BUS;
+                        ehi->action = ATA_EH_HARDRESET;
                         qc = ata_qc_from_tag(ap, ap->active_tag);
-                        if (qc && (qc->flags & ATA_QCFLAG_ACTIVE)) {
-                                VPRINTK("port %u IRQ found for qc, "
-                                        "ata_status 0x%x\n", port,ata_status);
-                                /* mark qc status appropriately */
-                                if (!(qc->tf.flags & ATA_TFLAG_POLLING)) {
-                                        qc->err_mask |= err_mask;
-                                        ata_qc_complete(qc);
-                                }
-                        }
+                        if (qc)
+                                qc->err_mask |= err_mask;
+                        else
+                                ehi->err_mask |= err_mask;
+
+                        ata_port_freeze(ap);
                 }
         }
-        VPRINTK("EXIT\n");
 }
 
 /**
- *      mv_interrupt -
+ *      mv_interrupt - Main interrupt event handler
  *      @irq: unused
  *      @dev_instance: private data; in this case the host structure
- *      @regs: unused
  *
  *      Read the read only register to determine if any host
  *      controllers have pending interrupts.  If so, call lower level
@@ -1477,7 +1683,6 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance)
         struct ata_host *host = dev_instance;
         unsigned int hc, handled = 0, n_hcs;
         void __iomem *mmio = host->iomap[MV_PRIMARY_BAR];
-        struct mv_host_priv *hpriv;
         u32 irq_stat;
 
         irq_stat = readl(mmio + HC_MAIN_IRQ_CAUSE_OFS);
@@ -1491,34 +1696,21 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance)
         n_hcs = mv_get_hc_count(host->ports[0]->flags);
         spin_lock(&host->lock);
 
+        if (unlikely(irq_stat & PCI_ERR)) {
+                mv_pci_error(host, mmio);
+                handled = 1;
+                goto out_unlock;        /* skip all other HC irq handling */
+        }
+
         for (hc = 0; hc < n_hcs; hc++) {
                 u32 relevant = irq_stat & (HC0_IRQ_PEND << (hc * HC_SHIFT));
                 if (relevant) {
                         mv_host_intr(host, relevant, hc);
-                        handled++;
-                }
-        }
-
-        hpriv = host->private_data;
-        if (IS_60XX(hpriv)) {
-                /* deal with the interrupt coalescing bits */
-                if (irq_stat & (TRAN_LO_DONE | TRAN_HI_DONE | PORTS_0_7_COAL_DONE)) {
-                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE_LO);
-                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE_HI);
-                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE);
+                        handled = 1;
                 }
         }
 
-        if (PCI_ERR & irq_stat) {
-                printk(KERN_ERR DRV_NAME ": PCI ERROR; PCI IRQ cause=0x%08x\n",
-                       readl(mmio + PCI_IRQ_CAUSE_OFS));
-
-                DPRINTK("All regs @ PCI error\n");
-                mv_dump_all_regs(mmio, -1, to_pci_dev(host->dev));
-
-                writelfl(0, mmio + PCI_IRQ_CAUSE_OFS);
-                handled++;
-        }
+out_unlock:
         spin_unlock(&host->lock);
 
         return IRQ_RETVAL(handled);
@@ -1904,7 +2096,7 @@ static void mv_channel_reset(struct mv_host_priv *hpriv, void __iomem *mmio,
 
         writelfl(ATA_RST, port_mmio + EDMA_CMD_OFS);
 
-        if (IS_60XX(hpriv)) {
+        if (IS_GEN_II(hpriv)) {
                 u32 ifctl = readl(port_mmio + SATA_INTERFACE_CTL);
                 ifctl |= (1 << 7);              /* enable gen2i speed */
                 ifctl = (ifctl & 0xfff) | 0x9b1000; /* from chip spec */
@@ -1920,32 +2112,12 @@ static void mv_channel_reset(struct mv_host_priv *hpriv, void __iomem *mmio,
 
         hpriv->ops->phy_errata(hpriv, mmio, port_no);
 
-        if (IS_50XX(hpriv))
+        if (IS_GEN_I(hpriv))
                 mdelay(1);
 }
 
-static void mv_stop_and_reset(struct ata_port *ap)
-{
-        struct mv_host_priv *hpriv = ap->host->private_data;
-        void __iomem *mmio = ap->host->iomap[MV_PRIMARY_BAR];
-
-        mv_stop_dma(ap);
-
-        mv_channel_reset(hpriv, mmio, ap->port_no);
-
-        __mv_phy_reset(ap, 0);
-}
-
-static inline void __msleep(unsigned int msec, int can_sleep)
-{
-        if (can_sleep)
-                msleep(msec);
-        else
-                mdelay(msec);
-}
-
 /**
- *      __mv_phy_reset - Perform eDMA reset followed by COMRESET
+ *      mv_phy_reset - Perform eDMA reset followed by COMRESET
  *      @ap: ATA channel to manipulate
  *
  *      Part of this is taken from __sata_phy_reset and modified to
@@ -1955,14 +2127,12 @@ static inline void __msleep(unsigned int msec, int can_sleep)
  *      Inherited from caller.  This is coded to safe to call at
  *      interrupt level, i.e. it does not sleep.
  */
-static void __mv_phy_reset(struct ata_port *ap, int can_sleep)
+static void mv_phy_reset(struct ata_port *ap, unsigned int *class,
+                         unsigned long deadline)
 {
         struct mv_port_priv *pp = ap->private_data;
         struct mv_host_priv *hpriv = ap->host->private_data;
         void __iomem *port_mmio = mv_ap_base(ap);
-        struct ata_taskfile tf;
-        struct ata_device *dev = &ap->device[0];
-        unsigned long timeout;
         int retry = 5;
         u32 sstatus;
 
@@ -1975,22 +2145,21 @@ static void __mv_phy_reset(struct ata_port *ap, int can_sleep)
         /* Issue COMRESET via SControl */
 comreset_retry:
         sata_scr_write_flush(ap, SCR_CONTROL, 0x301);
-        __msleep(1, can_sleep);
+        msleep(1);
 
         sata_scr_write_flush(ap, SCR_CONTROL, 0x300);
-        __msleep(20, can_sleep);
+        msleep(20);
 
-        timeout = jiffies + msecs_to_jiffies(200);
         do {
                 sata_scr_read(ap, SCR_STATUS, &sstatus);
                 if (((sstatus & 0x3) == 3) || ((sstatus & 0x3) == 0))
                         break;
 
-                __msleep(1, can_sleep);
-        } while (time_before(jiffies, timeout));
+                msleep(1);
+        } while (time_before(jiffies, deadline));
 
         /* work around errata */
-        if (IS_60XX(hpriv) &&
+        if (IS_GEN_II(hpriv) &&
             (sstatus != 0x0) && (sstatus != 0x113) && (sstatus != 0x123) &&
             (retry-- > 0))
                 goto comreset_retry;
@@ -1999,13 +2168,8 @@ comreset_retry:
                 "SCtrl 0x%08x\n", mv_scr_read(ap, SCR_STATUS),
                 mv_scr_read(ap, SCR_ERROR), mv_scr_read(ap, SCR_CONTROL));
 
-        if (ata_port_online(ap)) {
-                ata_port_probe(ap);
-        } else {
-                sata_scr_read(ap, SCR_STATUS, &sstatus);
-                ata_port_printk(ap, KERN_INFO,
-                                "no device found (phy stat %08x)\n", sstatus);
-                ata_port_disable(ap);
+        if (ata_port_offline(ap)) {
+                *class = ATA_DEV_NONE;
                 return;
         }
 
@@ -2019,68 +2183,152 @@ comreset_retry:
                 u8 drv_stat = ata_check_status(ap);
                 if ((drv_stat != 0x80) && (drv_stat != 0x7f))
                         break;
-                __msleep(500, can_sleep);
+                msleep(500);
                 if (retry-- <= 0)
                         break;
+                if (time_after(jiffies, deadline))
+                        break;
         }
 
-        tf.lbah = readb(ap->ioaddr.lbah_addr);
-        tf.lbam = readb(ap->ioaddr.lbam_addr);
-        tf.lbal = readb(ap->ioaddr.lbal_addr);
-        tf.nsect = readb(ap->ioaddr.nsect_addr);
+        /* FIXME: if we passed the deadline, the following
+         * code probably produces an invalid result
+         */
 
-        dev->class = ata_dev_classify(&tf);
-        if (!ata_dev_enabled(dev)) {
-                VPRINTK("Port disabled post-sig: No device present.\n");
-                ata_port_disable(ap);
-        }
+        /* finally, read device signature from TF registers */
+        *class = ata_dev_try_classify(ap, 0, NULL);
 
         writelfl(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
 
-        pp->pp_flags &= ~MV_PP_FLAG_EDMA_EN;
+        WARN_ON(pp->pp_flags & MV_PP_FLAG_EDMA_EN);
 
         VPRINTK("EXIT\n");
 }
 
-static void mv_phy_reset(struct ata_port *ap)
+static int mv_prereset(struct ata_port *ap, unsigned long deadline)
 {
-        __mv_phy_reset(ap, 1);
+        struct mv_port_priv *pp = ap->private_data;
+        struct ata_eh_context *ehc = &ap->eh_context;
+        int rc;
+        
+        rc = mv_stop_dma(ap);
+        if (rc)
+                ehc->i.action |= ATA_EH_HARDRESET;
+
+        if (!(pp->pp_flags & MV_PP_FLAG_HAD_A_RESET)) {
+                pp->pp_flags |= MV_PP_FLAG_HAD_A_RESET;
+                ehc->i.action |= ATA_EH_HARDRESET;
+        }
+
+        /* if we're about to do hardreset, nothing more to do */
+        if (ehc->i.action & ATA_EH_HARDRESET)
+                return 0;
+
+        if (ata_port_online(ap))
+                rc = ata_wait_ready(ap, deadline);
+        else
+                rc = -ENODEV;
+
+        return rc;
 }
 
-/**
- *      mv_eng_timeout - Routine called by libata when SCSI times out I/O
- *      @ap: ATA channel to manipulate
- *
- *      Intent is to clear all pending error conditions, reset the
- *      chip/bus, fail the command, and move on.
- *
- *      LOCKING:
- *      This routine holds the host lock while failing the command.
- */
-static void mv_eng_timeout(struct ata_port *ap)
+static int mv_hardreset(struct ata_port *ap, unsigned int *class,
+                        unsigned long deadline)
 {
+        struct mv_host_priv *hpriv = ap->host->private_data;
         void __iomem *mmio = ap->host->iomap[MV_PRIMARY_BAR];
-        struct ata_queued_cmd *qc;
-        unsigned long flags;
 
-        ata_port_printk(ap, KERN_ERR, "Entering mv_eng_timeout\n");
-        DPRINTK("All regs @ start of eng_timeout\n");
-        mv_dump_all_regs(mmio, ap->port_no, to_pci_dev(ap->host->dev));
+        mv_stop_dma(ap);
 
-        qc = ata_qc_from_tag(ap, ap->active_tag);
-        printk(KERN_ERR "mmio_base %p ap %p qc %p scsi_cmnd %p &cmnd %p\n",
-               mmio, ap, qc, qc->scsicmd, &qc->scsicmd->cmnd);
+        mv_channel_reset(hpriv, mmio, ap->port_no);
 
-        spin_lock_irqsave(&ap->host->lock, flags);
-        mv_err_intr(ap, 0);
-        mv_stop_and_reset(ap);
-        spin_unlock_irqrestore(&ap->host->lock, flags);
+        mv_phy_reset(ap, class, deadline);
+
+        return 0;
+}
+
+static void mv_postreset(struct ata_port *ap, unsigned int *classes)
+{
+        u32 serr;
+
+        /* print link status */
+        sata_print_link_status(ap);
+
+        /* clear SError */
+        sata_scr_read(ap, SCR_ERROR, &serr);
+        sata_scr_write_flush(ap, SCR_ERROR, serr);
 
-        WARN_ON(!(qc->flags & ATA_QCFLAG_ACTIVE));
-        if (qc->flags & ATA_QCFLAG_ACTIVE) {
-                qc->err_mask |= AC_ERR_TIMEOUT;
-                ata_eh_qc_complete(qc);
+        /* bail out if no device is present */
+        if (classes[0] == ATA_DEV_NONE && classes[1] == ATA_DEV_NONE) {
+                DPRINTK("EXIT, no device\n");
+                return;
         }
+
+        /* set up device control */
+        iowrite8(ap->ctl, ap->ioaddr.ctl_addr);
+}
+
+static void mv_error_handler(struct ata_port *ap)
+{
+        ata_do_eh(ap, mv_prereset, ata_std_softreset,
+                  mv_hardreset, mv_postreset);
+}
+
+static void mv_post_int_cmd(struct ata_queued_cmd *qc)
+{
+        mv_stop_dma(qc->ap);
+}
+
+static void mv_eh_freeze(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->host->iomap[MV_PRIMARY_BAR];
+        unsigned int hc = (ap->port_no > 3) ? 1 : 0;
+        u32 tmp, mask;
+        unsigned int shift;
+
+        /* FIXME: handle coalescing completion events properly */
+
+        shift = ap->port_no * 2;
+        if (hc > 0)
+                shift++;
+
+        mask = 0x3 << shift;
+
+        /* disable assertion of portN err, done events */
+        tmp = readl(mmio + HC_MAIN_IRQ_MASK_OFS);
+        writelfl(tmp & ~mask, mmio + HC_MAIN_IRQ_MASK_OFS);
+}
+
+static void mv_eh_thaw(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->host->iomap[MV_PRIMARY_BAR];
+        unsigned int hc = (ap->port_no > 3) ? 1 : 0;
+        void __iomem *hc_mmio = mv_hc_base(mmio, hc);
+        void __iomem *port_mmio = mv_ap_base(ap);
+        u32 tmp, mask, hc_irq_cause;
+        unsigned int shift, hc_port_no = ap->port_no;
+
+        /* FIXME: handle coalescing completion events properly */
+
+        shift = ap->port_no * 2;
+        if (hc > 0) {
+                shift++;
+                hc_port_no -= 4;
+        }
+
+        mask = 0x3 << shift;
+
+        /* clear EDMA errors on this port */
+        writel(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
+
+        /* clear pending irq events */
+        hc_irq_cause = readl(hc_mmio + HC_IRQ_CAUSE_OFS);
+        hc_irq_cause &= ~(1 << hc_port_no);     /* clear CRPB-done */
+        hc_irq_cause &= ~(1 << (hc_port_no + 8)); /* clear Device int */
+        writel(hc_irq_cause, hc_mmio + HC_IRQ_CAUSE_OFS);
+
+        /* enable assertion of portN err, done events */
+        tmp = readl(mmio + HC_MAIN_IRQ_MASK_OFS);
+        writelfl(tmp | mask, mmio + HC_MAIN_IRQ_MASK_OFS);
 }
 
 /**
@@ -2141,7 +2389,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
         switch(board_idx) {
         case chip_5080:
                 hpriv->ops = &mv5xxx_ops;
-                hp_flags |= MV_HP_50XX;
+                hp_flags |= MV_HP_GEN_I;
 
                 switch (pdev->revision) {
                 case 0x1:
@@ -2161,7 +2409,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
         case chip_504x:
         case chip_508x:
                 hpriv->ops = &mv5xxx_ops;
-                hp_flags |= MV_HP_50XX;
+                hp_flags |= MV_HP_GEN_I;
 
                 switch (pdev->revision) {
                 case 0x0:
@@ -2181,6 +2429,7 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
         case chip_604x:
         case chip_608x:
                 hpriv->ops = &mv6xxx_ops;
+                hp_flags |= MV_HP_GEN_II;
 
                 switch (pdev->revision) {
                 case 0x7:
@@ -2200,7 +2449,6 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
         case chip_7042:
         case chip_6042:
                 hpriv->ops = &mv6xxx_ops;
-
                 hp_flags |= MV_HP_GEN_IIE;
 
                 switch (pdev->revision) {
@@ -2267,7 +2515,7 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
         hpriv->ops->enable_leds(hpriv, mmio);
 
         for (port = 0; port < host->n_ports; port++) {
-                if (IS_60XX(hpriv)) {
+                if (IS_GEN_II(hpriv)) {
                         void __iomem *port_mmio = mv_port_base(mmio, port);
 
                         u32 ifctl = readl(port_mmio + SATA_INTERFACE_CTL);
@@ -2302,7 +2550,7 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
         /* and unmask interrupt generation for host regs */
         writelfl(PCI_UNMASK_ALL_IRQS, mmio + PCI_IRQ_MASK_OFS);
 
-        if (IS_50XX(hpriv))
+        if (IS_GEN_I(hpriv))
                 writelfl(~HC_MAIN_MASKED_IRQS_5, mmio + HC_MAIN_IRQ_MASK_OFS);
         else
                 writelfl(~HC_MAIN_MASKED_IRQS, mmio + HC_MAIN_IRQ_MASK_OFS);
@@ -2418,8 +2666,9 @@ static int mv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         mv_print_info(host);
 
         pci_set_master(pdev);
+        pci_set_mwi(pdev);
         return ata_host_activate(host, pdev->irq, mv_interrupt, IRQF_SHARED,
-                                 &mv_sht);
+                                 IS_GEN_I(hpriv) ? &mv5_sht : &mv6_sht);
 }
 
 static int __init mv_init(void)
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index b2656867c647..db81e3efa5ec 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -1560,7 +1560,7 @@ static int nv_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         ppi[0] = &nv_port_info[type];
-        rc = ata_pci_prepare_native_host(pdev, ppi, &host);
+        rc = ata_pci_prepare_sff_host(pdev, ppi, &host);
         if (rc)
                 return rc;
 
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 2ad5872fe90c..d2fcb9a6bec2 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -45,7 +45,7 @@
 #include "sata_promise.h"
 
 #define DRV_NAME        "sata_promise"
-#define DRV_VERSION     "2.08"
+#define DRV_VERSION     "2.09"
 
 enum {
         PDC_MAX_PORTS           = 4,
@@ -716,6 +716,9 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance)
         unsigned int i, tmp;
         unsigned int handled = 0;
         void __iomem *mmio_base;
+        unsigned int hotplug_offset, ata_no;
+        u32 hotplug_status;
+        int is_sataii_tx4;
 
         VPRINTK("ENTER\n");
 
@@ -726,10 +729,20 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance)
 
         mmio_base = host->iomap[PDC_MMIO_BAR];
 
+        /* read and clear hotplug flags for all ports */
+        if (host->ports[0]->flags & PDC_FLAG_GEN_II)
+                hotplug_offset = PDC2_SATA_PLUG_CSR;
+        else
+                hotplug_offset = PDC_SATA_PLUG_CSR;
+        hotplug_status = readl(mmio_base + hotplug_offset);
+        if (hotplug_status & 0xff)
+                writel(hotplug_status | 0xff, mmio_base + hotplug_offset);
+        hotplug_status &= 0xff; /* clear uninteresting bits */
+
         /* reading should also clear interrupts */
         mask = readl(mmio_base + PDC_INT_SEQMASK);
 
-        if (mask == 0xffffffff) {
+        if (mask == 0xffffffff && hotplug_status == 0) {
                 VPRINTK("QUICK EXIT 2\n");
                 return IRQ_NONE;
         }
@@ -737,16 +750,34 @@ static irqreturn_t pdc_interrupt (int irq, void *dev_instance)
         spin_lock(&host->lock);
 
         mask &= 0xffff;         /* only 16 tags possible */
-        if (!mask) {
+        if (mask == 0 && hotplug_status == 0) {
                 VPRINTK("QUICK EXIT 3\n");
                 goto done_irq;
         }
 
         writel(mask, mmio_base + PDC_INT_SEQMASK);
 
+        is_sataii_tx4 = pdc_is_sataii_tx4(host->ports[0]->flags);
+
         for (i = 0; i < host->n_ports; i++) {
                 VPRINTK("port %u\n", i);
                 ap = host->ports[i];
+
+                /* check for a plug or unplug event */
+                ata_no = pdc_port_no_to_ata_no(i, is_sataii_tx4);
+                tmp = hotplug_status & (0x11 << ata_no);
+                if (tmp && ap &&
+                    !(ap->flags & ATA_FLAG_DISABLED)) {
+                        struct ata_eh_info *ehi = &ap->eh_info;
+                        ata_ehi_clear_desc(ehi);
+                        ata_ehi_hotplugged(ehi);
+                        ata_ehi_push_desc(ehi, "hotplug_status %#x", tmp);
+                        ata_port_freeze(ap);
+                        ++handled;
+                        continue;
+                }
+
+                /* check for a packet interrupt */
                 tmp = mask & (1 << (i + 1));
                 if (tmp && ap &&
                     !(ap->flags & ATA_FLAG_DISABLED)) {
@@ -902,9 +933,9 @@ static void pdc_host_init(struct ata_host *host)
         tmp = readl(mmio + hotplug_offset);
         writel(tmp | 0xff, mmio + hotplug_offset);
 
-        /* mask plug/unplug ints */
+        /* unmask plug/unplug ints */
         tmp = readl(mmio + hotplug_offset);
-        writel(tmp | 0xff0000, mmio + hotplug_offset);
+        writel(tmp & ~0xff0000, mmio + hotplug_offset);
 
         /* don't initialise TBG or SLEW on 2nd generation chips */
         if (is_gen2)
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index fd80bcf1b236..33716b00c6b7 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -334,7 +334,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 break;
         }
 
-        rc = ata_pci_prepare_native_host(pdev, ppi, &host);
+        rc = ata_pci_prepare_sff_host(pdev, ppi, &host);
         if (rc)
                 return rc;
 
diff --git a/drivers/ata/sata_uli.c b/drivers/ata/sata_uli.c
index aca71819f6e8..b52f83ab056a 100644
--- a/drivers/ata/sata_uli.c
+++ b/drivers/ata/sata_uli.c
@@ -213,7 +213,7 @@ static int uli_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         host->private_data = hpriv;
 
         /* the first two ports are standard SFF */
-        rc = ata_pci_init_native_host(host);
+        rc = ata_pci_init_sff_host(host);
         if (rc)
                 return rc;
 
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index a4c0832033d8..c4124475f754 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -412,7 +412,7 @@ static int vt6420_prepare_host(struct pci_dev *pdev, struct ata_host **r_host)
         struct ata_host *host;
         int rc;
 
-        rc = ata_pci_prepare_native_host(pdev, ppi, &host);
+        rc = ata_pci_prepare_sff_host(pdev, ppi, &host);
         if (rc)
                 return rc;
         *r_host = host;
diff --git a/drivers/base/attribute_container.c b/drivers/base/attribute_container.c
index 1ec0654665cf..7370d7cf5988 100644
--- a/drivers/base/attribute_container.c
+++ b/drivers/base/attribute_container.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 
 #include "base.h"
 
diff --git a/drivers/base/base.h b/drivers/base/base.h
index 5512d84452f2..47eb02d9f1af 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -44,6 +44,6 @@ struct class_device_attribute *to_class_dev_attr(struct attribute *_attr)
 
 extern char *make_class_name(const char *name, struct kobject *kobj);
 
-extern void devres_release_all(struct device *dev);
+extern int devres_release_all(struct device *dev);
 
 extern struct kset devices_subsys;
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index dca734819e50..61c67526a656 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -138,12 +138,24 @@ void bus_remove_file(struct bus_type * bus, struct bus_attribute * attr)
         }
 }
 
-static struct kobj_type ktype_bus = {
+static struct kobj_type bus_ktype = {
         .sysfs_ops      = &bus_sysfs_ops,
+};
+
+static int bus_uevent_filter(struct kset *kset, struct kobject *kobj)
+{
+        struct kobj_type *ktype = get_ktype(kobj);
 
+        if (ktype == &bus_ktype)
+                return 1;
+        return 0;
+}
+
+static struct kset_uevent_ops bus_uevent_ops = {
+        .filter = bus_uevent_filter,
 };
 
-static decl_subsys(bus, &ktype_bus, NULL);
+static decl_subsys(bus, &bus_ktype, &bus_uevent_ops);
 
 
 #ifdef CONFIG_HOTPLUG
@@ -562,7 +574,6 @@ static int add_probe_files(struct bus_type *bus)
 
         bus->drivers_probe_attr.attr.name = "drivers_probe";
         bus->drivers_probe_attr.attr.mode = S_IWUSR;
-        bus->drivers_probe_attr.attr.owner = bus->owner;
         bus->drivers_probe_attr.store = store_drivers_probe;
         retval = bus_create_file(bus, &bus->drivers_probe_attr);
         if (retval)
@@ -570,7 +581,6 @@ static int add_probe_files(struct bus_type *bus)
 
         bus->drivers_autoprobe_attr.attr.name = "drivers_autoprobe";
         bus->drivers_autoprobe_attr.attr.mode = S_IWUSR | S_IRUGO;
-        bus->drivers_autoprobe_attr.attr.owner = bus->owner;
         bus->drivers_autoprobe_attr.show = show_drivers_autoprobe;
         bus->drivers_autoprobe_attr.store = store_drivers_autoprobe;
         retval = bus_create_file(bus, &bus->drivers_autoprobe_attr);
@@ -610,7 +620,8 @@ int bus_add_driver(struct device_driver *drv)
         if (error)
                 goto out_put_bus;
         drv->kobj.kset = &bus->drivers;
-        if ((error = kobject_register(&drv->kobj)))
+        error = kobject_register(&drv->kobj);
+        if (error)
                 goto out_put_bus;
 
         if (drv->bus->drivers_autoprobe) {
@@ -760,7 +771,8 @@ static int bus_add_attrs(struct bus_type * bus)
 
         if (bus->bus_attrs) {
                 for (i = 0; attr_name(bus->bus_attrs[i]); i++) {
-                        if ((error = bus_create_file(bus,&bus->bus_attrs[i])))
+                        error = bus_create_file(bus,&bus->bus_attrs[i]);
+                        if (error)
                                 goto Err;
                 }
         }
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 8c506dbe3913..4d2222618b78 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -312,9 +312,6 @@ static void class_dev_release(struct kobject * kobj)
 
         pr_debug("device class '%s': release.\n", cd->class_id);
 
-        kfree(cd->devt_attr);
-        cd->devt_attr = NULL;
-
         if (cd->release)
                 cd->release(cd);
         else if (cls->release)
@@ -547,6 +544,9 @@ static ssize_t show_dev(struct class_device *class_dev, char *buf)
         return print_dev_t(buf, class_dev->devt);
 }
 
+static struct class_device_attribute class_devt_attr =
+        __ATTR(dev, S_IRUGO, show_dev, NULL);
+
 static ssize_t store_uevent(struct class_device *class_dev,
                             const char *buf, size_t count)
 {
@@ -554,6 +554,9 @@ static ssize_t store_uevent(struct class_device *class_dev,
         return count;
 }
 
+static struct class_device_attribute class_uevent_attr =
+        __ATTR(uevent, S_IWUSR, NULL, store_uevent);
+
 void class_device_initialize(struct class_device *class_dev)
 {
         kobj_set_kset_s(class_dev, class_obj_subsys);
@@ -603,32 +606,15 @@ int class_device_add(struct class_device *class_dev)
                                   &parent_class->subsys.kobj, "subsystem");
         if (error)
                 goto out3;
-        class_dev->uevent_attr.attr.name = "uevent";
-        class_dev->uevent_attr.attr.mode = S_IWUSR;
-        class_dev->uevent_attr.attr.owner = parent_class->owner;
-        class_dev->uevent_attr.store = store_uevent;
-        error = class_device_create_file(class_dev, &class_dev->uevent_attr);
+
+        error = class_device_create_file(class_dev, &class_uevent_attr);
         if (error)
                 goto out3;
 
         if (MAJOR(class_dev->devt)) {
-                struct class_device_attribute *attr;
-                attr = kzalloc(sizeof(*attr), GFP_KERNEL);
-                if (!attr) {
-                        error = -ENOMEM;
-                        goto out4;
-                }
-                attr->attr.name = "dev";
-                attr->attr.mode = S_IRUGO;
-                attr->attr.owner = parent_class->owner;
-                attr->show = show_dev;
-                error = class_device_create_file(class_dev, attr);
-                if (error) {
-                        kfree(attr);
+                error = class_device_create_file(class_dev, &class_devt_attr);
+                if (error)
                         goto out4;
-                }
-
-                class_dev->devt_attr = attr;
         }
 
         error = class_device_add_attrs(class_dev);
@@ -671,10 +657,10 @@ int class_device_add(struct class_device *class_dev)
  out6:
         class_device_remove_attrs(class_dev);
  out5:
-        if (class_dev->devt_attr)
-                class_device_remove_file(class_dev, class_dev->devt_attr);
+        if (MAJOR(class_dev->devt))
+                class_device_remove_file(class_dev, &class_devt_attr);
  out4:
-        class_device_remove_file(class_dev, &class_dev->uevent_attr);
+        class_device_remove_file(class_dev, &class_uevent_attr);
  out3:
         kobject_del(&class_dev->kobj);
  out2:
@@ -774,9 +760,9 @@ void class_device_del(struct class_device *class_dev)
                 sysfs_remove_link(&class_dev->kobj, "device");
         }
         sysfs_remove_link(&class_dev->kobj, "subsystem");
-        class_device_remove_file(class_dev, &class_dev->uevent_attr);
-        if (class_dev->devt_attr)
-                class_device_remove_file(class_dev, class_dev->devt_attr);
+        class_device_remove_file(class_dev, &class_uevent_attr);
+        if (MAJOR(class_dev->devt))
+                class_device_remove_file(class_dev, &class_devt_attr);
         class_device_remove_attrs(class_dev);
         class_device_remove_groups(class_dev);
 
diff --git a/drivers/base/core.c b/drivers/base/core.c
index dd40d78a023d..0455aa78fa13 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -310,6 +310,9 @@ static ssize_t store_uevent(struct device *dev, struct device_attribute *attr,
         return count;
 }
 
+static struct device_attribute uevent_attr =
+        __ATTR(uevent, S_IRUGO | S_IWUSR, show_uevent, store_uevent);
+
 static int device_add_attributes(struct device *dev,
                                  struct device_attribute *attrs)
 {
@@ -423,6 +426,9 @@ static ssize_t show_dev(struct device *dev, struct device_attribute *attr,
         return print_dev_t(buf, dev->devt);
 }
 
+static struct device_attribute devt_attr =
+        __ATTR(dev, S_IRUGO, show_dev, NULL);
+
 /*
  *      devices_subsys - structure to be registered with kobject core.
  */
@@ -681,35 +687,14 @@ int device_add(struct device *dev)
                 blocking_notifier_call_chain(&dev->bus->bus_notifier,
                                              BUS_NOTIFY_ADD_DEVICE, dev);
 
-        dev->uevent_attr.attr.name = "uevent";
-        dev->uevent_attr.attr.mode = S_IRUGO | S_IWUSR;
-        if (dev->driver)
-                dev->uevent_attr.attr.owner = dev->driver->owner;
-        dev->uevent_attr.store = store_uevent;
-        dev->uevent_attr.show = show_uevent;
-        error = device_create_file(dev, &dev->uevent_attr);
+        error = device_create_file(dev, &uevent_attr);
         if (error)
                 goto attrError;
 
         if (MAJOR(dev->devt)) {
-                struct device_attribute *attr;
-                attr = kzalloc(sizeof(*attr), GFP_KERNEL);
-                if (!attr) {
-                        error = -ENOMEM;
-                        goto ueventattrError;
-                }
-                attr->attr.name = "dev";
-                attr->attr.mode = S_IRUGO;
-                if (dev->driver)
-                        attr->attr.owner = dev->driver->owner;
-                attr->show = show_dev;
-                error = device_create_file(dev, attr);
-                if (error) {
-                        kfree(attr);
+                error = device_create_file(dev, &devt_attr);
+                if (error)
                         goto ueventattrError;
-                }
-
-                dev->devt_attr = attr;
         }
 
         if (dev->class) {
@@ -733,11 +718,14 @@ int device_add(struct device *dev)
                 }
         }
 
-        if ((error = device_add_attrs(dev)))
+        error = device_add_attrs(dev);
+        if (error)
                 goto AttrsError;
-        if ((error = device_pm_add(dev)))
+        error = device_pm_add(dev);
+        if (error)
                 goto PMError;
-        if ((error = bus_add_device(dev)))
+        error = bus_add_device(dev);
+        if (error)
                 goto BusError;
         kobject_uevent(&dev->kobj, KOBJ_ADD);
         bus_attach_device(dev);
@@ -767,10 +755,8 @@ int device_add(struct device *dev)
                                              BUS_NOTIFY_DEL_DEVICE, dev);
         device_remove_attrs(dev);
  AttrsError:
-        if (dev->devt_attr) {
-                device_remove_file(dev, dev->devt_attr);
-                kfree(dev->devt_attr);
-        }
+        if (MAJOR(dev->devt))
+                device_remove_file(dev, &devt_attr);
 
         if (dev->class) {
                 sysfs_remove_link(&dev->kobj, "subsystem");
@@ -792,7 +778,7 @@ int device_add(struct device *dev)
                 }
         }
  ueventattrError:
-        device_remove_file(dev, &dev->uevent_attr);
+        device_remove_file(dev, &uevent_attr);
  attrError:
         kobject_uevent(&dev->kobj, KOBJ_REMOVE);
         kobject_del(&dev->kobj);
@@ -869,10 +855,8 @@ void device_del(struct device * dev)
 
         if (parent)
                 klist_del(&dev->knode_parent);
-        if (dev->devt_attr) {
-                device_remove_file(dev, dev->devt_attr);
-                kfree(dev->devt_attr);
-        }
+        if (MAJOR(dev->devt))
+                device_remove_file(dev, &devt_attr);
         if (dev->class) {
                 sysfs_remove_link(&dev->kobj, "subsystem");
                 /* If this is not a "fake" compatible device, remove the
@@ -926,7 +910,7 @@ void device_del(struct device * dev)
                         up(&dev->class->sem);
                 }
         }
-        device_remove_file(dev, &dev->uevent_attr);
+        device_remove_file(dev, &uevent_attr);
         device_remove_attrs(dev);
         bus_remove_device(dev);
 
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index b0088b0efecd..7ac474db88c5 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -281,24 +281,16 @@ int driver_attach(struct device_driver * drv)
         return bus_for_each_dev(drv->bus, NULL, drv, __driver_attach);
 }
 
-/**
- *      device_release_driver - manually detach device from driver.
- *      @dev:   device.
- *
- *      Manually detach device from driver.
- *
+/*
  *      __device_release_driver() must be called with @dev->sem held.
- *      When called for a USB interface, @dev->parent->sem must be held
- *      as well.
+ *      When called for a USB interface, @dev->parent->sem must be held as well.
  */
-
 static void __device_release_driver(struct device * dev)
 {
         struct device_driver * drv;
 
-        drv = dev->driver;
+        drv = get_driver(dev->driver);
         if (drv) {
-                get_driver(drv);
                 driver_sysfs_remove(dev);
                 sysfs_remove_link(&dev->kobj, "driver");
                 klist_remove(&dev->knode_driver);
@@ -318,6 +310,13 @@ static void __device_release_driver(struct device * dev)
         }
 }
 
+/**
+ *      device_release_driver - manually detach device from driver.
+ *      @dev:   device.
+ *
+ *      Manually detach device from driver.
+ *      When called for a USB interface, @dev->parent->sem must be held.
+ */
 void device_release_driver(struct device * dev)
 {
         /*
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index e1c0730a3b99..e8beb8e5b626 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -10,6 +10,8 @@
 #include <linux/device.h>
 #include <linux/module.h>
 
+#include "base.h"
+
 struct devres_node {
         struct list_head                entry;
         dr_release_t                    release;
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 89a5f4a54913..53f0ee6f3016 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -175,7 +175,7 @@ static ssize_t firmware_loading_store(struct device *dev,
 static DEVICE_ATTR(loading, 0644, firmware_loading_show, firmware_loading_store);
 
 static ssize_t
-firmware_data_read(struct kobject *kobj,
+firmware_data_read(struct kobject *kobj, struct bin_attribute *bin_attr,
                    char *buffer, loff_t offset, size_t count)
 {
         struct device *dev = to_dev(kobj);
@@ -240,7 +240,7 @@ fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
  *      the driver as a firmware image.
  **/
 static ssize_t
-firmware_data_write(struct kobject *kobj,
+firmware_data_write(struct kobject *kobj, struct bin_attribute *bin_attr,
                     char *buffer, loff_t offset, size_t count)
 {
         struct device *dev = to_dev(kobj);
@@ -271,7 +271,7 @@ out:
 }
 
 static struct bin_attribute firmware_attr_data_tmpl = {
-        .attr = {.name = "data", .mode = 0644, .owner = THIS_MODULE},
+        .attr = {.name = "data", .mode = 0644},
         .size = 0,
         .read = firmware_data_read,
         .write = firmware_data_write,
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 05dc8764e765..eb9f38d0aa58 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -20,64 +20,44 @@
  */
 
 #include <linux/device.h>
+#include <linux/mutex.h>
+
 #include "power.h"
 
 LIST_HEAD(dpm_active);
 LIST_HEAD(dpm_off);
 LIST_HEAD(dpm_off_irq);
 
-DECLARE_MUTEX(dpm_sem);
-DECLARE_MUTEX(dpm_list_sem);
+DEFINE_MUTEX(dpm_mtx);
+DEFINE_MUTEX(dpm_list_mtx);
 
 int (*platform_enable_wakeup)(struct device *dev, int is_on);
 
-
-/**
- *      device_pm_set_parent - Specify power dependency.
- *      @dev:           Device who needs power.
- *      @parent:        Device that supplies power.
- *
- *      This function is used to manually describe a power-dependency
- *      relationship. It may be used to specify a transversal relationship
- *      (where the power supplier is not the physical (or electrical)
- *      ancestor of a specific device.
- *      The effect of this is that the supplier will not be powered down
- *      before the power dependent.
- */
-
-void device_pm_set_parent(struct device * dev, struct device * parent)
-{
-        put_device(dev->power.pm_parent);
-        dev->power.pm_parent = get_device(parent);
-}
-EXPORT_SYMBOL_GPL(device_pm_set_parent);
-
-int device_pm_add(struct device * dev)
+int device_pm_add(struct device *dev)
 {
         int error;
 
         pr_debug("PM: Adding info for %s:%s\n",
                  dev->bus ? dev->bus->name : "No Bus",
                  kobject_name(&dev->kobj));
-        down(&dpm_list_sem);
+        mutex_lock(&dpm_list_mtx);
         list_add_tail(&dev->power.entry, &dpm_active);
-        device_pm_set_parent(dev, dev->parent);
-        if ((error = dpm_sysfs_add(dev)))
+        error = dpm_sysfs_add(dev);
+        if (error)
                 list_del(&dev->power.entry);
-        up(&dpm_list_sem);
+        mutex_unlock(&dpm_list_mtx);
         return error;
 }
 
-void device_pm_remove(struct device * dev)
+void device_pm_remove(struct device *dev)
 {
         pr_debug("PM: Removing info for %s:%s\n",
                  dev->bus ? dev->bus->name : "No Bus",
                  kobject_name(&dev->kobj));
-        down(&dpm_list_sem);
+        mutex_lock(&dpm_list_mtx);
         dpm_sysfs_remove(dev);
-        put_device(dev->power.pm_parent);
         list_del_init(&dev->power.entry);
-        up(&dpm_list_sem);
+        mutex_unlock(&dpm_list_mtx);
 }
 
 
diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
index fb3d35a9e101..2760f25b3ac5 100644
--- a/drivers/base/power/power.h
+++ b/drivers/base/power/power.h
@@ -14,12 +14,12 @@ extern void device_shutdown(void);
 /*
  * Used to synchronize global power management operations.
  */
-extern struct semaphore dpm_sem;
+extern struct mutex dpm_mtx;
 
 /*
  * Used to serialize changes to the dpm_* lists.
  */
-extern struct semaphore dpm_list_sem;
+extern struct mutex dpm_list_mtx;
 
 /*
  * The PM lists.
diff --git a/drivers/base/power/resume.c b/drivers/base/power/resume.c
index a2c64188d713..00fd84ae6e66 100644
--- a/drivers/base/power/resume.c
+++ b/drivers/base/power/resume.c
@@ -29,14 +29,6 @@ int resume_device(struct device * dev)
 
         down(&dev->sem);
 
-        if (dev->power.pm_parent
-                        && dev->power.pm_parent->power.power_state.event) {
-                dev_err(dev, "PM: resume from %d, parent %s still %d\n",
-                        dev->power.power_state.event,
-                        dev->power.pm_parent->bus_id,
-                        dev->power.pm_parent->power.power_state.event);
-        }
-
         if (dev->bus && dev->bus->resume) {
                 dev_dbg(dev,"resuming\n");
                 error = dev->bus->resume(dev);
@@ -80,7 +72,7 @@ static int resume_device_early(struct device * dev)
  */
 void dpm_resume(void)
 {
-        down(&dpm_list_sem);
+        mutex_lock(&dpm_list_mtx);
         while(!list_empty(&dpm_off)) {
                 struct list_head * entry = dpm_off.next;
                 struct device * dev = to_device(entry);
@@ -88,13 +80,12 @@ void dpm_resume(void)
                 get_device(dev);
                 list_move_tail(entry, &dpm_active);
 
-                up(&dpm_list_sem);
-                if (!dev->power.prev_state.event)
-                        resume_device(dev);
-                down(&dpm_list_sem);
+                mutex_unlock(&dpm_list_mtx);
+                resume_device(dev);
+                mutex_lock(&dpm_list_mtx);
                 put_device(dev);
         }
-        up(&dpm_list_sem);
+        mutex_unlock(&dpm_list_mtx);
 }
 
 
@@ -108,9 +99,9 @@ void dpm_resume(void)
 void device_resume(void)
 {
         might_sleep();
-        down(&dpm_sem);
+        mutex_lock(&dpm_mtx);
         dpm_resume();
-        up(&dpm_sem);
+        mutex_unlock(&dpm_mtx);
 }
 
 EXPORT_SYMBOL_GPL(device_resume);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 96370ec1d673..df6174d85866 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -32,9 +32,9 @@ static void runtime_resume(struct device * dev)
 
 void dpm_runtime_resume(struct device * dev)
 {
-        down(&dpm_sem);
+        mutex_lock(&dpm_mtx);
         runtime_resume(dev);
-        up(&dpm_sem);
+        mutex_unlock(&dpm_mtx);
 }
 EXPORT_SYMBOL(dpm_runtime_resume);
 
@@ -49,7 +49,7 @@ int dpm_runtime_suspend(struct device * dev, pm_message_t state)
 {
         int error = 0;
 
-        down(&dpm_sem);
+        mutex_lock(&dpm_mtx);
         if (dev->power.power_state.event == state.event)
                 goto Done;
 
@@ -59,7 +59,7 @@ int dpm_runtime_suspend(struct device * dev, pm_message_t state)
         if (!(error = suspend_device(dev, state)))
                 dev->power.power_state = state;
  Done:
-        up(&dpm_sem);
+        mutex_unlock(&dpm_mtx);
         return error;
 }
 EXPORT_SYMBOL(dpm_runtime_suspend);
@@ -78,8 +78,8 @@ EXPORT_SYMBOL(dpm_runtime_suspend);
  */
 void dpm_set_power_state(struct device * dev, pm_message_t state)
 {
-        down(&dpm_sem);
+        mutex_lock(&dpm_mtx);
         dev->power.power_state = state;
-        up(&dpm_sem);
+        mutex_unlock(&dpm_mtx);
 }
 #endif  /*  0  */
diff --git a/drivers/base/power/suspend.c b/drivers/base/power/suspend.c
index 42d2b86ba765..26df9b231737 100644
--- a/drivers/base/power/suspend.c
+++ b/drivers/base/power/suspend.c
@@ -40,6 +40,14 @@ static inline char *suspend_verb(u32 event)
 }
 
 
+static void
+suspend_device_dbg(struct device *dev, pm_message_t state, char *info)
+{
+        dev_dbg(dev, "%s%s%s\n", info, suspend_verb(state.event),
+                ((state.event == PM_EVENT_SUSPEND) && device_may_wakeup(dev)) ?
+                ", may wakeup" : "");
+}
+
 /**
  *      suspend_device - Save state of one device.
  *      @dev:   Device.
@@ -55,49 +63,21 @@ int suspend_device(struct device * dev, pm_message_t state)
                 dev_dbg(dev, "PM: suspend %d-->%d\n",
                         dev->power.power_state.event, state.event);
         }
-        if (dev->power.pm_parent
-                        && dev->power.pm_parent->power.power_state.event) {
-                dev_err(dev,
-                        "PM: suspend %d->%d, parent %s already %d\n",
-                        dev->power.power_state.event, state.event,
-                        dev->power.pm_parent->bus_id,
-                        dev->power.pm_parent->power.power_state.event);
-        }
-
-        dev->power.prev_state = dev->power.power_state;
 
-        if (dev->class && dev->class->suspend && !dev->power.power_state.event) {
-                dev_dbg(dev, "class %s%s\n",
-                        suspend_verb(state.event),
-                        ((state.event == PM_EVENT_SUSPEND)
-                                        && device_may_wakeup(dev))
-                                ? ", may wakeup"
-                                : ""
-                        );
+        if (dev->class && dev->class->suspend) {
+                suspend_device_dbg(dev, state, "class ");
                 error = dev->class->suspend(dev, state);
                 suspend_report_result(dev->class->suspend, error);
         }
 
-        if (!error && dev->type && dev->type->suspend && !dev->power.power_state.event) {
-                dev_dbg(dev, "%s%s\n",
-                        suspend_verb(state.event),
-                        ((state.event == PM_EVENT_SUSPEND)
-                                        && device_may_wakeup(dev))
-                                ? ", may wakeup"
-                                : ""
-                        );
+        if (!error && dev->type && dev->type->suspend) {
+                suspend_device_dbg(dev, state, "type ");
                 error = dev->type->suspend(dev, state);
                 suspend_report_result(dev->type->suspend, error);
         }
 
-        if (!error && dev->bus && dev->bus->suspend && !dev->power.power_state.event) {
-                dev_dbg(dev, "%s%s\n",
-                        suspend_verb(state.event),
-                        ((state.event == PM_EVENT_SUSPEND)
-                                        && device_may_wakeup(dev))
-                                ? ", may wakeup"
-                                : ""
-                        );
+        if (!error && dev->bus && dev->bus->suspend) {
+                suspend_device_dbg(dev, state, "");
                 error = dev->bus->suspend(dev, state);
                 suspend_report_result(dev->bus->suspend, error);
         }
@@ -108,21 +88,15 @@ int suspend_device(struct device * dev, pm_message_t state)
 
 /*
  * This is called with interrupts off, only a single CPU
- * running. We can't do down() on a semaphore (and we don't
+ * running. We can't acquire a mutex or semaphore (and we don't
  * need the protection)
  */
 static int suspend_device_late(struct device *dev, pm_message_t state)
 {
         int error = 0;
 
-        if (dev->bus && dev->bus->suspend_late && !dev->power.power_state.event) {
-                dev_dbg(dev, "LATE %s%s\n",
-                        suspend_verb(state.event),
-                        ((state.event == PM_EVENT_SUSPEND)
-                                        && device_may_wakeup(dev))
-                                ? ", may wakeup"
-                                : ""
-                        );
+        if (dev->bus && dev->bus->suspend_late) {
+                suspend_device_dbg(dev, state, "LATE ");
                 error = dev->bus->suspend_late(dev, state);
                 suspend_report_result(dev->bus->suspend_late, error);
         }
@@ -153,18 +127,18 @@ int device_suspend(pm_message_t state)
         int error = 0;
 
         might_sleep();
-        down(&dpm_sem);
-        down(&dpm_list_sem);
+        mutex_lock(&dpm_mtx);
+        mutex_lock(&dpm_list_mtx);
         while (!list_empty(&dpm_active) && error == 0) {
                 struct list_head * entry = dpm_active.prev;
                 struct device * dev = to_device(entry);
 
                 get_device(dev);
-                up(&dpm_list_sem);
+                mutex_unlock(&dpm_list_mtx);
 
                 error = suspend_device(dev, state);
 
-                down(&dpm_list_sem);
+                mutex_lock(&dpm_list_mtx);
 
                 /* Check if the device got removed */
                 if (!list_empty(&dev->power.entry)) {
@@ -179,11 +153,11 @@ int device_suspend(pm_message_t state)
                                 error == -EAGAIN ? " (please convert to suspend_late)" : "");
                 put_device(dev);
         }
-        up(&dpm_list_sem);
+        mutex_unlock(&dpm_list_mtx);
         if (error)
                 dpm_resume();
 
-        up(&dpm_sem);
+        mutex_unlock(&dpm_mtx);
         return error;
 }
 
diff --git a/drivers/base/sys.c b/drivers/base/sys.c
index 29f1291966c1..18febe26caa1 100644
--- a/drivers/base/sys.c
+++ b/drivers/base/sys.c
@@ -21,7 +21,7 @@
 #include <linux/string.h>
 #include <linux/pm.h>
 #include <linux/device.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 #include "base.h"
 
@@ -155,7 +155,7 @@ EXPORT_SYMBOL_GPL(sysdev_class_unregister);
 
 
 static LIST_HEAD(sysdev_drivers);
-static DECLARE_MUTEX(sysdev_drivers_lock);
+static DEFINE_MUTEX(sysdev_drivers_lock);
 
 /**
  *      sysdev_driver_register - Register auxillary driver
@@ -172,7 +172,7 @@ static DECLARE_MUTEX(sysdev_drivers_lock);
 int sysdev_driver_register(struct sysdev_class * cls,
                            struct sysdev_driver * drv)
 {
-        down(&sysdev_drivers_lock);
+        mutex_lock(&sysdev_drivers_lock);
         if (cls && kset_get(&cls->kset)) {
                 list_add_tail(&drv->entry, &cls->drivers);
 
@@ -184,7 +184,7 @@ int sysdev_driver_register(struct sysdev_class * cls,
                 }
         } else
                 list_add_tail(&drv->entry, &sysdev_drivers);
-        up(&sysdev_drivers_lock);
+        mutex_unlock(&sysdev_drivers_lock);
         return 0;
 }
 
@@ -197,7 +197,7 @@ int sysdev_driver_register(struct sysdev_class * cls,
 void sysdev_driver_unregister(struct sysdev_class * cls,
                               struct sysdev_driver * drv)
 {
-        down(&sysdev_drivers_lock);
+        mutex_lock(&sysdev_drivers_lock);
         list_del_init(&drv->entry);
         if (cls) {
                 if (drv->remove) {
@@ -207,7 +207,7 @@ void sysdev_driver_unregister(struct sysdev_class * cls,
                 }
                 kset_put(&cls->kset);
         }
-        up(&sysdev_drivers_lock);
+        mutex_unlock(&sysdev_drivers_lock);
 }
 
 EXPORT_SYMBOL_GPL(sysdev_driver_register);
@@ -246,7 +246,7 @@ int sysdev_register(struct sys_device * sysdev)
         if (!error) {
                 struct sysdev_driver * drv;
 
-                down(&sysdev_drivers_lock);
+                mutex_lock(&sysdev_drivers_lock);
                 /* Generic notification is implicit, because it's that
                  * code that should have called us.
                  */
@@ -262,7 +262,7 @@ int sysdev_register(struct sys_device * sysdev)
                         if (drv->add)
                                 drv->add(sysdev);
                 }
-                up(&sysdev_drivers_lock);
+                mutex_unlock(&sysdev_drivers_lock);
         }
         return error;
 }
@@ -271,7 +271,7 @@ void sysdev_unregister(struct sys_device * sysdev)
 {
         struct sysdev_driver * drv;
 
-        down(&sysdev_drivers_lock);
+        mutex_lock(&sysdev_drivers_lock);
         list_for_each_entry(drv, &sysdev_drivers, entry) {
                 if (drv->remove)
                         drv->remove(sysdev);
@@ -281,7 +281,7 @@ void sysdev_unregister(struct sys_device * sysdev)
                 if (drv->remove)
                         drv->remove(sysdev);
         }
-        up(&sysdev_drivers_lock);
+        mutex_unlock(&sysdev_drivers_lock);
 
         kobject_unregister(&sysdev->kobj);
 }
@@ -308,7 +308,7 @@ void sysdev_shutdown(void)
 
         pr_debug("Shutting Down System Devices\n");
 
-        down(&sysdev_drivers_lock);
+        mutex_lock(&sysdev_drivers_lock);
         list_for_each_entry_reverse(cls, &system_subsys.list,
                                     kset.kobj.entry) {
                 struct sys_device * sysdev;
@@ -337,7 +337,7 @@ void sysdev_shutdown(void)
                                 cls->shutdown(sysdev);
                 }
         }
-        up(&sysdev_drivers_lock);
+        mutex_unlock(&sysdev_drivers_lock);
 }
 
 static void __sysdev_resume(struct sys_device *dev)
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index f1b9dd7d47d6..ce64e86d6ffb 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -146,8 +146,7 @@ static void pkt_kobj_release(struct kobject *kobj)
  **********************************************************/
 
 #define DEF_ATTR(_obj,_name,_mode) \
-        static struct attribute _obj = { \
-                .name = _name, .owner = THIS_MODULE, .mode = _mode }
+        static struct attribute _obj = { .name = _name, .mode = _mode }
 
 /**********************************************************
   /sys/class/pktcdvd/pktcdvd[0-7]/
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 7e04dd69f609..59b054810ed0 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -199,7 +199,6 @@ static void hci_usb_tx_complete(struct urb *urb);
 #define __pending_q(husb, type)   (&husb->pending_q[type-1])
 #define __completed_q(husb, type) (&husb->completed_q[type-1])
 #define __transmit_q(husb, type)  (&husb->transmit_q[type-1])
-#define __reassembly(husb, type)  (husb->reassembly[type-1])
 
 static inline struct _urb *__get_completed(struct hci_usb *husb, int type)
 {
@@ -429,12 +428,6 @@ static void hci_usb_unlink_urbs(struct hci_usb *husb)
                         kfree(urb->transfer_buffer);
                         _urb_free(_urb);
                 }
-
-                /* Release reassembly buffers */
-                if (husb->reassembly[i]) {
-                        kfree_skb(husb->reassembly[i]);
-                        husb->reassembly[i] = NULL;
-                }
         }
 }
 
@@ -671,83 +664,6 @@ static int hci_usb_send_frame(struct sk_buff *skb)
         return 0;
 }
 
-static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int count)
-{
-        BT_DBG("%s type %d data %p count %d", husb->hdev->name, type, data, count);
-
-        husb->hdev->stat.byte_rx += count;
-
-        while (count) {
-                struct sk_buff *skb = __reassembly(husb, type);
-                struct { int expect; } *scb;
-                int len = 0;
-        
-                if (!skb) {
-                        /* Start of the frame */
-
-                        switch (type) {
-                        case HCI_EVENT_PKT:
-                                if (count >= HCI_EVENT_HDR_SIZE) {
-                                        struct hci_event_hdr *h = data;
-                                        len = HCI_EVENT_HDR_SIZE + h->plen;
-                                } else
-                                        return -EILSEQ;
-                                break;
-
-                        case HCI_ACLDATA_PKT:
-                                if (count >= HCI_ACL_HDR_SIZE) {
-                                        struct hci_acl_hdr *h = data;
-                                        len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
-                                } else
-                                        return -EILSEQ;
-                                break;
-#ifdef CONFIG_BT_HCIUSB_SCO
-                        case HCI_SCODATA_PKT:
-                                if (count >= HCI_SCO_HDR_SIZE) {
-                                        struct hci_sco_hdr *h = data;
-                                        len = HCI_SCO_HDR_SIZE + h->dlen;
-                                } else
-                                        return -EILSEQ;
-                                break;
-#endif
-                        }
-                        BT_DBG("new packet len %d", len);
-
-                        skb = bt_skb_alloc(len, GFP_ATOMIC);
-                        if (!skb) {
-                                BT_ERR("%s no memory for the packet", husb->hdev->name);
-                                return -ENOMEM;
-                        }
-                        skb->dev = (void *) husb->hdev;
-                        bt_cb(skb)->pkt_type = type;
-        
-                        __reassembly(husb, type) = skb;
-
-                        scb = (void *) skb->cb;
-                        scb->expect = len;
-                } else {
-                        /* Continuation */
-                        scb = (void *) skb->cb;
-                        len = scb->expect;
-                }
-
-                len = min(len, count);
-                
-                memcpy(skb_put(skb, len), data, len);
-
-                scb->expect -= len;
-                if (!scb->expect) {
-                        /* Complete frame */
-                        __reassembly(husb, type) = NULL;
-                        bt_cb(skb)->pkt_type = type;
-                        hci_recv_frame(skb);
-                }
-
-                count -= len; data += len;
-        }
-        return 0;
-}
-
 static void hci_usb_rx_complete(struct urb *urb)
 {
         struct _urb *_urb = container_of(urb, struct _urb, urb);
@@ -776,7 +692,7 @@ static void hci_usb_rx_complete(struct urb *urb)
                                         urb->iso_frame_desc[i].actual_length);
         
                         if (!urb->iso_frame_desc[i].status)
-                                __recv_frame(husb, _urb->type, 
+                                hci_recv_fragment(husb->hdev, _urb->type, 
                                         urb->transfer_buffer + urb->iso_frame_desc[i].offset,
                                         urb->iso_frame_desc[i].actual_length);
                 }
@@ -784,7 +700,7 @@ static void hci_usb_rx_complete(struct urb *urb)
                 ;
 #endif
         } else {
-                err = __recv_frame(husb, _urb->type, urb->transfer_buffer, count);
+                err = hci_recv_fragment(husb->hdev, _urb->type, urb->transfer_buffer, count);
                 if (err < 0) { 
                         BT_ERR("%s corrupted packet: type %d count %d",
                                         husb->hdev->name, _urb->type, count);
diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h
index 963fc55cdc85..56cd3a92ceca 100644
--- a/drivers/bluetooth/hci_usb.h
+++ b/drivers/bluetooth/hci_usb.h
@@ -102,9 +102,9 @@ struct hci_usb {
         struct hci_dev          *hdev;
 
         unsigned long           state;
-        
+
         struct usb_device       *udev;
-        
+
         struct usb_host_endpoint        *bulk_in_ep;
         struct usb_host_endpoint        *bulk_out_ep;
         struct usb_host_endpoint        *intr_in_ep;
@@ -116,7 +116,6 @@ struct hci_usb {
         __u8                    ctrl_req;
 
         struct sk_buff_head     transmit_q[4];
-        struct sk_buff          *reassembly[4];         /* Reassembly buffers */
 
         rwlock_t                completion_lock;
 
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index b71a5ccc587f..0638730a4a19 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -180,11 +180,6 @@ static inline ssize_t vhci_put_user(struct vhci_data *data,
         return total;
 }
 
-static loff_t vhci_llseek(struct file *file, loff_t offset, int origin)
-{
-        return -ESPIPE;
-}
-
 static ssize_t vhci_read(struct file *file,
                                 char __user *buf, size_t count, loff_t *pos)
 {
@@ -334,7 +329,6 @@ static int vhci_fasync(int fd, struct file *file, int on)
 
 static const struct file_operations vhci_fops = {
         .owner          = THIS_MODULE,
-        .llseek         = vhci_llseek,
         .read           = vhci_read,
         .write          = vhci_write,
         .poll           = vhci_poll,
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index ef683ebd367c..a31c6d2c061f 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -815,7 +815,7 @@ config SGI_IP27_RTC
 
 config GEN_RTC
         tristate "Generic /dev/rtc emulation"
-        depends on RTC!=y && !IA64 && !ARM && !M32R && !SPARC && !FRV && !S390 && !SUPERH
+        depends on RTC!=y && !IA64 && !ARM && !M32R && !MIPS && !SPARC && !FRV && !S390 && !SUPERH
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 8e222f2b80cc..b5df7e61aeb2 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2171,52 +2171,42 @@ static int create_files(struct bmc_device *bmc)
         int err;
 
         bmc->device_id_attr.attr.name = "device_id";
-        bmc->device_id_attr.attr.owner = THIS_MODULE;
         bmc->device_id_attr.attr.mode = S_IRUGO;
         bmc->device_id_attr.show = device_id_show;
 
         bmc->provides_dev_sdrs_attr.attr.name = "provides_device_sdrs";
-        bmc->provides_dev_sdrs_attr.attr.owner = THIS_MODULE;
         bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
         bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
 
         bmc->revision_attr.attr.name = "revision";
-        bmc->revision_attr.attr.owner = THIS_MODULE;
         bmc->revision_attr.attr.mode = S_IRUGO;
         bmc->revision_attr.show = revision_show;
 
         bmc->firmware_rev_attr.attr.name = "firmware_revision";
-        bmc->firmware_rev_attr.attr.owner = THIS_MODULE;
         bmc->firmware_rev_attr.attr.mode = S_IRUGO;
         bmc->firmware_rev_attr.show = firmware_rev_show;
 
         bmc->version_attr.attr.name = "ipmi_version";
-        bmc->version_attr.attr.owner = THIS_MODULE;
         bmc->version_attr.attr.mode = S_IRUGO;
         bmc->version_attr.show = ipmi_version_show;
 
         bmc->add_dev_support_attr.attr.name = "additional_device_support";
-        bmc->add_dev_support_attr.attr.owner = THIS_MODULE;
         bmc->add_dev_support_attr.attr.mode = S_IRUGO;
         bmc->add_dev_support_attr.show = add_dev_support_show;
 
         bmc->manufacturer_id_attr.attr.name = "manufacturer_id";
-        bmc->manufacturer_id_attr.attr.owner = THIS_MODULE;
         bmc->manufacturer_id_attr.attr.mode = S_IRUGO;
         bmc->manufacturer_id_attr.show = manufacturer_id_show;
 
         bmc->product_id_attr.attr.name = "product_id";
-        bmc->product_id_attr.attr.owner = THIS_MODULE;
         bmc->product_id_attr.attr.mode = S_IRUGO;
         bmc->product_id_attr.show = product_id_show;
 
         bmc->guid_attr.attr.name = "guid";
-        bmc->guid_attr.attr.owner = THIS_MODULE;
         bmc->guid_attr.attr.mode = S_IRUGO;
         bmc->guid_attr.show = guid_show;
 
         bmc->aux_firmware_rev_attr.attr.name = "aux_firmware_revision";
-        bmc->aux_firmware_rev_attr.attr.owner = THIS_MODULE;
         bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
         bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
 
diff --git a/drivers/char/vr41xx_giu.c b/drivers/char/vr41xx_giu.c
index 0cea8d4907df..e5ed09192be8 100644
--- a/drivers/char/vr41xx_giu.c
+++ b/drivers/char/vr41xx_giu.c
@@ -19,18 +19,17 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include <linux/platform_device.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
 
-#include <asm/cpu.h>
 #include <asm/io.h>
 #include <asm/vr41xx/giu.h>
 #include <asm/vr41xx/irq.h>
@@ -44,18 +43,6 @@ static int major;	/* default is dynamic major device number */
 module_param(major, int, 0);
 MODULE_PARM_DESC(major, "Major device number");
 
-#define GIU_TYPE1_START         0x0b000100UL
-#define GIU_TYPE1_SIZE          0x20UL
-
-#define GIU_TYPE2_START         0x0f000140UL
-#define GIU_TYPE2_SIZE          0x20UL
-
-#define GIU_TYPE3_START         0x0f000140UL
-#define GIU_TYPE3_SIZE          0x28UL
-
-#define GIU_PULLUPDOWN_START    0x0b0002e0UL
-#define GIU_PULLUPDOWN_SIZE     0x04UL
-
 #define GIUIOSELL       0x00
 #define GIUIOSELH       0x02
 #define GIUPIODL        0x04
@@ -89,8 +76,6 @@ MODULE_PARM_DESC(major, "Major device number");
 #define GPIO_HAS_INTERRUPT_EDGE_SELECT  0x0100
 
 static spinlock_t giu_lock;
-static struct resource *giu_resource1;
-static struct resource *giu_resource2;
 static unsigned long giu_flags;
 static unsigned int giu_nr_pins;
 
@@ -234,7 +219,7 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                 giu_set(GIUINTHTSELL, mask);
                         else
                                 giu_clear(GIUINTHTSELL, mask);
-                        if (current_cpu_data.cputype == CPU_VR4133) {
+                        if (giu_flags & GPIO_HAS_INTERRUPT_EDGE_SELECT) {
                                 switch (trigger) {
                                 case IRQ_TRIGGER_EDGE_FALLING:
                                         giu_set(GIUFEDGEINHL, mask);
@@ -269,7 +254,7 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                                 giu_set(GIUINTHTSELH, mask);
                         else
                                 giu_clear(GIUINTHTSELH, mask);
-                        if (current_cpu_data.cputype == CPU_VR4133) {
+                        if (giu_flags & GPIO_HAS_INTERRUPT_EDGE_SELECT) {
                                 switch (trigger) {
                                 case IRQ_TRIGGER_EDGE_FALLING:
                                         giu_set(GIUFEDGEINHH, mask);
@@ -298,7 +283,6 @@ void vr41xx_set_irq_trigger(unsigned int pin, irq_trigger_t trigger, irq_signal_
                 giu_write(GIUINTSTATH, mask);
         }
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_set_irq_trigger);
 
 void vr41xx_set_irq_level(unsigned int pin, irq_level_t level)
@@ -321,7 +305,6 @@ void vr41xx_set_irq_level(unsigned int pin, irq_level_t level)
                 giu_write(GIUINTSTATH, mask);
         }
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_set_irq_level);
 
 gpio_data_t vr41xx_gpio_get_pin(unsigned int pin)
@@ -350,7 +333,6 @@ gpio_data_t vr41xx_gpio_get_pin(unsigned int pin)
 
         return GPIO_DATA_LOW;
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_gpio_get_pin);
 
 int vr41xx_gpio_set_pin(unsigned int pin, gpio_data_t data)
@@ -388,7 +370,6 @@ int vr41xx_gpio_set_pin(unsigned int pin, gpio_data_t data)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_gpio_set_pin);
 
 int vr41xx_gpio_set_direction(unsigned int pin, gpio_direction_t dir)
@@ -438,7 +419,6 @@ int vr41xx_gpio_set_direction(unsigned int pin, gpio_direction_t dir)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_gpio_set_direction);
 
 int vr41xx_gpio_pullupdown(unsigned int pin, gpio_pull_t pull)
@@ -477,7 +457,6 @@ int vr41xx_gpio_pullupdown(unsigned int pin, gpio_pull_t pull)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_gpio_pullupdown);
 
 static ssize_t gpio_read(struct file *file, char __user *buf, size_t len,
@@ -596,61 +575,40 @@ static const struct file_operations gpio_fops = {
 
 static int __devinit giu_probe(struct platform_device *dev)
 {
-        unsigned long start, size, flags = 0;
-        unsigned int nr_pins = 0, trigger, i, pin;
-        struct resource *res1, *res2 = NULL;
-        void *base;
+        struct resource *res;
+        unsigned int trigger, i, pin;
         struct irq_chip *chip;
-        int retval;
-
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                start = GIU_TYPE1_START;
-                size = GIU_TYPE1_SIZE;
-                flags = GPIO_HAS_PULLUPDOWN_IO;
-                nr_pins = 50;
+        int irq, retval;
+
+        switch (dev->id) {
+        case GPIO_50PINS_PULLUPDOWN:
+                giu_flags = GPIO_HAS_PULLUPDOWN_IO;
+                giu_nr_pins = 50;
                 break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-                start = GIU_TYPE2_START;
-                size = GIU_TYPE2_SIZE;
-                nr_pins = 36;
+        case GPIO_36PINS:
+                giu_nr_pins = 36;
                 break;
-        case CPU_VR4133:
-                start = GIU_TYPE3_START;
-                size = GIU_TYPE3_SIZE;
-                flags = GPIO_HAS_INTERRUPT_EDGE_SELECT;
-                nr_pins = 48;
+        case GPIO_48PINS_EDGE_SELECT:
+                giu_flags = GPIO_HAS_INTERRUPT_EDGE_SELECT;
+                giu_nr_pins = 48;
                 break;
         default:
+                printk(KERN_ERR "GIU: unknown ID %d\n", dev->id);
                 return -ENODEV;
         }
 
-        res1 = request_mem_region(start, size, "GIU");
-        if (res1 == NULL)
+        res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+        if (!res)
                 return -EBUSY;
 
-        base = ioremap(start, size);
-        if (base == NULL) {
-                release_resource(res1);
+        giu_base = ioremap(res->start, res->end - res->start + 1);
+        if (!giu_base)
                 return -ENOMEM;
-        }
-
-        if (flags & GPIO_HAS_PULLUPDOWN_IO) {
-                res2 = request_mem_region(GIU_PULLUPDOWN_START, GIU_PULLUPDOWN_SIZE, "GIU");
-                if (res2 == NULL) {
-                        iounmap(base);
-                        release_resource(res1);
-                        return -EBUSY;
-                }
-        }
 
         retval = register_chrdev(major, "GIU", &gpio_fops);
         if (retval < 0) {
-                iounmap(base);
-                release_resource(res1);
-                release_resource(res2);
+                iounmap(giu_base);
+                giu_base = NULL;
                 return retval;
         }
 
@@ -660,11 +618,6 @@ static int __devinit giu_probe(struct platform_device *dev)
         }
 
         spin_lock_init(&giu_lock);
-        giu_base = base;
-        giu_resource1 = res1;
-        giu_resource2 = res2;
-        giu_flags = flags;
-        giu_nr_pins = nr_pins;
 
         giu_write(GIUINTENL, 0);
         giu_write(GIUINTENH, 0);
@@ -685,22 +638,23 @@ static int __devinit giu_probe(struct platform_device *dev)
 
         }
 
-        return cascade_irq(GIUINT_IRQ, giu_get_irq);
+        irq = platform_get_irq(dev, 0);
+        if (irq < 0 || irq >= NR_IRQS)
+                return -EBUSY;
+
+        return cascade_irq(irq, giu_get_irq);
 }
 
 static int __devexit giu_remove(struct platform_device *dev)
 {
-        iounmap(giu_base);
-
-        release_resource(giu_resource1);
-        if (giu_flags & GPIO_HAS_PULLUPDOWN_IO)
-                release_resource(giu_resource2);
+        if (giu_base) {
+                iounmap(giu_base);
+                giu_base = NULL;
+        }
 
         return 0;
 }
 
-static struct platform_device *giu_platform_device;
-
 static struct platform_driver giu_device_driver = {
         .probe          = giu_probe,
         .remove         = __devexit_p(giu_remove),
@@ -712,30 +666,12 @@ static struct platform_driver giu_device_driver = {
 
 static int __init vr41xx_giu_init(void)
 {
-        int retval;
-
-        giu_platform_device = platform_device_alloc("GIU", -1);
-        if (!giu_platform_device)
-                return -ENOMEM;
-
-        retval = platform_device_add(giu_platform_device);
-        if (retval < 0) {
-                platform_device_put(giu_platform_device);
-                return retval;
-        }
-
-        retval = platform_driver_register(&giu_device_driver);
-        if (retval < 0)
-                platform_device_unregister(giu_platform_device);
-
-        return retval;
+        return platform_driver_register(&giu_device_driver);
 }
 
 static void __exit vr41xx_giu_exit(void)
 {
         platform_driver_unregister(&giu_device_driver);
-
-        platform_device_unregister(giu_platform_device);
 }
 
 module_init(vr41xx_giu_init);
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index d2f0cbd8b8f3..917b9bab9ccb 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -25,8 +25,7 @@ static spinlock_t cpufreq_stats_lock;
 
 #define CPUFREQ_STATDEVICE_ATTR(_name,_mode,_show) \
 static struct freq_attr _attr_##_name = {\
-        .attr = {.name = __stringify(_name), .owner = THIS_MODULE, \
-                .mode = _mode, }, \
+        .attr = {.name = __stringify(_name), .mode = _mode, }, \
         .show = _show,\
 };
 
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 860345c7799a..a648970338b0 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -120,7 +120,7 @@ store_speed (struct cpufreq_policy *policy, const char *buf, size_t count)
 
 static struct freq_attr freq_attr_scaling_setspeed =
 {
-        .attr = { .name = "scaling_setspeed", .mode = 0644, .owner = THIS_MODULE },
+        .attr = { .name = "scaling_setspeed", .mode = 0644 },
         .show = show_speed,
         .store = store_speed,
 };
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index e7490925fdcf..5409f3afb3f8 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -199,7 +199,6 @@ static ssize_t show_available_freqs (struct cpufreq_policy *policy, char *buf)
 struct freq_attr cpufreq_freq_attr_scaling_available_freqs = {
         .attr = { .name = "scaling_available_frequencies",
                   .mode = 0444,
-                  .owner=THIS_MODULE
                 },
         .show = show_available_freqs,
 };
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 88f462122a30..05f02a326f1c 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -84,4 +84,13 @@ config DCDBAS
           Say Y or M here to enable the driver for use by Dell systems
           management software such as Dell OpenManage.
 
+config DMIID
+    bool "Export DMI identification via sysfs to userspace"
+    depends on DMI
+    default y
+        help
+          Say Y here if you want to query SMBIOS/DMI system identification
+          information from userspace through /sys/class/dmi/id/ or if you want
+          DMI-based module auto-loading.
+
 endmenu
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 98e395f4bb29..8d4ebc805a50 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -7,3 +7,4 @@ obj-$(CONFIG_EFI_VARS)		+= efivars.o
 obj-$(CONFIG_EFI_PCDP)          += pcdp.o
 obj-$(CONFIG_DELL_RBU)          += dell_rbu.o
 obj-$(CONFIG_DCDBAS)            += dcdbas.o
+obj-$(CONFIG_DMIID)             += dmi-id.o
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 1865b56fb141..18cdcb3ae1ca 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -149,8 +149,9 @@ static ssize_t smi_data_buf_size_store(struct device *dev,
         return count;
 }
 
-static ssize_t smi_data_read(struct kobject *kobj, char *buf, loff_t pos,
-                             size_t count)
+static ssize_t smi_data_read(struct kobject *kobj,
+                             struct bin_attribute *bin_attr,
+                             char *buf, loff_t pos, size_t count)
 {
         size_t max_read;
         ssize_t ret;
@@ -170,8 +171,9 @@ out:
         return ret;
 }
 
-static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
-                              size_t count)
+static ssize_t smi_data_write(struct kobject *kobj,
+                              struct bin_attribute *bin_attr,
+                              char *buf, loff_t pos, size_t count)
 {
         ssize_t ret;
 
diff --git a/drivers/firmware/dcdbas.h b/drivers/firmware/dcdbas.h
index 58a85182b3e8..dcdba0f1b32c 100644
--- a/drivers/firmware/dcdbas.h
+++ b/drivers/firmware/dcdbas.h
@@ -67,8 +67,7 @@
 #define DCDBAS_BIN_ATTR_RW(_name) \
 struct bin_attribute bin_attr_##_name = { \
         .attr =  { .name = __stringify(_name), \
-                   .mode = 0600, \
-                   .owner = THIS_MODULE }, \
+                   .mode = 0600 }, \
         .read =  _name##_read, \
         .write = _name##_write, \
 }
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index fc702e40bd43..477a3d0e3caf 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -543,8 +543,9 @@ static ssize_t read_rbu_mono_data(char *buffer, loff_t pos, size_t count)
         return ret_count;
 }
 
-static ssize_t read_rbu_data(struct kobject *kobj, char *buffer,
-        loff_t pos, size_t count)
+static ssize_t read_rbu_data(struct kobject *kobj,
+                             struct bin_attribute *bin_attr,
+                             char *buffer, loff_t pos, size_t count)
 {
         ssize_t ret_count = 0;
 
@@ -591,8 +592,9 @@ static void callbackfn_rbu(const struct firmware *fw, void *context)
         spin_unlock(&rbu_data.lock);
 }
 
-static ssize_t read_rbu_image_type(struct kobject *kobj, char *buffer,
-        loff_t pos, size_t count)
+static ssize_t read_rbu_image_type(struct kobject *kobj,
+                                   struct bin_attribute *bin_attr,
+                                   char *buffer, loff_t pos, size_t count)
 {
         int size = 0;
         if (!pos)
@@ -600,8 +602,9 @@ static ssize_t read_rbu_image_type(struct kobject *kobj, char *buffer,
         return size;
 }
 
-static ssize_t write_rbu_image_type(struct kobject *kobj, char *buffer,
-        loff_t pos, size_t count)
+static ssize_t write_rbu_image_type(struct kobject *kobj,
+                                    struct bin_attribute *bin_attr,
+                                    char *buffer, loff_t pos, size_t count)
 {
         int rc = count;
         int req_firm_rc = 0;
@@ -660,8 +663,9 @@ static ssize_t write_rbu_image_type(struct kobject *kobj, char *buffer,
         return rc;
 }
 
-static ssize_t read_rbu_packet_size(struct kobject *kobj, char *buffer,
-        loff_t pos, size_t count)
+static ssize_t read_rbu_packet_size(struct kobject *kobj,
+                                    struct bin_attribute *bin_attr,
+                                    char *buffer, loff_t pos, size_t count)
 {
         int size = 0;
         if (!pos) {
@@ -672,8 +676,9 @@ static ssize_t read_rbu_packet_size(struct kobject *kobj, char *buffer,
         return size;
 }
 
-static ssize_t write_rbu_packet_size(struct kobject *kobj, char *buffer,
-        loff_t pos, size_t count)
+static ssize_t write_rbu_packet_size(struct kobject *kobj,
+                                     struct bin_attribute *bin_attr,
+                                     char *buffer, loff_t pos, size_t count)
 {
         unsigned long temp;
         spin_lock(&rbu_data.lock);
@@ -687,18 +692,18 @@ static ssize_t write_rbu_packet_size(struct kobject *kobj, char *buffer,
 }
 
 static struct bin_attribute rbu_data_attr = {
-        .attr = {.name = "data",.owner = THIS_MODULE,.mode = 0444},
+        .attr = {.name = "data", .mode = 0444},
         .read = read_rbu_data,
 };
 
 static struct bin_attribute rbu_image_type_attr = {
-        .attr = {.name = "image_type",.owner = THIS_MODULE,.mode = 0644},
+        .attr = {.name = "image_type", .mode = 0644},
         .read = read_rbu_image_type,
         .write = write_rbu_image_type,
 };
 
 static struct bin_attribute rbu_packet_size_attr = {
-        .attr = {.name = "packet_size",.owner = THIS_MODULE,.mode = 0644},
+        .attr = {.name = "packet_size", .mode = 0644},
         .read = read_rbu_packet_size,
         .write = write_rbu_packet_size,
 };
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
new file mode 100644
index 000000000000..59c3b5aa89f4
--- /dev/null
+++ b/drivers/firmware/dmi-id.c
@@ -0,0 +1,222 @@
+/*
+ * Export SMBIOS/DMI info via sysfs to userspace
+ *
+ * Copyright 2007, Lennart Poettering
+ *
+ * Licensed under GPLv2
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/dmi.h>
+#include <linux/device.h>
+#include <linux/autoconf.h>
+
+#define DEFINE_DMI_ATTR(_name, _mode, _show)            \
+static struct device_attribute sys_dmi_##_name##_attr = \
+        __ATTR(_name, _mode, _show, NULL);
+
+#define DEFINE_DMI_ATTR_WITH_SHOW(_name, _mode, _field)                 \
+static ssize_t sys_dmi_##_name##_show(struct device *dev,               \
+                                      struct device_attribute *attr,    \
+                                      char *page)                       \
+{                                                                       \
+        ssize_t len;                                                    \
+        len = scnprintf(page, PAGE_SIZE, "%s\n", dmi_get_system_info(_field)); \
+        page[len-1] = '\n';                                             \
+        return len;                                                     \
+}                                                                       \
+DEFINE_DMI_ATTR(_name, _mode, sys_dmi_##_name##_show);
+
+DEFINE_DMI_ATTR_WITH_SHOW(bios_vendor,          0444, DMI_BIOS_VENDOR);
+DEFINE_DMI_ATTR_WITH_SHOW(bios_version,         0444, DMI_BIOS_VERSION);
+DEFINE_DMI_ATTR_WITH_SHOW(bios_date,            0444, DMI_BIOS_DATE);
+DEFINE_DMI_ATTR_WITH_SHOW(sys_vendor,           0444, DMI_SYS_VENDOR);
+DEFINE_DMI_ATTR_WITH_SHOW(product_name,         0444, DMI_PRODUCT_NAME);
+DEFINE_DMI_ATTR_WITH_SHOW(product_version,      0444, DMI_PRODUCT_VERSION);
+DEFINE_DMI_ATTR_WITH_SHOW(product_serial,       0400, DMI_PRODUCT_SERIAL);
+DEFINE_DMI_ATTR_WITH_SHOW(product_uuid,         0400, DMI_PRODUCT_UUID);
+DEFINE_DMI_ATTR_WITH_SHOW(board_vendor,         0444, DMI_BOARD_VENDOR);
+DEFINE_DMI_ATTR_WITH_SHOW(board_name,           0444, DMI_BOARD_NAME);
+DEFINE_DMI_ATTR_WITH_SHOW(board_version,        0444, DMI_BOARD_VERSION);
+DEFINE_DMI_ATTR_WITH_SHOW(board_serial,         0400, DMI_BOARD_SERIAL);
+DEFINE_DMI_ATTR_WITH_SHOW(board_asset_tag,      0444, DMI_BOARD_ASSET_TAG);
+DEFINE_DMI_ATTR_WITH_SHOW(chassis_vendor,       0444, DMI_CHASSIS_VENDOR);
+DEFINE_DMI_ATTR_WITH_SHOW(chassis_type,         0444, DMI_CHASSIS_TYPE);
+DEFINE_DMI_ATTR_WITH_SHOW(chassis_version,      0444, DMI_CHASSIS_VERSION);
+DEFINE_DMI_ATTR_WITH_SHOW(chassis_serial,       0400, DMI_CHASSIS_SERIAL);
+DEFINE_DMI_ATTR_WITH_SHOW(chassis_asset_tag,    0444, DMI_CHASSIS_ASSET_TAG);
+
+static void ascii_filter(char *d, const char *s)
+{
+        /* Filter out characters we don't want to see in the modalias string */
+        for (; *s; s++)
+                if (*s > ' ' && *s < 127 && *s != ':')
+                        *(d++) = *s;
+
+        *d = 0;
+}
+
+static ssize_t get_modalias(char *buffer, size_t buffer_size)
+{
+        static const struct mafield {
+                const char *prefix;
+                int field;
+        } fields[] = {
+                { "bvn", DMI_BIOS_VENDOR },
+                { "bvr", DMI_BIOS_VERSION },
+                { "bd",  DMI_BIOS_DATE },
+                { "svn", DMI_SYS_VENDOR },
+                { "pn",  DMI_PRODUCT_NAME },
+                { "pvr", DMI_PRODUCT_VERSION },
+                { "rvn", DMI_BOARD_VENDOR },
+                { "rn",  DMI_BOARD_NAME },
+                { "rvr", DMI_BOARD_VERSION },
+                { "cvn", DMI_CHASSIS_VENDOR },
+                { "ct",  DMI_CHASSIS_TYPE },
+                { "cvr", DMI_CHASSIS_VERSION },
+                { NULL,  DMI_NONE }
+        };
+
+        ssize_t l, left;
+        char *p;
+        const struct mafield *f;
+
+        strcpy(buffer, "dmi");
+        p = buffer + 3; left = buffer_size - 4;
+
+        for (f = fields; f->prefix && left > 0; f++) {
+                const char *c;
+                char *t;
+
+                c = dmi_get_system_info(f->field);
+                if (!c)
+                        continue;
+
+                t = kmalloc(strlen(c) + 1, GFP_KERNEL);
+                if (!t)
+                        break;
+                ascii_filter(t, c);
+                l = scnprintf(p, left, ":%s%s", f->prefix, t);
+                kfree(t);
+
+                p += l;
+                left -= l;
+        }
+
+        p[0] = ':';
+        p[1] = 0;
+
+        return p - buffer + 1;
+}
+
+static ssize_t sys_dmi_modalias_show(struct device *dev,
+                                     struct device_attribute *attr, char *page)
+{
+        ssize_t r;
+        r = get_modalias(page, PAGE_SIZE-1);
+        page[r] = '\n';
+        page[r+1] = 0;
+        return r+1;
+}
+
+DEFINE_DMI_ATTR(modalias, 0444, sys_dmi_modalias_show);
+
+static struct attribute *sys_dmi_attributes[DMI_STRING_MAX+2];
+
+static struct attribute_group sys_dmi_attribute_group = {
+        .attrs = sys_dmi_attributes,
+};
+
+static struct attribute_group* sys_dmi_attribute_groups[] = {
+        &sys_dmi_attribute_group,
+        NULL
+};
+
+static int dmi_dev_uevent(struct device *dev, char **envp,
+                            int num_envp, char *buffer, int buffer_size)
+{
+        strcpy(buffer, "MODALIAS=");
+        get_modalias(buffer+9, buffer_size-9);
+        envp[0] = buffer;
+        envp[1] = NULL;
+
+        return 0;
+}
+
+static struct class dmi_class = {
+        .name = "dmi",
+        .dev_release = (void(*)(struct device *)) kfree,
+        .dev_uevent = dmi_dev_uevent,
+};
+
+static struct device *dmi_dev;
+
+/* Initialization */
+
+#define ADD_DMI_ATTR(_name, _field) \
+        if (dmi_get_system_info(_field)) \
+                sys_dmi_attributes[i++] = & sys_dmi_##_name##_attr.attr;
+
+extern int dmi_available;
+
+static int __init dmi_id_init(void)
+{
+        int ret, i;
+
+        if (!dmi_available)
+                return -ENODEV;
+
+        /* Not necessarily all DMI fields are available on all
+         * systems, hence let's built an attribute table of just
+         * what's available */
+        i = 0;
+        ADD_DMI_ATTR(bios_vendor,       DMI_BIOS_VENDOR);
+        ADD_DMI_ATTR(bios_version,      DMI_BIOS_VERSION);
+        ADD_DMI_ATTR(bios_date,         DMI_BIOS_DATE);
+        ADD_DMI_ATTR(sys_vendor,        DMI_SYS_VENDOR);
+        ADD_DMI_ATTR(product_name,      DMI_PRODUCT_NAME);
+        ADD_DMI_ATTR(product_version,   DMI_PRODUCT_VERSION);
+        ADD_DMI_ATTR(product_serial,    DMI_PRODUCT_SERIAL);
+        ADD_DMI_ATTR(product_uuid,      DMI_PRODUCT_UUID);
+        ADD_DMI_ATTR(board_vendor,      DMI_BOARD_VENDOR);
+        ADD_DMI_ATTR(board_name,        DMI_BOARD_NAME);
+        ADD_DMI_ATTR(board_version,     DMI_BOARD_VERSION);
+        ADD_DMI_ATTR(board_serial,      DMI_BOARD_SERIAL);
+        ADD_DMI_ATTR(board_asset_tag,   DMI_BOARD_ASSET_TAG);
+        ADD_DMI_ATTR(chassis_vendor,    DMI_CHASSIS_VENDOR);
+        ADD_DMI_ATTR(chassis_type,      DMI_CHASSIS_TYPE);
+        ADD_DMI_ATTR(chassis_version,   DMI_CHASSIS_VERSION);
+        ADD_DMI_ATTR(chassis_serial,    DMI_CHASSIS_SERIAL);
+        ADD_DMI_ATTR(chassis_asset_tag, DMI_CHASSIS_ASSET_TAG);
+        sys_dmi_attributes[i++] = &sys_dmi_modalias_attr.attr;
+
+        ret = class_register(&dmi_class);
+        if (ret)
+                return ret;
+
+        dmi_dev = kzalloc(sizeof(*dmi_dev), GFP_KERNEL);
+        if (!dmi_dev) {
+                ret = -ENOMEM;
+                goto fail_class_unregister;
+        }
+
+        dmi_dev->class = &dmi_class;
+        strcpy(dmi_dev->bus_id, "id");
+        dmi_dev->groups = sys_dmi_attribute_groups;
+
+        ret = device_register(dmi_dev);
+        if (ret)
+                goto fail_class_unregister;
+
+        return 0;
+
+fail_class_unregister:
+
+        class_unregister(&dmi_class);
+
+        return ret;
+}
+
+arch_initcall(dmi_id_init);
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 37deee6c0c1c..f7318b3b51f2 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -84,6 +84,7 @@ static int __init dmi_checksum(u8 *buf)
 
 static char *dmi_ident[DMI_STRING_MAX];
 static LIST_HEAD(dmi_devices);
+int dmi_available;
 
 /*
  *      Save a DMI string
@@ -102,6 +103,51 @@ static void __init dmi_save_ident(struct dmi_header *dm, int slot, int string)
         dmi_ident[slot] = p;
 }
 
+static void __init dmi_save_uuid(struct dmi_header *dm, int slot, int index)
+{
+        u8 *d = (u8*) dm + index;
+        char *s;
+        int is_ff = 1, is_00 = 1, i;
+
+        if (dmi_ident[slot])
+                return;
+
+        for (i = 0; i < 16 && (is_ff || is_00); i++) {
+                if(d[i] != 0x00) is_ff = 0;
+                if(d[i] != 0xFF) is_00 = 0;
+        }
+
+        if (is_ff || is_00)
+                return;
+
+        s = dmi_alloc(16*2+4+1);
+        if (!s)
+                return;
+
+        sprintf(s,
+                "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
+                d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7],
+                d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]);
+
+        dmi_ident[slot] = s;
+}
+
+static void __init dmi_save_type(struct dmi_header *dm, int slot, int index)
+{
+        u8 *d = (u8*) dm + index;
+        char *s;
+
+        if (dmi_ident[slot])
+                return;
+
+        s = dmi_alloc(4);
+        if (!s)
+                return;
+
+        sprintf(s, "%u", *d & 0x7F);
+        dmi_ident[slot] = s;
+}
+
 static void __init dmi_save_devices(struct dmi_header *dm)
 {
         int i, count = (dm->length - sizeof(struct dmi_header)) / 2;
@@ -192,11 +238,21 @@ static void __init dmi_decode(struct dmi_header *dm)
                 dmi_save_ident(dm, DMI_PRODUCT_NAME, 5);
                 dmi_save_ident(dm, DMI_PRODUCT_VERSION, 6);
                 dmi_save_ident(dm, DMI_PRODUCT_SERIAL, 7);
+                dmi_save_uuid(dm, DMI_PRODUCT_UUID, 8);
                 break;
         case 2:         /* Base Board Information */
                 dmi_save_ident(dm, DMI_BOARD_VENDOR, 4);
                 dmi_save_ident(dm, DMI_BOARD_NAME, 5);
                 dmi_save_ident(dm, DMI_BOARD_VERSION, 6);
+                dmi_save_ident(dm, DMI_BOARD_SERIAL, 7);
+                dmi_save_ident(dm, DMI_BOARD_ASSET_TAG, 8);
+                break;
+        case 3:         /* Chassis Information */
+                dmi_save_ident(dm, DMI_CHASSIS_VENDOR, 4);
+                dmi_save_type(dm, DMI_CHASSIS_TYPE, 5);
+                dmi_save_ident(dm, DMI_CHASSIS_VERSION, 6);
+                dmi_save_ident(dm, DMI_CHASSIS_SERIAL, 7);
+                dmi_save_ident(dm, DMI_CHASSIS_ASSET_TAG, 8);
                 break;
         case 10:        /* Onboard Devices Information */
                 dmi_save_devices(dm);
@@ -243,18 +299,20 @@ void __init dmi_scan_machine(void)
                 if (efi.smbios == EFI_INVALID_TABLE_ADDR)
                         goto out;
 
-               /* This is called as a core_initcall() because it isn't
-                * needed during early boot.  This also means we can
-                * iounmap the space when we're done with it.
-                */
+                /* This is called as a core_initcall() because it isn't
+                 * needed during early boot.  This also means we can
+                 * iounmap the space when we're done with it.
+                 */
                 p = dmi_ioremap(efi.smbios, 32);
                 if (p == NULL)
                         goto out;
 
                 rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
                 dmi_iounmap(p, 32);
-                if (!rc)
+                if (!rc) {
+                        dmi_available = 1;
                         return;
+                }
         }
         else {
                 /*
@@ -268,8 +326,10 @@ void __init dmi_scan_machine(void)
 
                 for (q = p; q < p + 0x10000; q += 16) {
                         rc = dmi_present(q);
-                        if (!rc)
+                        if (!rc) {
+                                dmi_available = 1;
                                 return;
+                        }
                 }
         }
  out:   printk(KERN_INFO "DMI not present or invalid.\n");
@@ -404,3 +464,4 @@ int dmi_get_year(int field)
 
         return year;
 }
+
diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index d8806e4f1829..15232271d848 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -74,7 +74,7 @@ static struct edd_device *edd_devices[EDD_MBR_SIG_MAX];
 
 #define EDD_DEVICE_ATTR(_name,_mode,_show,_test) \
 struct edd_attribute edd_attr_##_name = {       \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE },     \
+        .attr = {.name = __stringify(_name), .mode = _mode },   \
         .show   = _show,                                \
         .test   = _test,                                \
 };
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 1324984a4c35..bfd2d67df689 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -131,21 +131,21 @@ struct efivar_attribute {
 
 #define EFI_ATTR(_name, _mode, _show, _store) \
 struct subsys_attribute efi_attr_##_name = { \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+        .attr = {.name = __stringify(_name), .mode = _mode}, \
         .show = _show, \
         .store = _store, \
 };
 
 #define EFIVAR_ATTR(_name, _mode, _show, _store) \
 struct efivar_attribute efivar_attr_##_name = { \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+        .attr = {.name = __stringify(_name), .mode = _mode}, \
         .show = _show, \
         .store = _store, \
 };
 
 #define VAR_SUBSYS_ATTR(_name, _mode, _show, _store) \
 struct subsys_attribute var_subsys_attr_##_name = { \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+        .attr = {.name = __stringify(_name), .mode = _mode}, \
         .show = _show, \
         .store = _store, \
 };
diff --git a/drivers/i2c/algos/Kconfig b/drivers/i2c/algos/Kconfig
index 58899078810b..014dfa575be7 100644
--- a/drivers/i2c/algos/Kconfig
+++ b/drivers/i2c/algos/Kconfig
@@ -34,10 +34,6 @@ config I2C_ALGOPCA
           This support is also available as a module.  If so, the module 
           will be called i2c-algo-pca.
 
-config I2C_ALGO8XX
-        tristate "MPC8xx CPM I2C interface"
-        depends on 8xx
-
 config I2C_ALGO_SGI
         tristate "I2C SGI interfaces"
         depends on SGI_IP22 || SGI_IP32 || X86_VISWS
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 838dc1c19d61..fcde9bab5b96 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -207,6 +207,7 @@ config I2C_PIIX4
             ATI IXP300
             ATI IXP400
             ATI SB600
+            ATI SB700
             Serverworks OSB4
             Serverworks CSB5
             Serverworks CSB6
@@ -390,11 +391,6 @@ config I2C_PROSAVAGE
           This support is also available as a module.  If so, the module 
           will be called i2c-prosavage.
 
-config I2C_RPXLITE
-        tristate "Embedded Planet RPX Lite/Classic support"
-        depends on RPXLITE || RPXCLASSIC
-        select I2C_ALGO8XX
-
 config I2C_S3C2410
         tristate "S3C2410 I2C Driver"
         depends on ARCH_S3C2410
@@ -512,6 +508,22 @@ config I2C_SIS96X
           This driver can also be built as a module.  If so, the module
           will be called i2c-sis96x.
 
+config I2C_TAOS_EVM
+        tristate "TAOS evaluation module"
+        depends on EXPERIMENTAL
+        select SERIO
+        select SERIO_SERPORT
+        default n
+        help
+          This supports TAOS evaluation modules on serial port. In order to
+          use this driver, you will need the inputattach tool, which is part
+          of the input-utils package.
+
+          If unsure, say N.
+
+          This support is also available as a module.  If so, the module
+          will be called i2c-taos-evm.
+
 config I2C_STUB
         tristate "I2C/SMBus Test Stub"
         depends on EXPERIMENTAL && m
@@ -635,4 +647,13 @@ config I2C_PNX
           This driver can also be built as a module.  If so, the module
           will be called i2c-pnx.
 
+config I2C_PMCMSP
+        tristate "PMC MSP I2C TWI Controller"
+        depends on PMC_MSP
+        help
+          This driver supports the PMC TWI controller on MSP devices.
+
+          This driver can also be built as module. If so, the module
+          will be called i2c-pmcmsp.
+
 endmenu
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 14d1432f698b..a6db4e38bda8 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -32,10 +32,10 @@ obj-$(CONFIG_I2C_PARPORT_LIGHT)	+= i2c-parport-light.o
 obj-$(CONFIG_I2C_PASEMI)        += i2c-pasemi.o
 obj-$(CONFIG_I2C_PCA_ISA)       += i2c-pca-isa.o
 obj-$(CONFIG_I2C_PIIX4)         += i2c-piix4.o
+obj-$(CONFIG_I2C_PMCMSP)        += i2c-pmcmsp.o
 obj-$(CONFIG_I2C_PNX)           += i2c-pnx.o
 obj-$(CONFIG_I2C_PROSAVAGE)     += i2c-prosavage.o
 obj-$(CONFIG_I2C_PXA)           += i2c-pxa.o
-obj-$(CONFIG_I2C_RPXLITE)       += i2c-rpx.o
 obj-$(CONFIG_I2C_S3C2410)       += i2c-s3c2410.o
 obj-$(CONFIG_I2C_SAVAGE4)       += i2c-savage4.o
 obj-$(CONFIG_I2C_SIBYTE)        += i2c-sibyte.o
@@ -44,6 +44,7 @@ obj-$(CONFIG_I2C_SIS5595)	+= i2c-sis5595.o
 obj-$(CONFIG_I2C_SIS630)        += i2c-sis630.o
 obj-$(CONFIG_I2C_SIS96X)        += i2c-sis96x.o
 obj-$(CONFIG_I2C_STUB)          += i2c-stub.o
+obj-$(CONFIG_I2C_TAOS_EVM)      += i2c-taos-evm.o
 obj-$(CONFIG_I2C_TINY_USB)      += i2c-tiny-usb.o
 obj-$(CONFIG_I2C_VERSATILE)     += i2c-versatile.o
 obj-$(CONFIG_I2C_ACORN)         += i2c-acorn.o
diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c
index a7dd54654a9a..025f19423faf 100644
--- a/drivers/i2c/busses/i2c-gpio.c
+++ b/drivers/i2c/busses/i2c-gpio.c
@@ -63,14 +63,14 @@ static void i2c_gpio_setscl_val(void *data, int state)
         gpio_set_value(pdata->scl_pin, state);
 }
 
-int i2c_gpio_getsda(void *data)
+static int i2c_gpio_getsda(void *data)
 {
         struct i2c_gpio_platform_data *pdata = data;
 
         return gpio_get_value(pdata->sda_pin);
 }
 
-int i2c_gpio_getscl(void *data)
+static int i2c_gpio_getscl(void *data)
 {
         struct i2c_gpio_platform_data *pdata = data;
 
@@ -142,7 +142,13 @@ static int __init i2c_gpio_probe(struct platform_device *pdev)
         adap->algo_data = bit_data;
         adap->dev.parent = &pdev->dev;
 
-        ret = i2c_bit_add_bus(adap);
+        /*
+         * If "dev->id" is negative we consider it as zero.
+         * The reason to do so is to avoid sysfs names that only make
+         * sense when there are multiple adapters.
+         */
+        adap->nr = pdev->id >= 0 ? pdev->id : 0;
+        ret = i2c_bit_add_numbered_bus(adap);
         if (ret)
                 goto err_add_bus;
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 611b57192c96..8f5c686123b8 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -22,12 +22,12 @@
 
 /*
     SUPPORTED DEVICES   PCI ID
-    82801AA             2413           
-    82801AB             2423           
-    82801BA             2443           
-    82801CA/CAM         2483           
-    82801DB             24C3   (HW PEC supported, 32 byte buffer not supported)
-    82801EB             24D3   (HW PEC supported, 32 byte buffer not supported)
+    82801AA             2413
+    82801AB             2423
+    82801BA             2443
+    82801CA/CAM         2483
+    82801DB             24C3   (HW PEC supported)
+    82801EB             24D3   (HW PEC supported)
     6300ESB             25A4
     ICH6                266A
     ICH7                27DA
@@ -74,6 +74,13 @@
 #define SMBHSTCFG_SMB_SMI_EN    2
 #define SMBHSTCFG_I2C_EN        4
 
+/* Auxillary control register bits, ICH4+ only */
+#define SMBAUXCTL_CRC           1
+#define SMBAUXCTL_E32B          2
+
+/* kill bit for SMBHSTCNT */
+#define SMBHSTCNT_KILL          2
+
 /* Other settings */
 #define MAX_TIMEOUT             100
 #define ENABLE_INT9             0       /* set to 0x01 to enable - untested */
@@ -91,10 +98,15 @@
 #define I801_START              0x40
 #define I801_PEC_EN             0x80    /* ICH4 only */
 
-
-static int i801_transaction(void);
-static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
-                                  int command, int hwpec);
+/* I801 Hosts Status register bits */
+#define SMBHSTSTS_BYTE_DONE     0x80
+#define SMBHSTSTS_INUSE_STS     0x40
+#define SMBHSTSTS_SMBALERT_STS  0x20
+#define SMBHSTSTS_FAILED        0x10
+#define SMBHSTSTS_BUS_ERR       0x08
+#define SMBHSTSTS_DEV_ERR       0x04
+#define SMBHSTSTS_INTR          0x02
+#define SMBHSTSTS_HOST_BUSY     0x01
 
 static unsigned long i801_smba;
 static unsigned char i801_original_hstcfg;
@@ -102,7 +114,7 @@ static struct pci_driver i801_driver;
 static struct pci_dev *I801_dev;
 static int isich4;
 
-static int i801_transaction(void)
+static int i801_transaction(int xact)
 {
         int temp;
         int result = 0;
@@ -127,33 +139,40 @@ static int i801_transaction(void)
                 }
         }
 
-        outb_p(inb(SMBHSTCNT) | I801_START, SMBHSTCNT);
+        /* the current contents of SMBHSTCNT can be overwritten, since PEC,
+         * INTREN, SMBSCMD are passed in xact */
+        outb_p(xact | I801_START, SMBHSTCNT);
 
         /* We will always wait for a fraction of a second! */
         do {
                 msleep(1);
                 temp = inb_p(SMBHSTSTS);
-        } while ((temp & 0x01) && (timeout++ < MAX_TIMEOUT));
+        } while ((temp & SMBHSTSTS_HOST_BUSY) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
         if (timeout >= MAX_TIMEOUT) {
                 dev_dbg(&I801_dev->dev, "SMBus Timeout!\n");
                 result = -1;
+                /* try to stop the current command */
+                dev_dbg(&I801_dev->dev, "Terminating the current operation\n");
+                outb_p(inb_p(SMBHSTCNT) | SMBHSTCNT_KILL, SMBHSTCNT);
+                msleep(1);
+                outb_p(inb_p(SMBHSTCNT) & (~SMBHSTCNT_KILL), SMBHSTCNT);
         }
 
-        if (temp & 0x10) {
+        if (temp & SMBHSTSTS_FAILED) {
                 result = -1;
                 dev_dbg(&I801_dev->dev, "Error: Failed bus transaction\n");
         }
 
-        if (temp & 0x08) {
+        if (temp & SMBHSTSTS_BUS_ERR) {
                 result = -1;
                 dev_err(&I801_dev->dev, "Bus collision! SMBus may be locked "
                         "until next hard reset. (sorry!)\n");
                 /* Clock stops and slave is stuck in mid-transmission */
         }
 
-        if (temp & 0x04) {
+        if (temp & SMBHSTSTS_DEV_ERR) {
                 result = -1;
                 dev_dbg(&I801_dev->dev, "Error: no response!\n");
         }
@@ -172,44 +191,70 @@ static int i801_transaction(void)
         return result;
 }
 
-/* All-inclusive block transaction function */
-static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
-                                  int command, int hwpec)
+/* wait for INTR bit as advised by Intel */
+static void i801_wait_hwpec(void)
+{
+        int timeout = 0;
+        int temp;
+
+        do {
+                msleep(1);
+                temp = inb_p(SMBHSTSTS);
+        } while ((!(temp & SMBHSTSTS_INTR))
+                 && (timeout++ < MAX_TIMEOUT));
+
+        if (timeout >= MAX_TIMEOUT) {
+                dev_dbg(&I801_dev->dev, "PEC Timeout!\n");
+        }
+        outb_p(temp, SMBHSTSTS);
+}
+
+static int i801_block_transaction_by_block(union i2c_smbus_data *data,
+                                           char read_write, int hwpec)
+{
+        int i, len;
+
+        inb_p(SMBHSTCNT); /* reset the data buffer index */
+
+        /* Use 32-byte buffer to process this transaction */
+        if (read_write == I2C_SMBUS_WRITE) {
+                len = data->block[0];
+                outb_p(len, SMBHSTDAT0);
+                for (i = 0; i < len; i++)
+                        outb_p(data->block[i+1], SMBBLKDAT);
+        }
+
+        if (i801_transaction(I801_BLOCK_DATA | ENABLE_INT9 |
+                             I801_PEC_EN * hwpec))
+                return -1;
+
+        if (read_write == I2C_SMBUS_READ) {
+                len = inb_p(SMBHSTDAT0);
+                if (len < 1 || len > I2C_SMBUS_BLOCK_MAX)
+                        return -1;
+
+                data->block[0] = len;
+                for (i = 0; i < len; i++)
+                        data->block[i + 1] = inb_p(SMBBLKDAT);
+        }
+        return 0;
+}
+
+static int i801_block_transaction_byte_by_byte(union i2c_smbus_data *data,
+                                               char read_write, int hwpec)
 {
         int i, len;
         int smbcmd;
         int temp;
         int result = 0;
         int timeout;
-        unsigned char hostc, errmask;
+        unsigned char errmask;
 
-        if (command == I2C_SMBUS_I2C_BLOCK_DATA) {
-                if (read_write == I2C_SMBUS_WRITE) {
-                        /* set I2C_EN bit in configuration register */
-                        pci_read_config_byte(I801_dev, SMBHSTCFG, &hostc);
-                        pci_write_config_byte(I801_dev, SMBHSTCFG,
-                                              hostc | SMBHSTCFG_I2C_EN);
-                } else {
-                        dev_err(&I801_dev->dev,
-                                "I2C_SMBUS_I2C_BLOCK_READ not DB!\n");
-                        return -1;
-                }
-        }
+        len = data->block[0];
 
         if (read_write == I2C_SMBUS_WRITE) {
-                len = data->block[0];
-                if (len < 1)
-                        len = 1;
-                if (len > 32)
-                        len = 32;
                 outb_p(len, SMBHSTDAT0);
                 outb_p(data->block[1], SMBBLKDAT);
-        } else {
-                len = 32;       /* max for reads */
-        }
-
-        if(isich4 && command != I2C_SMBUS_I2C_BLOCK_DATA) {
-                /* set 32 byte buffer */
         }
 
         for (i = 1; i <= len; i++) {
@@ -227,13 +272,13 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
                 /* Make sure the SMBus host is ready to start transmitting */
                 temp = inb_p(SMBHSTSTS);
                 if (i == 1) {
-                        /* Erronenous conditions before transaction: 
+                        /* Erronenous conditions before transaction:
                          * Byte_Done, Failed, Bus_Err, Dev_Err, Intr, Host_Busy */
-                        errmask=0x9f; 
+                        errmask = 0x9f;
                 } else {
-                        /* Erronenous conditions during transaction: 
+                        /* Erronenous conditions during transaction:
                          * Failed, Bus_Err, Dev_Err, Intr */
-                        errmask=0x1e; 
+                        errmask = 0x1e;
                 }
                 if (temp & errmask) {
                         dev_dbg(&I801_dev->dev, "SMBus busy (%02x). "
@@ -242,14 +287,11 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
                         if (((temp = inb_p(SMBHSTSTS)) & errmask) != 0x00) {
                                 dev_err(&I801_dev->dev,
                                         "Reset failed! (%02x)\n", temp);
-                                result = -1;
-                                goto END;
+                                return -1;
                         }
-                        if (i != 1) {
+                        if (i != 1)
                                 /* if die in middle of block transaction, fail */
-                                result = -1;
-                                goto END;
-                        }
+                                return -1;
                 }
 
                 if (i == 1)
@@ -261,33 +303,38 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
                         msleep(1);
                         temp = inb_p(SMBHSTSTS);
                 }
-                    while ((!(temp & 0x80))
-                           && (timeout++ < MAX_TIMEOUT));
+                while ((!(temp & SMBHSTSTS_BYTE_DONE))
+                       && (timeout++ < MAX_TIMEOUT));
 
                 /* If the SMBus is still busy, we give up */
                 if (timeout >= MAX_TIMEOUT) {
+                        /* try to stop the current command */
+                        dev_dbg(&I801_dev->dev, "Terminating the current "
+                                                "operation\n");
+                        outb_p(inb_p(SMBHSTCNT) | SMBHSTCNT_KILL, SMBHSTCNT);
+                        msleep(1);
+                        outb_p(inb_p(SMBHSTCNT) & (~SMBHSTCNT_KILL),
+                                SMBHSTCNT);
                         result = -1;
                         dev_dbg(&I801_dev->dev, "SMBus Timeout!\n");
                 }
 
-                if (temp & 0x10) {
+                if (temp & SMBHSTSTS_FAILED) {
                         result = -1;
                         dev_dbg(&I801_dev->dev,
                                 "Error: Failed bus transaction\n");
-                } else if (temp & 0x08) {
+                } else if (temp & SMBHSTSTS_BUS_ERR) {
                         result = -1;
                         dev_err(&I801_dev->dev, "Bus collision!\n");
-                } else if (temp & 0x04) {
+                } else if (temp & SMBHSTSTS_DEV_ERR) {
                         result = -1;
                         dev_dbg(&I801_dev->dev, "Error: no response!\n");
                 }
 
                 if (i == 1 && read_write == I2C_SMBUS_READ) {
                         len = inb_p(SMBHSTDAT0);
-                        if (len < 1)
-                                len = 1;
-                        if (len > 32)
-                                len = 32;
+                        if (len < 1 || len > I2C_SMBUS_BLOCK_MAX)
+                                return -1;
                         data->block[0] = len;
                 }
 
@@ -310,25 +357,58 @@ static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
                         inb_p(SMBHSTDAT0), inb_p(SMBBLKDAT));
 
                 if (result < 0)
-                        goto END;
+                        return result;
         }
+        return result;
+}
 
-        if (hwpec) {
-                /* wait for INTR bit as advised by Intel */
-                timeout = 0;
-                do {
-                        msleep(1);
-                        temp = inb_p(SMBHSTSTS);
-                } while ((!(temp & 0x02))
-                           && (timeout++ < MAX_TIMEOUT));
+static int i801_set_block_buffer_mode(void)
+{
+        outb_p(inb_p(SMBAUXCTL) | SMBAUXCTL_E32B, SMBAUXCTL);
+        if ((inb_p(SMBAUXCTL) & SMBAUXCTL_E32B) == 0)
+                return -1;
+        return 0;
+}
 
-                if (timeout >= MAX_TIMEOUT) {
-                        dev_dbg(&I801_dev->dev, "PEC Timeout!\n");
+/* Block transaction function */
+static int i801_block_transaction(union i2c_smbus_data *data, char read_write,
+                                  int command, int hwpec)
+{
+        int result = 0;
+        unsigned char hostc;
+
+        if (command == I2C_SMBUS_I2C_BLOCK_DATA) {
+                if (read_write == I2C_SMBUS_WRITE) {
+                        /* set I2C_EN bit in configuration register */
+                        pci_read_config_byte(I801_dev, SMBHSTCFG, &hostc);
+                        pci_write_config_byte(I801_dev, SMBHSTCFG,
+                                              hostc | SMBHSTCFG_I2C_EN);
+                } else {
+                        dev_err(&I801_dev->dev,
+                                "I2C_SMBUS_I2C_BLOCK_READ not DB!\n");
+                        return -1;
                 }
-                outb_p(temp, SMBHSTSTS); 
         }
-        result = 0;
-END:
+
+        if (read_write == I2C_SMBUS_WRITE) {
+                if (data->block[0] < 1)
+                        data->block[0] = 1;
+                if (data->block[0] > I2C_SMBUS_BLOCK_MAX)
+                        data->block[0] = I2C_SMBUS_BLOCK_MAX;
+        } else {
+                data->block[0] = 32;    /* max for reads */
+        }
+
+        if (isich4 && i801_set_block_buffer_mode() == 0 )
+                result = i801_block_transaction_by_block(data, read_write,
+                                                         hwpec);
+        else
+                result = i801_block_transaction_byte_by_byte(data, read_write,
+                                                             hwpec);
+
+        if (result == 0 && hwpec)
+                i801_wait_hwpec();
+
         if (command == I2C_SMBUS_I2C_BLOCK_DATA) {
                 /* restore saved configuration register value */
                 pci_write_config_byte(I801_dev, SMBHSTCFG, hostc);
@@ -393,19 +473,22 @@ static s32 i801_access(struct i2c_adapter * adap, u16 addr,
                 return -1;
         }
 
-        outb_p(hwpec, SMBAUXCTL);       /* enable/disable hardware PEC */
+        if (hwpec)      /* enable/disable hardware PEC */
+                outb_p(inb_p(SMBAUXCTL) | SMBAUXCTL_CRC, SMBAUXCTL);
+        else
+                outb_p(inb_p(SMBAUXCTL) & (~SMBAUXCTL_CRC), SMBAUXCTL);
 
         if(block)
                 ret = i801_block_transaction(data, read_write, size, hwpec);
-        else {
-                outb_p(xact | ENABLE_INT9, SMBHSTCNT);
-                ret = i801_transaction();
-        }
+        else
+                ret = i801_transaction(xact | ENABLE_INT9);
 
         /* Some BIOSes don't like it when PEC is enabled at reboot or resume
-           time, so we forcibly disable it after every transaction. */
+           time, so we forcibly disable it after every transaction. Turn off
+           E32B for the same reason. */
         if (hwpec)
-                outb_p(0, SMBAUXCTL);
+                outb_p(inb_p(SMBAUXCTL) & ~(SMBAUXCTL_CRC | SMBAUXCTL_E32B),
+                       SMBAUXCTL);
 
         if(block)
                 return ret;
diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index 90e2d9350c1b..440342bc62e1 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -491,6 +491,7 @@ iop3xx_i2c_probe(struct platform_device *pdev)
         new_adapter->id = I2C_HW_IOP3XX;
         new_adapter->owner = THIS_MODULE;
         new_adapter->dev.parent = &pdev->dev;
+        new_adapter->nr = pdev->id;
 
         /*
          * Default values...should these come in from board code?
@@ -508,7 +509,7 @@ iop3xx_i2c_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, new_adapter);
         new_adapter->algo_data = adapter_data;
 
-        i2c_add_adapter(new_adapter);
+        i2c_add_numbered_adapter(new_adapter);
 
         return 0;
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index c6b6898592b1..851c3ed513d0 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -74,6 +74,25 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+/* Sometimes 9th clock pulse isn't generated, and slave doesn't release
+ * the bus, because it wants to send ACK.
+ * Following sequence of enabling/disabling and sending start/stop generates
+ * the pulse, so it's all OK.
+ */
+static void mpc_i2c_fixup(struct mpc_i2c *i2c)
+{
+        writeccr(i2c, 0);
+        udelay(30);
+        writeccr(i2c, CCR_MEN);
+        udelay(30);
+        writeccr(i2c, CCR_MSTA | CCR_MTX);
+        udelay(30);
+        writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN);
+        udelay(30);
+        writeccr(i2c, CCR_MEN);
+        udelay(30);
+}
+
 static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
 {
         unsigned long orig_jiffies = jiffies;
@@ -153,6 +172,7 @@ static void mpc_i2c_start(struct mpc_i2c *i2c)
 static void mpc_i2c_stop(struct mpc_i2c *i2c)
 {
         writeccr(i2c, CCR_MEN);
+        writeccr(i2c, 0);
 }
 
 static int mpc_write(struct mpc_i2c *i2c, int target,
@@ -245,6 +265,9 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
                 }
                 if (time_after(jiffies, orig_jiffies + HZ)) {
                         pr_debug("I2C: timeout\n");
+                        if (readb(i2c->base + MPC_I2C_SR) ==
+                            (CSR_MCF | CSR_MBB | CSR_RXAK))
+                                mpc_i2c_fixup(i2c);
                         return -EIO;
                 }
                 schedule();
@@ -327,9 +350,10 @@ static int fsl_i2c_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, i2c);
 
         i2c->adap = mpc_ops;
+        i2c->adap.nr = pdev->id;
         i2c_set_adapdata(&i2c->adap, i2c);
         i2c->adap.dev.parent = &pdev->dev;
-        if ((result = i2c_add_adapter(&i2c->adap)) < 0) {
+        if ((result = i2c_add_numbered_adapter(&i2c->adap)) < 0) {
                 printk(KERN_ERR "i2c-mpc - failed to add adapter\n");
                 goto fail_add;
         }
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index a55b3335d1be..251154ae5d97 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -527,6 +527,7 @@ mv64xxx_i2c_probe(struct platform_device *pd)
         drv_data->adapter.class = I2C_CLASS_HWMON;
         drv_data->adapter.timeout = pdata->timeout;
         drv_data->adapter.retries = pdata->retries;
+        drv_data->adapter.nr = pd->id;
         platform_set_drvdata(pd, drv_data);
         i2c_set_adapdata(&drv_data->adapter, drv_data);
 
@@ -539,7 +540,7 @@ mv64xxx_i2c_probe(struct platform_device *pd)
                         drv_data->irq);
                 rc = -EINVAL;
                 goto exit_unmap_regs;
-        } else if ((rc = i2c_add_adapter(&drv_data->adapter)) != 0) {
+        } else if ((rc = i2c_add_numbered_adapter(&drv_data->adapter)) != 0) {
                 dev_err(&drv_data->adapter.dev,
                         "mv64xxx: Can't add i2c adapter, rc: %d\n", -rc);
                 goto exit_free_irq;
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 3cd0d63e7b50..c48140f782d0 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -61,6 +61,7 @@ struct nforce2_smbus {
         struct i2c_adapter adapter;
         int base;
         int size;
+        int blockops;
 };
 
 
@@ -80,6 +81,8 @@ struct nforce2_smbus {
 #define NVIDIA_SMB_ADDR         (smbus->base + 0x02)    /* address */
 #define NVIDIA_SMB_CMD          (smbus->base + 0x03)    /* command */
 #define NVIDIA_SMB_DATA         (smbus->base + 0x04)    /* 32 data registers */
+#define NVIDIA_SMB_BCNT         (smbus->base + 0x24)    /* number of data
+                                                           bytes */
 
 #define NVIDIA_SMB_STS_DONE     0x80
 #define NVIDIA_SMB_STS_ALRM     0x40
@@ -92,6 +95,7 @@ struct nforce2_smbus {
 #define NVIDIA_SMB_PRTCL_BYTE                   0x04
 #define NVIDIA_SMB_PRTCL_BYTE_DATA              0x06
 #define NVIDIA_SMB_PRTCL_WORD_DATA              0x08
+#define NVIDIA_SMB_PRTCL_BLOCK_DATA             0x0a
 #define NVIDIA_SMB_PRTCL_PEC                    0x80
 
 static struct pci_driver nforce2_driver;
@@ -103,6 +107,8 @@ static s32 nforce2_access(struct i2c_adapter * adap, u16 addr,
 {
         struct nforce2_smbus *smbus = adap->algo_data;
         unsigned char protocol, pec, temp;
+        u8 len;
+        int i;
 
         protocol = (read_write == I2C_SMBUS_READ) ? NVIDIA_SMB_PRTCL_READ :
                 NVIDIA_SMB_PRTCL_WRITE;
@@ -137,6 +143,25 @@ static s32 nforce2_access(struct i2c_adapter * adap, u16 addr,
                         protocol |= NVIDIA_SMB_PRTCL_WORD_DATA | pec;
                         break;
 
+                case I2C_SMBUS_BLOCK_DATA:
+                        outb_p(command, NVIDIA_SMB_CMD);
+                        if (read_write == I2C_SMBUS_WRITE) {
+                                len = data->block[0];
+                                if ((len == 0) || (len > I2C_SMBUS_BLOCK_MAX)) {
+                                        dev_err(&adap->dev,
+                                                "Transaction failed "
+                                                "(requested block size: %d)\n",
+                                                len);
+                                        return -1;
+                                }
+                                outb_p(len, NVIDIA_SMB_BCNT);
+                                for (i = 0; i < I2C_SMBUS_BLOCK_MAX; i++)
+                                        outb_p(data->block[i + 1],
+                                               NVIDIA_SMB_DATA+i);
+                        }
+                        protocol |= NVIDIA_SMB_PRTCL_BLOCK_DATA | pec;
+                        break;
+
                 default:
                         dev_err(&adap->dev, "Unsupported transaction %d\n", size);
                         return -1;
@@ -174,6 +199,14 @@ static s32 nforce2_access(struct i2c_adapter * adap, u16 addr,
                 case I2C_SMBUS_WORD_DATA:
                         data->word = inb_p(NVIDIA_SMB_DATA) | (inb_p(NVIDIA_SMB_DATA+1) << 8);
                         break;
+
+                case I2C_SMBUS_BLOCK_DATA:
+                        len = inb_p(NVIDIA_SMB_BCNT);
+                        len = min_t(u8, len, I2C_SMBUS_BLOCK_MAX);
+                        for (i = 0; i < len; i++)
+                                data->block[i+1] = inb_p(NVIDIA_SMB_DATA + i);
+                        data->block[0] = len;
+                        break;
         }
 
         return 0;
@@ -184,7 +217,9 @@ static u32 nforce2_func(struct i2c_adapter *adapter)
 {
         /* other functionality might be possible, but is not tested */
         return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
-            I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA;
+               I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+               (((struct nforce2_smbus*)adapter->algo_data)->blockops ?
+                I2C_FUNC_SMBUS_BLOCK_DATA : 0);
 }
 
 static struct i2c_algorithm smbus_algorithm = {
@@ -268,6 +303,13 @@ static int __devinit nforce2_probe(struct pci_dev *dev, const struct pci_device_
                 return -ENOMEM;
         pci_set_drvdata(dev, smbuses);
 
+        switch(dev->device) {
+        case PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SMBUS:
+        case PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SMBUS:
+                smbuses[0].blockops = 1;
+                smbuses[1].blockops = 1;
+        }
+
         /* SMBus adapter 1 */
         res1 = nforce2_probe_smb(dev, 4, NFORCE_PCI_SMB1, &smbuses[0], "SMB1");
         if (res1 < 0) {
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 5a52bf5e3fb0..debc76cd2161 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -23,7 +23,7 @@
    Supports:
         Intel PIIX4, 440MX
         Serverworks OSB4, CSB5, CSB6, HT-1000
-        ATI IXP200, IXP300, IXP400, SB600
+        ATI IXP200, IXP300, IXP400, SB600, SB700
         SMSC Victory66
 
    Note: we assume there can only be one device, with one SMBus interface.
@@ -399,6 +399,8 @@ static struct pci_device_id piix4_ids[] = {
           .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_SMBUS),
           .driver_data = 0 },
+        { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP700_SMBUS),
+          .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_OSB4),
           .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB5),
diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
new file mode 100644
index 000000000000..03188d277af1
--- /dev/null
+++ b/drivers/i2c/busses/i2c-pmcmsp.c
@@ -0,0 +1,653 @@
+/*
+ * Specific bus support for PMC-TWI compliant implementation on MSP71xx.
+ *
+ * Copyright 2005-2007 PMC-Sierra, Inc.
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
+ *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
+ *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *  You should have received a copy of the  GNU General Public License along
+ *  with this program; if not, write  to the Free Software Foundation, Inc.,
+ *  675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/completion.h>
+#include <linux/mutex.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+
+#define DRV_NAME        "pmcmsptwi"
+
+#define MSP_TWI_SF_CLK_REG_OFFSET       0x00
+#define MSP_TWI_HS_CLK_REG_OFFSET       0x04
+#define MSP_TWI_CFG_REG_OFFSET          0x08
+#define MSP_TWI_CMD_REG_OFFSET          0x0c
+#define MSP_TWI_ADD_REG_OFFSET          0x10
+#define MSP_TWI_DAT_0_REG_OFFSET        0x14
+#define MSP_TWI_DAT_1_REG_OFFSET        0x18
+#define MSP_TWI_INT_STS_REG_OFFSET      0x1c
+#define MSP_TWI_INT_MSK_REG_OFFSET      0x20
+#define MSP_TWI_BUSY_REG_OFFSET         0x24
+
+#define MSP_TWI_INT_STS_DONE                    (1 << 0)
+#define MSP_TWI_INT_STS_LOST_ARBITRATION        (1 << 1)
+#define MSP_TWI_INT_STS_NO_RESPONSE             (1 << 2)
+#define MSP_TWI_INT_STS_DATA_COLLISION          (1 << 3)
+#define MSP_TWI_INT_STS_BUSY                    (1 << 4)
+#define MSP_TWI_INT_STS_ALL                     0x1f
+
+#define MSP_MAX_BYTES_PER_RW            8
+#define MSP_MAX_POLL                    5
+#define MSP_POLL_DELAY                  10
+#define MSP_IRQ_TIMEOUT                 (MSP_MAX_POLL * MSP_POLL_DELAY)
+
+/* IO Operation macros */
+#define pmcmsptwi_readl         __raw_readl
+#define pmcmsptwi_writel        __raw_writel
+
+/* TWI command type */
+enum pmcmsptwi_cmd_type {
+        MSP_TWI_CMD_WRITE       = 0,    /* Write only */
+        MSP_TWI_CMD_READ        = 1,    /* Read only */
+        MSP_TWI_CMD_WRITE_READ  = 2,    /* Write then Read */
+};
+
+/* The possible results of the xferCmd */
+enum pmcmsptwi_xfer_result {
+        MSP_TWI_XFER_OK = 0,
+        MSP_TWI_XFER_TIMEOUT,
+        MSP_TWI_XFER_BUSY,
+        MSP_TWI_XFER_DATA_COLLISION,
+        MSP_TWI_XFER_NO_RESPONSE,
+        MSP_TWI_XFER_LOST_ARBITRATION,
+};
+
+/* Corresponds to a PMCTWI clock configuration register */
+struct pmcmsptwi_clock {
+        u8 filter;      /* Bits 15:12,  default = 0x03 */
+        u16 clock;      /* Bits 9:0,    default = 0x001f */
+};
+
+struct pmcmsptwi_clockcfg {
+        struct pmcmsptwi_clock standard;  /* The standard/fast clock config */
+        struct pmcmsptwi_clock highspeed; /* The highspeed clock config */
+};
+
+/* Corresponds to the main TWI configuration register */
+struct pmcmsptwi_cfg {
+        u8 arbf;        /* Bits 15:12,  default=0x03 */
+        u8 nak;         /* Bits 11:8,   default=0x03 */
+        u8 add10;       /* Bit 7,       default=0x00 */
+        u8 mst_code;    /* Bits 6:4,    default=0x00 */
+        u8 arb;         /* Bit 1,       default=0x01 */
+        u8 highspeed;   /* Bit 0,       default=0x00 */
+};
+
+/* A single pmctwi command to issue */
+struct pmcmsptwi_cmd {
+        u16 addr;       /* The slave address (7 or 10 bits) */
+        enum pmcmsptwi_cmd_type type;   /* The command type */
+        u8 write_len;   /* Number of bytes in the write buffer */
+        u8 read_len;    /* Number of bytes in the read buffer */
+        u8 *write_data; /* Buffer of characters to send */
+        u8 *read_data;  /* Buffer to fill with incoming data */
+};
+
+/* The private data */
+struct pmcmsptwi_data {
+        void __iomem *iobase;                   /* iomapped base for IO */
+        int irq;                                /* IRQ to use (0 disables) */
+        struct completion wait;                 /* Completion for xfer */
+        struct mutex lock;                      /* Used for threadsafeness */
+        enum pmcmsptwi_xfer_result last_result; /* result of last xfer */
+};
+
+/* The default settings */
+const static struct pmcmsptwi_clockcfg pmcmsptwi_defclockcfg = {
+        .standard = {
+                .filter = 0x3,
+                .clock  = 0x1f,
+        },
+        .highspeed = {
+                .filter = 0x3,
+                .clock  = 0x1f,
+        },
+};
+
+const static struct pmcmsptwi_cfg pmcmsptwi_defcfg = {
+        .arbf           = 0x03,
+        .nak            = 0x03,
+        .add10          = 0x00,
+        .mst_code       = 0x00,
+        .arb            = 0x01,
+        .highspeed      = 0x00,
+};
+
+static struct pmcmsptwi_data pmcmsptwi_data;
+
+static struct i2c_adapter pmcmsptwi_adapter;
+
+/* inline helper functions */
+static inline u32 pmcmsptwi_clock_to_reg(
+                        const struct pmcmsptwi_clock *clock)
+{
+        return ((clock->filter & 0xf) << 12) | (clock->clock & 0x03ff);
+}
+
+static inline void pmcmsptwi_reg_to_clock(
+                        u32 reg, struct pmcmsptwi_clock *clock)
+{
+        clock->filter = (reg >> 12) & 0xf;
+        clock->clock = reg & 0x03ff;
+}
+
+static inline u32 pmcmsptwi_cfg_to_reg(const struct pmcmsptwi_cfg *cfg)
+{
+        return ((cfg->arbf & 0xf) << 12) |
+                ((cfg->nak & 0xf) << 8) |
+                ((cfg->add10 & 0x1) << 7) |
+                ((cfg->mst_code & 0x7) << 4) |
+                ((cfg->arb & 0x1) << 1) |
+                (cfg->highspeed & 0x1);
+}
+
+static inline void pmcmsptwi_reg_to_cfg(u32 reg, struct pmcmsptwi_cfg *cfg)
+{
+        cfg->arbf = (reg >> 12) & 0xf;
+        cfg->nak = (reg >> 8) & 0xf;
+        cfg->add10 = (reg >> 7) & 0x1;
+        cfg->mst_code = (reg >> 4) & 0x7;
+        cfg->arb = (reg >> 1) & 0x1;
+        cfg->highspeed = reg & 0x1;
+}
+
+/*
+ * Sets the current clock configuration
+ */
+static void pmcmsptwi_set_clock_config(const struct pmcmsptwi_clockcfg *cfg,
+                                        struct pmcmsptwi_data *data)
+{
+        mutex_lock(&data->lock);
+        pmcmsptwi_writel(pmcmsptwi_clock_to_reg(&cfg->standard),
+                                data->iobase + MSP_TWI_SF_CLK_REG_OFFSET);
+        pmcmsptwi_writel(pmcmsptwi_clock_to_reg(&cfg->highspeed),
+                                data->iobase + MSP_TWI_HS_CLK_REG_OFFSET);
+        mutex_unlock(&data->lock);
+}
+
+/*
+ * Gets the current TWI bus configuration
+ */
+static void pmcmsptwi_get_twi_config(struct pmcmsptwi_cfg *cfg,
+                                        struct pmcmsptwi_data *data)
+{
+        mutex_lock(&data->lock);
+        pmcmsptwi_reg_to_cfg(pmcmsptwi_readl(
+                                data->iobase + MSP_TWI_CFG_REG_OFFSET), cfg);
+        mutex_unlock(&data->lock);
+}
+
+/*
+ * Sets the current TWI bus configuration
+ */
+static void pmcmsptwi_set_twi_config(const struct pmcmsptwi_cfg *cfg,
+                                        struct pmcmsptwi_data *data)
+{
+        mutex_lock(&data->lock);
+        pmcmsptwi_writel(pmcmsptwi_cfg_to_reg(cfg),
+                                data->iobase + MSP_TWI_CFG_REG_OFFSET);
+        mutex_unlock(&data->lock);
+}
+
+/*
+ * Parses the 'int_sts' register and returns a well-defined error code
+ */
+static enum pmcmsptwi_xfer_result pmcmsptwi_get_result(u32 reg)
+{
+        if (reg & MSP_TWI_INT_STS_LOST_ARBITRATION) {
+                dev_dbg(&pmcmsptwi_adapter.dev,
+                        "Result: Lost arbitration\n");
+                return MSP_TWI_XFER_LOST_ARBITRATION;
+        } else if (reg & MSP_TWI_INT_STS_NO_RESPONSE) {
+                dev_dbg(&pmcmsptwi_adapter.dev,
+                        "Result: No response\n");
+                return MSP_TWI_XFER_NO_RESPONSE;
+        } else if (reg & MSP_TWI_INT_STS_DATA_COLLISION) {
+                dev_dbg(&pmcmsptwi_adapter.dev,
+                        "Result: Data collision\n");
+                return MSP_TWI_XFER_DATA_COLLISION;
+        } else if (reg & MSP_TWI_INT_STS_BUSY) {
+                dev_dbg(&pmcmsptwi_adapter.dev,
+                        "Result: Bus busy\n");
+                return MSP_TWI_XFER_BUSY;
+        }
+
+        dev_dbg(&pmcmsptwi_adapter.dev, "Result: Operation succeeded\n");
+        return MSP_TWI_XFER_OK;
+}
+
+/*
+ * In interrupt mode, handle the interrupt.
+ * NOTE: Assumes data->lock is held.
+ */
+static irqreturn_t pmcmsptwi_interrupt(int irq, void *ptr)
+{
+        struct pmcmsptwi_data *data = ptr;
+
+        u32 reason = pmcmsptwi_readl(data->iobase +
+                                        MSP_TWI_INT_STS_REG_OFFSET);
+        pmcmsptwi_writel(reason, data->iobase + MSP_TWI_INT_STS_REG_OFFSET);
+
+        dev_dbg(&pmcmsptwi_adapter.dev, "Got interrupt 0x%08x\n", reason);
+        if (!(reason & MSP_TWI_INT_STS_DONE))
+                return IRQ_NONE;
+
+        data->last_result = pmcmsptwi_get_result(reason);
+        complete(&data->wait);
+
+        return IRQ_HANDLED;
+}
+
+/*
+ * Probe for and register the device and return 0 if there is one.
+ */
+static int __devinit pmcmsptwi_probe(struct platform_device *pldev)
+{
+        struct resource *res;
+        int rc = -ENODEV;
+
+        /* get the static platform resources */
+        res = platform_get_resource(pldev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pldev->dev, "IOMEM resource not found\n");
+                goto ret_err;
+        }
+
+        /* reserve the memory region */
+        if (!request_mem_region(res->start, res->end - res->start + 1,
+                                pldev->name)) {
+                dev_err(&pldev->dev,
+                        "Unable to get memory/io address region 0x%08x\n",
+                        res->start);
+                rc = -EBUSY;
+                goto ret_err;
+        }
+
+        /* remap the memory */
+        pmcmsptwi_data.iobase = ioremap_nocache(res->start,
+                                                res->end - res->start + 1);
+        if (!pmcmsptwi_data.iobase) {
+                dev_err(&pldev->dev,
+                        "Unable to ioremap address 0x%08x\n", res->start);
+                rc = -EIO;
+                goto ret_unreserve;
+        }
+
+        /* request the irq */
+        pmcmsptwi_data.irq = platform_get_irq(pldev, 0);
+        if (pmcmsptwi_data.irq) {
+                rc = request_irq(pmcmsptwi_data.irq, &pmcmsptwi_interrupt,
+                        IRQF_SHARED | IRQF_DISABLED | IRQF_SAMPLE_RANDOM,
+                        pldev->name, &pmcmsptwi_data);
+                if (rc == 0) {
+                        /*
+                         * Enable 'DONE' interrupt only.
+                         *
+                         * If you enable all interrupts, you will get one on
+                         * error and another when the operation completes.
+                         * This way you only have to handle one interrupt,
+                         * but you can still check all result flags.
+                         */
+                        pmcmsptwi_writel(MSP_TWI_INT_STS_DONE,
+                                        pmcmsptwi_data.iobase +
+                                        MSP_TWI_INT_MSK_REG_OFFSET);
+                } else {
+                        dev_warn(&pldev->dev,
+                                "Could not assign TWI IRQ handler "
+                                "to irq %d (continuing with poll)\n",
+                                pmcmsptwi_data.irq);
+                        pmcmsptwi_data.irq = 0;
+                }
+        }
+
+        init_completion(&pmcmsptwi_data.wait);
+        mutex_init(&pmcmsptwi_data.lock);
+
+        pmcmsptwi_set_clock_config(&pmcmsptwi_defclockcfg, &pmcmsptwi_data);
+        pmcmsptwi_set_twi_config(&pmcmsptwi_defcfg, &pmcmsptwi_data);
+
+        printk(KERN_INFO DRV_NAME ": Registering MSP71xx I2C adapter\n");
+
+        pmcmsptwi_adapter.dev.parent = &pldev->dev;
+        platform_set_drvdata(pldev, &pmcmsptwi_adapter);
+        i2c_set_adapdata(&pmcmsptwi_adapter, &pmcmsptwi_data);
+
+        rc = i2c_add_adapter(&pmcmsptwi_adapter);
+        if (rc) {
+                dev_err(&pldev->dev, "Unable to register I2C adapter\n");
+                goto ret_unmap;
+        }
+
+        return 0;
+
+ret_unmap:
+        platform_set_drvdata(pldev, NULL);
+        if (pmcmsptwi_data.irq) {
+                pmcmsptwi_writel(0,
+                        pmcmsptwi_data.iobase + MSP_TWI_INT_MSK_REG_OFFSET);
+                free_irq(pmcmsptwi_data.irq, &pmcmsptwi_data);
+        }
+
+        iounmap(pmcmsptwi_data.iobase);
+
+ret_unreserve:
+        release_mem_region(res->start, res->end - res->start + 1);
+
+ret_err:
+        return rc;
+}
+
+/*
+ * Release the device and return 0 if there is one.
+ */
+static int __devexit pmcmsptwi_remove(struct platform_device *pldev)
+{
+        struct resource *res;
+
+        i2c_del_adapter(&pmcmsptwi_adapter);
+
+        platform_set_drvdata(pldev, NULL);
+        if (pmcmsptwi_data.irq) {
+                pmcmsptwi_writel(0,
+                        pmcmsptwi_data.iobase + MSP_TWI_INT_MSK_REG_OFFSET);
+                free_irq(pmcmsptwi_data.irq, &pmcmsptwi_data);
+        }
+
+        iounmap(pmcmsptwi_data.iobase);
+
+        res = platform_get_resource(pldev, IORESOURCE_MEM, 0);
+        release_mem_region(res->start, res->end - res->start + 1);
+
+        return 0;
+}
+
+/*
+ * Polls the 'busy' register until the command is complete.
+ * NOTE: Assumes data->lock is held.
+ */
+static void pmcmsptwi_poll_complete(struct pmcmsptwi_data *data)
+{
+        int i;
+
+        for (i = 0; i < MSP_MAX_POLL; i++) {
+                u32 val = pmcmsptwi_readl(data->iobase +
+                                                MSP_TWI_BUSY_REG_OFFSET);
+                if (val == 0) {
+                        u32 reason = pmcmsptwi_readl(data->iobase +
+                                                MSP_TWI_INT_STS_REG_OFFSET);
+                        pmcmsptwi_writel(reason, data->iobase +
+                                                MSP_TWI_INT_STS_REG_OFFSET);
+                        data->last_result = pmcmsptwi_get_result(reason);
+                        return;
+                }
+                udelay(MSP_POLL_DELAY);
+        }
+
+        dev_dbg(&pmcmsptwi_adapter.dev, "Result: Poll timeout\n");
+        data->last_result = MSP_TWI_XFER_TIMEOUT;
+}
+
+/*
+ * Do the transfer (low level):
+ *   May use interrupt-driven or polling, depending on if an IRQ is
+ *   presently registered.
+ * NOTE: Assumes data->lock is held.
+ */
+static enum pmcmsptwi_xfer_result pmcmsptwi_do_xfer(
+                        u32 reg, struct pmcmsptwi_data *data)
+{
+        dev_dbg(&pmcmsptwi_adapter.dev, "Writing cmd reg 0x%08x\n", reg);
+        pmcmsptwi_writel(reg, data->iobase + MSP_TWI_CMD_REG_OFFSET);
+        if (data->irq) {
+                unsigned long timeleft = wait_for_completion_timeout(
+                                                &data->wait, MSP_IRQ_TIMEOUT);
+                if (timeleft == 0) {
+                        dev_dbg(&pmcmsptwi_adapter.dev,
+                                "Result: IRQ timeout\n");
+                        complete(&data->wait);
+                        data->last_result = MSP_TWI_XFER_TIMEOUT;
+                }
+        } else
+                pmcmsptwi_poll_complete(data);
+
+        return data->last_result;
+}
+
+/*
+ * Helper routine, converts 'pmctwi_cmd' struct to register format
+ */
+static inline u32 pmcmsptwi_cmd_to_reg(const struct pmcmsptwi_cmd *cmd)
+{
+        return ((cmd->type & 0x3) << 8) |
+                (((cmd->write_len - 1) & 0x7) << 4) |
+                ((cmd->read_len - 1) & 0x7);
+}
+
+/*
+ * Do the transfer (high level)
+ */
+static enum pmcmsptwi_xfer_result pmcmsptwi_xfer_cmd(
+                        struct pmcmsptwi_cmd *cmd,
+                        struct pmcmsptwi_data *data)
+{
+        enum pmcmsptwi_xfer_result retval;
+
+        if ((cmd->type == MSP_TWI_CMD_WRITE && cmd->write_len == 0) ||
+            (cmd->type == MSP_TWI_CMD_READ && cmd->read_len == 0) ||
+            (cmd->type == MSP_TWI_CMD_WRITE_READ &&
+            (cmd->read_len == 0 || cmd->write_len == 0))) {
+                dev_err(&pmcmsptwi_adapter.dev,
+                        "%s: Cannot transfer less than 1 byte\n",
+                        __FUNCTION__);
+                return -EINVAL;
+        }
+
+        if (cmd->read_len > MSP_MAX_BYTES_PER_RW ||
+            cmd->write_len > MSP_MAX_BYTES_PER_RW) {
+                dev_err(&pmcmsptwi_adapter.dev,
+                        "%s: Cannot transfer more than %d bytes\n",
+                        __FUNCTION__, MSP_MAX_BYTES_PER_RW);
+                return -EINVAL;
+        }
+
+        mutex_lock(&data->lock);
+        dev_dbg(&pmcmsptwi_adapter.dev,
+                "Setting address to 0x%04x\n", cmd->addr);
+        pmcmsptwi_writel(cmd->addr, data->iobase + MSP_TWI_ADD_REG_OFFSET);
+
+        if (cmd->type == MSP_TWI_CMD_WRITE ||
+            cmd->type == MSP_TWI_CMD_WRITE_READ) {
+                __be64 tmp = cpu_to_be64p((u64 *)cmd->write_data);
+                tmp >>= (MSP_MAX_BYTES_PER_RW - cmd->write_len) * 8;
+                dev_dbg(&pmcmsptwi_adapter.dev, "Writing 0x%016llx\n", tmp);
+                pmcmsptwi_writel(tmp & 0x00000000ffffffffLL,
+                                data->iobase + MSP_TWI_DAT_0_REG_OFFSET);
+                if (cmd->write_len > 4)
+                        pmcmsptwi_writel(tmp >> 32,
+                                data->iobase + MSP_TWI_DAT_1_REG_OFFSET);
+        }
+
+        retval = pmcmsptwi_do_xfer(pmcmsptwi_cmd_to_reg(cmd), data);
+        if (retval != MSP_TWI_XFER_OK)
+                goto xfer_err;
+
+        if (cmd->type == MSP_TWI_CMD_READ ||
+            cmd->type == MSP_TWI_CMD_WRITE_READ) {
+                int i;
+                u64 rmsk = ~(0xffffffffffffffffLL << (cmd->read_len * 8));
+                u64 tmp = (u64)pmcmsptwi_readl(data->iobase +
+                                        MSP_TWI_DAT_0_REG_OFFSET);
+                if (cmd->read_len > 4)
+                        tmp |= (u64)pmcmsptwi_readl(data->iobase +
+                                        MSP_TWI_DAT_1_REG_OFFSET) << 32;
+                tmp &= rmsk;
+                dev_dbg(&pmcmsptwi_adapter.dev, "Read 0x%016llx\n", tmp);
+
+                for (i = 0; i < cmd->read_len; i++)
+                        cmd->read_data[i] = tmp >> i;
+        }
+
+xfer_err:
+        mutex_unlock(&data->lock);
+
+        return retval;
+}
+
+/* -- Algorithm functions -- */
+
+/*
+ * Sends an i2c command out on the adapter
+ */
+static int pmcmsptwi_master_xfer(struct i2c_adapter *adap,
+                                struct i2c_msg *msg, int num)
+{
+        struct pmcmsptwi_data *data = i2c_get_adapdata(adap);
+        struct pmcmsptwi_cmd cmd;
+        struct pmcmsptwi_cfg oldcfg, newcfg;
+        int ret;
+
+        if (num > 2) {
+                dev_dbg(&adap->dev, "%d messages unsupported\n", num);
+                return -EINVAL;
+        } else if (num == 2) {
+                /* Check for a dual write-then-read command */
+                struct i2c_msg *nextmsg = msg + 1;
+                if (!(msg->flags & I2C_M_RD) &&
+                    (nextmsg->flags & I2C_M_RD) &&
+                    msg->addr == nextmsg->addr) {
+                        cmd.type = MSP_TWI_CMD_WRITE_READ;
+                        cmd.write_len = msg->len;
+                        cmd.write_data = msg->buf;
+                        cmd.read_len = nextmsg->len;
+                        cmd.read_data = nextmsg->buf;
+                } else {
+                        dev_dbg(&adap->dev,
+                                "Non write-read dual messages unsupported\n");
+                        return -EINVAL;
+                }
+        } else if (msg->flags & I2C_M_RD) {
+                cmd.type = MSP_TWI_CMD_READ;
+                cmd.read_len = msg->len;
+                cmd.read_data = msg->buf;
+                cmd.write_len = 0;
+                cmd.write_data = NULL;
+        } else {
+                cmd.type = MSP_TWI_CMD_WRITE;
+                cmd.read_len = 0;
+                cmd.read_data = NULL;
+                cmd.write_len = msg->len;
+                cmd.write_data = msg->buf;
+        }
+
+        if (msg->len == 0) {
+                dev_err(&adap->dev, "Zero-byte messages unsupported\n");
+                return -EINVAL;
+        }
+
+        cmd.addr = msg->addr;
+
+        if (msg->flags & I2C_M_TEN) {
+                pmcmsptwi_get_twi_config(&newcfg, data);
+                memcpy(&oldcfg, &newcfg, sizeof(oldcfg));
+
+                /* Set the special 10-bit address flag */
+                newcfg.add10 = 1;
+
+                pmcmsptwi_set_twi_config(&newcfg, data);
+        }
+
+        /* Execute the command */
+        ret = pmcmsptwi_xfer_cmd(&cmd, data);
+
+        if (msg->flags & I2C_M_TEN)
+                pmcmsptwi_set_twi_config(&oldcfg, data);
+
+        dev_dbg(&adap->dev, "I2C %s of %d bytes ",
+                (msg->flags & I2C_M_RD) ? "read" : "write", msg->len);
+        if (ret != MSP_TWI_XFER_OK) {
+                /*
+                 * TODO: We could potentially loop and retry in the case
+                 * of MSP_TWI_XFER_TIMEOUT.
+                 */
+                dev_dbg(&adap->dev, "failed\n");
+                return -1;
+        }
+
+        dev_dbg(&adap->dev, "succeeded\n");
+        return 0;
+}
+
+static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter)
+{
+        return I2C_FUNC_I2C | I2C_FUNC_10BIT_ADDR |
+                I2C_FUNC_SMBUS_BYTE | I2C_FUNC_SMBUS_BYTE_DATA |
+                I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_PROC_CALL;
+}
+
+/* -- Initialization -- */
+
+static struct i2c_algorithm pmcmsptwi_algo = {
+        .master_xfer    = pmcmsptwi_master_xfer,
+        .functionality  = pmcmsptwi_i2c_func,
+};
+
+static struct i2c_adapter pmcmsptwi_adapter = {
+        .owner          = THIS_MODULE,
+        .class          = I2C_CLASS_HWMON,
+        .algo           = &pmcmsptwi_algo,
+        .name           = DRV_NAME,
+};
+
+static struct platform_driver pmcmsptwi_driver = {
+        .probe  = pmcmsptwi_probe,
+        .remove = __devexit_p(pmcmsptwi_remove),
+        .driver {
+                .name   = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init pmcmsptwi_init(void)
+{
+        return platform_driver_register(&pmcmsptwi_driver);
+}
+
+static void __exit pmcmsptwi_exit(void)
+{
+        platform_driver_unregister(&pmcmsptwi_driver);
+}
+
+MODULE_DESCRIPTION("PMC MSP TWI/SMBus/I2C driver");
+MODULE_LICENSE("GPL");
+
+module_init(pmcmsptwi_init);
+module_exit(pmcmsptwi_exit);
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 1425d2245c82..0ab4f2627c26 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -121,8 +121,7 @@ static s32 i2c_powermac_smbus_xfer(	struct i2c_adapter*	adap,
                 if (rc)
                         goto bail;
                 rc = pmac_i2c_xfer(bus, addrdir, 1, command,
-                                   read ? data->block : &data->block[1],
-                                   data->block[0]);
+                                   &data->block[1], data->block[0]);
                 break;
 
         default:
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 28e7b91a4553..9d6b790d4321 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -921,7 +921,14 @@ static int i2c_pxa_probe(struct platform_device *dev)
                 i2c->adap.class = plat->class;
         }
 
-        ret = i2c_add_adapter(&i2c->adap);
+        /*
+         * If "dev->id" is negative we consider it as zero.
+         * The reason to do so is to avoid sysfs names that only make
+         * sense when there are multiple adapters.
+         */
+        i2c->adap.nr = dev->id >= 0 ? dev->id : 0;
+
+        ret = i2c_add_numbered_adapter(&i2c->adap);
         if (ret < 0) {
                 printk(KERN_INFO "I2C: Failed to add bus\n");
                 goto eadapt;
diff --git a/drivers/i2c/busses/i2c-rpx.c b/drivers/i2c/busses/i2c-rpx.c
deleted file mode 100644
index 8764df06f51d..000000000000
--- a/drivers/i2c/busses/i2c-rpx.c
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Embedded Planet RPX Lite MPC8xx CPM I2C interface.
- * Copyright (c) 1999 Dan Malek (dmalek@jlc.net).
- *
- * moved into proper i2c interface;
- * Brad Parker (brad@heeltoe.com)
- *
- * RPX lite specific parts of the i2c interface
- * Update:  There actually isn't anything RPXLite-specific about this module.
- * This should work for most any 8xx board.  The console messages have been 
- * changed to eliminate RPXLite references.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/stddef.h>
-#include <linux/i2c.h>
-#include <linux/i2c-algo-8xx.h>
-#include <asm/mpc8xx.h>
-#include <asm/commproc.h>
-
-
-static void
-rpx_iic_init(struct i2c_algo_8xx_data *data)
-{
-        volatile cpm8xx_t *cp;
-        volatile immap_t *immap;
-
-        cp = cpmp;      /* Get pointer to Communication Processor */
-        immap = (immap_t *)IMAP_ADDR;   /* and to internal registers */
-
-        data->iip = (iic_t *)&cp->cp_dparam[PROFF_IIC];
-
-        /* Check for and use a microcode relocation patch.
-        */
-        if ((data->reloc = data->iip->iic_rpbase))
-                data->iip = (iic_t *)&cp->cp_dpmem[data->iip->iic_rpbase];
-                
-        data->i2c = (i2c8xx_t *)&(immap->im_i2c);
-        data->cp = cp;
-
-        /* Initialize Port B IIC pins.
-        */
-        cp->cp_pbpar |= 0x00000030;
-        cp->cp_pbdir |= 0x00000030;
-        cp->cp_pbodr |= 0x00000030;
-
-        /* Allocate space for two transmit and two receive buffer
-         * descriptors in the DP ram.
-         */
-        data->dp_addr = cpm_dpalloc(sizeof(cbd_t) * 4, 8);
-                
-        /* ptr to i2c area */
-        data->i2c = (i2c8xx_t *)&(((immap_t *)IMAP_ADDR)->im_i2c);
-}
-
-static int rpx_install_isr(int irq, void (*func)(void *), void *data)
-{
-        /* install interrupt handler */
-        cpm_install_handler(irq, func, data);
-
-        return 0;
-}
-
-static struct i2c_algo_8xx_data rpx_data = {
-        .setisr = rpx_install_isr
-};
-
-static struct i2c_adapter rpx_ops = {
-        .owner          = THIS_MODULE,
-        .name           = "m8xx",
-        .id             = I2C_HW_MPC8XX_EPON,
-        .algo_data      = &rpx_data,
-};
-
-int __init i2c_rpx_init(void)
-{
-        printk(KERN_INFO "i2c-rpx: i2c MPC8xx driver\n");
-
-        /* reset hardware to sane state */
-        rpx_iic_init(&rpx_data);
-
-        if (i2c_8xx_add_bus(&rpx_ops) < 0) {
-                printk(KERN_ERR "i2c-rpx: Unable to register with I2C\n");
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
-void __exit i2c_rpx_exit(void)
-{
-        i2c_8xx_del_bus(&rpx_ops);
-}
-
-MODULE_AUTHOR("Dan Malek <dmalek@jlc.net>");
-MODULE_DESCRIPTION("I2C-Bus adapter routines for MPC8xx boards");
-
-module_init(i2c_rpx_init);
-module_exit(i2c_rpx_exit);
diff --git a/drivers/i2c/busses/i2c-savage4.c b/drivers/i2c/busses/i2c-savage4.c
index b7fb65c30112..8adf4abaa035 100644
--- a/drivers/i2c/busses/i2c-savage4.c
+++ b/drivers/i2c/busses/i2c-savage4.c
@@ -25,8 +25,6 @@
 /* This interfaces to the I2C bus of the Savage4 to gain access to
    the BT869 and possibly other I2C devices. The DDC bus is not
    yet supported because its register is not memory-mapped.
-   However we leave the DDC code here, commented out, to make
-   it easier to add later.
 */
 
 #include <linux/kernel.h>
@@ -37,36 +35,19 @@
 #include <linux/i2c-algo-bit.h>
 #include <asm/io.h>
 
-/* 3DFX defines */
-#define PCI_CHIP_SAVAGE3D       0x8A20
-#define PCI_CHIP_SAVAGE3D_MV    0x8A21
+/* device IDs */
 #define PCI_CHIP_SAVAGE4        0x8A22
 #define PCI_CHIP_SAVAGE2000     0x9102
-#define PCI_CHIP_PROSAVAGE_PM   0x8A25
-#define PCI_CHIP_PROSAVAGE_KM   0x8A26
-#define PCI_CHIP_SAVAGE_MX_MV   0x8c10
-#define PCI_CHIP_SAVAGE_MX      0x8c11
-#define PCI_CHIP_SAVAGE_IX_MV   0x8c12
-#define PCI_CHIP_SAVAGE_IX      0x8c13
 
 #define REG                     0xff20  /* Serial Port 1 Register */
 
 /* bit locations in the register */
-#define DDC_ENAB                0x00040000
-#define DDC_SCL_OUT             0x00080000
-#define DDC_SDA_OUT             0x00100000
-#define DDC_SCL_IN              0x00200000
-#define DDC_SDA_IN              0x00400000
 #define I2C_ENAB                0x00000020
 #define I2C_SCL_OUT             0x00000001
 #define I2C_SDA_OUT             0x00000002
 #define I2C_SCL_IN              0x00000008
 #define I2C_SDA_IN              0x00000010
 
-/* initialization states */
-#define INIT2                   0x20
-#define INIT3                   0x04
-
 /* delays */
 #define CYCLE_DELAY             10
 #define TIMEOUT                 (HZ / 2)
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index a6feed449dbe..283769cecee2 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -129,6 +129,7 @@ MODULE_PARM_DESC(force_addr, "Initialize the base address of the i2c controller"
 
 static struct pci_driver sis5595_driver;
 static unsigned short sis5595_base;
+static struct pci_dev *sis5595_pdev;
 
 static u8 sis5595_read(u8 reg)
 {
@@ -379,6 +380,8 @@ MODULE_DEVICE_TABLE (pci, sis5595_ids);
 
 static int __devinit sis5595_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
+        int err;
+
         if (sis5595_setup(dev)) {
                 dev_err(&dev->dev, "SIS5595 not detected, module not inserted.\n");
                 return -ENODEV;
@@ -389,20 +392,24 @@ static int __devinit sis5595_probe(struct pci_dev *dev, const struct pci_device_
 
         sprintf(sis5595_adapter.name, "SMBus SIS5595 adapter at %04x",
                 sis5595_base + SMB_INDEX);
-        return i2c_add_adapter(&sis5595_adapter);
-}
+        err = i2c_add_adapter(&sis5595_adapter);
+        if (err) {
+                release_region(sis5595_base + SMB_INDEX, 2);
+                return err;
+        }
 
-static void __devexit sis5595_remove(struct pci_dev *dev)
-{
-        i2c_del_adapter(&sis5595_adapter);
-        release_region(sis5595_base + SMB_INDEX, 2);
+        /* Always return failure here.  This is to allow other drivers to bind
+         * to this pci device.  We don't really want to have control over the
+         * pci device, we only wanted to read as few register values from it.
+         */
+        sis5595_pdev =  pci_dev_get(dev);
+        return -ENODEV;
 }
 
 static struct pci_driver sis5595_driver = {
         .name           = "sis5595_smbus",
         .id_table       = sis5595_ids,
         .probe          = sis5595_probe,
-        .remove         = __devexit_p(sis5595_remove),
 };
 
 static int __init i2c_sis5595_init(void)
@@ -413,6 +420,12 @@ static int __init i2c_sis5595_init(void)
 static void __exit i2c_sis5595_exit(void)
 {
         pci_unregister_driver(&sis5595_driver);
+        if (sis5595_pdev) {
+                i2c_del_adapter(&sis5595_adapter);
+                release_region(sis5595_base + SMB_INDEX, 2);
+                pci_dev_put(sis5595_pdev);
+                sis5595_pdev = NULL;
+        }
 }
 
 MODULE_AUTHOR("Frodo Looijaard <frodol@dds.nl>");
diff --git a/drivers/i2c/busses/i2c-taos-evm.c b/drivers/i2c/busses/i2c-taos-evm.c
new file mode 100644
index 000000000000..1b0cfd5472fd
--- /dev/null
+++ b/drivers/i2c/busses/i2c-taos-evm.c
@@ -0,0 +1,330 @@
+/*
+ * Driver for the TAOS evaluation modules
+ * These devices include an I2C master which can be controlled over the
+ * serial port.
+ *
+ * Copyright (C) 2007 Jean Delvare <khali@linux-fr.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/input.h>
+#include <linux/serio.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+
+#define TAOS_BUFFER_SIZE        63
+
+#define TAOS_STATE_INIT         0
+#define TAOS_STATE_IDLE         1
+#define TAOS_STATE_SEND         2
+#define TAOS_STATE_RECV         3
+
+#define TAOS_CMD_RESET          0x12
+
+static DECLARE_WAIT_QUEUE_HEAD(wq);
+
+struct taos_data {
+        struct i2c_adapter adapter;
+        struct i2c_client *client;
+        int state;
+        u8 addr;                /* last used address */
+        unsigned char buffer[TAOS_BUFFER_SIZE];
+        unsigned int pos;       /* position inside the buffer */
+};
+
+/* TAOS TSL2550 EVM */
+static struct i2c_board_info tsl2550_info = {
+        I2C_BOARD_INFO("tsl2550", 0x39),
+        .type   = "tsl2550",
+};
+
+/* Instantiate i2c devices based on the adapter name */
+static struct i2c_client *taos_instantiate_device(struct i2c_adapter *adapter)
+{
+        if (!strncmp(adapter->name, "TAOS TSL2550 EVM", 16)) {
+                dev_info(&adapter->dev, "Instantiating device %s at 0x%02x\n",
+                        tsl2550_info.driver_name, tsl2550_info.addr);
+                return i2c_new_device(adapter, &tsl2550_info);
+        }
+
+        return NULL;
+}
+
+static int taos_smbus_xfer(struct i2c_adapter *adapter, u16 addr,
+                           unsigned short flags, char read_write, u8 command,
+                           int size, union i2c_smbus_data *data)
+{
+        struct serio *serio = adapter->algo_data;
+        struct taos_data *taos = serio_get_drvdata(serio);
+        char *p;
+
+        /* Encode our transaction. "@" is for the device address, "$" for the
+           SMBus command and "#" for the data. */
+        p = taos->buffer;
+
+        /* The device remembers the last used address, no need to send it
+           again if it's the same */
+        if (addr != taos->addr)
+                p += sprintf(p, "@%02X", addr);
+
+        switch (size) {
+        case I2C_SMBUS_BYTE:
+                if (read_write == I2C_SMBUS_WRITE)
+                        sprintf(p, "$#%02X", command);
+                else
+                        sprintf(p, "$");
+                break;
+        case I2C_SMBUS_BYTE_DATA:
+                if (read_write == I2C_SMBUS_WRITE)
+                        sprintf(p, "$%02X#%02X", command, data->byte);
+                else
+                        sprintf(p, "$%02X", command);
+                break;
+        default:
+                dev_dbg(&adapter->dev, "Unsupported transaction size %d\n",
+                        size);
+                return -EINVAL;
+        }
+
+        /* Send the transaction to the TAOS EVM */
+        dev_dbg(&adapter->dev, "Command buffer: %s\n", taos->buffer);
+        taos->pos = 0;
+        taos->state = TAOS_STATE_SEND;
+        serio_write(serio, taos->buffer[0]);
+        wait_event_interruptible_timeout(wq, taos->state == TAOS_STATE_IDLE,
+                                         msecs_to_jiffies(250));
+        if (taos->state != TAOS_STATE_IDLE) {
+                dev_err(&adapter->dev, "Transaction failed "
+                        "(state=%d, pos=%d)\n", taos->state, taos->pos);
+                taos->addr = 0;
+                return -EIO;
+        }
+        taos->addr = addr;
+
+        /* Start the transaction and read the answer */
+        taos->pos = 0;
+        taos->state = TAOS_STATE_RECV;
+        serio_write(serio, read_write == I2C_SMBUS_WRITE ? '>' : '<');
+        wait_event_interruptible_timeout(wq, taos->state == TAOS_STATE_IDLE,
+                                         msecs_to_jiffies(150));
+        if (taos->state != TAOS_STATE_IDLE
+         || taos->pos != 6) {
+                dev_err(&adapter->dev, "Transaction timeout (pos=%d)\n",
+                        taos->pos);
+                return -EIO;
+        }
+        dev_dbg(&adapter->dev, "Answer buffer: %s\n", taos->buffer);
+
+        /* Interpret the returned string */
+        p = taos->buffer + 2;
+        p[3] = '\0';
+        if (!strcmp(p, "NAK"))
+                return -ENODEV;
+
+        if (read_write == I2C_SMBUS_WRITE) {
+                if (!strcmp(p, "ACK"))
+                        return 0;
+        } else {
+                if (p[0] == 'x') {
+                        data->byte = simple_strtol(p + 1, NULL, 16);
+                        return 0;
+                }
+        }
+
+        return -EIO;
+}
+
+static u32 taos_smbus_func(struct i2c_adapter *adapter)
+{
+        return I2C_FUNC_SMBUS_BYTE | I2C_FUNC_SMBUS_BYTE_DATA;
+}
+
+static const struct i2c_algorithm taos_algorithm = {
+        .smbus_xfer     = taos_smbus_xfer,
+        .functionality  = taos_smbus_func,
+};
+
+static irqreturn_t taos_interrupt(struct serio *serio, unsigned char data,
+                                  unsigned int flags)
+{
+        struct taos_data *taos = serio_get_drvdata(serio);
+
+        switch (taos->state) {
+        case TAOS_STATE_INIT:
+                taos->buffer[taos->pos++] = data;
+                if (data == ':'
+                 || taos->pos == TAOS_BUFFER_SIZE - 1) {
+                        taos->buffer[taos->pos] = '\0';
+                        taos->state = TAOS_STATE_IDLE;
+                        wake_up_interruptible(&wq);
+                }
+                break;
+        case TAOS_STATE_SEND:
+                if (taos->buffer[++taos->pos])
+                        serio_write(serio, taos->buffer[taos->pos]);
+                else {
+                        taos->state = TAOS_STATE_IDLE;
+                        wake_up_interruptible(&wq);
+                }
+                break;
+        case TAOS_STATE_RECV:
+                taos->buffer[taos->pos++] = data;
+                if (data == ']') {
+                        taos->buffer[taos->pos] = '\0';
+                        taos->state = TAOS_STATE_IDLE;
+                        wake_up_interruptible(&wq);
+                }
+                break;
+        }
+
+        return IRQ_HANDLED;
+}
+
+/* Extract the adapter name from the buffer received after reset.
+   The buffer is modified and a pointer inside the buffer is returned. */
+static char *taos_adapter_name(char *buffer)
+{
+        char *start, *end;
+
+        start = strstr(buffer, "TAOS ");
+        if (!start)
+                return NULL;
+
+        end = strchr(start, '\r');
+        if (!end)
+                return NULL;
+        *end = '\0';
+
+        return start;
+}
+
+static int taos_connect(struct serio *serio, struct serio_driver *drv)
+{
+        struct taos_data *taos;
+        struct i2c_adapter *adapter;
+        char *name;
+        int err;
+
+        taos = kzalloc(sizeof(struct taos_data), GFP_KERNEL);
+        if (!taos) {
+                err = -ENOMEM;
+                goto exit;
+        }
+        taos->state = TAOS_STATE_INIT;
+        serio_set_drvdata(serio, taos);
+
+        err = serio_open(serio, drv);
+        if (err)
+                goto exit_kfree;
+
+        adapter = &taos->adapter;
+        adapter->owner = THIS_MODULE;
+        adapter->algo = &taos_algorithm;
+        adapter->algo_data = serio;
+        adapter->dev.parent = &serio->dev;
+
+        /* Reset the TAOS evaluation module to identify it */
+        serio_write(serio, TAOS_CMD_RESET);
+        wait_event_interruptible_timeout(wq, taos->state == TAOS_STATE_IDLE,
+                                         msecs_to_jiffies(2000));
+
+        if (taos->state != TAOS_STATE_IDLE) {
+                err = -ENODEV;
+                dev_dbg(&serio->dev, "TAOS EVM reset failed (state=%d, "
+                        "pos=%d)\n", taos->state, taos->pos);
+                goto exit_close;
+        }
+
+        name = taos_adapter_name(taos->buffer);
+        if (!name) {
+                err = -ENODEV;
+                dev_err(&serio->dev, "TAOS EVM identification failed\n");
+                goto exit_close;
+        }
+        strlcpy(adapter->name, name, sizeof(adapter->name));
+
+        err = i2c_add_adapter(adapter);
+        if (err)
+                goto exit_close;
+        dev_dbg(&serio->dev, "Connected to TAOS EVM\n");
+
+        taos->client = taos_instantiate_device(adapter);
+        return 0;
+
+ exit_close:
+        serio_close(serio);
+ exit_kfree:
+        serio_set_drvdata(serio, NULL);
+        kfree(taos);
+ exit:
+        return err;
+}
+
+static void taos_disconnect(struct serio *serio)
+{
+        struct taos_data *taos = serio_get_drvdata(serio);
+
+        if (taos->client)
+                i2c_unregister_device(taos->client);
+        i2c_del_adapter(&taos->adapter);
+        serio_close(serio);
+        serio_set_drvdata(serio, NULL);
+        kfree(taos);
+
+        dev_dbg(&serio->dev, "Disconnected from TAOS EVM\n");
+}
+
+static struct serio_device_id taos_serio_ids[] = {
+        {
+                .type   = SERIO_RS232,
+                .proto  = SERIO_TAOSEVM,
+                .id     = SERIO_ANY,
+                .extra  = SERIO_ANY,
+        },
+        { 0 }
+};
+MODULE_DEVICE_TABLE(serio, taos_serio_ids);
+
+static struct serio_driver taos_drv = {
+        .driver         = {
+                .name   = "taos-evm",
+        },
+        .description    = "TAOS evaluation module driver",
+        .id_table       = taos_serio_ids,
+        .connect        = taos_connect,
+        .disconnect     = taos_disconnect,
+        .interrupt      = taos_interrupt,
+};
+
+static int __init taos_init(void)
+{
+        return serio_register_driver(&taos_drv);
+}
+
+static void __exit taos_exit(void)
+{
+        serio_unregister_driver(&taos_drv);
+}
+
+MODULE_AUTHOR("Jean Delvare <khali@linux-fr.org>");
+MODULE_DESCRIPTION("TAOS evaluation module driver");
+MODULE_LICENSE("GPL");
+
+module_init(taos_init);
+module_exit(taos_exit);
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index 1d76b9e5207a..edc275002f80 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -235,7 +235,7 @@ static s32 vt596_access(struct i2c_adapter *adap, u16 addr,
                 if (!(vt596_features & FEATURE_I2CBLOCK))
                         goto exit_unsupported;
                 if (read_write == I2C_SMBUS_READ)
-                        outb_p(I2C_SMBUS_BLOCK_MAX, SMBHSTDAT0);
+                        outb_p(data->block[0], SMBHSTDAT0);
                 /* Fall through */
         case I2C_SMBUS_BLOCK_DATA:
                 outb_p(command, SMBHSTCMD);
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index 0d6bd4f7b7fa..e6c4a2b762ec 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -310,8 +310,6 @@ static s32 scx200_acb_smbus_xfer(struct i2c_adapter *adapter,
                 break;
 
         case I2C_SMBUS_I2C_BLOCK_DATA:
-                if (rw == I2C_SMBUS_READ)
-                        data->block[0] = I2C_SMBUS_BLOCK_MAX; /* For now */
                 len = data->block[0];
                 if (len == 0 || len > I2C_SMBUS_BLOCK_MAX)
                         return -EINVAL;
@@ -388,7 +386,7 @@ static const struct i2c_algorithm scx200_acb_algorithm = {
 };
 
 static struct scx200_acb_iface *scx200_acb_list;
-static DECLARE_MUTEX(scx200_acb_list_mutex);
+static DEFINE_MUTEX(scx200_acb_list_mutex);
 
 static __init int scx200_acb_probe(struct scx200_acb_iface *iface)
 {
@@ -472,10 +470,10 @@ static int __init scx200_acb_create(struct scx200_acb_iface *iface)
                 return -ENODEV;
         }
 
-        down(&scx200_acb_list_mutex);
+        mutex_lock(&scx200_acb_list_mutex);
         iface->next = scx200_acb_list;
         scx200_acb_list = iface;
-        up(&scx200_acb_list_mutex);
+        mutex_unlock(&scx200_acb_list_mutex);
 
         return 0;
 }
@@ -633,10 +631,10 @@ static void __exit scx200_acb_cleanup(void)
 {
         struct scx200_acb_iface *iface;
 
-        down(&scx200_acb_list_mutex);
+        mutex_lock(&scx200_acb_list_mutex);
         while ((iface = scx200_acb_list) != NULL) {
                 scx200_acb_list = iface->next;
-                up(&scx200_acb_list_mutex);
+                mutex_unlock(&scx200_acb_list_mutex);
 
                 i2c_del_adapter(&iface->adapter);
 
@@ -648,9 +646,9 @@ static void __exit scx200_acb_cleanup(void)
                         release_region(iface->base, 8);
 
                 kfree(iface);
-                down(&scx200_acb_list_mutex);
+                mutex_lock(&scx200_acb_list_mutex);
         }
-        up(&scx200_acb_list_mutex);
+        mutex_unlock(&scx200_acb_list_mutex);
 }
 
 module_init(scx200_acb_init);
diff --git a/drivers/i2c/chips/Kconfig b/drivers/i2c/chips/Kconfig
index ea085a006ead..3944e889cb21 100644
--- a/drivers/i2c/chips/Kconfig
+++ b/drivers/i2c/chips/Kconfig
@@ -5,7 +5,7 @@
 menu "Miscellaneous I2C Chip support"
 
 config SENSORS_DS1337
-        tristate "Dallas Semiconductor DS1337 and DS1339 Real Time Clock"
+        tristate "Dallas DS1337 and DS1339 Real Time Clock (DEPRECATED)"
         depends on EXPERIMENTAL
         help
           If you say yes here you get support for Dallas Semiconductor
@@ -14,8 +14,11 @@ config SENSORS_DS1337
           This driver can also be built as a module.  If so, the module
           will be called ds1337.
 
+          This driver is deprecated and will be dropped soon. Use
+          rtc-ds1307 instead.
+
 config SENSORS_DS1374
-        tristate "Maxim/Dallas Semiconductor DS1374 Real Time Clock"
+        tristate "Dallas DS1374 Real Time Clock (DEPRECATED)"
         depends on EXPERIMENTAL
         help
           If you say yes here you get support for Dallas Semiconductor
@@ -24,6 +27,19 @@ config SENSORS_DS1374
           This driver can also be built as a module.  If so, the module
           will be called ds1374.
 
+          This driver is deprecated and will be dropped soon. Use
+          rtc-ds1374 instead.
+
+config DS1682
+        tristate "Dallas DS1682 Total Elapsed Time Recorder with Alarm"
+        depends on EXPERIMENTAL
+        help
+          If you say yes here you get support for Dallas Semiconductor
+          DS1682 Total Elapsed Time Recorder.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ds1682.
+
 config SENSORS_EEPROM
         tristate "EEPROM reader"
         depends on EXPERIMENTAL
@@ -101,7 +117,7 @@ config TPS65010
           will be called tps65010.
 
 config SENSORS_M41T00
-        tristate "ST M41T00 RTC chip"
+        tristate "ST M41T00 RTC chip (DEPRECATED)"
         depends on PPC32
         help
           If you say yes here you get support for the ST M41T00 RTC chip.
@@ -109,6 +125,9 @@ config SENSORS_M41T00
           This driver can also be built as a module.  If so, the module
           will be called m41t00.
 
+          This driver is deprecated and will be dropped soon. Use
+          rtc-ds1307 or rtc-m41t80 instead.
+
 config SENSORS_MAX6875
         tristate "Maxim MAX6875 Power supply supervisor"
         depends on EXPERIMENTAL
@@ -124,4 +143,14 @@ config SENSORS_MAX6875
           This driver can also be built as a module.  If so, the module
           will be called max6875.
 
+config SENSORS_TSL2550
+        tristate "Taos TSL2550 ambient light sensor"
+        depends on EXPERIMENTAL
+        help
+          If you say yes here you get support for the Taos TSL2550
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called tsl2550.
+
 endmenu
diff --git a/drivers/i2c/chips/Makefile b/drivers/i2c/chips/Makefile
index 779868ef2e26..d8cbeb3f4b63 100644
--- a/drivers/i2c/chips/Makefile
+++ b/drivers/i2c/chips/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_SENSORS_DS1337)    += ds1337.o
 obj-$(CONFIG_SENSORS_DS1374)    += ds1374.o
+obj-$(CONFIG_DS1682)            += ds1682.o
 obj-$(CONFIG_SENSORS_EEPROM)    += eeprom.o
 obj-$(CONFIG_SENSORS_MAX6875)   += max6875.o
 obj-$(CONFIG_SENSORS_M41T00)    += m41t00.o
@@ -12,6 +13,7 @@ obj-$(CONFIG_SENSORS_PCF8574)	+= pcf8574.o
 obj-$(CONFIG_SENSORS_PCF8591)   += pcf8591.o
 obj-$(CONFIG_ISP1301_OMAP)      += isp1301_omap.o
 obj-$(CONFIG_TPS65010)          += tps65010.o
+obj-$(CONFIG_SENSORS_TSL2550)   += tsl2550.o
 
 ifeq ($(CONFIG_I2C_DEBUG_CHIP),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/drivers/i2c/chips/ds1682.c b/drivers/i2c/chips/ds1682.c
new file mode 100644
index 000000000000..25fd4676fb17
--- /dev/null
+++ b/drivers/i2c/chips/ds1682.c
@@ -0,0 +1,259 @@
+/*
+ * Dallas Semiconductor DS1682 Elapsed Time Recorder device driver
+ *
+ * Written by: Grant Likely <grant.likely@secretlab.ca>
+ *
+ * Copyright (C) 2007 Secret Lab Technologies Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * The DS1682 elapsed timer recorder is a simple device that implements
+ * one elapsed time counter, one event counter, an alarm signal and 10
+ * bytes of general purpose EEPROM.
+ *
+ * This driver provides access to the DS1682 counters and user data via
+ * the sysfs.  The following attributes are added to the device node:
+ *     elapsed_time (u32): Total elapsed event time in ms resolution
+ *     alarm_time (u32): When elapsed time exceeds the value in alarm_time,
+ *                       then the alarm pin is asserted.
+ *     event_count (u16): number of times the event pin has gone low.
+ *     eeprom (u8[10]): general purpose EEPROM
+ *
+ * Counter registers and user data are both read/write unless the device
+ * has been write protected.  This driver does not support turning off write
+ * protection.  Once write protection is turned on, it is impossible to
+ * turn it off again, so I have left the feature out of this driver to avoid
+ * accidental enabling, but it is trivial to add write protect support.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/string.h>
+#include <linux/list.h>
+#include <linux/sysfs.h>
+#include <linux/ctype.h>
+#include <linux/hwmon-sysfs.h>
+
+/* Device registers */
+#define DS1682_REG_CONFIG               0x00
+#define DS1682_REG_ALARM                0x01
+#define DS1682_REG_ELAPSED              0x05
+#define DS1682_REG_EVT_CNTR             0x09
+#define DS1682_REG_EEPROM               0x0b
+#define DS1682_REG_RESET                0x1d
+#define DS1682_REG_WRITE_DISABLE        0x1e
+#define DS1682_REG_WRITE_MEM_DISABLE    0x1f
+
+#define DS1682_EEPROM_SIZE              10
+
+/*
+ * Generic counter attributes
+ */
+static ssize_t ds1682_show(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        __le32 val = 0;
+        int rc;
+
+        dev_dbg(dev, "ds1682_show() called on %s\n", attr->attr.name);
+
+        /* Read the register */
+        rc = i2c_smbus_read_i2c_block_data(client, sattr->index, sattr->nr,
+                                           (u8 *) & val);
+        if (rc < 0)
+                return -EIO;
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale them up to milliseconds */
+        if (sattr->nr == 4)
+                return sprintf(buf, "%llu\n", ((u64) le32_to_cpu(val)) * 250);
+
+        /* Format the output string and return # of bytes */
+        return sprintf(buf, "%li\n", (long)le32_to_cpu(val));
+}
+
+static ssize_t ds1682_store(struct device *dev, struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        struct sensor_device_attribute_2 *sattr = to_sensor_dev_attr_2(attr);
+        struct i2c_client *client = to_i2c_client(dev);
+        char *endp;
+        u64 val;
+        __le32 val_le;
+        int rc;
+
+        dev_dbg(dev, "ds1682_store() called on %s\n", attr->attr.name);
+
+        /* Decode input */
+        val = simple_strtoull(buf, &endp, 0);
+        if (buf == endp) {
+                dev_dbg(dev, "input string not a number\n");
+                return -EINVAL;
+        }
+
+        /* Special case: the 32 bit regs are time values with 1/4s
+         * resolution, scale input down to quarter-seconds */
+        if (sattr->nr == 4)
+                do_div(val, 250);
+
+        /* write out the value */
+        val_le = cpu_to_le32(val);
+        rc = i2c_smbus_write_i2c_block_data(client, sattr->index, sattr->nr,
+                                            (u8 *) & val_le);
+        if (rc < 0) {
+                dev_err(dev, "register write failed; reg=0x%x, size=%i\n",
+                        sattr->index, sattr->nr);
+                return -EIO;
+        }
+
+        return count;
+}
+
+/*
+ * Simple register attributes
+ */
+static SENSOR_DEVICE_ATTR_2(elapsed_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ELAPSED);
+static SENSOR_DEVICE_ATTR_2(alarm_time, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 4, DS1682_REG_ALARM);
+static SENSOR_DEVICE_ATTR_2(event_count, S_IRUGO | S_IWUSR, ds1682_show,
+                            ds1682_store, 2, DS1682_REG_EVT_CNTR);
+
+static const struct attribute_group ds1682_group = {
+        .attrs = (struct attribute *[]) {
+                &sensor_dev_attr_elapsed_time.dev_attr.attr,
+                &sensor_dev_attr_alarm_time.dev_attr.attr,
+                &sensor_dev_attr_event_count.dev_attr.attr,
+                NULL,
+        },
+};
+
+/*
+ * User data attribute
+ */
+static ssize_t ds1682_eeprom_read(struct kobject *kobj, char *buf, loff_t off,
+                                  size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+        int rc;
+
+        dev_dbg(&client->dev, "ds1682_eeprom_read(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return 0;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        rc = i2c_smbus_read_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf);
+        if (rc < 0)
+                return -EIO;
+
+        return count;
+}
+
+static ssize_t ds1682_eeprom_write(struct kobject *kobj, char *buf, loff_t off,
+                                   size_t count)
+{
+        struct i2c_client *client = kobj_to_i2c_client(kobj);
+
+        dev_dbg(&client->dev, "ds1682_eeprom_write(p=%p, off=%lli, c=%zi)\n",
+                buf, off, count);
+
+        if (off >= DS1682_EEPROM_SIZE)
+                return -ENOSPC;
+
+        if (off + count > DS1682_EEPROM_SIZE)
+                count = DS1682_EEPROM_SIZE - off;
+
+        /* Write out to the device */
+        if (i2c_smbus_write_i2c_block_data(client, DS1682_REG_EEPROM + off,
+                                           count, buf) < 0)
+                return -EIO;
+
+        return count;
+}
+
+static struct bin_attribute ds1682_eeprom_attr = {
+        .attr = {
+                .name = "eeprom",
+                .mode = S_IRUGO | S_IWUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = DS1682_EEPROM_SIZE,
+        .read = ds1682_eeprom_read,
+        .write = ds1682_eeprom_write,
+};
+
+/*
+ * Called when a ds1682 device is matched with this driver
+ */
+static int ds1682_probe(struct i2c_client *client)
+{
+        int rc;
+
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_I2C_BLOCK)) {
+                dev_err(&client->dev, "i2c bus does not support the ds1682\n");
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        rc = sysfs_create_group(&client->dev.kobj, &ds1682_group);
+        if (rc)
+                goto exit;
+
+        rc = sysfs_create_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        if (rc)
+                goto exit_bin_attr;
+
+        return 0;
+
+ exit_bin_attr:
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+ exit:
+        return rc;
+}
+
+static int ds1682_remove(struct i2c_client *client)
+{
+        sysfs_remove_bin_file(&client->dev.kobj, &ds1682_eeprom_attr);
+        sysfs_remove_group(&client->dev.kobj, &ds1682_group);
+        return 0;
+}
+
+static struct i2c_driver ds1682_driver = {
+        .driver = {
+                .name = "ds1682",
+        },
+        .probe = ds1682_probe,
+        .remove = ds1682_remove,
+};
+
+static int __init ds1682_init(void)
+{
+        return i2c_add_driver(&ds1682_driver);
+}
+
+static void __exit ds1682_exit(void)
+{
+        i2c_del_driver(&ds1682_driver);
+}
+
+MODULE_AUTHOR("Grant Likely <grant.likely@secretlab.ca>");
+MODULE_DESCRIPTION("DS1682 Elapsed Time Indicator driver");
+MODULE_LICENSE("GPL");
+
+module_init(ds1682_init);
+module_exit(ds1682_exit);
diff --git a/drivers/i2c/chips/eeprom.c b/drivers/i2c/chips/eeprom.c
index bfce13c8f1ff..d3da1fb05b9b 100644
--- a/drivers/i2c/chips/eeprom.c
+++ b/drivers/i2c/chips/eeprom.c
@@ -88,8 +88,10 @@ static void eeprom_update_client(struct i2c_client *client, u8 slice)
                 dev_dbg(&client->dev, "Starting eeprom update, slice %u\n", slice);
 
                 if (i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_READ_I2C_BLOCK)) {
-                        for (i = slice << 5; i < (slice + 1) << 5; i += I2C_SMBUS_BLOCK_MAX)
-                                if (i2c_smbus_read_i2c_block_data(client, i, data->data + i) != I2C_SMBUS_BLOCK_MAX)
+                        for (i = slice << 5; i < (slice + 1) << 5; i += 32)
+                                if (i2c_smbus_read_i2c_block_data(client, i,
+                                                        32, data->data + i)
+                                                        != 32)
                                         goto exit;
                 } else {
                         if (i2c_smbus_write_byte(client, slice << 5)) {
@@ -110,7 +112,8 @@ exit:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t eeprom_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t eeprom_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                           char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = to_i2c_client(container_of(kobj, struct device, kobj));
         struct eeprom_data *data = i2c_get_clientdata(client);
@@ -143,7 +146,6 @@ static struct bin_attribute eeprom_attr = {
         .attr = {
                 .name = "eeprom",
                 .mode = S_IRUGO,
-                .owner = THIS_MODULE,
         },
         .size = EEPROM_SIZE,
         .read = eeprom_read,
diff --git a/drivers/i2c/chips/max6875.c b/drivers/i2c/chips/max6875.c
index 76645c142977..64692f666372 100644
--- a/drivers/i2c/chips/max6875.c
+++ b/drivers/i2c/chips/max6875.c
@@ -106,6 +106,7 @@ static void max6875_update_slice(struct i2c_client *client, int slice)
                                             I2C_FUNC_SMBUS_READ_I2C_BLOCK)) {
                         if (i2c_smbus_read_i2c_block_data(client,
                                                           MAX6875_CMD_BLK_READ,
+                                                          SLICE_SIZE,
                                                           buf) != SLICE_SIZE) {
                                 goto exit_up;
                         }
@@ -125,8 +126,9 @@ exit_up:
         mutex_unlock(&data->update_lock);
 }
 
-static ssize_t max6875_read(struct kobject *kobj, char *buf, loff_t off,
-                            size_t count)
+static ssize_t max6875_read(struct kobject *kobj,
+                            struct bin_attribute *bin_attr,
+                            char *buf, loff_t off, size_t count)
 {
         struct i2c_client *client = kobj_to_i2c_client(kobj);
         struct max6875_data *data = i2c_get_clientdata(client);
@@ -152,7 +154,6 @@ static struct bin_attribute user_eeprom_attr = {
         .attr = {
                 .name = "eeprom",
                 .mode = S_IRUGO,
-                .owner = THIS_MODULE,
         },
         .size = USER_EEPROM_SIZE,
         .read = max6875_read,
diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
new file mode 100644
index 000000000000..3de4b19ba08f
--- /dev/null
+++ b/drivers/i2c/chips/tsl2550.c
@@ -0,0 +1,460 @@
+/*
+ *  tsl2550.c - Linux kernel modules for ambient light sensor
+ *
+ *  Copyright (C) 2007 Rodolfo Giometti <giometti@linux.it>
+ *  Copyright (C) 2007 Eurotech S.p.A. <info@eurotech.it>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/mutex.h>
+#include <linux/delay.h>
+
+#define TSL2550_DRV_NAME        "tsl2550"
+#define DRIVER_VERSION          "1.1.1"
+
+/*
+ * Defines
+ */
+
+#define TSL2550_POWER_DOWN              0x00
+#define TSL2550_POWER_UP                0x03
+#define TSL2550_STANDARD_RANGE          0x18
+#define TSL2550_EXTENDED_RANGE          0x1d
+#define TSL2550_READ_ADC0               0x43
+#define TSL2550_READ_ADC1               0x83
+
+/*
+ * Structs
+ */
+
+struct tsl2550_data {
+        struct i2c_client *client;
+        struct mutex update_lock;
+
+        unsigned int power_state : 1;
+        unsigned int operating_mode : 1;
+};
+
+/*
+ * Global data
+ */
+
+static const u8 TSL2550_MODE_RANGE[2] = {
+        TSL2550_STANDARD_RANGE, TSL2550_EXTENDED_RANGE,
+};
+
+/*
+ * Management functions
+ */
+
+static int tsl2550_set_operating_mode(struct i2c_client *client, int mode)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+
+        int ret = i2c_smbus_write_byte(client, TSL2550_MODE_RANGE[mode]);
+
+        data->operating_mode = mode;
+
+        return ret;
+}
+
+static int tsl2550_set_power_state(struct i2c_client *client, int state)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        if (state == 0)
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_DOWN);
+        else {
+                ret = i2c_smbus_write_byte(client, TSL2550_POWER_UP);
+
+                /* On power up we should reset operating mode also... */
+                tsl2550_set_operating_mode(client, data->operating_mode);
+        }
+
+        data->power_state = state;
+
+        return ret;
+}
+
+static int tsl2550_get_adc_value(struct i2c_client *client, u8 cmd)
+{
+        unsigned long end;
+        int loop = 0, ret = 0;
+
+        /*
+         * Read ADC channel waiting at most 400ms (see data sheet for further
+         * info).
+         * To avoid long busy wait we spin for few milliseconds then
+         * start sleeping.
+         */
+        end = jiffies + msecs_to_jiffies(400);
+        while (time_before(jiffies, end)) {
+                i2c_smbus_write_byte(client, cmd);
+
+                if (loop++ < 5)
+                        mdelay(1);
+                else
+                        msleep(1);
+
+                ret = i2c_smbus_read_byte(client);
+                if (ret < 0)
+                        return ret;
+                else if (ret & 0x0080)
+                        break;
+        }
+        if (!(ret & 0x80))
+                return -EIO;
+        return ret & 0x7f;      /* remove the "valid" bit */
+}
+
+/*
+ * LUX calculation
+ */
+
+#define TSL2550_MAX_LUX         1846
+
+static const u8 ratio_lut[] = {
+        100, 100, 100, 100, 100, 100, 100, 100,
+        100, 100, 100, 100, 100, 100, 99, 99,
+        99, 99, 99, 99, 99, 99, 99, 99,
+        99, 99, 99, 98, 98, 98, 98, 98,
+        98, 98, 97, 97, 97, 97, 97, 96,
+        96, 96, 96, 95, 95, 95, 94, 94,
+        93, 93, 93, 92, 92, 91, 91, 90,
+        89, 89, 88, 87, 87, 86, 85, 84,
+        83, 82, 81, 80, 79, 78, 77, 75,
+        74, 73, 71, 69, 68, 66, 64, 62,
+        60, 58, 56, 54, 52, 49, 47, 44,
+        42, 41, 40, 40, 39, 39, 38, 38,
+        37, 37, 37, 36, 36, 36, 35, 35,
+        35, 35, 34, 34, 34, 34, 33, 33,
+        33, 33, 32, 32, 32, 32, 32, 31,
+        31, 31, 31, 31, 30, 30, 30, 30,
+        30,
+};
+
+static const u16 count_lut[] = {
+        0, 1, 2, 3, 4, 5, 6, 7,
+        8, 9, 10, 11, 12, 13, 14, 15,
+        16, 18, 20, 22, 24, 26, 28, 30,
+        32, 34, 36, 38, 40, 42, 44, 46,
+        49, 53, 57, 61, 65, 69, 73, 77,
+        81, 85, 89, 93, 97, 101, 105, 109,
+        115, 123, 131, 139, 147, 155, 163, 171,
+        179, 187, 195, 203, 211, 219, 227, 235,
+        247, 263, 279, 295, 311, 327, 343, 359,
+        375, 391, 407, 423, 439, 455, 471, 487,
+        511, 543, 575, 607, 639, 671, 703, 735,
+        767, 799, 831, 863, 895, 927, 959, 991,
+        1039, 1103, 1167, 1231, 1295, 1359, 1423, 1487,
+        1551, 1615, 1679, 1743, 1807, 1871, 1935, 1999,
+        2095, 2223, 2351, 2479, 2607, 2735, 2863, 2991,
+        3119, 3247, 3375, 3503, 3631, 3759, 3887, 4015,
+};
+
+/*
+ * This function is described into Taos TSL2550 Designer's Notebook
+ * pages 2, 3.
+ */
+static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+{
+        unsigned int lux;
+
+        /* Look up count from channel values */
+        u16 c0 = count_lut[ch0];
+        u16 c1 = count_lut[ch1];
+
+        /*
+         * Calculate ratio.
+         * Note: the "128" is a scaling factor
+         */
+        u8 r = 128;
+
+        /* Avoid division by 0 and count 1 cannot be greater than count 0 */
+        if (c0 && (c1 <= c0))
+                r = c1 * 128 / c0;
+        else
+                return -1;
+
+        /* Calculate LUX */
+        lux = ((c0 - c1) * ratio_lut[r]) / 256;
+
+        /* LUX range check */
+        return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+}
+
+/*
+ * SysFS support
+ */
+
+static ssize_t tsl2550_show_power_state(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->power_state);
+}
+
+static ssize_t tsl2550_store_power_state(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_power_state(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                   tsl2550_show_power_state, tsl2550_store_power_state);
+
+static ssize_t tsl2550_show_operating_mode(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(to_i2c_client(dev));
+
+        return sprintf(buf, "%u\n", data->operating_mode);
+}
+
+static ssize_t tsl2550_store_operating_mode(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        unsigned long val = simple_strtoul(buf, NULL, 10);
+        int ret;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        if (data->power_state == 0)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = tsl2550_set_operating_mode(client, val);
+        mutex_unlock(&data->update_lock);
+
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(operating_mode, S_IWUSR | S_IRUGO,
+                   tsl2550_show_operating_mode, tsl2550_store_operating_mode);
+
+static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
+{
+        u8 ch0, ch1;
+        int ret;
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC0);
+        if (ret < 0)
+                return ret;
+        ch0 = ret;
+
+        mdelay(1);
+
+        ret = tsl2550_get_adc_value(client, TSL2550_READ_ADC1);
+        if (ret < 0)
+                return ret;
+        ch1 = ret;
+
+        /* Do the job */
+        ret = tsl2550_calculate_lux(ch0, ch1);
+        if (ret < 0)
+                return ret;
+
+        return sprintf(buf, "%d\n", ret);
+}
+
+static ssize_t tsl2550_show_lux1_input(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int ret;
+
+        /* No LUX data if not operational */
+        if (!data->power_state)
+                return -EBUSY;
+
+        mutex_lock(&data->update_lock);
+        ret = __tsl2550_show_lux(client, buf);
+        mutex_unlock(&data->update_lock);
+
+        return ret;
+}
+
+static DEVICE_ATTR(lux1_input, S_IRUGO,
+                   tsl2550_show_lux1_input, NULL);
+
+static struct attribute *tsl2550_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_operating_mode.attr,
+        &dev_attr_lux1_input.attr,
+        NULL
+};
+
+static const struct attribute_group tsl2550_attr_group = {
+        .attrs = tsl2550_attributes,
+};
+
+/*
+ * Initialization function
+ */
+
+static int tsl2550_init_client(struct i2c_client *client)
+{
+        struct tsl2550_data *data = i2c_get_clientdata(client);
+        int err;
+
+        /*
+         * Probe the chip. To do so we try to power up the device and then to
+         * read back the 0x03 code
+         */
+        err = i2c_smbus_write_byte(client, TSL2550_POWER_UP);
+        if (err < 0)
+                return err;
+        mdelay(1);
+        if (i2c_smbus_read_byte(client) != TSL2550_POWER_UP)
+                return -ENODEV;
+        data->power_state = 1;
+
+        /* Set the default operating mode */
+        err = i2c_smbus_write_byte(client,
+                                   TSL2550_MODE_RANGE[data->operating_mode]);
+        if (err < 0)
+                return err;
+
+        return 0;
+}
+
+/*
+ * I2C init/probing/exit functions
+ */
+
+static struct i2c_driver tsl2550_driver;
+static int __devinit tsl2550_probe(struct i2c_client *client)
+{
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+        struct tsl2550_data *data;
+        int *opmode, err = 0;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE)) {
+                err = -EIO;
+                goto exit;
+        }
+
+        data = kzalloc(sizeof(struct tsl2550_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+        data->client = client;
+        i2c_set_clientdata(client, data);
+
+        /* Check platform data */
+        opmode = client->dev.platform_data;
+        if (opmode) {
+                if (*opmode < 0 || *opmode > 1) {
+                        dev_err(&client->dev, "invalid operating_mode (%d)\n",
+                                        *opmode);
+                        err = -EINVAL;
+                        goto exit_kfree;
+                }
+                data->operating_mode = *opmode;
+        } else
+                data->operating_mode = 0;       /* default mode is standard */
+        dev_info(&client->dev, "%s operating mode\n",
+                        data->operating_mode ? "extended" : "standard");
+
+        mutex_init(&data->update_lock);
+
+        /* Initialize the TSL2550 chip */
+        err = tsl2550_init_client(client);
+        if (err)
+                goto exit_kfree;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &tsl2550_attr_group);
+        if (err)
+                goto exit_kfree;
+
+        dev_info(&client->dev, "support ver. %s enabled\n", DRIVER_VERSION);
+
+        return 0;
+
+exit_kfree:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int __devexit tsl2550_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
+
+        /* Power down the device */
+        tsl2550_set_power_state(client, 0);
+
+        kfree(i2c_get_clientdata(client));
+
+        return 0;
+}
+
+static struct i2c_driver tsl2550_driver = {
+        .driver = {
+                .name   = TSL2550_DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .probe  = tsl2550_probe,
+        .remove = __devexit_p(tsl2550_remove),
+};
+
+static int __init tsl2550_init(void)
+{
+        return i2c_add_driver(&tsl2550_driver);
+}
+
+static void __exit tsl2550_exit(void)
+{
+        i2c_del_driver(&tsl2550_driver);
+}
+
+MODULE_AUTHOR("Rodolfo Giometti <giometti@linux.it>");
+MODULE_DESCRIPTION("TSL2550 ambient light sensor driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(tsl2550_init);
+module_exit(tsl2550_exit);
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 435925eba437..6971a62397db 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -207,6 +207,7 @@ EXPORT_SYMBOL_GPL(i2c_bus_type);
  * i2c_new_device - instantiate an i2c device for use with a new style driver
  * @adap: the adapter managing the device
  * @info: describes one I2C device; bus_num is ignored
+ * Context: can sleep
  *
  * Create a device to work with a new style i2c driver, where binding is
  * handled through driver model probe()/remove() methods.  This call is not
@@ -255,6 +256,7 @@ EXPORT_SYMBOL_GPL(i2c_new_device);
 /**
  * i2c_unregister_device - reverse effect of i2c_new_device()
  * @client: value returned from i2c_new_device()
+ * Context: can sleep
  */
 void i2c_unregister_device(struct i2c_client *client)
 {
@@ -379,6 +381,7 @@ out_list:
 /**
  * i2c_add_adapter - declare i2c adapter, use dynamic bus number
  * @adapter: the adapter to add
+ * Context: can sleep
  *
  * This routine is used to declare an I2C adapter when its bus number
  * doesn't matter.  Examples: for I2C adapters dynamically added by
@@ -416,6 +419,7 @@ EXPORT_SYMBOL(i2c_add_adapter);
 /**
  * i2c_add_numbered_adapter - declare i2c adapter, use static bus number
  * @adap: the adapter to register (with adap->nr initialized)
+ * Context: can sleep
  *
  * This routine is used to declare an I2C adapter when its bus number
  * matters.  Example: for I2C adapters from system-on-chip CPUs, or
@@ -463,6 +467,14 @@ retry:
 }
 EXPORT_SYMBOL_GPL(i2c_add_numbered_adapter);
 
+/**
+ * i2c_del_adapter - unregister I2C adapter
+ * @adap: the adapter being unregistered
+ * Context: can sleep
+ *
+ * This unregisters an I2C adapter which was previously registered
+ * by @i2c_add_adapter or @i2c_add_numbered_adapter.
+ */
 int i2c_del_adapter(struct i2c_adapter *adap)
 {
         struct list_head  *item, *_n;
@@ -598,6 +610,7 @@ EXPORT_SYMBOL(i2c_register_driver);
 /**
  * i2c_del_driver - unregister I2C driver
  * @driver: the driver being unregistered
+ * Context: can sleep
  */
 void i2c_del_driver(struct i2c_driver *driver)
 {
@@ -1331,10 +1344,14 @@ s32 i2c_smbus_write_block_data(struct i2c_client *client, u8 command,
 EXPORT_SYMBOL(i2c_smbus_write_block_data);
 
 /* Returns the number of read bytes */
-s32 i2c_smbus_read_i2c_block_data(struct i2c_client *client, u8 command, u8 *values)
+s32 i2c_smbus_read_i2c_block_data(struct i2c_client *client, u8 command,
+                                  u8 length, u8 *values)
 {
         union i2c_smbus_data data;
 
+        if (length > I2C_SMBUS_BLOCK_MAX)
+                length = I2C_SMBUS_BLOCK_MAX;
+        data.block[0] = length;
         if (i2c_smbus_xfer(client->adapter,client->addr,client->flags,
                               I2C_SMBUS_READ,command,
                               I2C_SMBUS_I2C_BLOCK_DATA,&data))
@@ -1455,7 +1472,7 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter * adapter, u16 addr,
                 break;
         case I2C_SMBUS_I2C_BLOCK_DATA:
                 if (read_write == I2C_SMBUS_READ) {
-                        msg[1].len = I2C_SMBUS_BLOCK_MAX;
+                        msg[1].len = data->block[0];
                 } else {
                         msg[0].len = data->block[0] + 1;
                         if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
@@ -1511,9 +1528,7 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter * adapter, u16 addr,
                                 data->word = msgbuf1[0] | (msgbuf1[1] << 8);
                                 break;
                         case I2C_SMBUS_I2C_BLOCK_DATA:
-                                /* fixed at 32 for now */
-                                data->block[0] = I2C_SMBUS_BLOCK_MAX;
-                                for (i = 0; i < I2C_SMBUS_BLOCK_MAX; i++)
+                                for (i = 0; i < data->block[0]; i++)
                                         data->block[i+1] = msgbuf1[i];
                                 break;
                         case I2C_SMBUS_BLOCK_DATA:
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index e7a709710592..64eee9551b22 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -283,6 +283,7 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file,
                     (data_arg.size != I2C_SMBUS_WORD_DATA) &&
                     (data_arg.size != I2C_SMBUS_PROC_CALL) &&
                     (data_arg.size != I2C_SMBUS_BLOCK_DATA) &&
+                    (data_arg.size != I2C_SMBUS_I2C_BLOCK_BROKEN) &&
                     (data_arg.size != I2C_SMBUS_I2C_BLOCK_DATA) &&
                     (data_arg.size != I2C_SMBUS_BLOCK_PROC_CALL)) {
                         dev_dbg(&client->adapter->dev,
@@ -329,10 +330,18 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file,
 
                 if ((data_arg.size == I2C_SMBUS_PROC_CALL) ||
                     (data_arg.size == I2C_SMBUS_BLOCK_PROC_CALL) ||
+                    (data_arg.size == I2C_SMBUS_I2C_BLOCK_DATA) ||
                     (data_arg.read_write == I2C_SMBUS_WRITE)) {
                         if (copy_from_user(&temp, data_arg.data, datasize))
                                 return -EFAULT;
                 }
+                if (data_arg.size == I2C_SMBUS_I2C_BLOCK_BROKEN) {
+                        /* Convert old I2C block commands to the new
+                           convention. This preserves binary compatibility. */
+                        data_arg.size = I2C_SMBUS_I2C_BLOCK_DATA;
+                        if (data_arg.read_write == I2C_SMBUS_READ)
+                                temp.block[0] = I2C_SMBUS_BLOCK_MAX;
+                }
                 res = i2c_smbus_xfer(client->adapter,client->addr,client->flags,
                       data_arg.read_write,
                       data_arg.command,data_arg.size,&temp);
diff --git a/drivers/ide/legacy/hd.c b/drivers/ide/legacy/hd.c
index 7f4c0a5050a1..8f2db8dd35f7 100644
--- a/drivers/ide/legacy/hd.c
+++ b/drivers/ide/legacy/hd.c
@@ -719,74 +719,25 @@ static int __init hd_init(void)
         device_timer.function = hd_times_out;
         blk_queue_hardsect_size(hd_queue, 512);
 
-#ifdef __i386__
         if (!NR_HD) {
-                extern struct drive_info drive_info;
-                unsigned char *BIOS = (unsigned char *) &drive_info;
-                unsigned long flags;
-                int cmos_disks;
-
-                for (drive=0 ; drive<2 ; drive++) {
-                        hd_info[drive].cyl = *(unsigned short *) BIOS;
-                        hd_info[drive].head = *(2+BIOS);
-                        hd_info[drive].wpcom = *(unsigned short *) (5+BIOS);
-                        hd_info[drive].ctl = *(8+BIOS);
-                        hd_info[drive].lzone = *(unsigned short *) (12+BIOS);
-                        hd_info[drive].sect = *(14+BIOS);
-#ifdef does_not_work_for_everybody_with_scsi_but_helps_ibm_vp
-                        if (hd_info[drive].cyl && NR_HD == drive)
-                                NR_HD++;
-#endif
-                        BIOS += 16;
-                }
-
-        /*
-                We query CMOS about hard disks : it could be that 
-                we have a SCSI/ESDI/etc controller that is BIOS
-                compatible with ST-506, and thus showing up in our
-                BIOS table, but not register compatible, and therefore
-                not present in CMOS.
-
-                Furthermore, we will assume that our ST-506 drives
-                <if any> are the primary drives in the system, and 
-                the ones reflected as drive 1 or 2.
-
-                The first drive is stored in the high nibble of CMOS
-                byte 0x12, the second in the low nibble.  This will be
-                either a 4 bit drive type or 0xf indicating use byte 0x19 
-                for an 8 bit type, drive 1, 0x1a for drive 2 in CMOS.
-
-                Needless to say, a non-zero value means we have 
-                an AT controller hard disk for that drive.
-
-                Currently the rtc_lock is a bit academic since this
-                driver is non-modular, but someday... ?         Paul G.
-        */
-
-                spin_lock_irqsave(&rtc_lock, flags);
-                cmos_disks = CMOS_READ(0x12);
-                spin_unlock_irqrestore(&rtc_lock, flags);
-
-                if (cmos_disks & 0xf0) {
-                        if (cmos_disks & 0x0f)
-                                NR_HD = 2;
-                        else
-                                NR_HD = 1;
-                }
-        }
-#endif /* __i386__ */
-#ifdef __arm__
-        if (!NR_HD) {
-                /* We don't know anything about the drive.  This means
+                /*
+                 * We don't know anything about the drive.  This means
                  * that you *MUST* specify the drive parameters to the
                  * kernel yourself.
+                 *
+                 * If we were on an i386, we used to read this info from
+                 * the BIOS or CMOS.  This doesn't work all that well,
+                 * since this assumes that this is a primary or secondary
+                 * drive, and if we're using this legacy driver, it's
+                 * probably an auxilliary controller added to recover
+                 * legacy data off an ST-506 drive.  Either way, it's
+                 * definitely safest to have the user explicitly specify
+                 * the information.
                  */
                 printk("hd: no drives specified - use hd=cyl,head,sectors"
                         " on kernel command line\n");
-        }
-#endif
-        if (!NR_HD)
                 goto out;
+        }
 
         for (drive=0 ; drive < NR_HD ; drive++) {
                 struct gendisk *disk = alloc_disk(64);
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 08c299ebf4a8..bf9b99292048 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -479,7 +479,6 @@ alloc_group_attrs(ssize_t (*show)(struct ib_port *,
 
                 element->attr.attr.name  = element->name;
                 element->attr.attr.mode  = S_IRUGO;
-                element->attr.attr.owner = THIS_MODULE;
                 element->attr.show       = show;
                 element->index           = i;
 
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index 27a68835b5ba..1317bdd8cc7c 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -119,7 +119,6 @@ static struct psmouse_attribute psmouse_attr_##_name = {			\
                 .attr   = {                                                     \
                         .name   = __stringify(_name),                           \
                         .mode   = _mode,                                        \
-                        .owner  = THIS_MODULE,                                  \
                 },                                                              \
                 .show   = psmouse_attr_show_helper,                             \
                 .store  = psmouse_attr_set_helper,                              \
diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
index 11ced17f438a..4fcb245ba184 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -212,7 +212,6 @@ int wf_register_control(struct wf_control *new_ct)
         list_add(&new_ct->link, &wf_controls);
 
         new_ct->attr.attr.name = new_ct->name;
-        new_ct->attr.attr.owner = THIS_MODULE;
         new_ct->attr.attr.mode = 0644;
         new_ct->attr.show = wf_show_control;
         new_ct->attr.store = wf_store_control;
@@ -325,7 +324,6 @@ int wf_register_sensor(struct wf_sensor *new_sr)
         list_add(&new_sr->link, &wf_sensors);
 
         new_sr->attr.attr.name = new_sr->name;
-        new_sr->attr.attr.owner = THIS_MODULE;
         new_sr->attr.attr.mode = 0444;
         new_sr->attr.show = wf_show_sensor;
         new_sr->attr.store = NULL;
diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
index 1043b39aa123..351982bcec1b 100644
--- a/drivers/macintosh/windfarm_smu_sat.c
+++ b/drivers/macintosh/windfarm_smu_sat.c
@@ -67,26 +67,6 @@ static struct i2c_driver wf_sat_driver = {
         .detach_client  = wf_sat_detach,
 };
 
-/*
- * XXX i2c_smbus_read_i2c_block_data doesn't pass the requested
- * length down to the low-level driver, so we use this, which
- * works well enough with the SMU i2c driver code...
- */
-static int sat_read_block(struct i2c_client *client, u8 command,
-                          u8 *values, int len)
-{
-        union i2c_smbus_data data;
-        int err;
-
-        data.block[0] = len;
-        err = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
-                             I2C_SMBUS_READ, command, I2C_SMBUS_I2C_BLOCK_DATA,
-                             &data);
-        if (!err)
-                memcpy(values, data.block, len);
-        return err;
-}
-
 struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
                                                   unsigned int *size)
 {
@@ -124,8 +104,8 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
                 return NULL;
 
         for (i = 0; i < len; i += 4) {
-                err = sat_read_block(&sat->i2c, 0xa, data, 4);
-                if (err) {
+                err = i2c_smbus_read_i2c_block_data(&sat->i2c, 0xa, 4, data);
+                if (err < 0) {
                         printk(KERN_ERR "smu_sat_get_sdb_part rd err %d\n",
                                err);
                         goto fail;
@@ -157,8 +137,8 @@ static int wf_sat_read_cache(struct wf_sat *sat)
 {
         int err;
 
-        err = sat_read_block(&sat->i2c, 0x3f, sat->cache, 16);
-        if (err)
+        err = i2c_smbus_read_i2c_block_data(&sat->i2c, 0x3f, 16, sat->cache);
+        if (err < 0)
                 return err;
         sat->last_read = jiffies;
 #ifdef LOTSA_DEBUG
diff --git a/drivers/misc/asus-laptop.c b/drivers/misc/asus-laptop.c
index 4f9060a2a2f2..7798f590e5aa 100644
--- a/drivers/misc/asus-laptop.c
+++ b/drivers/misc/asus-laptop.c
@@ -737,8 +737,7 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
         struct device_attribute dev_attr_##_name = {                    \
                 .attr = {                                               \
                         .name = __stringify(_name),                     \
-                        .mode = 0,                                      \
-                        .owner = THIS_MODULE },                         \
+                        .mode = 0 },                                    \
                 .show   = NULL,                                         \
                 .store  = NULL,                                         \
         }
diff --git a/drivers/misc/msi-laptop.c b/drivers/misc/msi-laptop.c
index 41e901f53e7c..932a415197b3 100644
--- a/drivers/misc/msi-laptop.c
+++ b/drivers/misc/msi-laptop.c
@@ -23,6 +23,8 @@
  * msi-laptop.c - MSI S270 laptop support. This laptop is sold under
  * various brands, including "Cytron/TCM/Medion/Tchibo MD96100".
  *
+ * Driver also supports S271, S420 models.
+ *
  * This driver exports a few files in /sys/devices/platform/msi-laptop-pf/:
  *
  *   lcd_level - Screen brightness: contains a single integer in the
@@ -281,25 +283,56 @@ static struct platform_device *msipf_device;
 
 /* Initialization */
 
+static int dmi_check_cb(struct dmi_system_id *id)
+{
+        printk("msi-laptop: Identified laptop model '%s'.\n", id->ident);
+        return 0;
+}
+
 static struct dmi_system_id __initdata msi_dmi_table[] = {
         {
                 .ident = "MSI S270",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "MS-1013"),
-                }
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0131"),
+                        DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT'L CO.,LTD")
+                },
+                .callback = dmi_check_cb
+        },
+        {
+                .ident = "MSI S271",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MS-1058"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0581"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-1058")
+                },
+                .callback = dmi_check_cb
+        },
+        {
+                .ident = "MSI S420",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MS-1412"),
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MSI"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-1412")
+                },
+                .callback = dmi_check_cb
         },
         {
                 .ident = "Medion MD96100",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "NOTEBOOK"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "SAM2000"),
-                }
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0131"),
+                        DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-STAR INT'L CO.,LTD")
+                },
+                .callback = dmi_check_cb
         },
         { }
 };
 
-
 static int __init msi_init(void)
 {
         int ret;
@@ -394,3 +427,8 @@ MODULE_AUTHOR("Lennart Poettering");
 MODULE_DESCRIPTION("MSI Laptop Support");
 MODULE_VERSION(MSI_DRIVER_VERSION);
 MODULE_LICENSE("GPL");
+
+MODULE_ALIAS("dmi:*:svnMICRO-STARINT'LCO.,LTD:pnMS-1013:pvr0131*:cvnMICRO-STARINT'LCO.,LTD:ct10:*");
+MODULE_ALIAS("dmi:*:svnMicro-StarInternational:pnMS-1058:pvr0581:rvnMSI:rnMS-1058:*:ct10:*");
+MODULE_ALIAS("dmi:*:svnMicro-StarInternational:pnMS-1412:*:rvnMSI:rnMS-1412:*:cvnMICRO-STARINT'LCO.,LTD:ct10:*");
+MODULE_ALIAS("dmi:*:svnNOTEBOOK:pnSAM2000:pvr0131*:cvnMICRO-STARINT'LCO.,LTD:ct10:*");
diff --git a/drivers/net/3c523.c b/drivers/net/3c523.c
index da1a22c13865..ab18343e58ef 100644
--- a/drivers/net/3c523.c
+++ b/drivers/net/3c523.c
@@ -990,7 +990,7 @@ static void elmc_rcv_int(struct net_device *dev)
                                 if (skb != NULL) {
                                         skb_reserve(skb, 2);    /* 16 byte alignment */
                                         skb_put(skb,totlen);
-                                        eth_copy_and_sum(skb, (char *) p->base+(unsigned long) rbd->buffer,totlen,0);
+                                        skb_copy_to_linear_data(skb, (char *) p->base+(unsigned long) rbd->buffer,totlen);
                                         skb->protocol = eth_type_trans(skb, dev);
                                         netif_rx(skb);
                                         dev->last_rx = jiffies;
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 0877fc372f4b..e89ace109a5d 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -333,9 +333,9 @@ static int lance_rx (struct net_device *dev)
 
                         skb_reserve (skb, 2);           /* 16 byte align */
                         skb_put (skb, len);             /* make room */
-                        eth_copy_and_sum(skb,
+                        skb_copy_to_linear_data(skb,
                                          (unsigned char *)&(ib->rx_buf [lp->rx_new][0]),
-                                         len, 0);
+                                         len);
                         skb->protocol = eth_type_trans (skb, dev);
                         netif_rx (skb);
                         dev->last_rx = jiffies;
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 77457c7c6ac2..327eaa7b4999 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -2014,7 +2014,7 @@ no_early_rx:
 #if RX_BUF_IDX == 3
                         wrap_copy(skb, rx_ring, ring_offset+4, pkt_size);
 #else
-                        eth_copy_and_sum (skb, &rx_ring[ring_offset + 4], pkt_size, 0);
+                        skb_copy_to_linear_data (skb, &rx_ring[ring_offset + 4], pkt_size);
 #endif
                         skb_put (skb, pkt_size);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index b941c74a06c4..ba314adf68b8 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -25,6 +25,14 @@ menuconfig NETDEVICES
 # that for each of the symbols.
 if NETDEVICES
 
+config NETDEVICES_MULTIQUEUE
+        bool "Netdevice multiple hardware queue support"
+        ---help---
+          Say Y here if you want to allow the network stack to use multiple
+          hardware TX queues on an ethernet device.
+
+          Most people will say N here.
+
 config IFB
         tristate "Intermediate Functional Block support"
         depends on NET_CLS_ACT
@@ -877,7 +885,7 @@ config NET_NETX
 
 config DM9000
         tristate "DM9000 support"
-        depends on ARM || MIPS
+        depends on ARM || BLACKFIN || MIPS
         select CRC32
         select MII
         ---help---
@@ -2784,6 +2792,19 @@ config PPPOATM
           which can lead to bad results if the ATM peer loses state and
           changes its encapsulation unilaterally.
 
+config PPPOL2TP
+        tristate "PPP over L2TP (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && PPP
+        help
+          Support for PPP-over-L2TP socket family. L2TP is a protocol
+          used by ISPs and enterprises to tunnel PPP traffic over UDP
+          tunnels. L2TP is replacing PPTP for VPN uses.
+
+          This kernel component handles only L2TP data packets: a
+          userland daemon handles L2TP the control protocol (tunnel
+          and session setup). One such daemon is OpenL2TP
+          (http://openl2tp.sourceforge.net/).
+
 config SLIP
         tristate "SLIP (serial line) support"
         ---help---
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1bbcbedad04a..a2241e6e1457 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -121,6 +121,7 @@ obj-$(CONFIG_PPP_DEFLATE) += ppp_deflate.o
 obj-$(CONFIG_PPP_BSDCOMP) += bsd_comp.o
 obj-$(CONFIG_PPP_MPPE) += ppp_mppe.o
 obj-$(CONFIG_PPPOE) += pppox.o pppoe.o
+obj-$(CONFIG_PPPOL2TP) += pppox.o pppol2tp.o
 
 obj-$(CONFIG_SLIP) += slip.o
 obj-$(CONFIG_SLHC) += slhc.o
diff --git a/drivers/net/a2065.c b/drivers/net/a2065.c
index 81d5a374042a..a45de6975bfe 100644
--- a/drivers/net/a2065.c
+++ b/drivers/net/a2065.c
@@ -322,9 +322,9 @@ static int lance_rx (struct net_device *dev)
 
                         skb_reserve (skb, 2);           /* 16 byte align */
                         skb_put (skb, len);             /* make room */
-                        eth_copy_and_sum(skb,
+                        skb_copy_to_linear_data(skb,
                                          (unsigned char *)&(ib->rx_buf [lp->rx_new][0]),
-                                         len, 0);
+                                         len);
                         skb->protocol = eth_type_trans (skb, dev);
                         netif_rx (skb);
                         dev->last_rx = jiffies;
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index a241ae7855a3..bc5a38a6705f 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -746,7 +746,7 @@ static int ariadne_rx(struct net_device *dev)
 
             skb_reserve(skb,2);         /* 16 byte align */
             skb_put(skb,pkt_len);       /* Make room */
-            eth_copy_and_sum(skb, (char *)priv->rx_buff[entry], pkt_len,0);
+            skb_copy_to_linear_data(skb, (char *)priv->rx_buff[entry], pkt_len);
             skb->protocol=eth_type_trans(skb,dev);
 #if 0
             printk(KERN_DEBUG "RX pkt type 0x%04x from ",
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 2438c5bff237..f6ece1d43f6e 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -258,7 +258,7 @@ static int ep93xx_rx(struct net_device *dev, int *budget)
                         skb_reserve(skb, 2);
                         dma_sync_single(NULL, ep->descs->rdesc[entry].buf_addr,
                                                 length, DMA_FROM_DEVICE);
-                        eth_copy_and_sum(skb, ep->rx_buf[entry], length, 0);
+                        skb_copy_to_linear_data(skb, ep->rx_buf[entry], length);
                         skb_put(skb, length);
                         skb->protocol = eth_type_trans(skb, dev);
 
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index c27cfcef45fa..e86b3691765b 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -1205,8 +1205,8 @@ static int au1000_rx(struct net_device *dev)
                                 continue;
                         }
                         skb_reserve(skb, 2);    /* 16 byte IP header align */
-                        eth_copy_and_sum(skb,
-                                (unsigned char *)pDB->vaddr, frmlen, 0);
+                        skb_copy_to_linear_data(skb,
+                                (unsigned char *)pDB->vaddr, frmlen);
                         skb_put(skb, frmlen);
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_rx(skb);  /* pass the packet to upper layers */
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 23958f73c421..02e994b1b028 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -40,7 +40,6 @@
 #define BCM_VLAN 1
 #endif
 #include <net/ip.h>
-#include <net/tcp.h>
 #include <net/checksum.h>
 #include <linux/workqueue.h>
 #include <linux/crc32.h>
@@ -54,8 +53,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.11"
-#define DRV_MODULE_RELDATE      "June 4, 2007"
+#define DRV_MODULE_VERSION      "1.6.2"
+#define DRV_MODULE_RELDATE      "July 6, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -550,6 +549,9 @@ bnx2_report_fw_link(struct bnx2 *bp)
 {
         u32 fw_link_status = 0;
 
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                return;
+
         if (bp->link_up) {
                 u32 bmsr;
 
@@ -601,12 +603,21 @@ bnx2_report_fw_link(struct bnx2 *bp)
         REG_WR_IND(bp, bp->shmem_base + BNX2_LINK_STATUS, fw_link_status);
 }
 
+static char *
+bnx2_xceiver_str(struct bnx2 *bp)
+{
+        return ((bp->phy_port == PORT_FIBRE) ? "SerDes" :
+                ((bp->phy_flags & PHY_SERDES_FLAG) ? "Remote Copper" :
+                 "Copper"));
+}
+
 static void
 bnx2_report_link(struct bnx2 *bp)
 {
         if (bp->link_up) {
                 netif_carrier_on(bp->dev);
-                printk(KERN_INFO PFX "%s NIC Link is Up, ", bp->dev->name);
+                printk(KERN_INFO PFX "%s NIC %s Link is Up, ", bp->dev->name,
+                       bnx2_xceiver_str(bp));
 
                 printk("%d Mbps ", bp->line_speed);
 
@@ -630,7 +641,8 @@ bnx2_report_link(struct bnx2 *bp)
         }
         else {
                 netif_carrier_off(bp->dev);
-                printk(KERN_ERR PFX "%s NIC Link is Down\n", bp->dev->name);
+                printk(KERN_ERR PFX "%s NIC %s Link is Down\n", bp->dev->name,
+                       bnx2_xceiver_str(bp));
         }
 
         bnx2_report_fw_link(bp);
@@ -1100,6 +1112,9 @@ bnx2_set_link(struct bnx2 *bp)
                 return 0;
         }
 
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                return 0;
+
         link_up = bp->link_up;
 
         bnx2_enable_bmsr1(bp);
@@ -1210,12 +1225,74 @@ bnx2_phy_get_pause_adv(struct bnx2 *bp)
         return adv;
 }
 
+static int bnx2_fw_sync(struct bnx2 *, u32, int);
+
 static int
-bnx2_setup_serdes_phy(struct bnx2 *bp)
+bnx2_setup_remote_phy(struct bnx2 *bp, u8 port)
+{
+        u32 speed_arg = 0, pause_adv;
+
+        pause_adv = bnx2_phy_get_pause_adv(bp);
+
+        if (bp->autoneg & AUTONEG_SPEED) {
+                speed_arg |= BNX2_NETLINK_SET_LINK_ENABLE_AUTONEG;
+                if (bp->advertising & ADVERTISED_10baseT_Half)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_10HALF;
+                if (bp->advertising & ADVERTISED_10baseT_Full)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_10FULL;
+                if (bp->advertising & ADVERTISED_100baseT_Half)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_100HALF;
+                if (bp->advertising & ADVERTISED_100baseT_Full)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_100FULL;
+                if (bp->advertising & ADVERTISED_1000baseT_Full)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_1GFULL;
+                if (bp->advertising & ADVERTISED_2500baseX_Full)
+                        speed_arg |= BNX2_NETLINK_SET_LINK_SPEED_2G5FULL;
+        } else {
+                if (bp->req_line_speed == SPEED_2500)
+                        speed_arg = BNX2_NETLINK_SET_LINK_SPEED_2G5FULL;
+                else if (bp->req_line_speed == SPEED_1000)
+                        speed_arg = BNX2_NETLINK_SET_LINK_SPEED_1GFULL;
+                else if (bp->req_line_speed == SPEED_100) {
+                        if (bp->req_duplex == DUPLEX_FULL)
+                                speed_arg = BNX2_NETLINK_SET_LINK_SPEED_100FULL;
+                        else
+                                speed_arg = BNX2_NETLINK_SET_LINK_SPEED_100HALF;
+                } else if (bp->req_line_speed == SPEED_10) {
+                        if (bp->req_duplex == DUPLEX_FULL)
+                                speed_arg = BNX2_NETLINK_SET_LINK_SPEED_10FULL;
+                        else
+                                speed_arg = BNX2_NETLINK_SET_LINK_SPEED_10HALF;
+                }
+        }
+
+        if (pause_adv & (ADVERTISE_1000XPAUSE | ADVERTISE_PAUSE_CAP))
+                speed_arg |= BNX2_NETLINK_SET_LINK_FC_SYM_PAUSE;
+        if (pause_adv & (ADVERTISE_1000XPSE_ASYM | ADVERTISE_1000XPSE_ASYM))
+                speed_arg |= BNX2_NETLINK_SET_LINK_FC_ASYM_PAUSE;
+
+        if (port == PORT_TP)
+                speed_arg |= BNX2_NETLINK_SET_LINK_PHY_APP_REMOTE |
+                             BNX2_NETLINK_SET_LINK_ETH_AT_WIRESPEED;
+
+        REG_WR_IND(bp, bp->shmem_base + BNX2_DRV_MB_ARG0, speed_arg);
+
+        spin_unlock_bh(&bp->phy_lock);
+        bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_CMD_SET_LINK, 0);
+        spin_lock_bh(&bp->phy_lock);
+
+        return 0;
+}
+
+static int
+bnx2_setup_serdes_phy(struct bnx2 *bp, u8 port)
 {
         u32 adv, bmcr;
         u32 new_adv = 0;
 
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                return (bnx2_setup_remote_phy(bp, port));
+
         if (!(bp->autoneg & AUTONEG_SPEED)) {
                 u32 new_bmcr;
                 int force_link_down = 0;
@@ -1323,7 +1400,9 @@ bnx2_setup_serdes_phy(struct bnx2 *bp)
 }
 
 #define ETHTOOL_ALL_FIBRE_SPEED                                         \
-        (ADVERTISED_1000baseT_Full)
+        (bp->phy_flags & PHY_2_5G_CAPABLE_FLAG) ?                       \
+                (ADVERTISED_2500baseX_Full | ADVERTISED_1000baseT_Full) :\
+                (ADVERTISED_1000baseT_Full)
 
 #define ETHTOOL_ALL_COPPER_SPEED                                        \
         (ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |            \
@@ -1335,6 +1414,188 @@ bnx2_setup_serdes_phy(struct bnx2 *bp)
 
 #define PHY_ALL_1000_SPEED (ADVERTISE_1000HALF | ADVERTISE_1000FULL)
 
+static void
+bnx2_set_default_remote_link(struct bnx2 *bp)
+{
+        u32 link;
+
+        if (bp->phy_port == PORT_TP)
+                link = REG_RD_IND(bp, bp->shmem_base + BNX2_RPHY_COPPER_LINK);
+        else
+                link = REG_RD_IND(bp, bp->shmem_base + BNX2_RPHY_SERDES_LINK);
+
+        if (link & BNX2_NETLINK_SET_LINK_ENABLE_AUTONEG) {
+                bp->req_line_speed = 0;
+                bp->autoneg |= AUTONEG_SPEED;
+                bp->advertising = ADVERTISED_Autoneg;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_10HALF)
+                        bp->advertising |= ADVERTISED_10baseT_Half;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_10FULL)
+                        bp->advertising |= ADVERTISED_10baseT_Full;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_100HALF)
+                        bp->advertising |= ADVERTISED_100baseT_Half;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_100FULL)
+                        bp->advertising |= ADVERTISED_100baseT_Full;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_1GFULL)
+                        bp->advertising |= ADVERTISED_1000baseT_Full;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_2G5FULL)
+                        bp->advertising |= ADVERTISED_2500baseX_Full;
+        } else {
+                bp->autoneg = 0;
+                bp->advertising = 0;
+                bp->req_duplex = DUPLEX_FULL;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_10) {
+                        bp->req_line_speed = SPEED_10;
+                        if (link & BNX2_NETLINK_SET_LINK_SPEED_10HALF)
+                                bp->req_duplex = DUPLEX_HALF;
+                }
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_100) {
+                        bp->req_line_speed = SPEED_100;
+                        if (link & BNX2_NETLINK_SET_LINK_SPEED_100HALF)
+                                bp->req_duplex = DUPLEX_HALF;
+                }
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_1GFULL)
+                        bp->req_line_speed = SPEED_1000;
+                if (link & BNX2_NETLINK_SET_LINK_SPEED_2G5FULL)
+                        bp->req_line_speed = SPEED_2500;
+        }
+}
+
+static void
+bnx2_set_default_link(struct bnx2 *bp)
+{
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                return bnx2_set_default_remote_link(bp);
+
+        bp->autoneg = AUTONEG_SPEED | AUTONEG_FLOW_CTRL;
+        bp->req_line_speed = 0;
+        if (bp->phy_flags & PHY_SERDES_FLAG) {
+                u32 reg;
+
+                bp->advertising = ETHTOOL_ALL_FIBRE_SPEED | ADVERTISED_Autoneg;
+
+                reg = REG_RD_IND(bp, bp->shmem_base + BNX2_PORT_HW_CFG_CONFIG);
+                reg &= BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK;
+                if (reg == BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G) {
+                        bp->autoneg = 0;
+                        bp->req_line_speed = bp->line_speed = SPEED_1000;
+                        bp->req_duplex = DUPLEX_FULL;
+                }
+        } else
+                bp->advertising = ETHTOOL_ALL_COPPER_SPEED | ADVERTISED_Autoneg;
+}
+
+static void
+bnx2_send_heart_beat(struct bnx2 *bp)
+{
+        u32 msg;
+        u32 addr;
+
+        spin_lock(&bp->indirect_lock);
+        msg = (u32) (++bp->fw_drv_pulse_wr_seq & BNX2_DRV_PULSE_SEQ_MASK);
+        addr = bp->shmem_base + BNX2_DRV_PULSE_MB;
+        REG_WR(bp, BNX2_PCICFG_REG_WINDOW_ADDRESS, addr);
+        REG_WR(bp, BNX2_PCICFG_REG_WINDOW, msg);
+        spin_unlock(&bp->indirect_lock);
+}
+
+static void
+bnx2_remote_phy_event(struct bnx2 *bp)
+{
+        u32 msg;
+        u8 link_up = bp->link_up;
+        u8 old_port;
+
+        msg = REG_RD_IND(bp, bp->shmem_base + BNX2_LINK_STATUS);
+
+        if (msg & BNX2_LINK_STATUS_HEART_BEAT_EXPIRED)
+                bnx2_send_heart_beat(bp);
+
+        msg &= ~BNX2_LINK_STATUS_HEART_BEAT_EXPIRED;
+
+        if ((msg & BNX2_LINK_STATUS_LINK_UP) == BNX2_LINK_STATUS_LINK_DOWN)
+                bp->link_up = 0;
+        else {
+                u32 speed;
+
+                bp->link_up = 1;
+                speed = msg & BNX2_LINK_STATUS_SPEED_MASK;
+                bp->duplex = DUPLEX_FULL;
+                switch (speed) {
+                        case BNX2_LINK_STATUS_10HALF:
+                                bp->duplex = DUPLEX_HALF;
+                        case BNX2_LINK_STATUS_10FULL:
+                                bp->line_speed = SPEED_10;
+                                break;
+                        case BNX2_LINK_STATUS_100HALF:
+                                bp->duplex = DUPLEX_HALF;
+                        case BNX2_LINK_STATUS_100BASE_T4:
+                        case BNX2_LINK_STATUS_100FULL:
+                                bp->line_speed = SPEED_100;
+                                break;
+                        case BNX2_LINK_STATUS_1000HALF:
+                                bp->duplex = DUPLEX_HALF;
+                        case BNX2_LINK_STATUS_1000FULL:
+                                bp->line_speed = SPEED_1000;
+                                break;
+                        case BNX2_LINK_STATUS_2500HALF:
+                                bp->duplex = DUPLEX_HALF;
+                        case BNX2_LINK_STATUS_2500FULL:
+                                bp->line_speed = SPEED_2500;
+                                break;
+                        default:
+                                bp->line_speed = 0;
+                                break;
+                }
+
+                spin_lock(&bp->phy_lock);
+                bp->flow_ctrl = 0;
+                if ((bp->autoneg & (AUTONEG_SPEED | AUTONEG_FLOW_CTRL)) !=
+                    (AUTONEG_SPEED | AUTONEG_FLOW_CTRL)) {
+                        if (bp->duplex == DUPLEX_FULL)
+                                bp->flow_ctrl = bp->req_flow_ctrl;
+                } else {
+                        if (msg & BNX2_LINK_STATUS_TX_FC_ENABLED)
+                                bp->flow_ctrl |= FLOW_CTRL_TX;
+                        if (msg & BNX2_LINK_STATUS_RX_FC_ENABLED)
+                                bp->flow_ctrl |= FLOW_CTRL_RX;
+                }
+
+                old_port = bp->phy_port;
+                if (msg & BNX2_LINK_STATUS_SERDES_LINK)
+                        bp->phy_port = PORT_FIBRE;
+                else
+                        bp->phy_port = PORT_TP;
+
+                if (old_port != bp->phy_port)
+                        bnx2_set_default_link(bp);
+
+                spin_unlock(&bp->phy_lock);
+        }
+        if (bp->link_up != link_up)
+                bnx2_report_link(bp);
+
+        bnx2_set_mac_link(bp);
+}
+
+static int
+bnx2_set_remote_link(struct bnx2 *bp)
+{
+        u32 evt_code;
+
+        evt_code = REG_RD_IND(bp, bp->shmem_base + BNX2_FW_EVT_CODE_MB);
+        switch (evt_code) {
+                case BNX2_FW_EVT_CODE_LINK_EVENT:
+                        bnx2_remote_phy_event(bp);
+                        break;
+                case BNX2_FW_EVT_CODE_SW_TIMER_EXPIRATION_EVENT:
+                default:
+                        bnx2_send_heart_beat(bp);
+                        break;
+        }
+        return 0;
+}
+
 static int
 bnx2_setup_copper_phy(struct bnx2 *bp)
 {
@@ -1433,13 +1694,13 @@ bnx2_setup_copper_phy(struct bnx2 *bp)
 }
 
 static int
-bnx2_setup_phy(struct bnx2 *bp)
+bnx2_setup_phy(struct bnx2 *bp, u8 port)
 {
         if (bp->loopback == MAC_LOOPBACK)
                 return 0;
 
         if (bp->phy_flags & PHY_SERDES_FLAG) {
-                return (bnx2_setup_serdes_phy(bp));
+                return (bnx2_setup_serdes_phy(bp, port));
         }
         else {
                 return (bnx2_setup_copper_phy(bp));
@@ -1659,6 +1920,9 @@ bnx2_init_phy(struct bnx2 *bp)
 
         REG_WR(bp, BNX2_EMAC_ATTENTION_ENA, BNX2_EMAC_ATTENTION_ENA_LINK);
 
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                goto setup_phy;
+
         bnx2_read_phy(bp, MII_PHYSID1, &val);
         bp->phy_id = val << 16;
         bnx2_read_phy(bp, MII_PHYSID2, &val);
@@ -1676,7 +1940,9 @@ bnx2_init_phy(struct bnx2 *bp)
                 rc = bnx2_init_copper_phy(bp);
         }
 
-        bnx2_setup_phy(bp);
+setup_phy:
+        if (!rc)
+                rc = bnx2_setup_phy(bp, bp->phy_port);
 
         return rc;
 }
@@ -1984,6 +2250,9 @@ bnx2_phy_int(struct bnx2 *bp)
                 bnx2_set_link(bp);
                 spin_unlock(&bp->phy_lock);
         }
+        if (bnx2_phy_event_is_set(bp, STATUS_ATTN_BITS_TIMER_ABORT))
+                bnx2_set_remote_link(bp);
+
 }
 
 static void
@@ -2297,6 +2566,7 @@ bnx2_interrupt(int irq, void *dev_instance)
 {
         struct net_device *dev = dev_instance;
         struct bnx2 *bp = netdev_priv(dev);
+        struct status_block *sblk = bp->status_blk;
 
         /* When using INTx, it is possible for the interrupt to arrive
          * at the CPU before the status block posted prior to the
@@ -2304,7 +2574,7 @@ bnx2_interrupt(int irq, void *dev_instance)
          * When using MSI, the MSI message will always complete after
          * the status block write.
          */
-        if ((bp->status_blk->status_idx == bp->last_status_idx) &&
+        if ((sblk->status_idx == bp->last_status_idx) &&
             (REG_RD(bp, BNX2_PCICFG_MISC_STATUS) &
              BNX2_PCICFG_MISC_STATUS_INTA_VALUE))
                 return IRQ_NONE;
@@ -2313,16 +2583,25 @@ bnx2_interrupt(int irq, void *dev_instance)
                 BNX2_PCICFG_INT_ACK_CMD_USE_INT_HC_PARAM |
                 BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
 
+        /* Read back to deassert IRQ immediately to avoid too many
+         * spurious interrupts.
+         */
+        REG_RD(bp, BNX2_PCICFG_INT_ACK_CMD);
+
         /* Return here if interrupt is shared and is disabled. */
         if (unlikely(atomic_read(&bp->intr_sem) != 0))
                 return IRQ_HANDLED;
 
-        netif_rx_schedule(dev);
+        if (netif_rx_schedule_prep(dev)) {
+                bp->last_status_idx = sblk->status_idx;
+                __netif_rx_schedule(dev);
+        }
 
         return IRQ_HANDLED;
 }
 
-#define STATUS_ATTN_EVENTS      STATUS_ATTN_BITS_LINK_STATE
+#define STATUS_ATTN_EVENTS      (STATUS_ATTN_BITS_LINK_STATE | \
+                                 STATUS_ATTN_BITS_TIMER_ABORT)
 
 static inline int
 bnx2_has_work(struct bnx2 *bp)
@@ -3562,6 +3841,36 @@ nvram_write_end:
         return rc;
 }
 
+static void
+bnx2_init_remote_phy(struct bnx2 *bp)
+{
+        u32 val;
+
+        bp->phy_flags &= ~REMOTE_PHY_CAP_FLAG;
+        if (!(bp->phy_flags & PHY_SERDES_FLAG))
+                return;
+
+        val = REG_RD_IND(bp, bp->shmem_base + BNX2_FW_CAP_MB);
+        if ((val & BNX2_FW_CAP_SIGNATURE_MASK) != BNX2_FW_CAP_SIGNATURE)
+                return;
+
+        if (val & BNX2_FW_CAP_REMOTE_PHY_CAPABLE) {
+                if (netif_running(bp->dev)) {
+                        val = BNX2_DRV_ACK_CAP_SIGNATURE |
+                              BNX2_FW_CAP_REMOTE_PHY_CAPABLE;
+                        REG_WR_IND(bp, bp->shmem_base + BNX2_DRV_ACK_CAP_MB,
+                                   val);
+                }
+                bp->phy_flags |= REMOTE_PHY_CAP_FLAG;
+
+                val = REG_RD_IND(bp, bp->shmem_base + BNX2_LINK_STATUS);
+                if (val & BNX2_LINK_STATUS_SERDES_LINK)
+                        bp->phy_port = PORT_FIBRE;
+                else
+                        bp->phy_port = PORT_TP;
+        }
+}
+
 static int
 bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
 {
@@ -3642,6 +3951,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
         if (rc)
                 return rc;
 
+        spin_lock_bh(&bp->phy_lock);
+        bnx2_init_remote_phy(bp);
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                bnx2_set_default_remote_link(bp);
+        spin_unlock_bh(&bp->phy_lock);
+
         if (CHIP_ID(bp) == CHIP_ID_5706_A0) {
                 /* Adjust the voltage regular to two steps lower.  The default
                  * of this register is 0x0000000e. */
@@ -3826,7 +4141,7 @@ bnx2_init_chip(struct bnx2 *bp)
         rc = bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT2 | BNX2_DRV_MSG_CODE_RESET,
                           0);
 
-        REG_WR(bp, BNX2_MISC_ENABLE_SET_BITS, 0x5ffffff);
+        REG_WR(bp, BNX2_MISC_ENABLE_SET_BITS, BNX2_MISC_ENABLE_DEFAULT);
         REG_RD(bp, BNX2_MISC_ENABLE_SET_BITS);
 
         udelay(20);
@@ -4069,8 +4384,8 @@ bnx2_init_nic(struct bnx2 *bp)
 
         spin_lock_bh(&bp->phy_lock);
         bnx2_init_phy(bp);
-        spin_unlock_bh(&bp->phy_lock);
         bnx2_set_link(bp);
+        spin_unlock_bh(&bp->phy_lock);
         return 0;
 }
 
@@ -4600,6 +4915,9 @@ bnx2_5706_serdes_timer(struct bnx2 *bp)
 static void
 bnx2_5708_serdes_timer(struct bnx2 *bp)
 {
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                return;
+
         if ((bp->phy_flags & PHY_2_5G_CAPABLE_FLAG) == 0) {
                 bp->serdes_an_pending = 0;
                 return;
@@ -4631,7 +4949,6 @@ static void
 bnx2_timer(unsigned long data)
 {
         struct bnx2 *bp = (struct bnx2 *) data;
-        u32 msg;
 
         if (!netif_running(bp->dev))
                 return;
@@ -4639,8 +4956,7 @@ bnx2_timer(unsigned long data)
         if (atomic_read(&bp->intr_sem) != 0)
                 goto bnx2_restart_timer;
 
-        msg = (u32) ++bp->fw_drv_pulse_wr_seq;
-        REG_WR_IND(bp, bp->shmem_base + BNX2_DRV_PULSE_MB, msg);
+        bnx2_send_heart_beat(bp);
 
         bp->stats_blk->stat_FwRxDrop = REG_RD_IND(bp, BNX2_FW_RX_DROP_COUNT);
 
@@ -5083,17 +5399,25 @@ static int
 bnx2_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         struct bnx2 *bp = netdev_priv(dev);
+        int support_serdes = 0, support_copper = 0;
 
         cmd->supported = SUPPORTED_Autoneg;
-        if (bp->phy_flags & PHY_SERDES_FLAG) {
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG) {
+                support_serdes = 1;
+                support_copper = 1;
+        } else if (bp->phy_port == PORT_FIBRE)
+                support_serdes = 1;
+        else
+                support_copper = 1;
+
+        if (support_serdes) {
                 cmd->supported |= SUPPORTED_1000baseT_Full |
                         SUPPORTED_FIBRE;
                 if (bp->phy_flags & PHY_2_5G_CAPABLE_FLAG)
                         cmd->supported |= SUPPORTED_2500baseX_Full;
 
-                cmd->port = PORT_FIBRE;
         }
-        else {
+        if (support_copper) {
                 cmd->supported |= SUPPORTED_10baseT_Half |
                         SUPPORTED_10baseT_Full |
                         SUPPORTED_100baseT_Half |
@@ -5101,9 +5425,10 @@ bnx2_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         SUPPORTED_1000baseT_Full |
                         SUPPORTED_TP;
 
-                cmd->port = PORT_TP;
         }
 
+        spin_lock_bh(&bp->phy_lock);
+        cmd->port = bp->phy_port;
         cmd->advertising = bp->advertising;
 
         if (bp->autoneg & AUTONEG_SPEED) {
@@ -5121,6 +5446,7 @@ bnx2_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                 cmd->speed = -1;
                 cmd->duplex = -1;
         }
+        spin_unlock_bh(&bp->phy_lock);
 
         cmd->transceiver = XCVR_INTERNAL;
         cmd->phy_address = bp->phy_addr;
@@ -5136,6 +5462,15 @@ bnx2_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         u8 req_duplex = bp->req_duplex;
         u16 req_line_speed = bp->req_line_speed;
         u32 advertising = bp->advertising;
+        int err = -EINVAL;
+
+        spin_lock_bh(&bp->phy_lock);
+
+        if (cmd->port != PORT_TP && cmd->port != PORT_FIBRE)
+                goto err_out_unlock;
+
+        if (cmd->port != bp->phy_port && !(bp->phy_flags & REMOTE_PHY_CAP_FLAG))
+                goto err_out_unlock;
 
         if (cmd->autoneg == AUTONEG_ENABLE) {
                 autoneg |= AUTONEG_SPEED;
@@ -5148,44 +5483,41 @@ bnx2_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         (cmd->advertising == ADVERTISED_100baseT_Half) ||
                         (cmd->advertising == ADVERTISED_100baseT_Full)) {
 
-                        if (bp->phy_flags & PHY_SERDES_FLAG)
-                                return -EINVAL;
+                        if (cmd->port == PORT_FIBRE)
+                                goto err_out_unlock;
 
                         advertising = cmd->advertising;
 
                 } else if (cmd->advertising == ADVERTISED_2500baseX_Full) {
-                        if (!(bp->phy_flags & PHY_2_5G_CAPABLE_FLAG))
-                                return -EINVAL;
-                } else if (cmd->advertising == ADVERTISED_1000baseT_Full) {
+                        if (!(bp->phy_flags & PHY_2_5G_CAPABLE_FLAG) ||
+                            (cmd->port == PORT_TP))
+                                goto err_out_unlock;
+                } else if (cmd->advertising == ADVERTISED_1000baseT_Full)
                         advertising = cmd->advertising;
-                }
-                else if (cmd->advertising == ADVERTISED_1000baseT_Half) {
-                        return -EINVAL;
-                }
+                else if (cmd->advertising == ADVERTISED_1000baseT_Half)
+                        goto err_out_unlock;
                 else {
-                        if (bp->phy_flags & PHY_SERDES_FLAG) {
+                        if (cmd->port == PORT_FIBRE)
                                 advertising = ETHTOOL_ALL_FIBRE_SPEED;
-                        }
-                        else {
+                        else
                                 advertising = ETHTOOL_ALL_COPPER_SPEED;
-                        }
                 }
                 advertising |= ADVERTISED_Autoneg;
         }
         else {
-                if (bp->phy_flags & PHY_SERDES_FLAG) {
+                if (cmd->port == PORT_FIBRE) {
                         if ((cmd->speed != SPEED_1000 &&
                              cmd->speed != SPEED_2500) ||
                             (cmd->duplex != DUPLEX_FULL))
-                                return -EINVAL;
+                                goto err_out_unlock;
 
                         if (cmd->speed == SPEED_2500 &&
                             !(bp->phy_flags & PHY_2_5G_CAPABLE_FLAG))
-                                return -EINVAL;
-                }
-                else if (cmd->speed == SPEED_1000) {
-                        return -EINVAL;
+                                goto err_out_unlock;
                 }
+                else if (cmd->speed == SPEED_1000 || cmd->speed == SPEED_2500)
+                        goto err_out_unlock;
+
                 autoneg &= ~AUTONEG_SPEED;
                 req_line_speed = cmd->speed;
                 req_duplex = cmd->duplex;
@@ -5197,13 +5529,12 @@ bnx2_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         bp->req_line_speed = req_line_speed;
         bp->req_duplex = req_duplex;
 
-        spin_lock_bh(&bp->phy_lock);
-
-        bnx2_setup_phy(bp);
+        err = bnx2_setup_phy(bp, cmd->port);
 
+err_out_unlock:
         spin_unlock_bh(&bp->phy_lock);
 
-        return 0;
+        return err;
 }
 
 static void
@@ -5214,11 +5545,7 @@ bnx2_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
         strcpy(info->driver, DRV_MODULE_NAME);
         strcpy(info->version, DRV_MODULE_VERSION);
         strcpy(info->bus_info, pci_name(bp->pdev));
-        info->fw_version[0] = ((bp->fw_ver & 0xff000000) >> 24) + '0';
-        info->fw_version[2] = ((bp->fw_ver & 0xff0000) >> 16) + '0';
-        info->fw_version[4] = ((bp->fw_ver & 0xff00) >> 8) + '0';
-        info->fw_version[1] = info->fw_version[3] = '.';
-        info->fw_version[5] = 0;
+        strcpy(info->fw_version, bp->fw_version);
 }
 
 #define BNX2_REGDUMP_LEN                (32 * 1024)
@@ -5330,6 +5657,14 @@ bnx2_nway_reset(struct net_device *dev)
 
         spin_lock_bh(&bp->phy_lock);
 
+        if (bp->phy_flags & REMOTE_PHY_CAP_FLAG) {
+                int rc;
+
+                rc = bnx2_setup_remote_phy(bp, bp->phy_port);
+                spin_unlock_bh(&bp->phy_lock);
+                return rc;
+        }
+
         /* Force a link down visible on the other side */
         if (bp->phy_flags & PHY_SERDES_FLAG) {
                 bnx2_write_phy(bp, bp->mii_bmcr, BMCR_LOOPBACK);
@@ -5543,7 +5878,7 @@ bnx2_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 
         spin_lock_bh(&bp->phy_lock);
 
-        bnx2_setup_phy(bp);
+        bnx2_setup_phy(bp, bp->phy_port);
 
         spin_unlock_bh(&bp->phy_lock);
 
@@ -5939,6 +6274,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCGMIIREG: {
                 u32 mii_regval;
 
+                if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                        return -EOPNOTSUPP;
+
                 if (!netif_running(dev))
                         return -EAGAIN;
 
@@ -5955,6 +6293,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
+                if (bp->phy_flags & REMOTE_PHY_CAP_FLAG)
+                        return -EOPNOTSUPP;
+
                 if (!netif_running(dev))
                         return -EAGAIN;
 
@@ -6116,7 +6457,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 {
         struct bnx2 *bp;
         unsigned long mem_len;
-        int rc;
+        int rc, i, j;
         u32 reg;
         u64 dma_mask, persist_dma_mask;
 
@@ -6273,7 +6614,35 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 goto err_out_unmap;
         }
 
-        bp->fw_ver = REG_RD_IND(bp, bp->shmem_base + BNX2_DEV_INFO_BC_REV);
+        reg = REG_RD_IND(bp, bp->shmem_base + BNX2_DEV_INFO_BC_REV);
+        for (i = 0, j = 0; i < 3; i++) {
+                u8 num, k, skip0;
+
+                num = (u8) (reg >> (24 - (i * 8)));
+                for (k = 100, skip0 = 1; k >= 1; num %= k, k /= 10) {
+                        if (num >= k || !skip0 || k == 1) {
+                                bp->fw_version[j++] = (num / k) + '0';
+                                skip0 = 0;
+                        }
+                }
+                if (i != 2)
+                        bp->fw_version[j++] = '.';
+        }
+        reg = REG_RD_IND(bp, bp->shmem_base + BNX2_BC_STATE_CONDITION);
+        reg &= BNX2_CONDITION_MFW_RUN_MASK;
+        if (reg != BNX2_CONDITION_MFW_RUN_UNKNOWN &&
+            reg != BNX2_CONDITION_MFW_RUN_NONE) {
+                int i;
+                u32 addr = REG_RD_IND(bp, bp->shmem_base + BNX2_MFW_VER_PTR);
+
+                bp->fw_version[j++] = ' ';
+                for (i = 0; i < 3; i++) {
+                        reg = REG_RD_IND(bp, addr + i * 4);
+                        reg = swab32(reg);
+                        memcpy(&bp->fw_version[j], &reg, 4);
+                        j += 4;
+                }
+        }
 
         reg = REG_RD_IND(bp, bp->shmem_base + BNX2_PORT_HW_CFG_MAC_UPPER);
         bp->mac_addr[0] = (u8) (reg >> 8);
@@ -6315,7 +6684,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         else if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT)
                 bp->phy_flags |= PHY_SERDES_FLAG;
 
+        bp->phy_port = PORT_TP;
         if (bp->phy_flags & PHY_SERDES_FLAG) {
+                bp->phy_port = PORT_FIBRE;
                 bp->flags |= NO_WOL_FLAG;
                 if (CHIP_NUM(bp) != CHIP_NUM_5706) {
                         bp->phy_addr = 2;
@@ -6324,6 +6695,8 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                         if (reg & BNX2_SHARED_HW_CFG_PHY_2_5G)
                                 bp->phy_flags |= PHY_2_5G_CAPABLE_FLAG;
                 }
+                bnx2_init_remote_phy(bp);
+
         } else if (CHIP_NUM(bp) == CHIP_NUM_5706 ||
                    CHIP_NUM(bp) == CHIP_NUM_5708)
                 bp->phy_flags |= PHY_CRC_FIX_FLAG;
@@ -6373,23 +6746,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 }
         }
 
-        bp->autoneg = AUTONEG_SPEED | AUTONEG_FLOW_CTRL;
-        bp->req_line_speed = 0;
-        if (bp->phy_flags & PHY_SERDES_FLAG) {
-                bp->advertising = ETHTOOL_ALL_FIBRE_SPEED | ADVERTISED_Autoneg;
-
-                reg = REG_RD_IND(bp, bp->shmem_base + BNX2_PORT_HW_CFG_CONFIG);
-                reg &= BNX2_PORT_HW_CFG_CFG_DFLT_LINK_MASK;
-                if (reg == BNX2_PORT_HW_CFG_CFG_DFLT_LINK_1G) {
-                        bp->autoneg = 0;
-                        bp->req_line_speed = bp->line_speed = SPEED_1000;
-                        bp->req_duplex = DUPLEX_FULL;
-                }
-        }
-        else {
-                bp->advertising = ETHTOOL_ALL_COPPER_SPEED | ADVERTISED_Autoneg;
-        }
-
+        bnx2_set_default_link(bp);
         bp->req_flow_ctrl = FLOW_CTRL_RX | FLOW_CTRL_TX;
 
         init_timer(&bp->timer);
@@ -6489,10 +6846,10 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         memcpy(dev->perm_addr, bp->mac_addr, 6);
         bp->name = board_info[ent->driver_data].name;
 
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
         if (CHIP_NUM(bp) == CHIP_NUM_5709)
-                dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
-        else
-                dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
+                dev->features |= NETIF_F_IPV6_CSUM;
+
 #ifdef BCM_VLAN
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 #endif
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 49a5de253b17..d8cd1afeb23d 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6338,6 +6338,8 @@ struct l2_fhdr {
 
 #define RX_COPY_THRESH                  92
 
+#define BNX2_MISC_ENABLE_DEFAULT        0x7ffffff
+
 #define DMA_READ_CHANS  5
 #define DMA_WRITE_CHANS 3
 
@@ -6537,6 +6539,7 @@ struct bnx2 {
 #define PHY_INT_MODE_AUTO_POLLING_FLAG  0x100
 #define PHY_INT_MODE_LINK_READY_FLAG    0x200
 #define PHY_DIS_EARLY_DAC_FLAG          0x400
+#define REMOTE_PHY_CAP_FLAG             0x800
 
         u32                     mii_bmcr;
         u32                     mii_bmsr;
@@ -6625,6 +6628,7 @@ struct bnx2 {
         u16                     req_line_speed;
         u8                      req_duplex;
 
+        u8                      phy_port;
         u8                      link_up;
 
         u16                     line_speed;
@@ -6656,7 +6660,7 @@ struct bnx2 {
 
         u32                     shmem_base;
 
-        u32                     fw_ver;
+        char                    fw_version[32];
 
         int                     pm_cap;
         int                     pcix_cap;
@@ -6770,7 +6774,7 @@ struct fw_info {
  * the firmware has timed out, the driver will assume there is no firmware
  * running and there won't be any firmware-driver synchronization during a
  * driver reset. */
-#define FW_ACK_TIME_OUT_MS                  100
+#define FW_ACK_TIME_OUT_MS                  1000
 
 
 #define BNX2_DRV_RESET_SIGNATURE                0x00000000
@@ -6788,6 +6792,7 @@ struct fw_info {
 #define BNX2_DRV_MSG_CODE_DIAG                   0x07000000
 #define BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL         0x09000000
 #define BNX2_DRV_MSG_CODE_UNLOAD_LNK_DN          0x0b000000
+#define BNX2_DRV_MSG_CODE_CMD_SET_LINK           0x10000000
 
 #define BNX2_DRV_MSG_DATA                        0x00ff0000
 #define BNX2_DRV_MSG_DATA_WAIT0                  0x00010000
@@ -6836,6 +6841,7 @@ struct fw_info {
 #define BNX2_LINK_STATUS_SERDES_LINK             (1<<20)
 #define BNX2_LINK_STATUS_PARTNER_AD_2500FULL     (1<<21)
 #define BNX2_LINK_STATUS_PARTNER_AD_2500HALF     (1<<22)
+#define BNX2_LINK_STATUS_HEART_BEAT_EXPIRED      (1<<31)
 
 #define BNX2_DRV_PULSE_MB                       0x00000010
 #define BNX2_DRV_PULSE_SEQ_MASK                  0x00007fff
@@ -6845,6 +6851,30 @@ struct fw_info {
  * This is used for debugging. */
 #define BNX2_DRV_MSG_DATA_PULSE_CODE_ALWAYS_ALIVE        0x00080000
 
+#define BNX2_DRV_MB_ARG0                        0x00000014
+#define BNX2_NETLINK_SET_LINK_SPEED_10HALF       (1<<0)
+#define BNX2_NETLINK_SET_LINK_SPEED_10FULL       (1<<1)
+#define BNX2_NETLINK_SET_LINK_SPEED_10           \
+        (BNX2_NETLINK_SET_LINK_SPEED_10HALF |    \
+         BNX2_NETLINK_SET_LINK_SPEED_10FULL)
+#define BNX2_NETLINK_SET_LINK_SPEED_100HALF      (1<<2)
+#define BNX2_NETLINK_SET_LINK_SPEED_100FULL      (1<<3)
+#define BNX2_NETLINK_SET_LINK_SPEED_100          \
+        (BNX2_NETLINK_SET_LINK_SPEED_100HALF |   \
+         BNX2_NETLINK_SET_LINK_SPEED_100FULL)
+#define BNX2_NETLINK_SET_LINK_SPEED_1GHALF       (1<<4)
+#define BNX2_NETLINK_SET_LINK_SPEED_1GFULL       (1<<5)
+#define BNX2_NETLINK_SET_LINK_SPEED_2G5HALF      (1<<6)
+#define BNX2_NETLINK_SET_LINK_SPEED_2G5FULL      (1<<7)
+#define BNX2_NETLINK_SET_LINK_SPEED_10GHALF      (1<<8)
+#define BNX2_NETLINK_SET_LINK_SPEED_10GFULL      (1<<9)
+#define BNX2_NETLINK_SET_LINK_ENABLE_AUTONEG     (1<<10)
+#define BNX2_NETLINK_SET_LINK_PHY_APP_REMOTE     (1<<11)
+#define BNX2_NETLINK_SET_LINK_FC_SYM_PAUSE       (1<<12)
+#define BNX2_NETLINK_SET_LINK_FC_ASYM_PAUSE      (1<<13)
+#define BNX2_NETLINK_SET_LINK_ETH_AT_WIRESPEED   (1<<14)
+#define BNX2_NETLINK_SET_LINK_PHY_RESET          (1<<15)
+
 #define BNX2_DEV_INFO_SIGNATURE                 0x00000020
 #define BNX2_DEV_INFO_SIGNATURE_MAGIC            0x44564900
 #define BNX2_DEV_INFO_SIGNATURE_MAGIC_MASK       0xffffff00
@@ -7006,6 +7036,8 @@ struct fw_info {
 #define BNX2_PORT_FEATURE_MBA_VLAN_TAG_MASK      0xffff
 #define BNX2_PORT_FEATURE_MBA_VLAN_ENABLE        0x10000
 
+#define BNX2_MFW_VER_PTR                        0x00000014c
+
 #define BNX2_BC_STATE_RESET_TYPE                0x000001c0
 #define BNX2_BC_STATE_RESET_TYPE_SIG             0x00005254
 #define BNX2_BC_STATE_RESET_TYPE_SIG_MASK        0x0000ffff
@@ -7059,12 +7091,42 @@ struct fw_info {
 #define BNX2_BC_STATE_ERR_NO_RXP                 (BNX2_BC_STATE_SIGN | 0x0600)
 #define BNX2_BC_STATE_ERR_TOO_MANY_RBUF          (BNX2_BC_STATE_SIGN | 0x0700)
 
+#define BNX2_BC_STATE_CONDITION                 0x000001c8
+#define BNX2_CONDITION_MFW_RUN_UNKNOWN           0x00000000
+#define BNX2_CONDITION_MFW_RUN_IPMI              0x00002000
+#define BNX2_CONDITION_MFW_RUN_UMP               0x00004000
+#define BNX2_CONDITION_MFW_RUN_NCSI              0x00006000
+#define BNX2_CONDITION_MFW_RUN_NONE              0x0000e000
+#define BNX2_CONDITION_MFW_RUN_MASK              0x0000e000
+
 #define BNX2_BC_STATE_DEBUG_CMD                 0x1dc
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE       0x42440000
 #define BNX2_BC_STATE_BC_DBG_CMD_SIGNATURE_MASK  0xffff0000
 #define BNX2_BC_STATE_BC_DBG_CMD_LOOP_CNT_MASK   0xffff
 #define BNX2_BC_STATE_BC_DBG_CMD_LOOP_INFINITE   0xffff
 
+#define BNX2_FW_EVT_CODE_MB                     0x354
+#define BNX2_FW_EVT_CODE_SW_TIMER_EXPIRATION_EVENT 0x00000000
+#define BNX2_FW_EVT_CODE_LINK_EVENT              0x00000001
+
+#define BNX2_DRV_ACK_CAP_MB                     0x364
+#define BNX2_DRV_ACK_CAP_SIGNATURE               0x35450000
+#define BNX2_CAPABILITY_SIGNATURE_MASK           0xFFFF0000
+
+#define BNX2_FW_CAP_MB                          0x368
+#define BNX2_FW_CAP_SIGNATURE                    0xaa550000
+#define BNX2_FW_ACK_DRV_SIGNATURE                0x52500000
+#define BNX2_FW_CAP_SIGNATURE_MASK               0xffff0000
+#define BNX2_FW_CAP_REMOTE_PHY_CAPABLE           0x00000001
+#define BNX2_FW_CAP_REMOTE_PHY_PRESENT           0x00000002
+
+#define BNX2_RPHY_SIGNATURE                     0x36c
+#define BNX2_RPHY_LOAD_SIGNATURE                 0x5a5a5a5a
+
+#define BNX2_RPHY_FLAGS                         0x370
+#define BNX2_RPHY_SERDES_LINK                   0x374
+#define BNX2_RPHY_COPPER_LINK                   0x378
+
 #define HOST_VIEW_SHMEM_BASE                    0x167c00
 
 #endif
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index fab4fc9f7fd0..04e3710c9082 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -865,9 +865,9 @@ receive_packet (struct net_device *dev)
                                                             PCI_DMA_FROMDEVICE);
                                 /* 16 byte align the IP header */
                                 skb_reserve (skb, 2);
-                                eth_copy_and_sum (skb,
+                                skb_copy_to_linear_data (skb,
                                                   np->rx_skbuff[entry]->data,
-                                                  pkt_len, 0);
+                                                  pkt_len);
                                 skb_put (skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pdev,
                                                                desc->fraginfo &
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 264fa0e2e075..c3de81bf090a 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -104,6 +104,18 @@
 #define PRINTK(args...)   printk(KERN_DEBUG args)
 #endif
 
+#ifdef CONFIG_BLACKFIN
+#define readsb  insb
+#define readsw  insw
+#define readsl  insl
+#define writesb outsb
+#define writesw outsw
+#define writesl outsl
+#define DM9000_IRQ_FLAGS        (IRQF_SHARED | IRQF_TRIGGER_HIGH)
+#else
+#define DM9000_IRQ_FLAGS        IRQF_SHARED
+#endif
+
 /*
  * Transmit timeout, default 5 seconds.
  */
@@ -431,6 +443,9 @@ dm9000_probe(struct platform_device *pdev)
                 db->io_addr = (void __iomem *)base;
                 db->io_data = (void __iomem *)(base + 4);
 
+                /* ensure at least we have a default set of IO routines */
+                dm9000_set_io(db, 2);
+
         } else {
                 db->addr_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
                 db->data_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
@@ -614,7 +629,7 @@ dm9000_open(struct net_device *dev)
 
         PRINTK2("entering dm9000_open\n");
 
-        if (request_irq(dev->irq, &dm9000_interrupt, IRQF_SHARED, dev->name, dev))
+        if (request_irq(dev->irq, &dm9000_interrupt, DM9000_IRQ_FLAGS, dev->name, dev))
                 return -EAGAIN;
 
         /* Initialize DM9000 board */
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 60673bc292c0..756a6bcb038d 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -34,11 +34,12 @@
 #include <linux/etherdevice.h>
 #include <linux/init.h>
 #include <linux/moduleparam.h>
+#include <linux/rtnetlink.h>
+#include <net/rtnetlink.h>
 
 static int numdummies = 1;
 
 static int dummy_xmit(struct sk_buff *skb, struct net_device *dev);
-static struct net_device_stats *dummy_get_stats(struct net_device *dev);
 
 static int dummy_set_address(struct net_device *dev, void *p)
 {
@@ -56,13 +57,13 @@ static void set_multicast_list(struct net_device *dev)
 {
 }
 
-static void __init dummy_setup(struct net_device *dev)
+static void dummy_setup(struct net_device *dev)
 {
         /* Initialize the device structure. */
-        dev->get_stats = dummy_get_stats;
         dev->hard_start_xmit = dummy_xmit;
         dev->set_multicast_list = set_multicast_list;
         dev->set_mac_address = dummy_set_address;
+        dev->destructor = free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         ether_setup(dev);
@@ -76,77 +77,80 @@ static void __init dummy_setup(struct net_device *dev)
 
 static int dummy_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct net_device_stats *stats = netdev_priv(dev);
-
-        stats->tx_packets++;
-        stats->tx_bytes+=skb->len;
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
 
         dev_kfree_skb(skb);
         return 0;
 }
 
-static struct net_device_stats *dummy_get_stats(struct net_device *dev)
+static int dummy_validate(struct nlattr *tb[], struct nlattr *data[])
 {
-        return netdev_priv(dev);
+        if (tb[IFLA_ADDRESS]) {
+                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+                        return -EINVAL;
+                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
+                        return -EADDRNOTAVAIL;
+        }
+        return 0;
 }
 
-static struct net_device **dummies;
+static struct rtnl_link_ops dummy_link_ops __read_mostly = {
+        .kind           = "dummy",
+        .setup          = dummy_setup,
+        .validate       = dummy_validate,
+};
 
 /* Number of dummy devices to be set up by this module. */
 module_param(numdummies, int, 0);
 MODULE_PARM_DESC(numdummies, "Number of dummy pseudo devices");
 
-static int __init dummy_init_one(int index)
+static int __init dummy_init_one(void)
 {
         struct net_device *dev_dummy;
         int err;
 
-        dev_dummy = alloc_netdev(sizeof(struct net_device_stats),
-                                 "dummy%d", dummy_setup);
-
+        dev_dummy = alloc_netdev(0, "dummy%d", dummy_setup);
         if (!dev_dummy)
                 return -ENOMEM;
 
-        if ((err = register_netdev(dev_dummy))) {
-                free_netdev(dev_dummy);
-                dev_dummy = NULL;
-        } else {
-                dummies[index] = dev_dummy;
-        }
+        err = dev_alloc_name(dev_dummy, dev_dummy->name);
+        if (err < 0)
+                goto err;
 
-        return err;
-}
+        dev_dummy->rtnl_link_ops = &dummy_link_ops;
+        err = register_netdevice(dev_dummy);
+        if (err < 0)
+                goto err;
+        return 0;
 
-static void dummy_free_one(int index)
-{
-        unregister_netdev(dummies[index]);
-        free_netdev(dummies[index]);
+err:
+        free_netdev(dev_dummy);
+        return err;
 }
 
 static int __init dummy_init_module(void)
 {
         int i, err = 0;
-        dummies = kmalloc(numdummies * sizeof(void *), GFP_KERNEL);
-        if (!dummies)
-                return -ENOMEM;
+
+        rtnl_lock();
+        err = __rtnl_link_register(&dummy_link_ops);
+
         for (i = 0; i < numdummies && !err; i++)
-                err = dummy_init_one(i);
-        if (err) {
-                i--;
-                while (--i >= 0)
-                        dummy_free_one(i);
-        }
+                err = dummy_init_one();
+        if (err < 0)
+                __rtnl_link_unregister(&dummy_link_ops);
+        rtnl_unlock();
+
         return err;
 }
 
 static void __exit dummy_cleanup_module(void)
 {
-        int i;
-        for (i = 0; i < numdummies; i++)
-                dummy_free_one(i);
-        kfree(dummies);
+        rtnl_link_unregister(&dummy_link_ops);
 }
 
 module_init(dummy_init_module);
 module_exit(dummy_cleanup_module);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("dummy");
diff --git a/drivers/net/eepro100.c b/drivers/net/eepro100.c
index 9800341956a2..9afa47edfc58 100644
--- a/drivers/net/eepro100.c
+++ b/drivers/net/eepro100.c
@@ -1801,7 +1801,7 @@ speedo_rx(struct net_device *dev)
 
 #if 1 || USE_IP_CSUM
                                 /* Packet is in one chunk -- we can copy + cksum. */
-                                eth_copy_and_sum(skb, sp->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb, sp->rx_skbuff[entry]->data, pkt_len);
                                 skb_put(skb, pkt_len);
 #else
                                 skb_copy_from_linear_data(sp->rx_skbuff[entry],
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 5e517946f46a..119778401e48 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -1201,7 +1201,7 @@ static int epic_rx(struct net_device *dev, int budget)
                                                             ep->rx_ring[entry].bufaddr,
                                                             ep->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
-                                eth_copy_and_sum(skb, ep->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb, ep->rx_skbuff[entry]->data, pkt_len);
                                 skb_put(skb, pkt_len);
                                 pci_dma_sync_single_for_device(ep->pci_dev,
                                                                ep->rx_ring[entry].bufaddr,
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index abe9b089c610..ff9f177d7157 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -1727,8 +1727,8 @@ static int netdev_rx(struct net_device *dev)
                                 /* Call copy + cksum if available. */
 
 #if ! defined(__alpha__)
-                                eth_copy_and_sum(skb,
-                                        np->cur_rx->skbuff->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb,
+                                        np->cur_rx->skbuff->data, pkt_len);
                                 skb_put(skb, pkt_len);
 #else
                                 memcpy(skb_put(skb, pkt_len),
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 255b09124e11..03023dd17829 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -648,7 +648,7 @@ while (!((status = bdp->cbd_sc) & BD_ENET_RX_EMPTY)) {
                 fep->stats.rx_dropped++;
         } else {
                 skb_put(skb,pkt_len-4); /* Make room */
-                eth_copy_and_sum(skb, data, pkt_len-4, 0);
+                skb_copy_to_linear_data(skb, data, pkt_len-4);
                 skb->protocol=eth_type_trans(skb,dev);
                 netif_rx(skb);
         }
diff --git a/drivers/net/hamachi.c b/drivers/net/hamachi.c
index 2521b111b3a5..15254dc7876a 100644
--- a/drivers/net/hamachi.c
+++ b/drivers/net/hamachi.c
@@ -1575,8 +1575,8 @@ static int hamachi_rx(struct net_device *dev)
                                                             PCI_DMA_FROMDEVICE);
                                 /* Call copy + cksum if available. */
 #if 1 || USE_IP_COPYSUM
-                                eth_copy_and_sum(skb,
-                                        hmp->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb,
+                                        hmp->rx_skbuff[entry]->data, pkt_len);
                                 skb_put(skb, pkt_len);
 #else
                                 memcpy(skb_put(skb, pkt_len), hmp->rx_ring_dma
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 6ec3d500f334..d96eb7229548 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -1337,7 +1337,7 @@ const char * buf, size_t count)
 
 #define ATTR(_name, _mode)      \
         struct attribute veth_##_name##_attr = {               \
-        .name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE \
+        .name = __stringify(_name), .mode = _mode, \
         };
 
 static ATTR(active, 0644);
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 07b4c0d7a75c..f5c3598e59af 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -136,13 +136,14 @@ resched:
 
 }
 
-static void __init ifb_setup(struct net_device *dev)
+static void ifb_setup(struct net_device *dev)
 {
         /* Initialize the device structure. */
         dev->get_stats = ifb_get_stats;
         dev->hard_start_xmit = ifb_xmit;
         dev->open = &ifb_open;
         dev->stop = &ifb_close;
+        dev->destructor = free_netdev;
 
         /* Fill in device structure with ethernet-generic values. */
         ether_setup(dev);
@@ -197,12 +198,6 @@ static struct net_device_stats *ifb_get_stats(struct net_device *dev)
         return stats;
 }
 
-static struct net_device **ifbs;
-
-/* Number of ifb devices to be set up by this module. */
-module_param(numifbs, int, 0);
-MODULE_PARM_DESC(numifbs, "Number of ifb devices");
-
 static int ifb_close(struct net_device *dev)
 {
         struct ifb_private *dp = netdev_priv(dev);
@@ -226,6 +221,28 @@ static int ifb_open(struct net_device *dev)
         return 0;
 }
 
+static int ifb_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        if (tb[IFLA_ADDRESS]) {
+                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+                        return -EINVAL;
+                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
+                        return -EADDRNOTAVAIL;
+        }
+        return 0;
+}
+
+static struct rtnl_link_ops ifb_link_ops __read_mostly = {
+        .kind           = "ifb",
+        .priv_size      = sizeof(struct ifb_private),
+        .setup          = ifb_setup,
+        .validate       = ifb_validate,
+};
+
+/* Number of ifb devices to be set up by this module. */
+module_param(numifbs, int, 0);
+MODULE_PARM_DESC(numifbs, "Number of ifb devices");
+
 static int __init ifb_init_one(int index)
 {
         struct net_device *dev_ifb;
@@ -237,49 +254,44 @@ static int __init ifb_init_one(int index)
         if (!dev_ifb)
                 return -ENOMEM;
 
-        if ((err = register_netdev(dev_ifb))) {
-                free_netdev(dev_ifb);
-                dev_ifb = NULL;
-        } else {
-                ifbs[index] = dev_ifb;
-        }
+        err = dev_alloc_name(dev_ifb, dev_ifb->name);
+        if (err < 0)
+                goto err;
 
-        return err;
-}
+        dev_ifb->rtnl_link_ops = &ifb_link_ops;
+        err = register_netdevice(dev_ifb);
+        if (err < 0)
+                goto err;
+        return 0;
 
-static void ifb_free_one(int index)
-{
-        unregister_netdev(ifbs[index]);
-        free_netdev(ifbs[index]);
+err:
+        free_netdev(dev_ifb);
+        return err;
 }
 
 static int __init ifb_init_module(void)
 {
-        int i, err = 0;
-        ifbs = kmalloc(numifbs * sizeof(void *), GFP_KERNEL);
-        if (!ifbs)
-                return -ENOMEM;
+        int i, err;
+
+        rtnl_lock();
+        err = __rtnl_link_register(&ifb_link_ops);
+
         for (i = 0; i < numifbs && !err; i++)
                 err = ifb_init_one(i);
-        if (err) {
-                i--;
-                while (--i >= 0)
-                        ifb_free_one(i);
-        }
+        if (err)
+                __rtnl_link_unregister(&ifb_link_ops);
+        rtnl_unlock();
 
         return err;
 }
 
 static void __exit ifb_cleanup_module(void)
 {
-        int i;
-
-        for (i = 0; i < numifbs; i++)
-                ifb_free_one(i);
-        kfree(ifbs);
+        rtnl_link_unregister(&ifb_link_ops);
 }
 
 module_init(ifb_init_module);
 module_exit(ifb_cleanup_module);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jamal Hadi Salim");
+MODULE_ALIAS_RTNL_LINK("ifb");
diff --git a/drivers/net/irda/kingsun-sir.c b/drivers/net/irda/kingsun-sir.c
index 217429122e79..bdd5c979bead 100644
--- a/drivers/net/irda/kingsun-sir.c
+++ b/drivers/net/irda/kingsun-sir.c
@@ -4,7 +4,7 @@
 * Version:       0.1.1
 * Description:   Irda KingSun/DonShine USB Dongle
 * Status:        Experimental
-* Author:        Alex Villac�s Lasso <a_villacis@palosanto.com>
+* Author:        Alex Villacís Lasso <a_villacis@palosanto.com>
 *
 *       Based on stir4200 and mcs7780 drivers, with (strange?) differences
 *
@@ -652,6 +652,6 @@ static void __exit kingsun_cleanup(void)
 }
 module_exit(kingsun_cleanup);
 
-MODULE_AUTHOR("Alex Villac�s Lasso <a_villacis@palosanto.com>");
+MODULE_AUTHOR("Alex Villacís Lasso <a_villacis@palosanto.com>");
 MODULE_DESCRIPTION("IrDA-USB Dongle Driver for KingSun/DonShine");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index bf78ef1120ad..0538ca9ce058 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -44,6 +44,7 @@ MODULE_LICENSE("GPL");
 #include <linux/time.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <asm/byteorder.h>
 
@@ -1660,8 +1661,8 @@ vlsi_irda_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         idev = ndev->priv;
 
         spin_lock_init(&idev->lock);
-        init_MUTEX(&idev->sem);
-        down(&idev->sem);
+        mutex_init(&idev->mtx);
+        mutex_lock(&idev->mtx);
         idev->pdev = pdev;
 
         if (vlsi_irda_init(ndev) < 0)
@@ -1689,12 +1690,12 @@ vlsi_irda_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         IRDA_MESSAGE("%s: registered device %s\n", drivername, ndev->name);
 
         pci_set_drvdata(pdev, ndev);
-        up(&idev->sem);
+        mutex_unlock(&idev->mtx);
 
         return 0;
 
 out_freedev:
-        up(&idev->sem);
+        mutex_unlock(&idev->mtx);
         free_netdev(ndev);
 out_disable:
         pci_disable_device(pdev);
@@ -1716,12 +1717,12 @@ static void __devexit vlsi_irda_remove(struct pci_dev *pdev)
         unregister_netdev(ndev);
 
         idev = ndev->priv;
-        down(&idev->sem);
+        mutex_lock(&idev->mtx);
         if (idev->proc_entry) {
                 remove_proc_entry(ndev->name, vlsi_proc_root);
                 idev->proc_entry = NULL;
         }
-        up(&idev->sem);
+        mutex_unlock(&idev->mtx);
 
         free_netdev(ndev);
 
@@ -1751,7 +1752,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
                 return 0;
         }
         idev = ndev->priv;      
-        down(&idev->sem);
+        mutex_lock(&idev->mtx);
         if (pdev->current_state != 0) {                 /* already suspended */
                 if (state.event > pdev->current_state) {        /* simply go deeper */
                         pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1759,7 +1760,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
                 }
                 else
                         IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, pci_name(pdev), pdev->current_state, state.event);
-                up(&idev->sem);
+                mutex_unlock(&idev->mtx);
                 return 0;
         }
 
@@ -1775,7 +1776,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
         pdev->current_state = state.event;
         idev->resume_ok = 1;
-        up(&idev->sem);
+        mutex_unlock(&idev->mtx);
         return 0;
 }
 
@@ -1790,9 +1791,9 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
                 return 0;
         }
         idev = ndev->priv;      
-        down(&idev->sem);
+        mutex_lock(&idev->mtx);
         if (pdev->current_state == 0) {
-                up(&idev->sem);
+                mutex_unlock(&idev->mtx);
                 IRDA_WARNING("%s - %s: already resumed\n",
                              __FUNCTION__, pci_name(pdev));
                 return 0;
@@ -1814,7 +1815,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
                  * device and independently resume_ok should catch any garbage config.
                  */
                 IRDA_WARNING("%s - hm, nothing to resume?\n", __FUNCTION__);
-                up(&idev->sem);
+                mutex_unlock(&idev->mtx);
                 return 0;
         }
 
@@ -1824,7 +1825,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
                 netif_device_attach(ndev);
         }
         idev->resume_ok = 0;
-        up(&idev->sem);
+        mutex_unlock(&idev->mtx);
         return 0;
 }
 
diff --git a/drivers/net/irda/vlsi_ir.h b/drivers/net/irda/vlsi_ir.h
index 2d3b773d8e35..ca12a6096419 100644
--- a/drivers/net/irda/vlsi_ir.h
+++ b/drivers/net/irda/vlsi_ir.h
@@ -728,7 +728,7 @@ typedef struct vlsi_irda_dev {
         struct timeval          last_rx;
 
         spinlock_t              lock;
-        struct semaphore        sem;
+        struct mutex            mtx;
 
         u8                      resume_ok;      
         struct proc_dir_entry   *proc_entry;
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index d5f694fc4a21..d9ce1aef148a 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -111,7 +111,7 @@ static int ixpdev_rx(struct net_device *dev, int *budget)
                 skb = dev_alloc_skb(desc->pkt_length + 2);
                 if (likely(skb != NULL)) {
                         skb_reserve(skb, 2);
-                        eth_copy_and_sum(skb, buf, desc->pkt_length, 0);
+                        skb_copy_to_linear_data(skb, buf, desc->pkt_length);
                         skb_put(skb, desc->pkt_length);
                         skb->protocol = eth_type_trans(skb, nds[desc->channel]);
 
diff --git a/drivers/net/lance.c b/drivers/net/lance.c
index 0fe96c85828b..a2f37e52b928 100644
--- a/drivers/net/lance.c
+++ b/drivers/net/lance.c
@@ -1186,9 +1186,9 @@ lance_rx(struct net_device *dev)
                                 }
                                 skb_reserve(skb,2);     /* 16 byte align */
                                 skb_put(skb,pkt_len);   /* Make room */
-                                eth_copy_and_sum(skb,
+                                skb_copy_to_linear_data(skb,
                                         (unsigned char *)isa_bus_to_virt((lp->rx_ring[entry].base & 0x00ffffff)),
-                                        pkt_len,0);
+                                        pkt_len);
                                 skb->protocol=eth_type_trans(skb,dev);
                                 netif_rx(skb);
                                 dev->last_rx = jiffies;
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 460a08718c69..3450051ae56b 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2357,8 +2357,8 @@ static void netdev_rx(struct net_device *dev, int *work_done, int work_to_do)
                                         np->rx_dma[entry],
                                         buflen,
                                         PCI_DMA_FROMDEVICE);
-                                eth_copy_and_sum(skb,
-                                        np->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb,
+                                        np->rx_skbuff[entry]->data, pkt_len);
                                 skb_put(skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pci_dev,
                                         np->rx_dma[entry],
diff --git a/drivers/net/ni52.c b/drivers/net/ni52.c
index 8dbd6d1900b5..5e7999db2096 100644
--- a/drivers/net/ni52.c
+++ b/drivers/net/ni52.c
@@ -936,7 +936,7 @@ static void ni52_rcv_int(struct net_device *dev)
                                         {
                                                 skb_reserve(skb,2);
                                                 skb_put(skb,totlen);
-                                                eth_copy_and_sum(skb,(char *) p->base+(unsigned long) rbd->buffer,totlen,0);
+                                                skb_copy_to_linear_data(skb,(char *) p->base+(unsigned long) rbd->buffer,totlen);
                                                 skb->protocol=eth_type_trans(skb,dev);
                                                 netif_rx(skb);
                                                 dev->last_rx = jiffies;
diff --git a/drivers/net/ni65.c b/drivers/net/ni65.c
index 3818edf0ac18..4ef5fe345191 100644
--- a/drivers/net/ni65.c
+++ b/drivers/net/ni65.c
@@ -1096,7 +1096,7 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
 #ifdef RCV_VIA_SKB
                                 if( (unsigned long) (skb->data + R_BUF_SIZE) > 0x1000000) {
                                         skb_put(skb,len);
-                                        eth_copy_and_sum(skb, (unsigned char *)(p->recv_skb[p->rmdnum]->data),len,0);
+                                        skb_copy_to_linear_data(skb, (unsigned char *)(p->recv_skb[p->rmdnum]->data),len);
                                 }
                                 else {
                                         struct sk_buff *skb1 = p->recv_skb[p->rmdnum];
@@ -1108,7 +1108,7 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
                                 }
 #else
                                 skb_put(skb,len);
-                                eth_copy_and_sum(skb, (unsigned char *) p->recvbounce[p->rmdnum],len,0);
+                                skb_copy_to_linear_data(skb, (unsigned char *) p->recvbounce[p->rmdnum],len);
 #endif
                                 p->stats.rx_packets++;
                                 p->stats.rx_bytes += len;
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index df8998b4f37e..3cdbe118200b 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -1567,7 +1567,7 @@ static void netdrv_rx_interrupt (struct net_device *dev,
                 if (skb) {
                         skb_reserve (skb, 2);   /* 16 byte align the IP fields. */
 
-                        eth_copy_and_sum (skb, &rx_ring[ring_offset + 4], pkt_size, 0);
+                        skb_copy_to_linear_data (skb, &rx_ring[ring_offset + 4], pkt_size);
                         skb_put (skb, pkt_size);
 
                         skb->protocol = eth_type_trans (skb, dev);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 9c171a7390e2..465485a3fbc6 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1235,9 +1235,9 @@ static void pcnet32_rx_entry(struct net_device *dev,
                                             lp->rx_dma_addr[entry],
                                             pkt_len,
                                             PCI_DMA_FROMDEVICE);
-                eth_copy_and_sum(skb,
+                skb_copy_to_linear_data(skb,
                                  (unsigned char *)(lp->rx_skbuff[entry]->data),
-                                 pkt_len, 0);
+                                 pkt_len);
                 pci_dma_sync_single_for_device(lp->pci_dev,
                                                lp->rx_dma_addr[entry],
                                                pkt_len,
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
new file mode 100644
index 000000000000..5891a0fbdc8b
--- /dev/null
+++ b/drivers/net/pppol2tp.c
@@ -0,0 +1,2486 @@
+/*****************************************************************************
+ * Linux PPP over L2TP (PPPoX/PPPoL2TP) Sockets
+ *
+ * PPPoX    --- Generic PPP encapsulation socket family
+ * PPPoL2TP --- PPP over L2TP (RFC 2661)
+ *
+ * Version:     1.0.0
+ *
+ * Authors:     Martijn van Oosterhout <kleptog@svana.org>
+ *              James Chapman (jchapman@katalix.com)
+ * Contributors:
+ *              Michal Ostrowski <mostrows@speakeasy.net>
+ *              Arnaldo Carvalho de Melo <acme@xconectiva.com.br>
+ *              David S. Miller (davem@redhat.com)
+ *
+ * License:
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ */
+
+/* This driver handles only L2TP data frames; control frames are handled by a
+ * userspace application.
+ *
+ * To send data in an L2TP session, userspace opens a PPPoL2TP socket and
+ * attaches it to a bound UDP socket with local tunnel_id / session_id and
+ * peer tunnel_id / session_id set. Data can then be sent or received using
+ * regular socket sendmsg() / recvmsg() calls. Kernel parameters of the socket
+ * can be read or modified using ioctl() or [gs]etsockopt() calls.
+ *
+ * When a PPPoL2TP socket is connected with local and peer session_id values
+ * zero, the socket is treated as a special tunnel management socket.
+ *
+ * Here's example userspace code to create a socket for sending/receiving data
+ * over an L2TP session:-
+ *
+ *      struct sockaddr_pppol2tp sax;
+ *      int fd;
+ *      int session_fd;
+ *
+ *      fd = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
+ *
+ *      sax.sa_family = AF_PPPOX;
+ *      sax.sa_protocol = PX_PROTO_OL2TP;
+ *      sax.pppol2tp.fd = tunnel_fd;    // bound UDP socket
+ *      sax.pppol2tp.addr.sin_addr.s_addr = addr->sin_addr.s_addr;
+ *      sax.pppol2tp.addr.sin_port = addr->sin_port;
+ *      sax.pppol2tp.addr.sin_family = AF_INET;
+ *      sax.pppol2tp.s_tunnel  = tunnel_id;
+ *      sax.pppol2tp.s_session = session_id;
+ *      sax.pppol2tp.d_tunnel  = peer_tunnel_id;
+ *      sax.pppol2tp.d_session = peer_session_id;
+ *
+ *      session_fd = connect(fd, (struct sockaddr *)&sax, sizeof(sax));
+ *
+ * A pppd plugin that allows PPP traffic to be carried over L2TP using
+ * this driver is available from the OpenL2TP project at
+ * http://openl2tp.sourceforge.net.
+ */
+
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/string.h>
+#include <linux/list.h>
+#include <asm/uaccess.h>
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/kthread.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/jiffies.h>
+
+#include <linux/netdevice.h>
+#include <linux/net.h>
+#include <linux/inetdevice.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/if_pppox.h>
+#include <linux/if_pppol2tp.h>
+#include <net/sock.h>
+#include <linux/ppp_channel.h>
+#include <linux/ppp_defs.h>
+#include <linux/if_ppp.h>
+#include <linux/file.h>
+#include <linux/hash.h>
+#include <linux/sort.h>
+#include <linux/proc_fs.h>
+#include <net/dst.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <net/xfrm.h>
+
+#include <asm/byteorder.h>
+#include <asm/atomic.h>
+
+
+#define PPPOL2TP_DRV_VERSION    "V1.0"
+
+/* L2TP header constants */
+#define L2TP_HDRFLAG_T     0x8000
+#define L2TP_HDRFLAG_L     0x4000
+#define L2TP_HDRFLAG_S     0x0800
+#define L2TP_HDRFLAG_O     0x0200
+#define L2TP_HDRFLAG_P     0x0100
+
+#define L2TP_HDR_VER_MASK  0x000F
+#define L2TP_HDR_VER       0x0002
+
+/* Space for UDP, L2TP and PPP headers */
+#define PPPOL2TP_HEADER_OVERHEAD        40
+
+/* Just some random numbers */
+#define L2TP_TUNNEL_MAGIC       0x42114DDA
+#define L2TP_SESSION_MAGIC      0x0C04EB7D
+
+#define PPPOL2TP_HASH_BITS      4
+#define PPPOL2TP_HASH_SIZE      (1 << PPPOL2TP_HASH_BITS)
+
+/* Default trace flags */
+#define PPPOL2TP_DEFAULT_DEBUG_FLAGS    0
+
+#define PRINTK(_mask, _type, _lvl, _fmt, args...)                       \
+        do {                                                            \
+                if ((_mask) & (_type))                                  \
+                        printk(_lvl "PPPOL2TP: " _fmt, ##args);         \
+        } while(0)
+
+/* Number of bytes to build transmit L2TP headers.
+ * Unfortunately the size is different depending on whether sequence numbers
+ * are enabled.
+ */
+#define PPPOL2TP_L2TP_HDR_SIZE_SEQ              10
+#define PPPOL2TP_L2TP_HDR_SIZE_NOSEQ            6
+
+struct pppol2tp_tunnel;
+
+/* Describes a session. It is the sk_user_data field in the PPPoL2TP
+ * socket. Contains information to determine incoming packets and transmit
+ * outgoing ones.
+ */
+struct pppol2tp_session
+{
+        int                     magic;          /* should be
+                                                 * L2TP_SESSION_MAGIC */
+        int                     owner;          /* pid that opened the socket */
+
+        struct sock             *sock;          /* Pointer to the session
+                                                 * PPPoX socket */
+        struct sock             *tunnel_sock;   /* Pointer to the tunnel UDP
+                                                 * socket */
+
+        struct pppol2tp_addr    tunnel_addr;    /* Description of tunnel */
+
+        struct pppol2tp_tunnel  *tunnel;        /* back pointer to tunnel
+                                                 * context */
+
+        char                    name[20];       /* "sess xxxxx/yyyyy", where
+                                                 * x=tunnel_id, y=session_id */
+        int                     mtu;
+        int                     mru;
+        int                     flags;          /* accessed by PPPIOCGFLAGS.
+                                                 * Unused. */
+        unsigned                recv_seq:1;     /* expect receive packets with
+                                                 * sequence numbers? */
+        unsigned                send_seq:1;     /* send packets with sequence
+                                                 * numbers? */
+        unsigned                lns_mode:1;     /* behave as LNS? LAC enables
+                                                 * sequence numbers under
+                                                 * control of LNS. */
+        int                     debug;          /* bitmask of debug message
+                                                 * categories */
+        int                     reorder_timeout; /* configured reorder timeout
+                                                  * (in jiffies) */
+        u16                     nr;             /* session NR state (receive) */
+        u16                     ns;             /* session NR state (send) */
+        struct sk_buff_head     reorder_q;      /* receive reorder queue */
+        struct pppol2tp_ioc_stats stats;
+        struct hlist_node       hlist;          /* Hash list node */
+};
+
+/* The sk_user_data field of the tunnel's UDP socket. It contains info to track
+ * all the associated sessions so incoming packets can be sorted out
+ */
+struct pppol2tp_tunnel
+{
+        int                     magic;          /* Should be L2TP_TUNNEL_MAGIC */
+        rwlock_t                hlist_lock;     /* protect session_hlist */
+        struct hlist_head       session_hlist[PPPOL2TP_HASH_SIZE];
+                                                /* hashed list of sessions,
+                                                 * hashed by id */
+        int                     debug;          /* bitmask of debug message
+                                                 * categories */
+        char                    name[12];       /* "tunl xxxxx" */
+        struct pppol2tp_ioc_stats stats;
+
+        void (*old_sk_destruct)(struct sock *);
+
+        struct sock             *sock;          /* Parent socket */
+        struct list_head        list;           /* Keep a list of all open
+                                                 * prepared sockets */
+
+        atomic_t                ref_count;
+};
+
+/* Private data stored for received packets in the skb.
+ */
+struct pppol2tp_skb_cb {
+        u16                     ns;
+        u16                     nr;
+        u16                     has_seq;
+        u16                     length;
+        unsigned long           expires;
+};
+
+#define PPPOL2TP_SKB_CB(skb)    ((struct pppol2tp_skb_cb *) &skb->cb[sizeof(struct inet_skb_parm)])
+
+static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb);
+static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel);
+
+static atomic_t pppol2tp_tunnel_count;
+static atomic_t pppol2tp_session_count;
+static struct ppp_channel_ops pppol2tp_chan_ops = { pppol2tp_xmit , NULL };
+static struct proto_ops pppol2tp_ops;
+static LIST_HEAD(pppol2tp_tunnel_list);
+static DEFINE_RWLOCK(pppol2tp_tunnel_list_lock);
+
+/* Helpers to obtain tunnel/session contexts from sockets.
+ */
+static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
+{
+        struct pppol2tp_session *session;
+
+        if (sk == NULL)
+                return NULL;
+
+        session = (struct pppol2tp_session *)(sk->sk_user_data);
+        if (session == NULL)
+                return NULL;
+
+        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+
+        return session;
+}
+
+static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
+{
+        struct pppol2tp_tunnel *tunnel;
+
+        if (sk == NULL)
+                return NULL;
+
+        tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
+        if (tunnel == NULL)
+                return NULL;
+
+        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+
+        return tunnel;
+}
+
+/* Tunnel reference counts. Incremented per session that is added to
+ * the tunnel.
+ */
+static inline void pppol2tp_tunnel_inc_refcount(struct pppol2tp_tunnel *tunnel)
+{
+        atomic_inc(&tunnel->ref_count);
+}
+
+static inline void pppol2tp_tunnel_dec_refcount(struct pppol2tp_tunnel *tunnel)
+{
+        if (atomic_dec_and_test(&tunnel->ref_count))
+                pppol2tp_tunnel_free(tunnel);
+}
+
+/* Session hash list.
+ * The session_id SHOULD be random according to RFC2661, but several
+ * L2TP implementations (Cisco and Microsoft) use incrementing
+ * session_ids.  So we do a real hash on the session_id, rather than a
+ * simple bitmask.
+ */
+static inline struct hlist_head *
+pppol2tp_session_id_hash(struct pppol2tp_tunnel *tunnel, u16 session_id)
+{
+        unsigned long hash_val = (unsigned long) session_id;
+        return &tunnel->session_hlist[hash_long(hash_val, PPPOL2TP_HASH_BITS)];
+}
+
+/* Lookup a session by id
+ */
+static struct pppol2tp_session *
+pppol2tp_session_find(struct pppol2tp_tunnel *tunnel, u16 session_id)
+{
+        struct hlist_head *session_list =
+                pppol2tp_session_id_hash(tunnel, session_id);
+        struct pppol2tp_session *session;
+        struct hlist_node *walk;
+
+        read_lock(&tunnel->hlist_lock);
+        hlist_for_each_entry(session, walk, session_list, hlist) {
+                if (session->tunnel_addr.s_session == session_id) {
+                        read_unlock(&tunnel->hlist_lock);
+                        return session;
+                }
+        }
+        read_unlock(&tunnel->hlist_lock);
+
+        return NULL;
+}
+
+/* Lookup a tunnel by id
+ */
+static struct pppol2tp_tunnel *pppol2tp_tunnel_find(u16 tunnel_id)
+{
+        struct pppol2tp_tunnel *tunnel = NULL;
+
+        read_lock(&pppol2tp_tunnel_list_lock);
+        list_for_each_entry(tunnel, &pppol2tp_tunnel_list, list) {
+                if (tunnel->stats.tunnel_id == tunnel_id) {
+                        read_unlock(&pppol2tp_tunnel_list_lock);
+                        return tunnel;
+                }
+        }
+        read_unlock(&pppol2tp_tunnel_list_lock);
+
+        return NULL;
+}
+
+/*****************************************************************************
+ * Receive data handling
+ *****************************************************************************/
+
+/* Queue a skb in order. We come here only if the skb has an L2TP sequence
+ * number.
+ */
+static void pppol2tp_recv_queue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
+{
+        struct sk_buff *skbp;
+        u16 ns = PPPOL2TP_SKB_CB(skb)->ns;
+
+        spin_lock(&session->reorder_q.lock);
+        skb_queue_walk(&session->reorder_q, skbp) {
+                if (PPPOL2TP_SKB_CB(skbp)->ns > ns) {
+                        __skb_insert(skb, skbp->prev, skbp, &session->reorder_q);
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                               "%s: pkt %hu, inserted before %hu, reorder_q len=%d\n",
+                               session->name, ns, PPPOL2TP_SKB_CB(skbp)->ns,
+                               skb_queue_len(&session->reorder_q));
+                        session->stats.rx_oos_packets++;
+                        goto out;
+                }
+        }
+
+        __skb_queue_tail(&session->reorder_q, skb);
+
+out:
+        spin_unlock(&session->reorder_q.lock);
+}
+
+/* Dequeue a single skb.
+ */
+static void pppol2tp_recv_dequeue_skb(struct pppol2tp_session *session, struct sk_buff *skb)
+{
+        struct pppol2tp_tunnel *tunnel = session->tunnel;
+        int length = PPPOL2TP_SKB_CB(skb)->length;
+        struct sock *session_sock = NULL;
+
+        /* We're about to requeue the skb, so unlink it and return resources
+         * to its current owner (a socket receive buffer).
+         */
+        skb_unlink(skb, &session->reorder_q);
+        skb_orphan(skb);
+
+        tunnel->stats.rx_packets++;
+        tunnel->stats.rx_bytes += length;
+        session->stats.rx_packets++;
+        session->stats.rx_bytes += length;
+
+        if (PPPOL2TP_SKB_CB(skb)->has_seq) {
+                /* Bump our Nr */
+                session->nr++;
+                PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                       "%s: updated nr to %hu\n", session->name, session->nr);
+        }
+
+        /* If the socket is bound, send it in to PPP's input queue. Otherwise
+         * queue it on the session socket.
+         */
+        session_sock = session->sock;
+        if (session_sock->sk_state & PPPOX_BOUND) {
+                struct pppox_sock *po;
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: recv %d byte data frame, passing to ppp\n",
+                       session->name, length);
+
+                /* We need to forget all info related to the L2TP packet
+                 * gathered in the skb as we are going to reuse the same
+                 * skb for the inner packet.
+                 * Namely we need to:
+                 * - reset xfrm (IPSec) information as it applies to
+                 *   the outer L2TP packet and not to the inner one
+                 * - release the dst to force a route lookup on the inner
+                 *   IP packet since skb->dst currently points to the dst
+                 *   of the UDP tunnel
+                 * - reset netfilter information as it doesn't apply
+                 *   to the inner packet either
+                 */
+                secpath_reset(skb);
+                dst_release(skb->dst);
+                skb->dst = NULL;
+                nf_reset(skb);
+
+                po = pppox_sk(session_sock);
+                ppp_input(&po->chan, skb);
+        } else {
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
+                       "%s: socket not bound\n", session->name);
+
+                /* Not bound. Nothing we can do, so discard. */
+                session->stats.rx_errors++;
+                kfree_skb(skb);
+        }
+
+        sock_put(session->sock);
+}
+
+/* Dequeue skbs from the session's reorder_q, subject to packet order.
+ * Skbs that have been in the queue for too long are simply discarded.
+ */
+static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
+{
+        struct sk_buff *skb;
+        struct sk_buff *tmp;
+
+        /* If the pkt at the head of the queue has the nr that we
+         * expect to send up next, dequeue it and any other
+         * in-sequence packets behind it.
+         */
+        spin_lock(&session->reorder_q.lock);
+        skb_queue_walk_safe(&session->reorder_q, skb, tmp) {
+                if (time_after(jiffies, PPPOL2TP_SKB_CB(skb)->expires)) {
+                        session->stats.rx_seq_discards++;
+                        session->stats.rx_errors++;
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                               "%s: oos pkt %hu len %d discarded (too old), "
+                               "waiting for %hu, reorder_q_len=%d\n",
+                               session->name, PPPOL2TP_SKB_CB(skb)->ns,
+                               PPPOL2TP_SKB_CB(skb)->length, session->nr,
+                               skb_queue_len(&session->reorder_q));
+                        __skb_unlink(skb, &session->reorder_q);
+                        kfree_skb(skb);
+                        continue;
+                }
+
+                if (PPPOL2TP_SKB_CB(skb)->has_seq) {
+                        if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
+                                PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                                       "%s: holding oos pkt %hu len %d, "
+                                       "waiting for %hu, reorder_q_len=%d\n",
+                                       session->name, PPPOL2TP_SKB_CB(skb)->ns,
+                                       PPPOL2TP_SKB_CB(skb)->length, session->nr,
+                                       skb_queue_len(&session->reorder_q));
+                                goto out;
+                        }
+                }
+                spin_unlock(&session->reorder_q.lock);
+                pppol2tp_recv_dequeue_skb(session, skb);
+                spin_lock(&session->reorder_q.lock);
+        }
+
+out:
+        spin_unlock(&session->reorder_q.lock);
+}
+
+/* Internal receive frame. Do the real work of receiving an L2TP data frame
+ * here. The skb is not on a list when we get here.
+ * Returns 0 if the packet was a data packet and was successfully passed on.
+ * Returns 1 if the packet was not a good data packet and could not be
+ * forwarded.  All such packets are passed up to userspace to deal with.
+ */
+static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
+{
+        struct pppol2tp_session *session = NULL;
+        struct pppol2tp_tunnel *tunnel;
+        unsigned char *ptr;
+        u16 hdrflags;
+        u16 tunnel_id, session_id;
+        int length;
+        struct udphdr *uh;
+
+        tunnel = pppol2tp_sock_to_tunnel(sock);
+        if (tunnel == NULL)
+                goto error;
+
+        /* Short packet? */
+        if (skb->len < sizeof(struct udphdr)) {
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
+                       "%s: recv short packet (len=%d)\n", tunnel->name, skb->len);
+                goto error;
+        }
+
+        /* Point to L2TP header */
+        ptr = skb->data + sizeof(struct udphdr);
+
+        /* Get L2TP header flags */
+        hdrflags = ntohs(*(__be16*)ptr);
+
+        /* Trace packet contents, if enabled */
+        if (tunnel->debug & PPPOL2TP_MSG_DATA) {
+                printk(KERN_DEBUG "%s: recv: ", tunnel->name);
+
+                for (length = 0; length < 16; length++)
+                        printk(" %02X", ptr[length]);
+                printk("\n");
+        }
+
+        /* Get length of L2TP packet */
+        uh = (struct udphdr *) skb_transport_header(skb);
+        length = ntohs(uh->len) - sizeof(struct udphdr);
+
+        /* Too short? */
+        if (length < 12) {
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
+                       "%s: recv short L2TP packet (len=%d)\n", tunnel->name, length);
+                goto error;
+        }
+
+        /* If type is control packet, it is handled by userspace. */
+        if (hdrflags & L2TP_HDRFLAG_T) {
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: recv control packet, len=%d\n", tunnel->name, length);
+                goto error;
+        }
+
+        /* Skip flags */
+        ptr += 2;
+
+        /* If length is present, skip it */
+        if (hdrflags & L2TP_HDRFLAG_L)
+                ptr += 2;
+
+        /* Extract tunnel and session ID */
+        tunnel_id = ntohs(*(__be16 *) ptr);
+        ptr += 2;
+        session_id = ntohs(*(__be16 *) ptr);
+        ptr += 2;
+
+        /* Find the session context */
+        session = pppol2tp_session_find(tunnel, session_id);
+        if (!session) {
+                /* Not found? Pass to userspace to deal with */
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_INFO,
+                       "%s: no socket found (%hu/%hu). Passing up.\n",
+                       tunnel->name, tunnel_id, session_id);
+                goto error;
+        }
+        sock_hold(session->sock);
+
+        /* The ref count on the socket was increased by the above call since
+         * we now hold a pointer to the session. Take care to do sock_put()
+         * when exiting this function from now on...
+         */
+
+        /* Handle the optional sequence numbers.  If we are the LAC,
+         * enable/disable sequence numbers under the control of the LNS.  If
+         * no sequence numbers present but we were expecting them, discard
+         * frame.
+         */
+        if (hdrflags & L2TP_HDRFLAG_S) {
+                u16 ns, nr;
+                ns = ntohs(*(__be16 *) ptr);
+                ptr += 2;
+                nr = ntohs(*(__be16 *) ptr);
+                ptr += 2;
+
+                /* Received a packet with sequence numbers. If we're the LNS,
+                 * check if we sre sending sequence numbers and if not,
+                 * configure it so.
+                 */
+                if ((!session->lns_mode) && (!session->send_seq)) {
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
+                               "%s: requested to enable seq numbers by LNS\n",
+                               session->name);
+                        session->send_seq = -1;
+                }
+
+                /* Store L2TP info in the skb */
+                PPPOL2TP_SKB_CB(skb)->ns = ns;
+                PPPOL2TP_SKB_CB(skb)->nr = nr;
+                PPPOL2TP_SKB_CB(skb)->has_seq = 1;
+
+                PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                       "%s: recv data ns=%hu, nr=%hu, session nr=%hu\n",
+                       session->name, ns, nr, session->nr);
+        } else {
+                /* No sequence numbers.
+                 * If user has configured mandatory sequence numbers, discard.
+                 */
+                if (session->recv_seq) {
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
+                               "%s: recv data has no seq numbers when required. "
+                               "Discarding\n", session->name);
+                        session->stats.rx_seq_discards++;
+                        session->stats.rx_errors++;
+                        goto discard;
+                }
+
+                /* If we're the LAC and we're sending sequence numbers, the
+                 * LNS has requested that we no longer send sequence numbers.
+                 * If we're the LNS and we're sending sequence numbers, the
+                 * LAC is broken. Discard the frame.
+                 */
+                if ((!session->lns_mode) && (session->send_seq)) {
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_INFO,
+                               "%s: requested to disable seq numbers by LNS\n",
+                               session->name);
+                        session->send_seq = 0;
+                } else if (session->send_seq) {
+                        PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_WARNING,
+                               "%s: recv data has no seq numbers when required. "
+                               "Discarding\n", session->name);
+                        session->stats.rx_seq_discards++;
+                        session->stats.rx_errors++;
+                        goto discard;
+                }
+
+                /* Store L2TP info in the skb */
+                PPPOL2TP_SKB_CB(skb)->has_seq = 0;
+        }
+
+        /* If offset bit set, skip it. */
+        if (hdrflags & L2TP_HDRFLAG_O)
+                ptr += 2 + ntohs(*(__be16 *) ptr);
+
+        skb_pull(skb, ptr - skb->data);
+
+        /* Skip PPP header, if present.  In testing, Microsoft L2TP clients
+         * don't send the PPP header (PPP header compression enabled), but
+         * other clients can include the header. So we cope with both cases
+         * here. The PPP header is always FF03 when using L2TP.
+         *
+         * Note that skb->data[] isn't dereferenced from a u16 ptr here since
+         * the field may be unaligned.
+         */
+        if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
+                skb_pull(skb, 2);
+
+        /* Prepare skb for adding to the session's reorder_q.  Hold
+         * packets for max reorder_timeout or 1 second if not
+         * reordering.
+         */
+        PPPOL2TP_SKB_CB(skb)->length = length;
+        PPPOL2TP_SKB_CB(skb)->expires = jiffies +
+                (session->reorder_timeout ? session->reorder_timeout : HZ);
+
+        /* Add packet to the session's receive queue. Reordering is done here, if
+         * enabled. Saved L2TP protocol info is stored in skb->sb[].
+         */
+        if (PPPOL2TP_SKB_CB(skb)->has_seq) {
+                if (session->reorder_timeout != 0) {
+                        /* Packet reordering enabled. Add skb to session's
+                         * reorder queue, in order of ns.
+                         */
+                        pppol2tp_recv_queue_skb(session, skb);
+                } else {
+                        /* Packet reordering disabled. Discard out-of-sequence
+                         * packets
+                         */
+                        if (PPPOL2TP_SKB_CB(skb)->ns != session->nr) {
+                                session->stats.rx_seq_discards++;
+                                session->stats.rx_errors++;
+                                PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                                       "%s: oos pkt %hu len %d discarded, "
+                                       "waiting for %hu, reorder_q_len=%d\n",
+                                       session->name, PPPOL2TP_SKB_CB(skb)->ns,
+                                       PPPOL2TP_SKB_CB(skb)->length, session->nr,
+                                       skb_queue_len(&session->reorder_q));
+                                goto discard;
+                        }
+                        skb_queue_tail(&session->reorder_q, skb);
+                }
+        } else {
+                /* No sequence numbers. Add the skb to the tail of the
+                 * reorder queue. This ensures that it will be
+                 * delivered after all previous sequenced skbs.
+                 */
+                skb_queue_tail(&session->reorder_q, skb);
+        }
+
+        /* Try to dequeue as many skbs from reorder_q as we can. */
+        pppol2tp_recv_dequeue(session);
+
+        return 0;
+
+discard:
+        kfree_skb(skb);
+        sock_put(session->sock);
+
+        return 0;
+
+error:
+        return 1;
+}
+
+/* UDP encapsulation receive handler. See net/ipv4/udp.c.
+ * Return codes:
+ * 0 : success.
+ * <0: error
+ * >0: skb should be passed up to userspace as UDP.
+ */
+static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+{
+        struct pppol2tp_tunnel *tunnel;
+
+        tunnel = pppol2tp_sock_to_tunnel(sk);
+        if (tunnel == NULL)
+                goto pass_up;
+
+        PRINTK(tunnel->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+               "%s: received %d bytes\n", tunnel->name, skb->len);
+
+        if (pppol2tp_recv_core(sk, skb))
+                goto pass_up;
+
+        return 0;
+
+pass_up:
+        return 1;
+}
+
+/* Receive message. This is the recvmsg for the PPPoL2TP socket.
+ */
+static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
+                            struct msghdr *msg, size_t len,
+                            int flags)
+{
+        int err;
+        struct sk_buff *skb;
+        struct sock *sk = sock->sk;
+
+        err = -EIO;
+        if (sk->sk_state & PPPOX_BOUND)
+                goto end;
+
+        msg->msg_namelen = 0;
+
+        err = 0;
+        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
+                                flags & MSG_DONTWAIT, &err);
+        if (skb) {
+                err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
+                                     skb->len);
+                if (err < 0)
+                        goto do_skb_free;
+                err = skb->len;
+        }
+do_skb_free:
+        kfree_skb(skb);
+end:
+        return err;
+}
+
+/************************************************************************
+ * Transmit handling
+ ***********************************************************************/
+
+/* Tell how big L2TP headers are for a particular session. This
+ * depends on whether sequence numbers are being used.
+ */
+static inline int pppol2tp_l2tp_header_len(struct pppol2tp_session *session)
+{
+        if (session->send_seq)
+                return PPPOL2TP_L2TP_HDR_SIZE_SEQ;
+
+        return PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
+}
+
+/* Build an L2TP header for the session into the buffer provided.
+ */
+static void pppol2tp_build_l2tp_header(struct pppol2tp_session *session,
+                                       void *buf)
+{
+        __be16 *bufp = buf;
+        u16 flags = L2TP_HDR_VER;
+
+        if (session->send_seq)
+                flags |= L2TP_HDRFLAG_S;
+
+        /* Setup L2TP header.
+         * FIXME: Can this ever be unaligned? Is direct dereferencing of
+         * 16-bit header fields safe here for all architectures?
+         */
+        *bufp++ = htons(flags);
+        *bufp++ = htons(session->tunnel_addr.d_tunnel);
+        *bufp++ = htons(session->tunnel_addr.d_session);
+        if (session->send_seq) {
+                *bufp++ = htons(session->ns);
+                *bufp++ = 0;
+                session->ns++;
+                PRINTK(session->debug, PPPOL2TP_MSG_SEQ, KERN_DEBUG,
+                       "%s: updated ns to %hu\n", session->name, session->ns);
+        }
+}
+
+/* This is the sendmsg for the PPPoL2TP pppol2tp_session socket.  We come here
+ * when a user application does a sendmsg() on the session socket. L2TP and
+ * PPP headers must be inserted into the user's data.
+ */
+static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
+                            size_t total_len)
+{
+        static const unsigned char ppph[2] = { 0xff, 0x03 };
+        struct sock *sk = sock->sk;
+        struct inet_sock *inet;
+        __wsum csum = 0;
+        struct sk_buff *skb;
+        int error;
+        int hdr_len;
+        struct pppol2tp_session *session;
+        struct pppol2tp_tunnel *tunnel;
+        struct udphdr *uh;
+
+        error = -ENOTCONN;
+        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
+                goto error;
+
+        /* Get session and tunnel contexts */
+        error = -EBADF;
+        session = pppol2tp_sock_to_session(sk);
+        if (session == NULL)
+                goto error;
+
+        tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+        if (tunnel == NULL)
+                goto error;
+
+        /* What header length is configured for this session? */
+        hdr_len = pppol2tp_l2tp_header_len(session);
+
+        /* Allocate a socket buffer */
+        error = -ENOMEM;
+        skb = sock_wmalloc(sk, NET_SKB_PAD + sizeof(struct iphdr) +
+                           sizeof(struct udphdr) + hdr_len +
+                           sizeof(ppph) + total_len,
+                           0, GFP_KERNEL);
+        if (!skb)
+                goto error;
+
+        /* Reserve space for headers. */
+        skb_reserve(skb, NET_SKB_PAD);
+        skb_reset_network_header(skb);
+        skb_reserve(skb, sizeof(struct iphdr));
+        skb_reset_transport_header(skb);
+
+        /* Build UDP header */
+        inet = inet_sk(session->tunnel_sock);
+        uh = (struct udphdr *) skb->data;
+        uh->source = inet->sport;
+        uh->dest = inet->dport;
+        uh->len = htons(hdr_len + sizeof(ppph) + total_len);
+        uh->check = 0;
+        skb_put(skb, sizeof(struct udphdr));
+
+        /* Build L2TP header */
+        pppol2tp_build_l2tp_header(session, skb->data);
+        skb_put(skb, hdr_len);
+
+        /* Add PPP header */
+        skb->data[0] = ppph[0];
+        skb->data[1] = ppph[1];
+        skb_put(skb, 2);
+
+        /* Copy user data into skb */
+        error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
+        if (error < 0) {
+                kfree_skb(skb);
+                goto error;
+        }
+        skb_put(skb, total_len);
+
+        /* Calculate UDP checksum if configured to do so */
+        if (session->tunnel_sock->sk_no_check != UDP_CSUM_NOXMIT)
+                csum = udp_csum_outgoing(sk, skb);
+
+        /* Debug */
+        if (session->send_seq)
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: send %Zd bytes, ns=%hu\n", session->name,
+                       total_len, session->ns - 1);
+        else
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: send %Zd bytes\n", session->name, total_len);
+
+        if (session->debug & PPPOL2TP_MSG_DATA) {
+                int i;
+                unsigned char *datap = skb->data;
+
+                printk(KERN_DEBUG "%s: xmit:", session->name);
+                for (i = 0; i < total_len; i++) {
+                        printk(" %02X", *datap++);
+                        if (i == 15) {
+                                printk(" ...");
+                                break;
+                        }
+                }
+                printk("\n");
+        }
+
+        /* Queue the packet to IP for output */
+        error = ip_queue_xmit(skb, 1);
+
+        /* Update stats */
+        if (error >= 0) {
+                tunnel->stats.tx_packets++;
+                tunnel->stats.tx_bytes += skb->len;
+                session->stats.tx_packets++;
+                session->stats.tx_bytes += skb->len;
+        } else {
+                tunnel->stats.tx_errors++;
+                session->stats.tx_errors++;
+        }
+
+error:
+        return error;
+}
+
+/* Transmit function called by generic PPP driver.  Sends PPP frame
+ * over PPPoL2TP socket.
+ *
+ * This is almost the same as pppol2tp_sendmsg(), but rather than
+ * being called with a msghdr from userspace, it is called with a skb
+ * from the kernel.
+ *
+ * The supplied skb from ppp doesn't have enough headroom for the
+ * insertion of L2TP, UDP and IP headers so we need to allocate more
+ * headroom in the skb. This will create a cloned skb. But we must be
+ * careful in the error case because the caller will expect to free
+ * the skb it supplied, not our cloned skb. So we take care to always
+ * leave the original skb unfreed if we return an error.
+ */
+static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+{
+        static const u8 ppph[2] = { 0xff, 0x03 };
+        struct sock *sk = (struct sock *) chan->private;
+        struct sock *sk_tun;
+        int hdr_len;
+        struct pppol2tp_session *session;
+        struct pppol2tp_tunnel *tunnel;
+        int rc;
+        int headroom;
+        int data_len = skb->len;
+        struct inet_sock *inet;
+        __wsum csum = 0;
+        struct sk_buff *skb2 = NULL;
+        struct udphdr *uh;
+
+        if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
+                goto abort;
+
+        /* Get session and tunnel contexts from the socket */
+        session = pppol2tp_sock_to_session(sk);
+        if (session == NULL)
+                goto abort;
+
+        sk_tun = session->tunnel_sock;
+        if (sk_tun == NULL)
+                goto abort;
+        tunnel = pppol2tp_sock_to_tunnel(sk_tun);
+        if (tunnel == NULL)
+                goto abort;
+
+        /* What header length is configured for this session? */
+        hdr_len = pppol2tp_l2tp_header_len(session);
+
+        /* Check that there's enough headroom in the skb to insert IP,
+         * UDP and L2TP and PPP headers. If not enough, expand it to
+         * make room. Note that a new skb (or a clone) is
+         * allocated. If we return an error from this point on, make
+         * sure we free the new skb but do not free the original skb
+         * since that is done by the caller for the error case.
+         */
+        headroom = NET_SKB_PAD + sizeof(struct iphdr) +
+                sizeof(struct udphdr) + hdr_len + sizeof(ppph);
+        if (skb_headroom(skb) < headroom) {
+                skb2 = skb_realloc_headroom(skb, headroom);
+                if (skb2 == NULL)
+                        goto abort;
+        } else
+                skb2 = skb;
+
+        /* Check that the socket has room */
+        if (atomic_read(&sk_tun->sk_wmem_alloc) < sk_tun->sk_sndbuf)
+                skb_set_owner_w(skb2, sk_tun);
+        else
+                goto discard;
+
+        /* Setup PPP header */
+        skb_push(skb2, sizeof(ppph));
+        skb2->data[0] = ppph[0];
+        skb2->data[1] = ppph[1];
+
+        /* Setup L2TP header */
+        skb_push(skb2, hdr_len);
+        pppol2tp_build_l2tp_header(session, skb2->data);
+
+        /* Setup UDP header */
+        inet = inet_sk(sk_tun);
+        skb_push(skb2, sizeof(struct udphdr));
+        skb_reset_transport_header(skb2);
+        uh = (struct udphdr *) skb2->data;
+        uh->source = inet->sport;
+        uh->dest = inet->dport;
+        uh->len = htons(sizeof(struct udphdr) + hdr_len + sizeof(ppph) + data_len);
+        uh->check = 0;
+
+        /* Calculate UDP checksum if configured to do so */
+        if (sk_tun->sk_no_check != UDP_CSUM_NOXMIT)
+                csum = udp_csum_outgoing(sk_tun, skb2);
+
+        /* Debug */
+        if (session->send_seq)
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: send %d bytes, ns=%hu\n", session->name,
+                       data_len, session->ns - 1);
+        else
+                PRINTK(session->debug, PPPOL2TP_MSG_DATA, KERN_DEBUG,
+                       "%s: send %d bytes\n", session->name, data_len);
+
+        if (session->debug & PPPOL2TP_MSG_DATA) {
+                int i;
+                unsigned char *datap = skb2->data;
+
+                printk(KERN_DEBUG "%s: xmit:", session->name);
+                for (i = 0; i < data_len; i++) {
+                        printk(" %02X", *datap++);
+                        if (i == 31) {
+                                printk(" ...");
+                                break;
+                        }
+                }
+                printk("\n");
+        }
+
+        /* Get routing info from the tunnel socket */
+        skb2->dst = sk_dst_get(sk_tun);
+
+        /* Queue the packet to IP for output */
+        rc = ip_queue_xmit(skb2, 1);
+
+        /* Update stats */
+        if (rc >= 0) {
+                tunnel->stats.tx_packets++;
+                tunnel->stats.tx_bytes += skb2->len;
+                session->stats.tx_packets++;
+                session->stats.tx_bytes += skb2->len;
+        } else {
+                tunnel->stats.tx_errors++;
+                session->stats.tx_errors++;
+        }
+
+        /* Free the original skb */
+        kfree_skb(skb);
+
+        return 1;
+
+discard:
+        /* Free the new skb. Caller will free original skb. */
+        if (skb2 != skb)
+                kfree_skb(skb2);
+abort:
+        return 0;
+}
+
+/*****************************************************************************
+ * Session (and tunnel control) socket create/destroy.
+ *****************************************************************************/
+
+/* When the tunnel UDP socket is closed, all the attached sockets need to go
+ * too.
+ */
+static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
+{
+        int hash;
+        struct hlist_node *walk;
+        struct hlist_node *tmp;
+        struct pppol2tp_session *session;
+        struct sock *sk;
+
+        if (tunnel == NULL)
+                BUG();
+
+        PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+               "%s: closing all sessions...\n", tunnel->name);
+
+        write_lock(&tunnel->hlist_lock);
+        for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
+again:
+                hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+                        session = hlist_entry(walk, struct pppol2tp_session, hlist);
+
+                        sk = session->sock;
+
+                        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                               "%s: closing session\n", session->name);
+
+                        hlist_del_init(&session->hlist);
+
+                        /* Since we should hold the sock lock while
+                         * doing any unbinding, we need to release the
+                         * lock we're holding before taking that lock.
+                         * Hold a reference to the sock so it doesn't
+                         * disappear as we're jumping between locks.
+                         */
+                        sock_hold(sk);
+                        write_unlock(&tunnel->hlist_lock);
+                        lock_sock(sk);
+
+                        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+                                pppox_unbind_sock(sk);
+                                sk->sk_state = PPPOX_DEAD;
+                                sk->sk_state_change(sk);
+                        }
+
+                        /* Purge any queued data */
+                        skb_queue_purge(&sk->sk_receive_queue);
+                        skb_queue_purge(&sk->sk_write_queue);
+                        skb_queue_purge(&session->reorder_q);
+
+                        release_sock(sk);
+                        sock_put(sk);
+
+                        /* Now restart from the beginning of this hash
+                         * chain.  We always remove a session from the
+                         * list so we are guaranteed to make forward
+                         * progress.
+                         */
+                        write_lock(&tunnel->hlist_lock);
+                        goto again;
+                }
+        }
+        write_unlock(&tunnel->hlist_lock);
+}
+
+/* Really kill the tunnel.
+ * Come here only when all sessions have been cleared from the tunnel.
+ */
+static void pppol2tp_tunnel_free(struct pppol2tp_tunnel *tunnel)
+{
+        /* Remove from socket list */
+        write_lock(&pppol2tp_tunnel_list_lock);
+        list_del_init(&tunnel->list);
+        write_unlock(&pppol2tp_tunnel_list_lock);
+
+        atomic_dec(&pppol2tp_tunnel_count);
+        kfree(tunnel);
+}
+
+/* Tunnel UDP socket destruct hook.
+ * The tunnel context is deleted only when all session sockets have been
+ * closed.
+ */
+static void pppol2tp_tunnel_destruct(struct sock *sk)
+{
+        struct pppol2tp_tunnel *tunnel;
+
+        tunnel = pppol2tp_sock_to_tunnel(sk);
+        if (tunnel == NULL)
+                goto end;
+
+        PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+               "%s: closing...\n", tunnel->name);
+
+        /* Close all sessions */
+        pppol2tp_tunnel_closeall(tunnel);
+
+        /* No longer an encapsulation socket. See net/ipv4/udp.c */
+        (udp_sk(sk))->encap_type = 0;
+        (udp_sk(sk))->encap_rcv = NULL;
+
+        /* Remove hooks into tunnel socket */
+        tunnel->sock = NULL;
+        sk->sk_destruct = tunnel->old_sk_destruct;
+        sk->sk_user_data = NULL;
+
+        /* Call original (UDP) socket descructor */
+        if (sk->sk_destruct != NULL)
+                (*sk->sk_destruct)(sk);
+
+        pppol2tp_tunnel_dec_refcount(tunnel);
+
+end:
+        return;
+}
+
+/* Really kill the session socket. (Called from sock_put() if
+ * refcnt == 0.)
+ */
+static void pppol2tp_session_destruct(struct sock *sk)
+{
+        struct pppol2tp_session *session = NULL;
+
+        if (sk->sk_user_data != NULL) {
+                struct pppol2tp_tunnel *tunnel;
+
+                session = pppol2tp_sock_to_session(sk);
+                if (session == NULL)
+                        goto out;
+
+                /* Don't use pppol2tp_sock_to_tunnel() here to
+                 * get the tunnel context because the tunnel
+                 * socket might have already been closed (its
+                 * sk->sk_user_data will be NULL) so use the
+                 * session's private tunnel ptr instead.
+                 */
+                tunnel = session->tunnel;
+                if (tunnel != NULL) {
+                        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+
+                        /* If session_id is zero, this is a null
+                         * session context, which was created for a
+                         * socket that is being used only to manage
+                         * tunnels.
+                         */
+                        if (session->tunnel_addr.s_session != 0) {
+                                /* Delete the session socket from the
+                                 * hash
+                                 */
+                                write_lock(&tunnel->hlist_lock);
+                                hlist_del_init(&session->hlist);
+                                write_unlock(&tunnel->hlist_lock);
+
+                                atomic_dec(&pppol2tp_session_count);
+                        }
+
+                        /* This will delete the tunnel context if this
+                         * is the last session on the tunnel.
+                         */
+                        session->tunnel = NULL;
+                        session->tunnel_sock = NULL;
+                        pppol2tp_tunnel_dec_refcount(tunnel);
+                }
+        }
+
+        kfree(session);
+out:
+        return;
+}
+
+/* Called when the PPPoX socket (session) is closed.
+ */
+static int pppol2tp_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        int error;
+
+        if (!sk)
+                return 0;
+
+        error = -EBADF;
+        lock_sock(sk);
+        if (sock_flag(sk, SOCK_DEAD) != 0)
+                goto error;
+
+        pppox_unbind_sock(sk);
+
+        /* Signal the death of the socket. */
+        sk->sk_state = PPPOX_DEAD;
+        sock_orphan(sk);
+        sock->sk = NULL;
+
+        /* Purge any queued data */
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+
+        release_sock(sk);
+
+        /* This will delete the session context via
+         * pppol2tp_session_destruct() if the socket's refcnt drops to
+         * zero.
+         */
+        sock_put(sk);
+
+        return 0;
+
+error:
+        release_sock(sk);
+        return error;
+}
+
+/* Internal function to prepare a tunnel (UDP) socket to have PPPoX
+ * sockets attached to it.
+ */
+static struct sock *pppol2tp_prepare_tunnel_socket(int fd, u16 tunnel_id,
+                                                   int *error)
+{
+        int err;
+        struct socket *sock = NULL;
+        struct sock *sk;
+        struct pppol2tp_tunnel *tunnel;
+        struct sock *ret = NULL;
+
+        /* Get the tunnel UDP socket from the fd, which was opened by
+         * the userspace L2TP daemon.
+         */
+        err = -EBADF;
+        sock = sockfd_lookup(fd, &err);
+        if (!sock) {
+                PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
+                       "tunl %hu: sockfd_lookup(fd=%d) returned %d\n",
+                       tunnel_id, fd, err);
+                goto err;
+        }
+
+        /* Quick sanity checks */
+        err = -ESOCKTNOSUPPORT;
+        if (sock->type != SOCK_DGRAM) {
+                PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
+                       "tunl %hu: fd %d wrong type, got %d, expected %d\n",
+                       tunnel_id, fd, sock->type, SOCK_DGRAM);
+                goto err;
+        }
+        err = -EAFNOSUPPORT;
+        if (sock->ops->family != AF_INET) {
+                PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_ERR,
+                       "tunl %hu: fd %d wrong family, got %d, expected %d\n",
+                       tunnel_id, fd, sock->ops->family, AF_INET);
+                goto err;
+        }
+
+        err = -ENOTCONN;
+        sk = sock->sk;
+
+        /* Check if this socket has already been prepped */
+        tunnel = (struct pppol2tp_tunnel *)sk->sk_user_data;
+        if (tunnel != NULL) {
+                /* User-data field already set */
+                err = -EBUSY;
+                BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+
+                /* This socket has already been prepped */
+                ret = tunnel->sock;
+                goto out;
+        }
+
+        /* This socket is available and needs prepping. Create a new tunnel
+         * context and init it.
+         */
+        sk->sk_user_data = tunnel = kzalloc(sizeof(struct pppol2tp_tunnel), GFP_KERNEL);
+        if (sk->sk_user_data == NULL) {
+                err = -ENOMEM;
+                goto err;
+        }
+
+        tunnel->magic = L2TP_TUNNEL_MAGIC;
+        sprintf(&tunnel->name[0], "tunl %hu", tunnel_id);
+
+        tunnel->stats.tunnel_id = tunnel_id;
+        tunnel->debug = PPPOL2TP_DEFAULT_DEBUG_FLAGS;
+
+        /* Hook on the tunnel socket destructor so that we can cleanup
+         * if the tunnel socket goes away.
+         */
+        tunnel->old_sk_destruct = sk->sk_destruct;
+        sk->sk_destruct = &pppol2tp_tunnel_destruct;
+
+        tunnel->sock = sk;
+        sk->sk_allocation = GFP_ATOMIC;
+
+        /* Misc init */
+        rwlock_init(&tunnel->hlist_lock);
+
+        /* Add tunnel to our list */
+        INIT_LIST_HEAD(&tunnel->list);
+        write_lock(&pppol2tp_tunnel_list_lock);
+        list_add(&tunnel->list, &pppol2tp_tunnel_list);
+        write_unlock(&pppol2tp_tunnel_list_lock);
+        atomic_inc(&pppol2tp_tunnel_count);
+
+        /* Bump the reference count. The tunnel context is deleted
+         * only when this drops to zero.
+         */
+        pppol2tp_tunnel_inc_refcount(tunnel);
+
+        /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
+        (udp_sk(sk))->encap_type = UDP_ENCAP_L2TPINUDP;
+        (udp_sk(sk))->encap_rcv = pppol2tp_udp_encap_recv;
+
+        ret = tunnel->sock;
+
+        *error = 0;
+out:
+        if (sock)
+                sockfd_put(sock);
+
+        return ret;
+
+err:
+        *error = err;
+        goto out;
+}
+
+static struct proto pppol2tp_sk_proto = {
+        .name     = "PPPOL2TP",
+        .owner    = THIS_MODULE,
+        .obj_size = sizeof(struct pppox_sock),
+};
+
+/* socket() handler. Initialize a new struct sock.
+ */
+static int pppol2tp_create(struct socket *sock)
+{
+        int error = -ENOMEM;
+        struct sock *sk;
+
+        sk = sk_alloc(PF_PPPOX, GFP_KERNEL, &pppol2tp_sk_proto, 1);
+        if (!sk)
+                goto out;
+
+        sock_init_data(sock, sk);
+
+        sock->state  = SS_UNCONNECTED;
+        sock->ops    = &pppol2tp_ops;
+
+        sk->sk_backlog_rcv = pppol2tp_recv_core;
+        sk->sk_protocol    = PX_PROTO_OL2TP;
+        sk->sk_family      = PF_PPPOX;
+        sk->sk_state       = PPPOX_NONE;
+        sk->sk_type        = SOCK_STREAM;
+        sk->sk_destruct    = pppol2tp_session_destruct;
+
+        error = 0;
+
+out:
+        return error;
+}
+
+/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket
+ */
+static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+                            int sockaddr_len, int flags)
+{
+        struct sock *sk = sock->sk;
+        struct sockaddr_pppol2tp *sp = (struct sockaddr_pppol2tp *) uservaddr;
+        struct pppox_sock *po = pppox_sk(sk);
+        struct sock *tunnel_sock = NULL;
+        struct pppol2tp_session *session = NULL;
+        struct pppol2tp_tunnel *tunnel;
+        struct dst_entry *dst;
+        int error = 0;
+
+        lock_sock(sk);
+
+        error = -EINVAL;
+        if (sp->sa_protocol != PX_PROTO_OL2TP)
+                goto end;
+
+        /* Check for already bound sockets */
+        error = -EBUSY;
+        if (sk->sk_state & PPPOX_CONNECTED)
+                goto end;
+
+        /* We don't supporting rebinding anyway */
+        error = -EALREADY;
+        if (sk->sk_user_data)
+                goto end; /* socket is already attached */
+
+        /* Don't bind if s_tunnel is 0 */
+        error = -EINVAL;
+        if (sp->pppol2tp.s_tunnel == 0)
+                goto end;
+
+        /* Special case: prepare tunnel socket if s_session and
+         * d_session is 0. Otherwise look up tunnel using supplied
+         * tunnel id.
+         */
+        if ((sp->pppol2tp.s_session == 0) && (sp->pppol2tp.d_session == 0)) {
+                tunnel_sock = pppol2tp_prepare_tunnel_socket(sp->pppol2tp.fd,
+                                                             sp->pppol2tp.s_tunnel,
+                                                             &error);
+                if (tunnel_sock == NULL)
+                        goto end;
+
+                tunnel = tunnel_sock->sk_user_data;
+        } else {
+                tunnel = pppol2tp_tunnel_find(sp->pppol2tp.s_tunnel);
+
+                /* Error if we can't find the tunnel */
+                error = -ENOENT;
+                if (tunnel == NULL)
+                        goto end;
+
+                tunnel_sock = tunnel->sock;
+        }
+
+        /* Check that this session doesn't already exist */
+        error = -EEXIST;
+        session = pppol2tp_session_find(tunnel, sp->pppol2tp.s_session);
+        if (session != NULL)
+                goto end;
+
+        /* Allocate and initialize a new session context. */
+        session = kzalloc(sizeof(struct pppol2tp_session), GFP_KERNEL);
+        if (session == NULL) {
+                error = -ENOMEM;
+                goto end;
+        }
+
+        skb_queue_head_init(&session->reorder_q);
+
+        session->magic       = L2TP_SESSION_MAGIC;
+        session->owner       = current->pid;
+        session->sock        = sk;
+        session->tunnel      = tunnel;
+        session->tunnel_sock = tunnel_sock;
+        session->tunnel_addr = sp->pppol2tp;
+        sprintf(&session->name[0], "sess %hu/%hu",
+                session->tunnel_addr.s_tunnel,
+                session->tunnel_addr.s_session);
+
+        session->stats.tunnel_id  = session->tunnel_addr.s_tunnel;
+        session->stats.session_id = session->tunnel_addr.s_session;
+
+        INIT_HLIST_NODE(&session->hlist);
+
+        /* Inherit debug options from tunnel */
+        session->debug = tunnel->debug;
+
+        /* Default MTU must allow space for UDP/L2TP/PPP
+         * headers.
+         */
+        session->mtu = session->mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
+
+        /* If PMTU discovery was enabled, use the MTU that was discovered */
+        dst = sk_dst_get(sk);
+        if (dst != NULL) {
+                u32 pmtu = dst_mtu(__sk_dst_get(sk));
+                if (pmtu != 0)
+                        session->mtu = session->mru = pmtu -
+                                PPPOL2TP_HEADER_OVERHEAD;
+                dst_release(dst);
+        }
+
+        /* Special case: if source & dest session_id == 0x0000, this socket is
+         * being created to manage the tunnel. Don't add the session to the
+         * session hash list, just set up the internal context for use by
+         * ioctl() and sockopt() handlers.
+         */
+        if ((session->tunnel_addr.s_session == 0) &&
+            (session->tunnel_addr.d_session == 0)) {
+                error = 0;
+                sk->sk_user_data = session;
+                goto out_no_ppp;
+        }
+
+        /* Get tunnel context from the tunnel socket */
+        tunnel = pppol2tp_sock_to_tunnel(tunnel_sock);
+        if (tunnel == NULL) {
+                error = -EBADF;
+                goto end;
+        }
+
+        /* Right now, because we don't have a way to push the incoming skb's
+         * straight through the UDP layer, the only header we need to worry
+         * about is the L2TP header. This size is different depending on
+         * whether sequence numbers are enabled for the data channel.
+         */
+        po->chan.hdrlen = PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
+
+        po->chan.private = sk;
+        po->chan.ops     = &pppol2tp_chan_ops;
+        po->chan.mtu     = session->mtu;
+
+        error = ppp_register_channel(&po->chan);
+        if (error)
+                goto end;
+
+        /* This is how we get the session context from the socket. */
+        sk->sk_user_data = session;
+
+        /* Add session to the tunnel's hash list */
+        write_lock(&tunnel->hlist_lock);
+        hlist_add_head(&session->hlist,
+                       pppol2tp_session_id_hash(tunnel,
+                                                session->tunnel_addr.s_session));
+        write_unlock(&tunnel->hlist_lock);
+
+        atomic_inc(&pppol2tp_session_count);
+
+out_no_ppp:
+        pppol2tp_tunnel_inc_refcount(tunnel);
+        sk->sk_state = PPPOX_CONNECTED;
+        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+               "%s: created\n", session->name);
+
+end:
+        release_sock(sk);
+
+        if (error != 0)
+                PRINTK(session ? session->debug : -1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,
+                       "%s: connect failed: %d\n", session->name, error);
+
+        return error;
+}
+
+/* getname() support.
+ */
+static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
+                            int *usockaddr_len, int peer)
+{
+        int len = sizeof(struct sockaddr_pppol2tp);
+        struct sockaddr_pppol2tp sp;
+        int error = 0;
+        struct pppol2tp_session *session;
+
+        error = -ENOTCONN;
+        if (sock->sk->sk_state != PPPOX_CONNECTED)
+                goto end;
+
+        session = pppol2tp_sock_to_session(sock->sk);
+        if (session == NULL) {
+                error = -EBADF;
+                goto end;
+        }
+
+        sp.sa_family    = AF_PPPOX;
+        sp.sa_protocol  = PX_PROTO_OL2TP;
+        memcpy(&sp.pppol2tp, &session->tunnel_addr,
+               sizeof(struct pppol2tp_addr));
+
+        memcpy(uaddr, &sp, len);
+
+        *usockaddr_len = len;
+
+        error = 0;
+
+end:
+        return error;
+}
+
+/****************************************************************************
+ * ioctl() handlers.
+ *
+ * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
+ * sockets. However, in order to control kernel tunnel features, we allow
+ * userspace to create a special "tunnel" PPPoX socket which is used for
+ * control only.  Tunnel PPPoX sockets have session_id == 0 and simply allow
+ * the user application to issue L2TP setsockopt(), getsockopt() and ioctl()
+ * calls.
+ ****************************************************************************/
+
+/* Session ioctl helper.
+ */
+static int pppol2tp_session_ioctl(struct pppol2tp_session *session,
+                                  unsigned int cmd, unsigned long arg)
+{
+        struct ifreq ifr;
+        int err = 0;
+        struct sock *sk = session->sock;
+        int val = (int) arg;
+
+        PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
+               "%s: pppol2tp_session_ioctl(cmd=%#x, arg=%#lx)\n",
+               session->name, cmd, arg);
+
+        sock_hold(sk);
+
+        switch (cmd) {
+        case SIOCGIFMTU:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                err = -EFAULT;
+                if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
+                        break;
+                ifr.ifr_mtu = session->mtu;
+                if (copy_to_user((void __user *) arg, &ifr, sizeof(struct ifreq)))
+                        break;
+
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get mtu=%d\n", session->name, session->mtu);
+                err = 0;
+                break;
+
+        case SIOCSIFMTU:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                err = -EFAULT;
+                if (copy_from_user(&ifr, (void __user *) arg, sizeof(struct ifreq)))
+                        break;
+
+                session->mtu = ifr.ifr_mtu;
+
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set mtu=%d\n", session->name, session->mtu);
+                err = 0;
+                break;
+
+        case PPPIOCGMRU:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                err = -EFAULT;
+                if (put_user(session->mru, (int __user *) arg))
+                        break;
+
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get mru=%d\n", session->name, session->mru);
+                err = 0;
+                break;
+
+        case PPPIOCSMRU:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                err = -EFAULT;
+                if (get_user(val,(int __user *) arg))
+                        break;
+
+                session->mru = val;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set mru=%d\n", session->name, session->mru);
+                err = 0;
+                break;
+
+        case PPPIOCGFLAGS:
+                err = -EFAULT;
+                if (put_user(session->flags, (int __user *) arg))
+                        break;
+
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get flags=%d\n", session->name, session->flags);
+                err = 0;
+                break;
+
+        case PPPIOCSFLAGS:
+                err = -EFAULT;
+                if (get_user(val, (int __user *) arg))
+                        break;
+                session->flags = val;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set flags=%d\n", session->name, session->flags);
+                err = 0;
+                break;
+
+        case PPPIOCGL2TPSTATS:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                if (copy_to_user((void __user *) arg, &session->stats,
+                                 sizeof(session->stats)))
+                        break;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get L2TP stats\n", session->name);
+                err = 0;
+                break;
+
+        default:
+                err = -ENOSYS;
+                break;
+        }
+
+        sock_put(sk);
+
+        return err;
+}
+
+/* Tunnel ioctl helper.
+ *
+ * Note the special handling for PPPIOCGL2TPSTATS below. If the ioctl data
+ * specifies a session_id, the session ioctl handler is called. This allows an
+ * application to retrieve session stats via a tunnel socket.
+ */
+static int pppol2tp_tunnel_ioctl(struct pppol2tp_tunnel *tunnel,
+                                 unsigned int cmd, unsigned long arg)
+{
+        int err = 0;
+        struct sock *sk = tunnel->sock;
+        struct pppol2tp_ioc_stats stats_req;
+
+        PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_DEBUG,
+               "%s: pppol2tp_tunnel_ioctl(cmd=%#x, arg=%#lx)\n", tunnel->name,
+               cmd, arg);
+
+        sock_hold(sk);
+
+        switch (cmd) {
+        case PPPIOCGL2TPSTATS:
+                err = -ENXIO;
+                if (!(sk->sk_state & PPPOX_CONNECTED))
+                        break;
+
+                if (copy_from_user(&stats_req, (void __user *) arg,
+                                   sizeof(stats_req))) {
+                        err = -EFAULT;
+                        break;
+                }
+                if (stats_req.session_id != 0) {
+                        /* resend to session ioctl handler */
+                        struct pppol2tp_session *session =
+                                pppol2tp_session_find(tunnel, stats_req.session_id);
+                        if (session != NULL)
+                                err = pppol2tp_session_ioctl(session, cmd, arg);
+                        else
+                                err = -EBADR;
+                        break;
+                }
+#ifdef CONFIG_XFRM
+                tunnel->stats.using_ipsec = (sk->sk_policy[0] || sk->sk_policy[1]) ? 1 : 0;
+#endif
+                if (copy_to_user((void __user *) arg, &tunnel->stats,
+                                 sizeof(tunnel->stats))) {
+                        err = -EFAULT;
+                        break;
+                }
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get L2TP stats\n", tunnel->name);
+                err = 0;
+                break;
+
+        default:
+                err = -ENOSYS;
+                break;
+        }
+
+        sock_put(sk);
+
+        return err;
+}
+
+/* Main ioctl() handler.
+ * Dispatch to tunnel or session helpers depending on the socket.
+ */
+static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
+                          unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        struct pppol2tp_session *session;
+        struct pppol2tp_tunnel *tunnel;
+        int err;
+
+        if (!sk)
+                return 0;
+
+        err = -EBADF;
+        if (sock_flag(sk, SOCK_DEAD) != 0)
+                goto end;
+
+        err = -ENOTCONN;
+        if ((sk->sk_user_data == NULL) ||
+            (!(sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND))))
+                goto end;
+
+        /* Get session context from the socket */
+        err = -EBADF;
+        session = pppol2tp_sock_to_session(sk);
+        if (session == NULL)
+                goto end;
+
+        /* Special case: if session's session_id is zero, treat ioctl as a
+         * tunnel ioctl
+         */
+        if ((session->tunnel_addr.s_session == 0) &&
+            (session->tunnel_addr.d_session == 0)) {
+                err = -EBADF;
+                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+                if (tunnel == NULL)
+                        goto end;
+
+                err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
+                goto end;
+        }
+
+        err = pppol2tp_session_ioctl(session, cmd, arg);
+
+end:
+        return err;
+}
+
+/*****************************************************************************
+ * setsockopt() / getsockopt() support.
+ *
+ * The PPPoX socket is created for L2TP sessions: tunnels have their own UDP
+ * sockets. In order to control kernel tunnel features, we allow userspace to
+ * create a special "tunnel" PPPoX socket which is used for control only.
+ * Tunnel PPPoX sockets have session_id == 0 and simply allow the user
+ * application to issue L2TP setsockopt(), getsockopt() and ioctl() calls.
+ *****************************************************************************/
+
+/* Tunnel setsockopt() helper.
+ */
+static int pppol2tp_tunnel_setsockopt(struct sock *sk,
+                                      struct pppol2tp_tunnel *tunnel,
+                                      int optname, int val)
+{
+        int err = 0;
+
+        switch (optname) {
+        case PPPOL2TP_SO_DEBUG:
+                tunnel->debug = val;
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set debug=%x\n", tunnel->name, tunnel->debug);
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        return err;
+}
+
+/* Session setsockopt helper.
+ */
+static int pppol2tp_session_setsockopt(struct sock *sk,
+                                       struct pppol2tp_session *session,
+                                       int optname, int val)
+{
+        int err = 0;
+
+        switch (optname) {
+        case PPPOL2TP_SO_RECVSEQ:
+                if ((val != 0) && (val != 1)) {
+                        err = -EINVAL;
+                        break;
+                }
+                session->recv_seq = val ? -1 : 0;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set recv_seq=%d\n", session->name,
+                       session->recv_seq);
+                break;
+
+        case PPPOL2TP_SO_SENDSEQ:
+                if ((val != 0) && (val != 1)) {
+                        err = -EINVAL;
+                        break;
+                }
+                session->send_seq = val ? -1 : 0;
+                {
+                        struct sock *ssk      = session->sock;
+                        struct pppox_sock *po = pppox_sk(ssk);
+                        po->chan.hdrlen = val ? PPPOL2TP_L2TP_HDR_SIZE_SEQ :
+                                PPPOL2TP_L2TP_HDR_SIZE_NOSEQ;
+                }
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set send_seq=%d\n", session->name, session->send_seq);
+                break;
+
+        case PPPOL2TP_SO_LNSMODE:
+                if ((val != 0) && (val != 1)) {
+                        err = -EINVAL;
+                        break;
+                }
+                session->lns_mode = val ? -1 : 0;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set lns_mode=%d\n", session->name,
+                       session->lns_mode);
+                break;
+
+        case PPPOL2TP_SO_DEBUG:
+                session->debug = val;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set debug=%x\n", session->name, session->debug);
+                break;
+
+        case PPPOL2TP_SO_REORDERTO:
+                session->reorder_timeout = msecs_to_jiffies(val);
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: set reorder_timeout=%d\n", session->name,
+                       session->reorder_timeout);
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        return err;
+}
+
+/* Main setsockopt() entry point.
+ * Does API checks, then calls either the tunnel or session setsockopt
+ * handler, according to whether the PPPoL2TP socket is a for a regular
+ * session or the special tunnel type.
+ */
+static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct pppol2tp_session *session = sk->sk_user_data;
+        struct pppol2tp_tunnel *tunnel;
+        int val;
+        int err;
+
+        if (level != SOL_PPPOL2TP)
+                return udp_prot.setsockopt(sk, level, optname, optval, optlen);
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
+
+        err = -ENOTCONN;
+        if (sk->sk_user_data == NULL)
+                goto end;
+
+        /* Get session context from the socket */
+        err = -EBADF;
+        session = pppol2tp_sock_to_session(sk);
+        if (session == NULL)
+                goto end;
+
+        /* Special case: if session_id == 0x0000, treat as operation on tunnel
+         */
+        if ((session->tunnel_addr.s_session == 0) &&
+            (session->tunnel_addr.d_session == 0)) {
+                err = -EBADF;
+                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+                if (tunnel == NULL)
+                        goto end;
+
+                err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
+        } else
+                err = pppol2tp_session_setsockopt(sk, session, optname, val);
+
+        err = 0;
+
+end:
+        return err;
+}
+
+/* Tunnel getsockopt helper. Called with sock locked.
+ */
+static int pppol2tp_tunnel_getsockopt(struct sock *sk,
+                                      struct pppol2tp_tunnel *tunnel,
+                                      int optname, int __user *val)
+{
+        int err = 0;
+
+        switch (optname) {
+        case PPPOL2TP_SO_DEBUG:
+                *val = tunnel->debug;
+                PRINTK(tunnel->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get debug=%x\n", tunnel->name, tunnel->debug);
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        return err;
+}
+
+/* Session getsockopt helper. Called with sock locked.
+ */
+static int pppol2tp_session_getsockopt(struct sock *sk,
+                                       struct pppol2tp_session *session,
+                                       int optname, int __user *val)
+{
+        int err = 0;
+
+        switch (optname) {
+        case PPPOL2TP_SO_RECVSEQ:
+                *val = session->recv_seq;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get recv_seq=%d\n", session->name, *val);
+                break;
+
+        case PPPOL2TP_SO_SENDSEQ:
+                *val = session->send_seq;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get send_seq=%d\n", session->name, *val);
+                break;
+
+        case PPPOL2TP_SO_LNSMODE:
+                *val = session->lns_mode;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get lns_mode=%d\n", session->name, *val);
+                break;
+
+        case PPPOL2TP_SO_DEBUG:
+                *val = session->debug;
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get debug=%d\n", session->name, *val);
+                break;
+
+        case PPPOL2TP_SO_REORDERTO:
+                *val = (int) jiffies_to_msecs(session->reorder_timeout);
+                PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+                       "%s: get reorder_timeout=%d\n", session->name, *val);
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+        }
+
+        return err;
+}
+
+/* Main getsockopt() entry point.
+ * Does API checks, then calls either the tunnel or session getsockopt
+ * handler, according to whether the PPPoX socket is a for a regular session
+ * or the special tunnel type.
+ */
+static int pppol2tp_getsockopt(struct socket *sock, int level,
+                               int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct pppol2tp_session *session = sk->sk_user_data;
+        struct pppol2tp_tunnel *tunnel;
+        int val, len;
+        int err;
+
+        if (level != SOL_PPPOL2TP)
+                return udp_prot.getsockopt(sk, level, optname, optval, optlen);
+
+        if (get_user(len, (int __user *) optlen))
+                return -EFAULT;
+
+        len = min_t(unsigned int, len, sizeof(int));
+
+        if (len < 0)
+                return -EINVAL;
+
+        err = -ENOTCONN;
+        if (sk->sk_user_data == NULL)
+                goto end;
+
+        /* Get the session context */
+        err = -EBADF;
+        session = pppol2tp_sock_to_session(sk);
+        if (session == NULL)
+                goto end;
+
+        /* Special case: if session_id == 0x0000, treat as operation on tunnel */
+        if ((session->tunnel_addr.s_session == 0) &&
+            (session->tunnel_addr.d_session == 0)) {
+                err = -EBADF;
+                tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+                if (tunnel == NULL)
+                        goto end;
+
+                err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
+        } else
+                err = pppol2tp_session_getsockopt(sk, session, optname, &val);
+
+        err = -EFAULT;
+        if (put_user(len, (int __user *) optlen))
+                goto end;
+
+        if (copy_to_user((void __user *) optval, &val, len))
+                goto end;
+
+        err = 0;
+end:
+        return err;
+}
+
+/*****************************************************************************
+ * /proc filesystem for debug
+ *****************************************************************************/
+
+#ifdef CONFIG_PROC_FS
+
+#include <linux/seq_file.h>
+
+struct pppol2tp_seq_data {
+        struct pppol2tp_tunnel *tunnel; /* current tunnel */
+        struct pppol2tp_session *session; /* NULL means get first session in tunnel */
+};
+
+static struct pppol2tp_session *next_session(struct pppol2tp_tunnel *tunnel, struct pppol2tp_session *curr)
+{
+        struct pppol2tp_session *session = NULL;
+        struct hlist_node *walk;
+        int found = 0;
+        int next = 0;
+        int i;
+
+        read_lock(&tunnel->hlist_lock);
+        for (i = 0; i < PPPOL2TP_HASH_SIZE; i++) {
+                hlist_for_each_entry(session, walk, &tunnel->session_hlist[i], hlist) {
+                        if (curr == NULL) {
+                                found = 1;
+                                goto out;
+                        }
+                        if (session == curr) {
+                                next = 1;
+                                continue;
+                        }
+                        if (next) {
+                                found = 1;
+                                goto out;
+                        }
+                }
+        }
+out:
+        read_unlock(&tunnel->hlist_lock);
+        if (!found)
+                session = NULL;
+
+        return session;
+}
+
+static struct pppol2tp_tunnel *next_tunnel(struct pppol2tp_tunnel *curr)
+{
+        struct pppol2tp_tunnel *tunnel = NULL;
+
+        read_lock(&pppol2tp_tunnel_list_lock);
+        if (list_is_last(&curr->list, &pppol2tp_tunnel_list)) {
+                goto out;
+        }
+        tunnel = list_entry(curr->list.next, struct pppol2tp_tunnel, list);
+out:
+        read_unlock(&pppol2tp_tunnel_list_lock);
+
+        return tunnel;
+}
+
+static void *pppol2tp_seq_start(struct seq_file *m, loff_t *offs)
+{
+        struct pppol2tp_seq_data *pd = SEQ_START_TOKEN;
+        loff_t pos = *offs;
+
+        if (!pos)
+                goto out;
+
+        BUG_ON(m->private == NULL);
+        pd = m->private;
+
+        if (pd->tunnel == NULL) {
+                if (!list_empty(&pppol2tp_tunnel_list))
+                        pd->tunnel = list_entry(pppol2tp_tunnel_list.next, struct pppol2tp_tunnel, list);
+        } else {
+                pd->session = next_session(pd->tunnel, pd->session);
+                if (pd->session == NULL) {
+                        pd->tunnel = next_tunnel(pd->tunnel);
+                }
+        }
+
+        /* NULL tunnel and session indicates end of list */
+        if ((pd->tunnel == NULL) && (pd->session == NULL))
+                pd = NULL;
+
+out:
+        return pd;
+}
+
+static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
+{
+        (*pos)++;
+        return NULL;
+}
+
+static void pppol2tp_seq_stop(struct seq_file *p, void *v)
+{
+        /* nothing to do */
+}
+
+static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
+{
+        struct pppol2tp_tunnel *tunnel = v;
+
+        seq_printf(m, "\nTUNNEL '%s', %c %d\n",
+                   tunnel->name,
+                   (tunnel == tunnel->sock->sk_user_data) ? 'Y':'N',
+                   atomic_read(&tunnel->ref_count) - 1);
+        seq_printf(m, " %08x %llu/%llu/%llu %llu/%llu/%llu\n",
+                   tunnel->debug,
+                   tunnel->stats.tx_packets, tunnel->stats.tx_bytes,
+                   tunnel->stats.tx_errors,
+                   tunnel->stats.rx_packets, tunnel->stats.rx_bytes,
+                   tunnel->stats.rx_errors);
+}
+
+static void pppol2tp_seq_session_show(struct seq_file *m, void *v)
+{
+        struct pppol2tp_session *session = v;
+
+        seq_printf(m, "  SESSION '%s' %08X/%d %04X/%04X -> "
+                   "%04X/%04X %d %c\n",
+                   session->name,
+                   ntohl(session->tunnel_addr.addr.sin_addr.s_addr),
+                   ntohs(session->tunnel_addr.addr.sin_port),
+                   session->tunnel_addr.s_tunnel,
+                   session->tunnel_addr.s_session,
+                   session->tunnel_addr.d_tunnel,
+                   session->tunnel_addr.d_session,
+                   session->sock->sk_state,
+                   (session == session->sock->sk_user_data) ?
+                   'Y' : 'N');
+        seq_printf(m, "   %d/%d/%c/%c/%s %08x %u\n",
+                   session->mtu, session->mru,
+                   session->recv_seq ? 'R' : '-',
+                   session->send_seq ? 'S' : '-',
+                   session->lns_mode ? "LNS" : "LAC",
+                   session->debug,
+                   jiffies_to_msecs(session->reorder_timeout));
+        seq_printf(m, "   %hu/%hu %llu/%llu/%llu %llu/%llu/%llu\n",
+                   session->nr, session->ns,
+                   session->stats.tx_packets,
+                   session->stats.tx_bytes,
+                   session->stats.tx_errors,
+                   session->stats.rx_packets,
+                   session->stats.rx_bytes,
+                   session->stats.rx_errors);
+}
+
+static int pppol2tp_seq_show(struct seq_file *m, void *v)
+{
+        struct pppol2tp_seq_data *pd = v;
+
+        /* display header on line 1 */
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(m, "PPPoL2TP driver info, " PPPOL2TP_DRV_VERSION "\n");
+                seq_puts(m, "TUNNEL name, user-data-ok session-count\n");
+                seq_puts(m, " debug tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
+                seq_puts(m, "  SESSION name, addr/port src-tid/sid "
+                         "dest-tid/sid state user-data-ok\n");
+                seq_puts(m, "   mtu/mru/rcvseq/sendseq/lns debug reorderto\n");
+                seq_puts(m, "   nr/ns tx-pkts/bytes/errs rx-pkts/bytes/errs\n");
+                goto out;
+        }
+
+        /* Show the tunnel or session context.
+         */
+        if (pd->session == NULL)
+                pppol2tp_seq_tunnel_show(m, pd->tunnel);
+        else
+                pppol2tp_seq_session_show(m, pd->session);
+
+out:
+        return 0;
+}
+
+static struct seq_operations pppol2tp_seq_ops = {
+        .start          = pppol2tp_seq_start,
+        .next           = pppol2tp_seq_next,
+        .stop           = pppol2tp_seq_stop,
+        .show           = pppol2tp_seq_show,
+};
+
+/* Called when our /proc file is opened. We allocate data for use when
+ * iterating our tunnel / session contexts and store it in the private
+ * data of the seq_file.
+ */
+static int pppol2tp_proc_open(struct inode *inode, struct file *file)
+{
+        struct seq_file *m;
+        struct pppol2tp_seq_data *pd;
+        int ret = 0;
+
+        ret = seq_open(file, &pppol2tp_seq_ops);
+        if (ret < 0)
+                goto out;
+
+        m = file->private_data;
+
+        /* Allocate and fill our proc_data for access later */
+        ret = -ENOMEM;
+        m->private = kzalloc(sizeof(struct pppol2tp_seq_data), GFP_KERNEL);
+        if (m->private == NULL)
+                goto out;
+
+        pd = m->private;
+        ret = 0;
+
+out:
+        return ret;
+}
+
+/* Called when /proc file access completes.
+ */
+static int pppol2tp_proc_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *m = (struct seq_file *)file->private_data;
+
+        kfree(m->private);
+        m->private = NULL;
+
+        return seq_release(inode, file);
+}
+
+static struct file_operations pppol2tp_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = pppol2tp_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = pppol2tp_proc_release,
+};
+
+static struct proc_dir_entry *pppol2tp_proc;
+
+#endif /* CONFIG_PROC_FS */
+
+/*****************************************************************************
+ * Init and cleanup
+ *****************************************************************************/
+
+static struct proto_ops pppol2tp_ops = {
+        .family         = AF_PPPOX,
+        .owner          = THIS_MODULE,
+        .release        = pppol2tp_release,
+        .bind           = sock_no_bind,
+        .connect        = pppol2tp_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .getname        = pppol2tp_getname,
+        .poll           = datagram_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = pppol2tp_setsockopt,
+        .getsockopt     = pppol2tp_getsockopt,
+        .sendmsg        = pppol2tp_sendmsg,
+        .recvmsg        = pppol2tp_recvmsg,
+        .mmap           = sock_no_mmap,
+        .ioctl          = pppox_ioctl,
+};
+
+static struct pppox_proto pppol2tp_proto = {
+        .create         = pppol2tp_create,
+        .ioctl          = pppol2tp_ioctl
+};
+
+static int __init pppol2tp_init(void)
+{
+        int err;
+
+        err = proto_register(&pppol2tp_sk_proto, 0);
+        if (err)
+                goto out;
+        err = register_pppox_proto(PX_PROTO_OL2TP, &pppol2tp_proto);
+        if (err)
+                goto out_unregister_pppol2tp_proto;
+
+#ifdef CONFIG_PROC_FS
+        pppol2tp_proc = create_proc_entry("pppol2tp", 0, proc_net);
+        if (!pppol2tp_proc) {
+                err = -ENOMEM;
+                goto out_unregister_pppox_proto;
+        }
+        pppol2tp_proc->proc_fops = &pppol2tp_proc_fops;
+#endif /* CONFIG_PROC_FS */
+        printk(KERN_INFO "PPPoL2TP kernel driver, %s\n",
+               PPPOL2TP_DRV_VERSION);
+
+out:
+        return err;
+
+out_unregister_pppox_proto:
+        unregister_pppox_proto(PX_PROTO_OL2TP);
+out_unregister_pppol2tp_proto:
+        proto_unregister(&pppol2tp_sk_proto);
+        goto out;
+}
+
+static void __exit pppol2tp_exit(void)
+{
+        unregister_pppox_proto(PX_PROTO_OL2TP);
+
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("pppol2tp", proc_net);
+#endif
+        proto_unregister(&pppol2tp_sk_proto);
+}
+
+module_init(pppol2tp_init);
+module_exit(pppol2tp_exit);
+
+MODULE_AUTHOR("Martijn van Oosterhout <kleptog@svana.org>,"
+              "James Chapman <jchapman@katalix.com>");
+MODULE_DESCRIPTION("PPP over L2TP over UDP");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(PPPOL2TP_DRV_VERSION);
diff --git a/drivers/net/saa9730.c b/drivers/net/saa9730.c
index ad94358ece89..451486b32f23 100644
--- a/drivers/net/saa9730.c
+++ b/drivers/net/saa9730.c
@@ -690,9 +690,9 @@ static int lan_saa9730_rx(struct net_device *dev)
                                 lp->stats.rx_packets++;
                                 skb_reserve(skb, 2);    /* 16 byte align */
                                 skb_put(skb, len);      /* make room */
-                                eth_copy_and_sum(skb,
+                                skb_copy_to_linear_data(skb,
                                                  (unsigned char *) pData,
-                                                 len, 0);
+                                                 len);
                                 skb->protocol = eth_type_trans(skb, dev);
                                 netif_rx(skb);
                                 dev->last_rx = jiffies;
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index 2106becf6990..384b4685e977 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -320,7 +320,7 @@ static inline void sgiseeq_rx(struct net_device *dev, struct sgiseeq_private *sp
                                 skb_put(skb, len);
 
                                 /* Copy out of kseg1 to avoid silly cache flush. */
-                                eth_copy_and_sum(skb, pkt_pointer + 2, len, 0);
+                                skb_copy_to_linear_data(skb, pkt_pointer + 2, len);
                                 skb->protocol = eth_type_trans(skb, dev);
 
                                 /* We don't want to receive our own packets */
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index bc8de48da313..ec2ad9f0efa2 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -548,7 +548,7 @@ static inline int sis190_try_rx_copy(struct sk_buff **sk_buff, int pkt_size,
                 skb = dev_alloc_skb(pkt_size + NET_IP_ALIGN);
                 if (skb) {
                         skb_reserve(skb, NET_IP_ALIGN);
-                        eth_copy_and_sum(skb, sk_buff[0]->data, pkt_size, 0);
+                        skb_copy_to_linear_data(skb, sk_buff[0]->data, pkt_size);
                         *sk_buff = skb;
                         sis190_give_to_asic(desc, rx_buf_sz);
                         ret = 0;
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 2f69d5c5dfa6..8b6478663a56 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1456,7 +1456,7 @@ static int __netdev_rx(struct net_device *dev, int *quota)
                         pci_dma_sync_single_for_cpu(np->pci_dev,
                                                     np->rx_info[entry].mapping,
                                                     pkt_len, PCI_DMA_FROMDEVICE);
-                        eth_copy_and_sum(skb, np->rx_info[entry].skb->data, pkt_len, 0);
+                        skb_copy_to_linear_data(skb, np->rx_info[entry].skb->data, pkt_len);
                         pci_dma_sync_single_for_device(np->pci_dev,
                                                        np->rx_info[entry].mapping,
                                                        pkt_len, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/sun3_82586.c b/drivers/net/sun3_82586.c
index a123ea87893b..b77ab6e8fd35 100644
--- a/drivers/net/sun3_82586.c
+++ b/drivers/net/sun3_82586.c
@@ -777,7 +777,7 @@ static void sun3_82586_rcv_int(struct net_device *dev)
                                         {
                                                 skb_reserve(skb,2);
                                                 skb_put(skb,totlen);
-                                                eth_copy_and_sum(skb,(char *) p->base+swab32((unsigned long) rbd->buffer),totlen,0);
+                                                skb_copy_to_linear_data(skb,(char *) p->base+swab32((unsigned long) rbd->buffer),totlen);
                                                 skb->protocol=eth_type_trans(skb,dev);
                                                 netif_rx(skb);
                                                 p->stats.rx_packets++;
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 791e081fdc15..f1548c033327 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -853,10 +853,9 @@ static int lance_rx( struct net_device *dev )
 
                                 skb_reserve( skb, 2 );  /* 16 byte align */
                                 skb_put( skb, pkt_len );        /* Make room */
-//                              skb_copy_to_linear_data(skb, PKTBUF_ADDR(head), pkt_len);
-                                eth_copy_and_sum(skb,
+                                skb_copy_to_linear_data(skb,
                                                  PKTBUF_ADDR(head),
-                                                 pkt_len, 0);
+                                                 pkt_len);
 
                                 skb->protocol = eth_type_trans( skb, dev );
                                 netif_rx( skb );
diff --git a/drivers/net/sunbmac.c b/drivers/net/sunbmac.c
index 2ad8d58dee3b..b3e0158def4f 100644
--- a/drivers/net/sunbmac.c
+++ b/drivers/net/sunbmac.c
@@ -860,7 +860,7 @@ static void bigmac_rx(struct bigmac *bp)
                         sbus_dma_sync_single_for_cpu(bp->bigmac_sdev,
                                                      this->rx_addr, len,
                                                      SBUS_DMA_FROMDEVICE);
-                        eth_copy_and_sum(copy_skb, (unsigned char *)skb->data, len, 0);
+                        skb_copy_to_linear_data(copy_skb, (unsigned char *)skb->data, len);
                         sbus_dma_sync_single_for_device(bp->bigmac_sdev,
                                                         this->rx_addr, len,
                                                         SBUS_DMA_FROMDEVICE);
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
index c9f7b7aa5556..af0c9831074c 100644
--- a/drivers/net/sundance.c
+++ b/drivers/net/sundance.c
@@ -1310,7 +1310,7 @@ static void rx_poll(unsigned long data)
                                                             np->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
 
-                                eth_copy_and_sum(skb, np->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb, np->rx_skbuff[entry]->data, pkt_len);
                                 pci_dma_sync_single_for_device(np->pci_dev,
                                                                desc->frag[0].addr,
                                                                np->rx_buf_sz,
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 42722530ab24..053b7cb0d944 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -549,9 +549,9 @@ static void lance_rx_dvma(struct net_device *dev)
 
                         skb_reserve(skb, 2);            /* 16 byte align */
                         skb_put(skb, len);              /* make room */
-                        eth_copy_and_sum(skb,
+                        skb_copy_to_linear_data(skb,
                                          (unsigned char *)&(ib->rx_buf [entry][0]),
-                                         len, 0);
+                                         len);
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_rx(skb);
                         dev->last_rx = jiffies;
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index fa70e0b78af7..1b65ae8a1c7c 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -439,8 +439,8 @@ static void qe_rx(struct sunqe *qep)
                         } else {
                                 skb_reserve(skb, 2);
                                 skb_put(skb, len);
-                                eth_copy_and_sum(skb, (unsigned char *) this_qbuf,
-                                                 len, 0);
+                                skb_copy_to_linear_data(skb, (unsigned char *) this_qbuf,
+                                                 len);
                                 skb->protocol = eth_type_trans(skb, qep->dev);
                                 netif_rx(skb);
                                 qep->dev->last_rx = jiffies;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b148d57ec571..32e4037dcb50 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.77"
-#define DRV_MODULE_RELDATE      "May 31, 2007"
+#define DRV_MODULE_VERSION      "3.78"
+#define DRV_MODULE_RELDATE      "July 11, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -721,6 +721,44 @@ static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
         return ret;
 }
 
+static void tg3_phy_toggle_automdix(struct tg3 *tp, int enable)
+{
+        u32 phy;
+
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) ||
+            (tp->tg3_flags2 & TG3_FLG2_ANY_SERDES))
+                return;
+
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
+                u32 ephy;
+
+                if (!tg3_readphy(tp, MII_TG3_EPHY_TEST, &ephy)) {
+                        tg3_writephy(tp, MII_TG3_EPHY_TEST,
+                                     ephy | MII_TG3_EPHY_SHADOW_EN);
+                        if (!tg3_readphy(tp, MII_TG3_EPHYTST_MISCCTRL, &phy)) {
+                                if (enable)
+                                        phy |= MII_TG3_EPHYTST_MISCCTRL_MDIX;
+                                else
+                                        phy &= ~MII_TG3_EPHYTST_MISCCTRL_MDIX;
+                                tg3_writephy(tp, MII_TG3_EPHYTST_MISCCTRL, phy);
+                        }
+                        tg3_writephy(tp, MII_TG3_EPHY_TEST, ephy);
+                }
+        } else {
+                phy = MII_TG3_AUXCTL_MISC_RDSEL_MISC |
+                      MII_TG3_AUXCTL_SHDWSEL_MISC;
+                if (!tg3_writephy(tp, MII_TG3_AUX_CTRL, phy) &&
+                    !tg3_readphy(tp, MII_TG3_AUX_CTRL, &phy)) {
+                        if (enable)
+                                phy |= MII_TG3_AUXCTL_MISC_FORCE_AMDIX;
+                        else
+                                phy &= ~MII_TG3_AUXCTL_MISC_FORCE_AMDIX;
+                        phy |= MII_TG3_AUXCTL_MISC_WREN;
+                        tg3_writephy(tp, MII_TG3_AUX_CTRL, phy);
+                }
+        }
+}
+
 static void tg3_phy_set_wirespeed(struct tg3 *tp)
 {
         u32 val;
@@ -1045,23 +1083,11 @@ out:
         }
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                u32 phy_reg;
-
                 /* adjust output voltage */
                 tg3_writephy(tp, MII_TG3_EPHY_PTEST, 0x12);
-
-                if (!tg3_readphy(tp, MII_TG3_EPHY_TEST, &phy_reg)) {
-                        u32 phy_reg2;
-
-                        tg3_writephy(tp, MII_TG3_EPHY_TEST,
-                                     phy_reg | MII_TG3_EPHY_SHADOW_EN);
-                        /* Enable auto-MDIX */
-                        if (!tg3_readphy(tp, 0x10, &phy_reg2))
-                                tg3_writephy(tp, 0x10, phy_reg2 | 0x4000);
-                        tg3_writephy(tp, MII_TG3_EPHY_TEST, phy_reg);
-                }
         }
 
+        tg3_phy_toggle_automdix(tp, 1);
         tg3_phy_set_wirespeed(tp);
         return 0;
 }
@@ -1162,6 +1188,19 @@ static void tg3_frob_aux_power(struct tg3 *tp)
         }
 }
 
+static int tg3_5700_link_polarity(struct tg3 *tp, u32 speed)
+{
+        if (tp->led_ctrl == LED_CTRL_MODE_PHY_2)
+                return 1;
+        else if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5411) {
+                if (speed != SPEED_10)
+                        return 1;
+        } else if (speed == SPEED_10)
+                return 1;
+
+        return 0;
+}
+
 static int tg3_setup_phy(struct tg3 *, int);
 
 #define RESET_KIND_SHUTDOWN     0
@@ -1320,9 +1359,17 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state)
                         else
                                 mac_mode = MAC_MODE_PORT_MODE_MII;
 
-                        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700 ||
-                            !(tp->tg3_flags & TG3_FLAG_WOL_SPEED_100MB))
-                                mac_mode |= MAC_MODE_LINK_POLARITY;
+                        mac_mode |= tp->mac_mode & MAC_MODE_LINK_POLARITY;
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
+                            ASIC_REV_5700) {
+                                u32 speed = (tp->tg3_flags &
+                                             TG3_FLAG_WOL_SPEED_100MB) ?
+                                             SPEED_100 : SPEED_10;
+                                if (tg3_5700_link_polarity(tp, speed))
+                                        mac_mode |= MAC_MODE_LINK_POLARITY;
+                                else
+                                        mac_mode &= ~MAC_MODE_LINK_POLARITY;
+                        }
                 } else {
                         mac_mode = MAC_MODE_PORT_MODE_TBI;
                 }
@@ -1990,15 +2037,12 @@ relink:
         if (tp->link_config.active_duplex == DUPLEX_HALF)
                 tp->mac_mode |= MAC_MODE_HALF_DUPLEX;
 
-        tp->mac_mode &= ~MAC_MODE_LINK_POLARITY;
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700) {
-                if ((tp->led_ctrl == LED_CTRL_MODE_PHY_2) ||
-                    (current_link_up == 1 &&
-                     tp->link_config.active_speed == SPEED_10))
-                        tp->mac_mode |= MAC_MODE_LINK_POLARITY;
-        } else {
-                if (current_link_up == 1)
+                if (current_link_up == 1 &&
+                    tg3_5700_link_polarity(tp, tp->link_config.active_speed))
                         tp->mac_mode |= MAC_MODE_LINK_POLARITY;
+                else
+                        tp->mac_mode &= ~MAC_MODE_LINK_POLARITY;
         }
 
         /* ??? Without this setting Netgear GA302T PHY does not
@@ -2639,6 +2683,9 @@ static int tg3_setup_fiber_by_hand(struct tg3 *tp, u32 mac_status)
 
                 tw32_f(MAC_MODE, (tp->mac_mode | MAC_MODE_SEND_CONFIGS));
                 udelay(40);
+
+                tw32_f(MAC_MODE, tp->mac_mode);
+                udelay(40);
         }
 
 out:
@@ -2698,10 +2745,6 @@ static int tg3_setup_fiber_phy(struct tg3 *tp, int force_reset)
         else
                 current_link_up = tg3_setup_fiber_by_hand(tp, mac_status);
 
-        tp->mac_mode &= ~MAC_MODE_LINK_POLARITY;
-        tw32_f(MAC_MODE, tp->mac_mode);
-        udelay(40);
-
         tp->hw_status->status =
                 (SD_STATUS_UPDATED |
                  (tp->hw_status->status & ~SD_STATUS_LINK_CHG));
@@ -3512,9 +3555,9 @@ static inline int tg3_irq_sync(struct tg3 *tp)
  */
 static inline void tg3_full_lock(struct tg3 *tp, int irq_sync)
 {
+        spin_lock_bh(&tp->lock);
         if (irq_sync)
                 tg3_irq_quiesce(tp);
-        spin_lock_bh(&tp->lock);
 }
 
 static inline void tg3_full_unlock(struct tg3 *tp)
@@ -6444,6 +6487,10 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 
         tp->mac_mode = MAC_MODE_TXSTAT_ENABLE | MAC_MODE_RXSTAT_ENABLE |
                 MAC_MODE_TDE_ENABLE | MAC_MODE_RDE_ENABLE | MAC_MODE_FHDE_ENABLE;
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) &&
+            !(tp->tg3_flags2 & TG3_FLG2_PHY_SERDES) &&
+            GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700)
+                tp->mac_mode |= MAC_MODE_LINK_POLARITY;
         tw32_f(MAC_MODE, tp->mac_mode | MAC_MODE_RXSTAT_CLEAR | MAC_MODE_TXSTAT_CLEAR);
         udelay(40);
 
@@ -8805,7 +8852,9 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
                         return 0;
 
                 mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
-                           MAC_MODE_PORT_INT_LPBACK | MAC_MODE_LINK_POLARITY;
+                           MAC_MODE_PORT_INT_LPBACK;
+                if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
+                        mac_mode |= MAC_MODE_LINK_POLARITY;
                 if (tp->tg3_flags & TG3_FLAG_10_100_ONLY)
                         mac_mode |= MAC_MODE_PORT_MODE_MII;
                 else
@@ -8824,19 +8873,18 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
                                              phytest | MII_TG3_EPHY_SHADOW_EN);
                                 if (!tg3_readphy(tp, 0x1b, &phy))
                                         tg3_writephy(tp, 0x1b, phy & ~0x20);
-                                if (!tg3_readphy(tp, 0x10, &phy))
-                                        tg3_writephy(tp, 0x10, phy & ~0x4000);
                                 tg3_writephy(tp, MII_TG3_EPHY_TEST, phytest);
                         }
                         val = BMCR_LOOPBACK | BMCR_FULLDPLX | BMCR_SPEED100;
                 } else
                         val = BMCR_LOOPBACK | BMCR_FULLDPLX | BMCR_SPEED1000;
 
+                tg3_phy_toggle_automdix(tp, 0);
+
                 tg3_writephy(tp, MII_BMCR, val);
                 udelay(40);
 
-                mac_mode = (tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK) |
-                           MAC_MODE_LINK_POLARITY;
+                mac_mode = tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK;
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
                         tg3_writephy(tp, MII_TG3_EPHY_PTEST, 0x1800);
                         mac_mode |= MAC_MODE_PORT_MODE_MII;
@@ -8849,8 +8897,11 @@ static int tg3_run_loopback(struct tg3 *tp, int loopback_mode)
                         udelay(10);
                         tw32_f(MAC_RX_MODE, tp->rx_mode);
                 }
-                if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5401) {
-                        mac_mode &= ~MAC_MODE_LINK_POLARITY;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700) {
+                        if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5401)
+                                mac_mode &= ~MAC_MODE_LINK_POLARITY;
+                        else if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5411)
+                                mac_mode |= MAC_MODE_LINK_POLARITY;
                         tg3_writephy(tp, MII_TG3_EXT_CTRL,
                                      MII_TG3_EXT_CTRL_LNK3_LED_MODE);
                 }
@@ -9116,10 +9167,10 @@ static void tg3_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         /* Update RX_MODE_KEEP_VLAN_TAG bit in RX_MODE register. */
         __tg3_set_rx_mode(dev);
 
-        tg3_full_unlock(tp);
-
         if (netif_running(dev))
                 tg3_netif_start(tp);
+
+        tg3_full_unlock(tp);
 }
 #endif
 
@@ -9410,11 +9461,13 @@ static void __devinit tg3_get_5755_nvram_info(struct tg3 *tp)
                 case FLASH_5755VENDOR_ATMEL_FLASH_1:
                 case FLASH_5755VENDOR_ATMEL_FLASH_2:
                 case FLASH_5755VENDOR_ATMEL_FLASH_3:
+                case FLASH_5755VENDOR_ATMEL_FLASH_5:
                         tp->nvram_jedecnum = JEDEC_ATMEL;
                         tp->tg3_flags |= TG3_FLAG_NVRAM_BUFFERED;
                         tp->tg3_flags2 |= TG3_FLG2_FLASH;
                         tp->nvram_pagesize = 264;
-                        if (nvcfg1 == FLASH_5755VENDOR_ATMEL_FLASH_1)
+                        if (nvcfg1 == FLASH_5755VENDOR_ATMEL_FLASH_1 ||
+                            nvcfg1 == FLASH_5755VENDOR_ATMEL_FLASH_5)
                                 tp->nvram_size = (protect ? 0x3e200 : 0x80000);
                         else if (nvcfg1 == FLASH_5755VENDOR_ATMEL_FLASH_2)
                                 tp->nvram_size = (protect ? 0x1f200 : 0x40000);
@@ -11940,12 +11993,11 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
          * checksumming.
          */
         if ((tp->tg3_flags & TG3_FLAG_BROKEN_CHECKSUMS) == 0) {
+                dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787)
-                        dev->features |= NETIF_F_HW_CSUM;
-                else
-                        dev->features |= NETIF_F_IP_CSUM;
-                dev->features |= NETIF_F_SG;
+                        dev->features |= NETIF_F_IPV6_CSUM;
+
                 tp->tg3_flags |= TG3_FLAG_RX_CHECKSUMS;
         } else
                 tp->tg3_flags &= ~TG3_FLAG_RX_CHECKSUMS;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index bd9f4f428e5b..d84e75e7365d 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1467,6 +1467,7 @@
 #define  FLASH_5755VENDOR_ATMEL_FLASH_2  0x03400002
 #define  FLASH_5755VENDOR_ATMEL_FLASH_3  0x03400000
 #define  FLASH_5755VENDOR_ATMEL_FLASH_4  0x00000003
+#define  FLASH_5755VENDOR_ATMEL_FLASH_5  0x02000003
 #define  FLASH_5755VENDOR_ATMEL_EEPROM_64KHZ     0x03c00003
 #define  FLASH_5755VENDOR_ATMEL_EEPROM_376KHZ    0x03c00002
 #define  FLASH_5787VENDOR_ATMEL_EEPROM_64KHZ     0x03000003
@@ -1642,6 +1643,11 @@
 
 #define MII_TG3_AUX_CTRL                0x18 /* auxilliary control register */
 
+#define MII_TG3_AUXCTL_MISC_WREN        0x8000
+#define MII_TG3_AUXCTL_MISC_FORCE_AMDIX 0x0200
+#define MII_TG3_AUXCTL_MISC_RDSEL_MISC  0x7000
+#define MII_TG3_AUXCTL_SHDWSEL_MISC             0x0007
+
 #define MII_TG3_AUX_STAT                0x19 /* auxilliary status register */
 #define MII_TG3_AUX_STAT_LPASS          0x0004
 #define MII_TG3_AUX_STAT_SPDMASK        0x0700
@@ -1667,6 +1673,9 @@
 #define MII_TG3_EPHY_TEST               0x1f /* 5906 PHY register */
 #define MII_TG3_EPHY_SHADOW_EN          0x80
 
+#define MII_TG3_EPHYTST_MISCCTRL        0x10 /* 5906 EPHY misc ctrl shadow register */
+#define MII_TG3_EPHYTST_MISCCTRL_MDIX   0x4000
+
 #define MII_TG3_TEST1                   0x1e
 #define MII_TG3_TEST1_TRIM_EN           0x0010
 #define MII_TG3_TEST1_CRC_EN            0x8000
diff --git a/drivers/net/tulip/interrupt.c b/drivers/net/tulip/interrupt.c
index ea896777bcaf..53efd6694e75 100644
--- a/drivers/net/tulip/interrupt.c
+++ b/drivers/net/tulip/interrupt.c
@@ -197,8 +197,8 @@ int tulip_poll(struct net_device *dev, int *budget)
                                                                    tp->rx_buffers[entry].mapping,
                                                                    pkt_len, PCI_DMA_FROMDEVICE);
 #if ! defined(__alpha__)
-                                       eth_copy_and_sum(skb, tp->rx_buffers[entry].skb->data,
-                                                        pkt_len, 0);
+                                       skb_copy_to_linear_data(skb, tp->rx_buffers[entry].skb->data,
+                                                        pkt_len);
                                        skb_put(skb, pkt_len);
 #else
                                        memcpy(skb_put(skb, pkt_len),
@@ -420,8 +420,8 @@ static int tulip_rx(struct net_device *dev)
                                                             tp->rx_buffers[entry].mapping,
                                                             pkt_len, PCI_DMA_FROMDEVICE);
 #if ! defined(__alpha__)
-                                eth_copy_and_sum(skb, tp->rx_buffers[entry].skb->data,
-                                                 pkt_len, 0);
+                                skb_copy_to_linear_data(skb, tp->rx_buffers[entry].skb->data,
+                                                 pkt_len);
                                 skb_put(skb, pkt_len);
 #else
                                 memcpy(skb_put(skb, pkt_len),
diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
index 38f3b99716b8..5824f6a35495 100644
--- a/drivers/net/tulip/winbond-840.c
+++ b/drivers/net/tulip/winbond-840.c
@@ -1232,7 +1232,7 @@ static int netdev_rx(struct net_device *dev)
                                 pci_dma_sync_single_for_cpu(np->pci_dev,np->rx_addr[entry],
                                                             np->rx_skbuff[entry]->len,
                                                             PCI_DMA_FROMDEVICE);
-                                eth_copy_and_sum(skb, np->rx_skbuff[entry]->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb, np->rx_skbuff[entry]->data, pkt_len);
                                 skb_put(skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pci_dev,np->rx_addr[entry],
                                                                np->rx_skbuff[entry]->len,
diff --git a/drivers/net/tulip/xircom_cb.c b/drivers/net/tulip/xircom_cb.c
index 79943cdd6337..16a54e6b8d4f 100644
--- a/drivers/net/tulip/xircom_cb.c
+++ b/drivers/net/tulip/xircom_cb.c
@@ -1205,7 +1205,7 @@ static void investigate_read_descriptor(struct net_device *dev,struct xircom_pri
                                 goto out;
                         }
                         skb_reserve(skb, 2);
-                        eth_copy_and_sum(skb, (unsigned char*)&card->rx_buffer[bufferoffset / 4], pkt_len, 0);
+                        skb_copy_to_linear_data(skb, (unsigned char*)&card->rx_buffer[bufferoffset / 4], pkt_len);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_rx(skb);
diff --git a/drivers/net/tulip/xircom_tulip_cb.c b/drivers/net/tulip/xircom_tulip_cb.c
index 83d69f11892f..fc439f333350 100644
--- a/drivers/net/tulip/xircom_tulip_cb.c
+++ b/drivers/net/tulip/xircom_tulip_cb.c
@@ -1240,8 +1240,8 @@ xircom_rx(struct net_device *dev)
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
 #if ! defined(__alpha__)
-                                eth_copy_and_sum(skb, bus_to_virt(tp->rx_ring[entry].buffer1),
-                                                                 pkt_len, 0);
+                                skb_copy_to_linear_data(skb, bus_to_virt(tp->rx_ring[entry].buffer1),
+                                                                 pkt_len);
                                 skb_put(skb, pkt_len);
 #else
                                 memcpy(skb_put(skb, pkt_len),
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a2c6caaaae93..62b2b3005019 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -432,6 +432,7 @@ static void tun_setup(struct net_device *dev)
         init_waitqueue_head(&tun->read_wait);
 
         tun->owner = -1;
+        tun->group = -1;
 
         SET_MODULE_OWNER(dev);
         dev->open = tun_net_open;
@@ -467,8 +468,11 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)
                         return -EBUSY;
 
                 /* Check permissions */
-                if (tun->owner != -1 &&
-                    current->euid != tun->owner && !capable(CAP_NET_ADMIN))
+                if (((tun->owner != -1 &&
+                      current->euid != tun->owner) ||
+                     (tun->group != -1 &&
+                      current->egid != tun->group)) &&
+                     !capable(CAP_NET_ADMIN))
                         return -EPERM;
         }
         else if (__dev_get_by_name(ifr->ifr_name))
@@ -610,6 +614,13 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 DBG(KERN_INFO "%s: owner set to %d\n", tun->dev->name, tun->owner);
                 break;
 
+        case TUNSETGROUP:
+                /* Set group of the device */
+                tun->group= (gid_t) arg;
+
+                DBG(KERN_INFO "%s: group set to %d\n", tun->dev->name, tun->group);
+                break;
+
         case TUNSETLINK:
                 /* Only allow setting the type when the interface is down */
                 if (tun->dev->flags & IFF_UP) {
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 0f2c0610ed71..03587205546e 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -1703,7 +1703,7 @@ typhoon_rx(struct typhoon *tp, struct basic_ring *rxRing, volatile u32 * ready,
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr,
                                                     PKT_BUF_SZ,
                                                     PCI_DMA_FROMDEVICE);
-                        eth_copy_and_sum(new_skb, skb->data, pkt_len, 0);
+                        skb_copy_to_linear_data(new_skb, skb->data, pkt_len);
                         pci_dma_sync_single_for_device(tp->pdev, dma_addr,
                                                        PKT_BUF_SZ,
                                                        PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c
index 86e90c59d551..76752d84a30f 100644
--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -255,7 +255,7 @@ static void catc_rx_done(struct urb *urb)
                 if (!(skb = dev_alloc_skb(pkt_len)))
                         return;
 
-                eth_copy_and_sum(skb, pkt_start + pkt_offset, pkt_len, 0);
+                skb_copy_to_linear_data(skb, pkt_start + pkt_offset, pkt_len);
                 skb_put(skb, pkt_len);
 
                 skb->protocol = eth_type_trans(skb, catc->netdev);
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 60d29440f316..524dc5f5e46d 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -635,7 +635,7 @@ static void kaweth_usb_receive(struct urb *urb)
 
                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
 
-                eth_copy_and_sum(skb, kaweth->rx_buf + 2, pkt_len, 0);
+                skb_copy_to_linear_data(skb, kaweth->rx_buf + 2, pkt_len);
 
                 skb_put(skb, pkt_len);
 
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 73e9c3dcddde..f51c2c138f10 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1489,9 +1489,9 @@ static int rhine_rx(struct net_device *dev, int limit)
                                                             rp->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
 
-                                eth_copy_and_sum(skb,
+                                skb_copy_to_linear_data(skb,
                                                  rp->rx_skbuff[entry]->data,
-                                                 pkt_len, 0);
+                                                 pkt_len);
                                 skb_put(skb, pkt_len);
                                 pci_dma_sync_single_for_device(rp->pdev,
                                                                rp->rx_skbuff_dma[entry],
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index ce9230b2f630..c8b5c2271938 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1011,7 +1011,7 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev,
         } else {
                 skb->dev = dev;
                 skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
-                eth_copy_and_sum(skb, (unsigned char *)&sig.daddr, 12, 0);
+                skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12);
                 wl3501_receive(this, skb->data, pkt_len);
                 skb_put(skb, pkt_len);
                 skb->protocol   = eth_type_trans(skb, dev);
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index f2a90a7fa2d6..870c5393c21a 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -1137,7 +1137,7 @@ static int yellowfin_rx(struct net_device *dev)
                                 if (skb == NULL)
                                         break;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
-                                eth_copy_and_sum(skb, rx_skb->data, pkt_len, 0);
+                                skb_copy_to_linear_data(skb, rx_skb->data, pkt_len);
                                 skb_put(skb, pkt_len);
                                 pci_dma_sync_single_for_device(yp->pci_dev, desc->addr,
                                                                                            yp->rx_buf_sz,
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 924ef0609460..fc4bde259dc7 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -121,14 +121,14 @@ struct pdcspath_entry pdcspath_entry_##_name = { \
 
 #define PDCS_ATTR(_name, _mode, _show, _store) \
 struct subsys_attribute pdcs_attr_##_name = { \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+        .attr = {.name = __stringify(_name), .mode = _mode}, \
         .show = _show, \
         .store = _store, \
 };
 
 #define PATHS_ATTR(_name, _mode, _show, _store) \
 struct pdcspath_attribute paths_attr_##_name = { \
-        .attr = {.name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE}, \
+        .attr = {.name = __stringify(_name), .mode = _mode}, \
         .show = _show, \
         .store = _store, \
 };
diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index e7322c25d377..70db38c0ced9 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -106,7 +106,8 @@ static int ibm_get_attention_status(struct hotplug_slot *slot, u8 *status);
 static void ibm_handle_events(acpi_handle handle, u32 event, void *context);
 static int ibm_get_table_from_acpi(char **bufp);
 static ssize_t ibm_read_apci_table(struct kobject *kobj,
-                char *buffer, loff_t pos, size_t size);
+                                   struct bin_attribute *bin_attr,
+                                   char *buffer, loff_t pos, size_t size);
 static acpi_status __init ibm_find_acpi_device(acpi_handle handle,
                 u32 lvl, void *context, void **rv);
 static int __init ibm_acpiphp_init(void);
@@ -117,7 +118,6 @@ static struct notification ibm_note;
 static struct bin_attribute ibm_apci_table_attr = {
             .attr = {
                     .name = "apci_table",
-                    .owner = THIS_MODULE,
                     .mode = S_IRUGO,
             },
             .read = ibm_read_apci_table,
@@ -358,7 +358,8 @@ read_table_done:
  * our solution is to only allow reading the table in all at once
  **/
 static ssize_t ibm_read_apci_table(struct kobject *kobj,
-                char *buffer, loff_t pos, size_t size)
+                                   struct bin_attribute *bin_attr,
+                                   char *buffer, loff_t pos, size_t size)
 {
         int bytes_read = -EINVAL;
         char *table = NULL;
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 9c4a123eacd1..10dbdec80416 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -213,7 +213,8 @@ struct device_attribute pci_dev_attrs[] = {
 };
 
 static ssize_t
-pci_read_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_read_config(struct kobject *kobj, struct bin_attribute *bin_attr,
+                char *buf, loff_t off, size_t count)
 {
         struct pci_dev *dev = to_pci_dev(container_of(kobj,struct device,kobj));
         unsigned int size = 64;
@@ -285,7 +286,8 @@ pci_read_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
 }
 
 static ssize_t
-pci_write_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_write_config(struct kobject *kobj, struct bin_attribute *bin_attr,
+                 char *buf, loff_t off, size_t count)
 {
         struct pci_dev *dev = to_pci_dev(container_of(kobj,struct device,kobj));
         unsigned int size = count;
@@ -352,7 +354,8 @@ pci_write_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
  * callback routine (pci_legacy_read).
  */
 ssize_t
-pci_read_legacy_io(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_read_legacy_io(struct kobject *kobj, struct bin_attribute *bin_attr,
+                   char *buf, loff_t off, size_t count)
 {
         struct pci_bus *bus = to_pci_bus(container_of(kobj,
                                                       struct class_device,
@@ -376,7 +379,8 @@ pci_read_legacy_io(struct kobject *kobj, char *buf, loff_t off, size_t count)
  * callback routine (pci_legacy_write).
  */
 ssize_t
-pci_write_legacy_io(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_write_legacy_io(struct kobject *kobj, struct bin_attribute *bin_attr,
+                    char *buf, loff_t off, size_t count)
 {
         struct pci_bus *bus = to_pci_bus(container_of(kobj,
                                                       struct class_device,
@@ -499,7 +503,6 @@ static int pci_create_resource_files(struct pci_dev *pdev)
                         sprintf(res_attr_name, "resource%d", i);
                         res_attr->attr.name = res_attr_name;
                         res_attr->attr.mode = S_IRUSR | S_IWUSR;
-                        res_attr->attr.owner = THIS_MODULE;
                         res_attr->size = pci_resource_len(pdev, i);
                         res_attr->mmap = pci_mmap_resource;
                         res_attr->private = &pdev->resource[i];
@@ -529,7 +532,8 @@ static inline void pci_remove_resource_files(struct pci_dev *dev) { return; }
  * writing anything except 0 enables it
  */
 static ssize_t
-pci_write_rom(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_write_rom(struct kobject *kobj, struct bin_attribute *bin_attr,
+              char *buf, loff_t off, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(container_of(kobj, struct device, kobj));
 
@@ -552,7 +556,8 @@ pci_write_rom(struct kobject *kobj, char *buf, loff_t off, size_t count)
  * device corresponding to @kobj.
  */
 static ssize_t
-pci_read_rom(struct kobject *kobj, char *buf, loff_t off, size_t count)
+pci_read_rom(struct kobject *kobj, struct bin_attribute *bin_attr,
+             char *buf, loff_t off, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(container_of(kobj, struct device, kobj));
         void __iomem *rom;
@@ -582,7 +587,6 @@ static struct bin_attribute pci_config_attr = {
         .attr = {
                 .name = "config",
                 .mode = S_IRUGO | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 256,
         .read = pci_read_config,
@@ -593,7 +597,6 @@ static struct bin_attribute pcie_config_attr = {
         .attr = {
                 .name = "config",
                 .mode = S_IRUGO | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 4096,
         .read = pci_read_config,
@@ -633,7 +636,6 @@ int __must_check pci_create_sysfs_dev_files (struct pci_dev *pdev)
                         rom_attr->size = pci_resource_len(pdev, PCI_ROM_RESOURCE);
                         rom_attr->attr.name = "rom";
                         rom_attr->attr.mode = S_IRUSR;
-                        rom_attr->attr.owner = THIS_MODULE;
                         rom_attr->read = pci_read_rom;
                         rom_attr->write = pci_write_rom;
                         retval = sysfs_create_bin_file(&pdev->dev.kobj, rom_attr);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 8802fcb4aaf0..a7bce75c6732 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -39,7 +39,6 @@ static void pci_create_legacy_files(struct pci_bus *b)
                 b->legacy_io->attr.name = "legacy_io";
                 b->legacy_io->size = 0xffff;
                 b->legacy_io->attr.mode = S_IRUSR | S_IWUSR;
-                b->legacy_io->attr.owner = THIS_MODULE;
                 b->legacy_io->read = pci_read_legacy_io;
                 b->legacy_io->write = pci_write_legacy_io;
                 class_device_create_bin_file(&b->class_dev, b->legacy_io);
@@ -49,7 +48,6 @@ static void pci_create_legacy_files(struct pci_bus *b)
                 b->legacy_mem->attr.name = "legacy_mem";
                 b->legacy_mem->size = 1024*1024;
                 b->legacy_mem->attr.mode = S_IRUSR | S_IWUSR;
-                b->legacy_mem->attr.owner = THIS_MODULE;
                 b->legacy_mem->mmap = pci_mmap_legacy_mem;
                 class_device_create_bin_file(&b->class_dev, b->legacy_mem);
         }
diff --git a/drivers/pcmcia/socket_sysfs.c b/drivers/pcmcia/socket_sysfs.c
index a2bb46526b56..b4409002b7f8 100644
--- a/drivers/pcmcia/socket_sysfs.c
+++ b/drivers/pcmcia/socket_sysfs.c
@@ -283,7 +283,9 @@ static ssize_t pccard_extract_cis(struct pcmcia_socket *s, char *buf, loff_t off
         return (ret);
 }
 
-static ssize_t pccard_show_cis(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t pccard_show_cis(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         unsigned int size = 0x200;
 
@@ -311,7 +313,9 @@ static ssize_t pccard_show_cis(struct kobject *kobj, char *buf, loff_t off, size
         return (count);
 }
 
-static ssize_t pccard_store_cis(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t pccard_store_cis(struct kobject *kobj,
+                                struct bin_attribute *bin_attr,
+                                char *buf, loff_t off, size_t count)
 {
         struct pcmcia_socket *s = to_socket(container_of(kobj, struct device, kobj));
         cisdump_t *cis;
@@ -366,7 +370,7 @@ static struct device_attribute *pccard_socket_attributes[] = {
 };
 
 static struct bin_attribute pccard_cis_attr = {
-        .attr = { .name = "cis", .mode = S_IRUGO | S_IWUSR, .owner = THIS_MODULE},
+        .attr = { .name = "cis", .mode = S_IRUGO | S_IWUSR },
         .size = 0x200,
         .read = pccard_show_cis,
         .write = pccard_store_cis,
diff --git a/drivers/rapidio/rio-sysfs.c b/drivers/rapidio/rio-sysfs.c
index eed91434417d..659e31164cf0 100644
--- a/drivers/rapidio/rio-sysfs.c
+++ b/drivers/rapidio/rio-sysfs.c
@@ -67,7 +67,8 @@ struct device_attribute rio_dev_attrs[] = {
 };
 
 static ssize_t
-rio_read_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
+rio_read_config(struct kobject *kobj, struct bin_attribute *bin_attr,
+                char *buf, loff_t off, size_t count)
 {
         struct rio_dev *dev =
             to_rio_dev(container_of(kobj, struct device, kobj));
@@ -137,7 +138,8 @@ rio_read_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
 }
 
 static ssize_t
-rio_write_config(struct kobject *kobj, char *buf, loff_t off, size_t count)
+rio_write_config(struct kobject *kobj, struct bin_attribute *bin_attr,
+                 char *buf, loff_t off, size_t count)
 {
         struct rio_dev *dev =
             to_rio_dev(container_of(kobj, struct device, kobj));
@@ -197,7 +199,6 @@ static struct bin_attribute rio_config_attr = {
         .attr = {
                  .name = "config",
                  .mode = S_IRUGO | S_IWUSR,
-                 .owner = THIS_MODULE,
                  },
         .size = 0x200000,
         .read = rio_read_config,
diff --git a/drivers/rtc/rtc-ds1553.c b/drivers/rtc/rtc-ds1553.c
index afa64c7fa2e2..f98a83a11aae 100644
--- a/drivers/rtc/rtc-ds1553.c
+++ b/drivers/rtc/rtc-ds1553.c
@@ -258,8 +258,9 @@ static const struct rtc_class_ops ds1553_rtc_ops = {
         .ioctl          = ds1553_rtc_ioctl,
 };
 
-static ssize_t ds1553_nvram_read(struct kobject *kobj, char *buf,
-                                 loff_t pos, size_t size)
+static ssize_t ds1553_nvram_read(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t pos, size_t size)
 {
         struct platform_device *pdev =
                 to_platform_device(container_of(kobj, struct device, kobj));
@@ -272,8 +273,9 @@ static ssize_t ds1553_nvram_read(struct kobject *kobj, char *buf,
         return count;
 }
 
-static ssize_t ds1553_nvram_write(struct kobject *kobj, char *buf,
-                                  loff_t pos, size_t size)
+static ssize_t ds1553_nvram_write(struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buf, loff_t pos, size_t size)
 {
         struct platform_device *pdev =
                 to_platform_device(container_of(kobj, struct device, kobj));
@@ -290,7 +292,6 @@ static struct bin_attribute ds1553_nvram_attr = {
         .attr = {
                 .name = "nvram",
                 .mode = S_IRUGO | S_IWUGO,
-                .owner = THIS_MODULE,
         },
         .size = RTC_OFFSET,
         .read = ds1553_nvram_read,
diff --git a/drivers/rtc/rtc-ds1742.c b/drivers/rtc/rtc-ds1742.c
index d68288b389dc..d1778ae8bca5 100644
--- a/drivers/rtc/rtc-ds1742.c
+++ b/drivers/rtc/rtc-ds1742.c
@@ -127,8 +127,9 @@ static const struct rtc_class_ops ds1742_rtc_ops = {
         .set_time       = ds1742_rtc_set_time,
 };
 
-static ssize_t ds1742_nvram_read(struct kobject *kobj, char *buf,
-                                 loff_t pos, size_t size)
+static ssize_t ds1742_nvram_read(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t pos, size_t size)
 {
         struct platform_device *pdev =
                 to_platform_device(container_of(kobj, struct device, kobj));
@@ -141,8 +142,9 @@ static ssize_t ds1742_nvram_read(struct kobject *kobj, char *buf,
         return count;
 }
 
-static ssize_t ds1742_nvram_write(struct kobject *kobj, char *buf,
-                                  loff_t pos, size_t size)
+static ssize_t ds1742_nvram_write(struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buf, loff_t pos, size_t size)
 {
         struct platform_device *pdev =
                 to_platform_device(container_of(kobj, struct device, kobj));
@@ -159,7 +161,6 @@ static struct bin_attribute ds1742_nvram_attr = {
         .attr = {
                 .name = "nvram",
                 .mode = S_IRUGO | S_IWUGO,
-                .owner = THIS_MODULE,
         },
         .read = ds1742_nvram_read,
         .write = ds1742_nvram_write,
diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
index af7596ef29e2..ce2f78de7a80 100644
--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -17,10 +17,11 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+#include <linux/err.h>
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
-#include <linux/irq.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/rtc.h>
@@ -30,25 +31,11 @@
 #include <asm/div64.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
-#include <asm/vr41xx/irq.h>
 
 MODULE_AUTHOR("Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>");
 MODULE_DESCRIPTION("NEC VR4100 series RTC driver");
 MODULE_LICENSE("GPL");
 
-#define RTC1_TYPE1_START        0x0b0000c0UL
-#define RTC1_TYPE1_END          0x0b0000dfUL
-#define RTC2_TYPE1_START        0x0b0001c0UL
-#define RTC2_TYPE1_END          0x0b0001dfUL
-
-#define RTC1_TYPE2_START        0x0f000100UL
-#define RTC1_TYPE2_END          0x0f00011fUL
-#define RTC2_TYPE2_START        0x0f000120UL
-#define RTC2_TYPE2_END          0x0f00013fUL
-
-#define RTC1_SIZE               0x20
-#define RTC2_SIZE               0x20
-
 /* RTC 1 registers */
 #define ETIMELREG               0x00
 #define ETIMEMREG               0x02
@@ -98,13 +85,8 @@ static char rtc_name[] = "RTC";
 static unsigned long periodic_frequency;
 static unsigned long periodic_count;
 static unsigned int alarm_enabled;
-
-struct resource rtc_resource[2] = {
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-        {       .name   = rtc_name,
-                .flags  = IORESOURCE_MEM,       },
-};
+static int aie_irq = -1;
+static int pie_irq = -1;
 
 static inline unsigned long read_elapsed_second(void)
 {
@@ -150,8 +132,8 @@ static void vr41xx_rtc_release(struct device *dev)
 
         spin_unlock_irq(&rtc_lock);
 
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
+        disable_irq(aie_irq);
+        disable_irq(pie_irq);
 }
 
 static int vr41xx_rtc_read_time(struct device *dev, struct rtc_time *time)
@@ -209,14 +191,14 @@ static int vr41xx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
         spin_lock_irq(&rtc_lock);
 
         if (alarm_enabled)
-                disable_irq(ELAPSEDTIME_IRQ);
+                disable_irq(aie_irq);
 
         rtc1_write(ECMPLREG, (uint16_t)(alarm_sec << 15));
         rtc1_write(ECMPMREG, (uint16_t)(alarm_sec >> 1));
         rtc1_write(ECMPHREG, (uint16_t)(alarm_sec >> 17));
 
         if (wkalrm->enabled)
-                enable_irq(ELAPSEDTIME_IRQ);
+                enable_irq(aie_irq);
 
         alarm_enabled = wkalrm->enabled;
 
@@ -234,7 +216,7 @@ static int vr41xx_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long
                 spin_lock_irq(&rtc_lock);
 
                 if (!alarm_enabled) {
-                        enable_irq(ELAPSEDTIME_IRQ);
+                        enable_irq(aie_irq);
                         alarm_enabled = 1;
                 }
 
@@ -244,17 +226,17 @@ static int vr41xx_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long
                 spin_lock_irq(&rtc_lock);
 
                 if (alarm_enabled) {
-                        disable_irq(ELAPSEDTIME_IRQ);
+                        disable_irq(aie_irq);
                         alarm_enabled = 0;
                 }
 
                 spin_unlock_irq(&rtc_lock);
                 break;
         case RTC_PIE_ON:
-                enable_irq(RTCLONG1_IRQ);
+                enable_irq(pie_irq);
                 break;
         case RTC_PIE_OFF:
-                disable_irq(RTCLONG1_IRQ);
+                disable_irq(pie_irq);
                 break;
         case RTC_IRQP_READ:
                 return put_user(periodic_frequency, (unsigned long __user *)arg);
@@ -331,31 +313,37 @@ static const struct rtc_class_ops vr41xx_rtc_ops = {
 
 static int __devinit rtc_probe(struct platform_device *pdev)
 {
+        struct resource *res;
         struct rtc_device *rtc;
-        unsigned int irq;
         int retval;
 
-        if (pdev->num_resources != 2)
+        if (pdev->num_resources != 4)
                 return -EBUSY;
 
-        rtc1_base = ioremap(pdev->resource[0].start, RTC1_SIZE);
-        if (rtc1_base == NULL)
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
                 return -EBUSY;
 
-        rtc2_base = ioremap(pdev->resource[1].start, RTC2_SIZE);
-        if (rtc2_base == NULL) {
-                iounmap(rtc1_base);
-                rtc1_base = NULL;
+        rtc1_base = ioremap(res->start, res->end - res->start + 1);
+        if (!rtc1_base)
                 return -EBUSY;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!res) {
+                retval = -EBUSY;
+                goto err_rtc1_iounmap;
+        }
+
+        rtc2_base = ioremap(res->start, res->end - res->start + 1);
+        if (!rtc2_base) {
+                retval = -EBUSY;
+                goto err_rtc1_iounmap;
         }
 
         rtc = rtc_device_register(rtc_name, &pdev->dev, &vr41xx_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return PTR_ERR(rtc);
+                retval = PTR_ERR(rtc);
+                goto err_iounmap_all;
         }
 
         spin_lock_irq(&rtc_lock);
@@ -368,35 +356,50 @@ static int __devinit rtc_probe(struct platform_device *pdev)
 
         spin_unlock_irq(&rtc_lock);
 
-        irq = ELAPSEDTIME_IRQ;
-        retval = request_irq(irq, elapsedtime_interrupt, IRQF_DISABLED,
-                             "elapsed_time", pdev);
-        if (retval == 0) {
-                irq = RTCLONG1_IRQ;
-                retval = request_irq(irq, rtclong1_interrupt, IRQF_DISABLED,
-                                     "rtclong1", pdev);
+        aie_irq = platform_get_irq(pdev, 0);
+        if (aie_irq < 0 || aie_irq >= NR_IRQS) {
+                retval = -EBUSY;
+                goto err_device_unregister;
         }
 
-        if (retval < 0) {
-                printk(KERN_ERR "rtc: IRQ%d is busy\n", irq);
-                rtc_device_unregister(rtc);
-                if (irq == RTCLONG1_IRQ)
-                        free_irq(ELAPSEDTIME_IRQ, NULL);
-                iounmap(rtc1_base);
-                iounmap(rtc2_base);
-                rtc1_base = NULL;
-                rtc2_base = NULL;
-                return retval;
-        }
+        retval = request_irq(aie_irq, elapsedtime_interrupt, IRQF_DISABLED,
+                             "elapsed_time", pdev);
+        if (retval < 0)
+                goto err_device_unregister;
+
+        pie_irq = platform_get_irq(pdev, 1);
+        if (pie_irq < 0 || pie_irq >= NR_IRQS)
+                goto err_free_irq;
+
+        retval = request_irq(pie_irq, rtclong1_interrupt, IRQF_DISABLED,
+                             "rtclong1", pdev);
+        if (retval < 0)
+                goto err_free_irq;
 
         platform_set_drvdata(pdev, rtc);
 
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
+        disable_irq(aie_irq);
+        disable_irq(pie_irq);
 
         printk(KERN_INFO "rtc: Real Time Clock of NEC VR4100 series\n");
 
         return 0;
+
+err_free_irq:
+        free_irq(aie_irq, pdev);
+
+err_device_unregister:
+        rtc_device_unregister(rtc);
+
+err_iounmap_all:
+        iounmap(rtc2_base);
+        rtc2_base = NULL;
+
+err_rtc1_iounmap:
+        iounmap(rtc1_base);
+        rtc1_base = NULL;
+
+        return retval;
 }
 
 static int __devexit rtc_remove(struct platform_device *pdev)
@@ -404,23 +407,21 @@ static int __devexit rtc_remove(struct platform_device *pdev)
         struct rtc_device *rtc;
 
         rtc = platform_get_drvdata(pdev);
-        if (rtc != NULL)
+        if (rtc)
                 rtc_device_unregister(rtc);
 
         platform_set_drvdata(pdev, NULL);
 
-        free_irq(ELAPSEDTIME_IRQ, NULL);
-        free_irq(RTCLONG1_IRQ, NULL);
-        if (rtc1_base != NULL)
+        free_irq(aie_irq, pdev);
+        free_irq(pie_irq, pdev);
+        if (rtc1_base)
                 iounmap(rtc1_base);
-        if (rtc2_base != NULL)
+        if (rtc2_base)
                 iounmap(rtc2_base);
 
         return 0;
 }
 
-static struct platform_device *rtc_platform_device;
-
 static struct platform_driver rtc_platform_driver = {
         .probe          = rtc_probe,
         .remove         = __devexit_p(rtc_remove),
@@ -432,55 +433,12 @@ static struct platform_driver rtc_platform_driver = {
 
 static int __init vr41xx_rtc_init(void)
 {
-        int retval;
-
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                rtc_resource[0].start = RTC1_TYPE1_START;
-                rtc_resource[0].end = RTC1_TYPE1_END;
-                rtc_resource[1].start = RTC2_TYPE1_START;
-                rtc_resource[1].end = RTC2_TYPE1_END;
-                break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                rtc_resource[0].start = RTC1_TYPE2_START;
-                rtc_resource[0].end = RTC1_TYPE2_END;
-                rtc_resource[1].start = RTC2_TYPE2_START;
-                rtc_resource[1].end = RTC2_TYPE2_END;
-                break;
-        default:
-                return -ENODEV;
-                break;
-        }
-
-        rtc_platform_device = platform_device_alloc("RTC", -1);
-        if (rtc_platform_device == NULL)
-                return -ENOMEM;
-
-        retval = platform_device_add_resources(rtc_platform_device,
-                                rtc_resource, ARRAY_SIZE(rtc_resource));
-
-        if (retval == 0)
-                retval = platform_device_add(rtc_platform_device);
-
-        if (retval < 0) {
-                platform_device_put(rtc_platform_device);
-                return retval;
-        }
-
-        retval = platform_driver_register(&rtc_platform_driver);
-        if (retval < 0)
-                platform_device_unregister(rtc_platform_device);
-
-        return retval;
+        return platform_driver_register(&rtc_platform_driver);
 }
 
 static void __exit vr41xx_rtc_exit(void)
 {
         platform_driver_unregister(&rtc_platform_driver);
-        platform_device_unregister(rtc_platform_device);
 }
 
 module_init(vr41xx_rtc_init);
diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
index 513d1a611aab..b3fae357ca49 100644
--- a/drivers/rtc/rtc-x1205.c
+++ b/drivers/rtc/rtc-x1205.c
@@ -9,6 +9,9 @@
  *
  * based on a lot of other RTC drivers.
  *
+ * Information and datasheet:
+ * http://www.intersil.com/cda/deviceinfo/0,1477,X1205,00.html
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -26,7 +29,7 @@
  * Two bytes need to be written to read a single register,
  * while most other chips just require one and take the second
  * one as the data to be written. To prevent corrupting
- * unknown chips, the user must explicitely set the probe parameter.
+ * unknown chips, the user must explicitly set the probe parameter.
  */
 
 static unsigned short normal_i2c[] = { I2C_CLIENT_END };
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index ac289e6eadfe..b57d93d986c0 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -141,8 +141,9 @@ static int s390_vary_chpid(struct chp_id chpid, int on)
 /*
  * Channel measurement related functions
  */
-static ssize_t chp_measurement_chars_read(struct kobject *kobj, char *buf,
-                                          loff_t off, size_t count)
+static ssize_t chp_measurement_chars_read(struct kobject *kobj,
+                                          struct bin_attribute *bin_attr,
+                                          char *buf, loff_t off, size_t count)
 {
         struct channel_path *chp;
         unsigned int size;
@@ -165,7 +166,6 @@ static struct bin_attribute chp_measurement_chars_attr = {
         .attr = {
                 .name = "measurement_chars",
                 .mode = S_IRUSR,
-                .owner = THIS_MODULE,
         },
         .size = sizeof(struct cmg_chars),
         .read = chp_measurement_chars_read,
@@ -193,8 +193,9 @@ static void chp_measurement_copy_block(struct cmg_entry *buf,
         } while (reference_buf.values[0] != buf->values[0]);
 }
 
-static ssize_t chp_measurement_read(struct kobject *kobj, char *buf,
-                                    loff_t off, size_t count)
+static ssize_t chp_measurement_read(struct kobject *kobj,
+                                    struct bin_attribute *bin_attr,
+                                    char *buf, loff_t off, size_t count)
 {
         struct channel_path *chp;
         struct channel_subsystem *css;
@@ -217,7 +218,6 @@ static struct bin_attribute chp_measurement_attr = {
         .attr = {
                 .name = "measurement",
                 .mode = S_IRUSR,
-                .owner = THIS_MODULE,
         },
         .size = sizeof(struct cmg_entry),
         .read = chp_measurement_read,
diff --git a/drivers/s390/net/qeth_sys.c b/drivers/s390/net/qeth_sys.c
index 65ffc21afc37..bb0287ad1aac 100644
--- a/drivers/s390/net/qeth_sys.c
+++ b/drivers/s390/net/qeth_sys.c
@@ -991,7 +991,7 @@ static struct attribute_group qeth_osn_device_attr_group = {
 
 #define QETH_DEVICE_ATTR(_id,_name,_mode,_show,_store)                       \
 struct device_attribute dev_attr_##_id = {                                   \
-        .attr = {.name=__stringify(_name), .mode=_mode, .owner=THIS_MODULE },\
+        .attr = {.name=__stringify(_name), .mode=_mode, },\
         .show   = _show,                                                     \
         .store  = _store,                                                    \
 };
diff --git a/drivers/scsi/arcmsr/arcmsr_attr.c b/drivers/scsi/arcmsr/arcmsr_attr.c
index 03bfed61bffc..06c0dce3b839 100644
--- a/drivers/scsi/arcmsr/arcmsr_attr.c
+++ b/drivers/scsi/arcmsr/arcmsr_attr.c
@@ -59,8 +59,9 @@
 struct class_device_attribute *arcmsr_host_attrs[];
 
 static ssize_t
-arcmsr_sysfs_iop_message_read(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+arcmsr_sysfs_iop_message_read(struct kobject *kobj,
+                              struct bin_attribute *bin_attr,
+                              char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *host = class_to_shost(cdev);
@@ -105,8 +106,9 @@ arcmsr_sysfs_iop_message_read(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-arcmsr_sysfs_iop_message_write(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+arcmsr_sysfs_iop_message_write(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *host = class_to_shost(cdev);
@@ -152,8 +154,9 @@ arcmsr_sysfs_iop_message_write(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-arcmsr_sysfs_iop_message_clear(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+arcmsr_sysfs_iop_message_clear(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *host = class_to_shost(cdev);
@@ -188,7 +191,6 @@ static struct bin_attribute arcmsr_sysfs_message_read_attr = {
         .attr = {
                 .name = "mu_read",
                 .mode = S_IRUSR ,
-                .owner = THIS_MODULE,
         },
         .size = 1032,
         .read = arcmsr_sysfs_iop_message_read,
@@ -198,7 +200,6 @@ static struct bin_attribute arcmsr_sysfs_message_write_attr = {
         .attr = {
                 .name = "mu_write",
                 .mode = S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 1032,
         .write = arcmsr_sysfs_iop_message_write,
@@ -208,7 +209,6 @@ static struct bin_attribute arcmsr_sysfs_message_clear_attr = {
         .attr = {
                 .name = "mu_clear",
                 .mode = S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 1,
         .write = arcmsr_sysfs_iop_message_clear,
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 81330712048c..b3bf77f1ec05 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -2465,6 +2465,7 @@ restart:
 /**
  * ipr_read_trace - Dump the adapter trace
  * @kobj:               kobject struct
+ * @bin_attr:           bin_attribute struct
  * @buf:                buffer
  * @off:                offset
  * @count:              buffer size
@@ -2472,8 +2473,9 @@ restart:
  * Return value:
  *      number of bytes printed to buffer
  **/
-static ssize_t ipr_read_trace(struct kobject *kobj, char *buf,
-                              loff_t off, size_t count)
+static ssize_t ipr_read_trace(struct kobject *kobj,
+                              struct bin_attribute *bin_attr,
+                              char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *shost = class_to_shost(cdev);
@@ -3166,6 +3168,7 @@ static struct class_device_attribute *ipr_ioa_attrs[] = {
 /**
  * ipr_read_dump - Dump the adapter
  * @kobj:               kobject struct
+ * @bin_attr:           bin_attribute struct
  * @buf:                buffer
  * @off:                offset
  * @count:              buffer size
@@ -3173,8 +3176,9 @@ static struct class_device_attribute *ipr_ioa_attrs[] = {
  * Return value:
  *      number of bytes printed to buffer
  **/
-static ssize_t ipr_read_dump(struct kobject *kobj, char *buf,
-                              loff_t off, size_t count)
+static ssize_t ipr_read_dump(struct kobject *kobj,
+                             struct bin_attribute *bin_attr,
+                             char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *shost = class_to_shost(cdev);
@@ -3327,6 +3331,7 @@ static int ipr_free_dump(struct ipr_ioa_cfg *ioa_cfg)
 /**
  * ipr_write_dump - Setup dump state of adapter
  * @kobj:               kobject struct
+ * @bin_attr:           bin_attribute struct
  * @buf:                buffer
  * @off:                offset
  * @count:              buffer size
@@ -3334,8 +3339,9 @@ static int ipr_free_dump(struct ipr_ioa_cfg *ioa_cfg)
  * Return value:
  *      number of bytes printed to buffer
  **/
-static ssize_t ipr_write_dump(struct kobject *kobj, char *buf,
-                              loff_t off, size_t count)
+static ssize_t ipr_write_dump(struct kobject *kobj,
+                              struct bin_attribute *bin_attr,
+                              char *buf, loff_t off, size_t count)
 {
         struct class_device *cdev = container_of(kobj,struct class_device,kobj);
         struct Scsi_Host *shost = class_to_shost(cdev);
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index e34442e405e8..23e90c5f8f35 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -38,8 +38,10 @@ static int sas_disable_routing(struct domain_device *dev,  u8 *sas_addr);
 
 #if 0
 /* FIXME: smp needs to migrate into the sas class */
-static ssize_t smp_portal_read(struct kobject *, char *, loff_t, size_t);
-static ssize_t smp_portal_write(struct kobject *, char *, loff_t, size_t);
+static ssize_t smp_portal_read(struct kobject *, struct bin_attribute *,
+                               char *, loff_t, size_t);
+static ssize_t smp_portal_write(struct kobject *, struct bin_attribute *,
+                                char *, loff_t, size_t);
 #endif
 
 /* ---------- SMP task management ---------- */
@@ -1368,7 +1370,6 @@ static void sas_ex_smp_hook(struct domain_device *dev)
         memset(bin_attr, 0, sizeof(*bin_attr));
 
         bin_attr->attr.name = SMP_BIN_ATTR_NAME;
-        bin_attr->attr.owner = THIS_MODULE;
         bin_attr->attr.mode = 0600;
 
         bin_attr->size = 0;
@@ -1846,8 +1847,9 @@ out:
 #if 0
 /* ---------- SMP portal ---------- */
 
-static ssize_t smp_portal_write(struct kobject *kobj, char *buf, loff_t offs,
-                                size_t size)
+static ssize_t smp_portal_write(struct kobject *kobj,
+                                struct bin_attribute *bin_attr,
+                                char *buf, loff_t offs, size_t size)
 {
         struct domain_device *dev = to_dom_device(kobj);
         struct expander_device *ex = &dev->ex_dev;
@@ -1873,8 +1875,9 @@ static ssize_t smp_portal_write(struct kobject *kobj, char *buf, loff_t offs,
         return size;
 }
 
-static ssize_t smp_portal_read(struct kobject *kobj, char *buf, loff_t offs,
-                               size_t size)
+static ssize_t smp_portal_read(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t offs, size_t size)
 {
         struct domain_device *dev = to_dom_device(kobj);
         struct expander_device *ex = &dev->ex_dev;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 95fe77e816f8..5dfda9778c80 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -1133,7 +1133,8 @@ struct class_device_attribute *lpfc_host_attrs[] = {
 };
 
 static ssize_t
-sysfs_ctlreg_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
+sysfs_ctlreg_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+                   char *buf, loff_t off, size_t count)
 {
         size_t buf_off;
         struct Scsi_Host *host = class_to_shost(container_of(kobj,
@@ -1165,7 +1166,8 @@ sysfs_ctlreg_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
 }
 
 static ssize_t
-sysfs_ctlreg_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
+sysfs_ctlreg_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                  char *buf, loff_t off, size_t count)
 {
         size_t buf_off;
         uint32_t * tmp_ptr;
@@ -1200,7 +1202,6 @@ static struct bin_attribute sysfs_ctlreg_attr = {
         .attr = {
                 .name = "ctlreg",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 256,
         .read = sysfs_ctlreg_read,
@@ -1222,7 +1223,8 @@ sysfs_mbox_idle (struct lpfc_hba * phba)
 }
 
 static ssize_t
-sysfs_mbox_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
+sysfs_mbox_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+                 char *buf, loff_t off, size_t count)
 {
         struct Scsi_Host * host =
                 class_to_shost(container_of(kobj, struct class_device, kobj));
@@ -1274,7 +1276,8 @@ sysfs_mbox_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
 }
 
 static ssize_t
-sysfs_mbox_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
+sysfs_mbox_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+                char *buf, loff_t off, size_t count)
 {
         struct Scsi_Host *host =
                 class_to_shost(container_of(kobj, struct class_device,
@@ -1422,7 +1425,6 @@ static struct bin_attribute sysfs_mbox_attr = {
         .attr = {
                 .name = "mbox",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = MAILBOX_CMD_SIZE,
         .read = sysfs_mbox_read,
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 8081b637d97e..942db9de785e 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -11,8 +11,9 @@
 /* SYSFS attributes --------------------------------------------------------- */
 
 static ssize_t
-qla2x00_sysfs_read_fw_dump(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_read_fw_dump(struct kobject *kobj,
+                           struct bin_attribute *bin_attr,
+                           char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -31,8 +32,9 @@ qla2x00_sysfs_read_fw_dump(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-qla2x00_sysfs_write_fw_dump(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_write_fw_dump(struct kobject *kobj,
+                            struct bin_attribute *bin_attr,
+                            char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -73,7 +75,6 @@ static struct bin_attribute sysfs_fw_dump_attr = {
         .attr = {
                 .name = "fw_dump",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 0,
         .read = qla2x00_sysfs_read_fw_dump,
@@ -81,8 +82,9 @@ static struct bin_attribute sysfs_fw_dump_attr = {
 };
 
 static ssize_t
-qla2x00_sysfs_read_nvram(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_read_nvram(struct kobject *kobj,
+                         struct bin_attribute *bin_attr,
+                         char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -101,8 +103,9 @@ qla2x00_sysfs_read_nvram(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-qla2x00_sysfs_write_nvram(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_write_nvram(struct kobject *kobj,
+                          struct bin_attribute *bin_attr,
+                          char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -149,7 +152,6 @@ static struct bin_attribute sysfs_nvram_attr = {
         .attr = {
                 .name = "nvram",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 512,
         .read = qla2x00_sysfs_read_nvram,
@@ -157,8 +159,9 @@ static struct bin_attribute sysfs_nvram_attr = {
 };
 
 static ssize_t
-qla2x00_sysfs_read_optrom(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_read_optrom(struct kobject *kobj,
+                          struct bin_attribute *bin_attr,
+                          char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -176,8 +179,9 @@ qla2x00_sysfs_read_optrom(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-qla2x00_sysfs_write_optrom(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_write_optrom(struct kobject *kobj,
+                           struct bin_attribute *bin_attr,
+                           char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -198,7 +202,6 @@ static struct bin_attribute sysfs_optrom_attr = {
         .attr = {
                 .name = "optrom",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = OPTROM_SIZE_24XX,
         .read = qla2x00_sysfs_read_optrom,
@@ -206,8 +209,9 @@ static struct bin_attribute sysfs_optrom_attr = {
 };
 
 static ssize_t
-qla2x00_sysfs_write_optrom_ctl(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_write_optrom_ctl(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -279,15 +283,15 @@ static struct bin_attribute sysfs_optrom_ctl_attr = {
         .attr = {
                 .name = "optrom_ctl",
                 .mode = S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 0,
         .write = qla2x00_sysfs_write_optrom_ctl,
 };
 
 static ssize_t
-qla2x00_sysfs_read_vpd(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_read_vpd(struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -305,8 +309,9 @@ qla2x00_sysfs_read_vpd(struct kobject *kobj, char *buf, loff_t off,
 }
 
 static ssize_t
-qla2x00_sysfs_write_vpd(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_write_vpd(struct kobject *kobj,
+                        struct bin_attribute *bin_attr,
+                        char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -327,7 +332,6 @@ static struct bin_attribute sysfs_vpd_attr = {
         .attr = {
                 .name = "vpd",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = 0,
         .read = qla2x00_sysfs_read_vpd,
@@ -335,8 +339,9 @@ static struct bin_attribute sysfs_vpd_attr = {
 };
 
 static ssize_t
-qla2x00_sysfs_read_sfp(struct kobject *kobj, char *buf, loff_t off,
-    size_t count)
+qla2x00_sysfs_read_sfp(struct kobject *kobj,
+                       struct bin_attribute *bin_attr,
+                       char *buf, loff_t off, size_t count)
 {
         struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
             struct device, kobj)));
@@ -375,7 +380,6 @@ static struct bin_attribute sysfs_sfp_attr = {
         .attr = {
                 .name = "sfp",
                 .mode = S_IRUSR | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = SFP_DEV_SIZE * 2,
         .read = qla2x00_sysfs_read_sfp,
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 315ea9916456..2adbed4e10f3 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -556,7 +556,7 @@ choice
 
 config SERIAL_BFIN_DMA
         bool "DMA mode"
-        depends on DMA_UNCACHED_1M
+        depends on DMA_UNCACHED_1M && !KGDB_UART
         help
           This driver works under DMA mode. If this option is selected, the
           blackfin simple dma driver is also enabled.
@@ -599,7 +599,7 @@ config UART0_RTS_PIN
 
 config SERIAL_BFIN_UART1
         bool "Enable UART1"
-        depends on SERIAL_BFIN && (BF534 || BF536 || BF537)
+        depends on SERIAL_BFIN && (BF534 || BF536 || BF537 || BF54x)
         help
           Enable UART1
 
@@ -612,18 +612,58 @@ config BFIN_UART1_CTSRTS
 
 config UART1_CTS_PIN
         int "UART1 CTS pin"
-        depends on BFIN_UART1_CTSRTS
+        depends on BFIN_UART1_CTSRTS && (BF53x || BF561)
         default -1
         help
           Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
 
 config UART1_RTS_PIN
         int "UART1 RTS pin"
-        depends on BFIN_UART1_CTSRTS
+        depends on BFIN_UART1_CTSRTS && (BF53x || BF561)
         default -1
         help
           Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
 
+config SERIAL_BFIN_UART2
+        bool "Enable UART2"
+        depends on SERIAL_BFIN && (BF54x)
+        help
+          Enable UART2
+
+config BFIN_UART2_CTSRTS
+        bool "Enable UART2 hardware flow control"
+        depends on SERIAL_BFIN_UART2
+        help
+          Enable hardware flow control in the driver. Using GPIO emulate the CTS/RTS
+          signal.
+
+config UART2_CTS_PIN
+        int "UART2 CTS pin"
+        depends on BFIN_UART2_CTSRTS
+        default -1
+        help
+          Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
+
+config UART2_RTS_PIN
+        int "UART2 RTS pin"
+        depends on BFIN_UART2_CTSRTS
+        default -1
+        help
+          Refer to ./include/asm-blackfin/gpio.h to see the GPIO map.
+
+config SERIAL_BFIN_UART3
+        bool "Enable UART3"
+        depends on SERIAL_BFIN && (BF54x)
+        help
+          Enable UART3
+
+config BFIN_UART3_CTSRTS
+        bool "Enable UART3 hardware flow control"
+        depends on SERIAL_BFIN_UART3
+        help
+          Enable hardware flow control in the driver. Using GPIO emulate the CTS/RTS
+          signal.
+
 config SERIAL_IMX
         bool "IMX serial port support"
         depends on ARM && ARCH_IMX
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 22569bd5d821..66c92bc36f3d 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -41,6 +41,11 @@
 #include <linux/tty_flip.h>
 #include <linux/serial_core.h>
 
+#ifdef CONFIG_KGDB_UART
+#include <linux/kgdb.h>
+#include <asm/irq_regs.h>
+#endif
+
 #include <asm/gpio.h>
 #include <asm/mach/bfin_serial_5xx.h>
 
@@ -81,15 +86,29 @@ static void bfin_serial_stop_tx(struct uart_port *port)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
 
+#ifdef CONFIG_BF54x
+        while (!(UART_GET_LSR(uart) & TEMT))
+                continue;
+#endif
+
 #ifdef CONFIG_SERIAL_BFIN_DMA
         disable_dma(uart->tx_dma_channel);
 #else
+#ifdef CONFIG_BF54x
+        /* Waiting for Transmission Finished */
+        while (!(UART_GET_LSR(uart) & TFI))
+                continue;
+        /* Clear TFI bit */
+        UART_PUT_LSR(uart, TFI);
+        UART_CLEAR_IER(uart, ETBEI);
+#else
         unsigned short ier;
 
         ier = UART_GET_IER(uart);
         ier &= ~ETBEI;
         UART_PUT_IER(uart, ier);
 #endif
+#endif
 }
 
 /*
@@ -102,12 +121,16 @@ static void bfin_serial_start_tx(struct uart_port *port)
 #ifdef CONFIG_SERIAL_BFIN_DMA
         bfin_serial_dma_tx_chars(uart);
 #else
+#ifdef CONFIG_BF54x
+        UART_SET_IER(uart, ETBEI);
+#else
         unsigned short ier;
         ier = UART_GET_IER(uart);
         ier |= ETBEI;
         UART_PUT_IER(uart, ier);
         bfin_serial_tx_chars(uart);
 #endif
+#endif
 }
 
 /*
@@ -116,11 +139,18 @@ static void bfin_serial_start_tx(struct uart_port *port)
 static void bfin_serial_stop_rx(struct uart_port *port)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
+#ifdef CONFIG_BF54x
+        UART_CLEAR_IER(uart, ERBFI);
+#else
         unsigned short ier;
 
         ier = UART_GET_IER(uart);
+#ifdef  CONFIG_KGDB_UART
+        if (uart->port.line != CONFIG_KGDB_UART_PORT)
+#endif
         ier &= ~ERBFI;
         UART_PUT_IER(uart, ier);
+#endif
 }
 
 /*
@@ -130,6 +160,49 @@ static void bfin_serial_enable_ms(struct uart_port *port)
 {
 }
 
+#ifdef CONFIG_KGDB_UART
+static int kgdb_entry_state;
+
+void kgdb_put_debug_char(int chr)
+{
+        struct bfin_serial_port *uart;
+        
+        if (CONFIG_KGDB_UART_PORT<0 || CONFIG_KGDB_UART_PORT>=NR_PORTS)
+                uart = &bfin_serial_ports[0];
+        else
+                uart = &bfin_serial_ports[CONFIG_KGDB_UART_PORT];
+        
+        while (!(UART_GET_LSR(uart) & THRE)) {
+                __builtin_bfin_ssync();
+        }
+        UART_PUT_LCR(uart, UART_GET_LCR(uart)&(~DLAB));
+        __builtin_bfin_ssync();
+        UART_PUT_CHAR(uart, (unsigned char)chr);
+        __builtin_bfin_ssync();
+}
+
+int kgdb_get_debug_char(void)
+{
+        struct bfin_serial_port *uart;
+        unsigned char chr;
+
+        if (CONFIG_KGDB_UART_PORT<0 || CONFIG_KGDB_UART_PORT>=NR_PORTS)
+                uart = &bfin_serial_ports[0];
+        else
+                uart = &bfin_serial_ports[CONFIG_KGDB_UART_PORT];
+        
+        while(!(UART_GET_LSR(uart) & DR)) {
+                __builtin_bfin_ssync();
+        }
+        UART_PUT_LCR(uart, UART_GET_LCR(uart)&(~DLAB));
+        __builtin_bfin_ssync();
+        chr = UART_GET_CHAR(uart);
+        __builtin_bfin_ssync();
+
+        return chr;
+}
+#endif
+
 #ifdef CONFIG_SERIAL_BFIN_PIO
 static void local_put_char(struct bfin_serial_port *uart, char ch)
 {
@@ -152,6 +225,9 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
 {
         struct tty_struct *tty = uart->port.info->tty;
         unsigned int status, ch, flg;
+#ifdef CONFIG_KGDB_UART
+        struct pt_regs *regs = get_irq_regs();
+#endif
 #ifdef BF533_FAMILY
         static int in_break = 0;
 #endif
@@ -160,6 +236,27 @@ static void bfin_serial_rx_chars(struct bfin_serial_port *uart)
         ch = UART_GET_CHAR(uart);
         uart->port.icount.rx++;
 
+#ifdef CONFIG_KGDB_UART
+        if (uart->port.line == CONFIG_KGDB_UART_PORT) {
+                if (uart->port.cons->index == CONFIG_KGDB_UART_PORT && ch == 0x1) { /* Ctrl + A */
+                        kgdb_breakkey_pressed(regs);
+                        return;
+                } else if (kgdb_entry_state == 0 && ch == '$') {/* connection from KGDB */
+                        kgdb_entry_state = 1;
+                } else if (kgdb_entry_state == 1 && ch == 'q') {
+                        kgdb_entry_state = 0;
+                        kgdb_breakkey_pressed(regs);
+                        return;
+                } else if (ch == 0x3) {/* Ctrl + C */
+                        kgdb_entry_state = 0;
+                        kgdb_breakkey_pressed(regs);
+                        return;
+                } else {
+                        kgdb_entry_state = 0;
+                }
+        }
+#endif
+ 
 #ifdef BF533_FAMILY
         /* The BF533 family of processors have a nice misbehavior where
          * they continuously generate characters for a "single" break.
@@ -250,10 +347,21 @@ static irqreturn_t bfin_serial_rx_int(int irq, void *dev_id)
 {
         struct bfin_serial_port *uart = dev_id;
 
+#ifdef CONFIG_BF54x
+        unsigned short status;
+        spin_lock(&uart->port.lock);
+        status = UART_GET_LSR(uart);
+        while ((UART_GET_IER(uart) & ERBFI) && (status & DR)) {
+                bfin_serial_rx_chars(uart);
+                status = UART_GET_LSR(uart);
+        }
+        spin_unlock(&uart->port.lock);
+#else
         spin_lock(&uart->port.lock);
         while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_RX_READY)
                 bfin_serial_rx_chars(uart);
         spin_unlock(&uart->port.lock);
+#endif
         return IRQ_HANDLED;
 }
 
@@ -261,10 +369,21 @@ static irqreturn_t bfin_serial_tx_int(int irq, void *dev_id)
 {
         struct bfin_serial_port *uart = dev_id;
 
+#ifdef CONFIG_BF54x
+        unsigned short status;
+        spin_lock(&uart->port.lock);
+        status = UART_GET_LSR(uart);
+        while ((UART_GET_IER(uart) & ETBEI) && (status & THRE)) {
+                bfin_serial_tx_chars(uart);
+                status = UART_GET_LSR(uart);
+        }
+        spin_unlock(&uart->port.lock);
+#else
         spin_lock(&uart->port.lock);
         while ((UART_GET_IIR(uart) & IIR_STATUS) == IIR_TX_READY)
                 bfin_serial_tx_chars(uart);
         spin_unlock(&uart->port.lock);
+#endif
         return IRQ_HANDLED;
 }
 
@@ -275,7 +394,6 @@ static void bfin_serial_do_work(struct work_struct *work)
 
         bfin_serial_mctrl_check(uart);
 }
-
 #endif
 
 #ifdef CONFIG_SERIAL_BFIN_DMA
@@ -324,9 +442,13 @@ static void bfin_serial_dma_tx_chars(struct bfin_serial_port *uart)
         set_dma_x_count(uart->tx_dma_channel, uart->tx_count);
         set_dma_x_modify(uart->tx_dma_channel, 1);
         enable_dma(uart->tx_dma_channel);
+#ifdef CONFIG_BF54x
+        UART_SET_IER(uart, ETBEI);
+#else
         ier = UART_GET_IER(uart);
         ier |= ETBEI;
         UART_PUT_IER(uart, ier);
+#endif
         spin_unlock_irqrestore(&uart->port.lock, flags);
 }
 
@@ -406,9 +528,13 @@ static irqreturn_t bfin_serial_dma_tx_int(int irq, void *dev_id)
         if (!(get_dma_curr_irqstat(uart->tx_dma_channel)&DMA_RUN)) {
                 clear_dma_irqstat(uart->tx_dma_channel);
                 disable_dma(uart->tx_dma_channel);
+#ifdef CONFIG_BF54x
+                UART_CLEAR_IER(uart, ETBEI);
+#else
                 ier = UART_GET_IER(uart);
                 ier &= ~ETBEI;
                 UART_PUT_IER(uart, ier);
+#endif
                 xmit->tail = (xmit->tail+uart->tx_count) &(UART_XMIT_SIZE -1);
                 uart->port.icount.tx+=uart->tx_count;
 
@@ -571,7 +697,11 @@ static int bfin_serial_startup(struct uart_port *port)
         uart->rx_dma_timer.expires = jiffies + DMA_RX_FLUSH_JIFFIES;
         add_timer(&(uart->rx_dma_timer));
 #else
+# ifdef CONFIG_KGDB_UART
+        if (uart->port.line != CONFIG_KGDB_UART_PORT && request_irq
+# else
         if (request_irq
+# endif
             (uart->port.irq, bfin_serial_rx_int, IRQF_DISABLED,
              "BFIN_UART_RX", uart)) {
                 printk(KERN_NOTICE "Unable to attach BlackFin UART RX interrupt\n");
@@ -586,7 +716,11 @@ static int bfin_serial_startup(struct uart_port *port)
                 return -EBUSY;
         }
 #endif
+#ifdef CONFIG_BF54x
+        UART_SET_IER(uart, ERBFI);
+#else
         UART_PUT_IER(uart, UART_GET_IER(uart) | ERBFI);
+#endif
         return 0;
 }
 
@@ -601,6 +735,9 @@ static void bfin_serial_shutdown(struct uart_port *port)
         free_dma(uart->rx_dma_channel);
         del_timer(&(uart->rx_dma_timer));
 #else
+#ifdef  CONFIG_KGDB_UART
+        if (uart->port.line != CONFIG_KGDB_UART_PORT)
+#endif
         free_irq(uart->port.irq, uart);
         free_irq(uart->port.irq+1, uart);
 #endif
@@ -674,29 +811,41 @@ bfin_serial_set_termios(struct uart_port *port, struct ktermios *termios,
 
         /* Disable UART */
         ier = UART_GET_IER(uart);
+#ifdef CONFIG_BF54x
+        UART_CLEAR_IER(uart, 0xF);
+#else
         UART_PUT_IER(uart, 0);
+#endif
 
+#ifndef CONFIG_BF54x
         /* Set DLAB in LCR to Access DLL and DLH */
         val = UART_GET_LCR(uart);
         val |= DLAB;
         UART_PUT_LCR(uart, val);
         SSYNC();
+#endif
 
         UART_PUT_DLL(uart, quot & 0xFF);
         SSYNC();
         UART_PUT_DLH(uart, (quot >> 8) & 0xFF);
         SSYNC();
 
+#ifndef CONFIG_BF54x
         /* Clear DLAB in LCR to Access THR RBR IER */
         val = UART_GET_LCR(uart);
         val &= ~DLAB;
         UART_PUT_LCR(uart, val);
         SSYNC();
+#endif
 
         UART_PUT_LCR(uart, lcr);
 
         /* Enable UART */
+#ifdef CONFIG_BF54x
+        UART_SET_IER(uart, ier);
+#else
         UART_PUT_IER(uart, ier);
+#endif
 
         val = UART_GET_GCTL(uart);
         val |= UCEN;
@@ -808,15 +957,15 @@ static void __init bfin_serial_init_ports(void)
                         bfin_serial_resource[i].uart_rts_pin;
 #endif
                 bfin_serial_hw_init(&bfin_serial_ports[i]);
-
         }
+
 }
 
 #ifdef CONFIG_SERIAL_BFIN_CONSOLE
 static void bfin_serial_console_putchar(struct uart_port *port, int ch)
 {
         struct bfin_serial_port *uart = (struct bfin_serial_port *)port;
-        while (!(UART_GET_LSR(uart)))
+        while (!(UART_GET_LSR(uart) & THRE))
                 barrier();
         UART_PUT_CHAR(uart, ch);
         SSYNC();
@@ -868,18 +1017,22 @@ bfin_serial_console_get_options(struct bfin_serial_port *uart, int *baud,
                         case 2: *bits = 7; break;
                         case 3: *bits = 8; break;
                 }
+#ifndef CONFIG_BF54x
                 /* Set DLAB in LCR to Access DLL and DLH */
                 val = UART_GET_LCR(uart);
                 val |= DLAB;
                 UART_PUT_LCR(uart, val);
+#endif
 
                 dll = UART_GET_DLL(uart);
                 dlh = UART_GET_DLH(uart);
 
+#ifndef CONFIG_BF54x
                 /* Clear DLAB in LCR to Access THR RBR IER */
                 val = UART_GET_LCR(uart);
                 val &= ~DLAB;
                 UART_PUT_LCR(uart, val);
+#endif
 
                 *baud = get_sclk() / (16*(dll | dlh << 8));
         }
@@ -931,6 +1084,10 @@ static int __init bfin_serial_rs_console_init(void)
 {
         bfin_serial_init_ports();
         register_console(&bfin_serial_console);
+#ifdef CONFIG_KGDB_UART
+        kgdb_entry_state = 0;
+        init_kgdb_uart();
+#endif
         return 0;
 }
 console_initcall(bfin_serial_rs_console_init);
@@ -1023,6 +1180,10 @@ static struct platform_driver bfin_serial_driver = {
 static int __init bfin_serial_init(void)
 {
         int ret;
+#ifdef CONFIG_KGDB_UART
+        struct bfin_serial_port *uart = &bfin_serial_ports[CONFIG_KGDB_UART_PORT];
+        struct termios t;
+#endif
 
         pr_info("Serial: Blackfin serial driver\n");
 
@@ -1036,6 +1197,21 @@ static int __init bfin_serial_init(void)
                         uart_unregister_driver(&bfin_serial_reg);
                 }
         }
+#ifdef CONFIG_KGDB_UART
+        if (uart->port.cons->index != CONFIG_KGDB_UART_PORT) {
+                request_irq(uart->port.irq, bfin_serial_int,
+                        IRQF_DISABLED, "BFIN_UART_RX", uart);
+                pr_info("Request irq for kgdb uart port\n");
+                UART_PUT_IER(uart, UART_GET_IER(uart) | ERBFI);
+                __builtin_bfin_ssync();
+                t.c_cflag = CS8|B57600;
+                t.c_iflag = 0;
+                t.c_oflag = 0;
+                t.c_lflag = ICANON;
+                t.c_line = CONFIG_KGDB_UART_PORT;
+                bfin_serial_set_termios(&uart->port, &t, &t);
+        }
+#endif
         return ret;
 }
 
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index cf0e663b42ed..85309acb75f6 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -1,7 +1,7 @@
 /*
  *  Driver for NEC VR4100 series Serial Interface Unit.
  *
- *  Copyright (C) 2004-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2004-2007  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
  *
  *  Based on drivers/serial/8250.c, by Russell King.
  *
@@ -25,12 +25,12 @@
 #endif
 
 #include <linux/console.h>
-#include <linux/platform_device.h>
-#include <linux/err.h>
-#include <linux/ioport.h>
+#include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/ioport.h>
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
 #include <linux/serial_reg.h>
@@ -38,11 +38,9 @@
 #include <linux/tty_flip.h>
 
 #include <asm/io.h>
-#include <asm/vr41xx/irq.h>
 #include <asm/vr41xx/siu.h>
 #include <asm/vr41xx/vr41xx.h>
 
-#define SIU_PORTS_MAX   2
 #define SIU_BAUD_BASE   1152000
 #define SIU_MAJOR       204
 #define SIU_MINOR_BASE  82
@@ -60,32 +58,13 @@
  #define IRUSESEL       0x02
  #define SIRSEL         0x01
 
-struct siu_port {
-        unsigned int type;
-        unsigned int irq;
-        unsigned long start;
-};
-
-static const struct siu_port siu_type1_ports[] = {
-        {       .type           = PORT_VR41XX_SIU,
-                .irq            = SIU_IRQ,
-                .start          = 0x0c000000UL,         },
-};
-
-#define SIU_TYPE1_NR_PORTS      (sizeof(siu_type1_ports) / sizeof(struct siu_port))
-
-static const struct siu_port siu_type2_ports[] = {
-        {       .type           = PORT_VR41XX_SIU,
-                .irq            = SIU_IRQ,
-                .start          = 0x0f000800UL,         },
-        {       .type           = PORT_VR41XX_DSIU,
-                .irq            = DSIU_IRQ,
-                .start          = 0x0f000820UL,         },
+static struct uart_port siu_uart_ports[SIU_PORTS_MAX] = {
+        [0 ... SIU_PORTS_MAX-1] = {
+                .lock   = __SPIN_LOCK_UNLOCKED(siu_uart_ports->lock),
+                .irq    = -1,
+        },
 };
 
-#define SIU_TYPE2_NR_PORTS      (sizeof(siu_type2_ports) / sizeof(struct siu_port))
-
-static struct uart_port siu_uart_ports[SIU_PORTS_MAX];
 static uint8_t lsr_break_flag[SIU_PORTS_MAX];
 
 #define siu_read(port, offset)          readb((port)->membase + (offset))
@@ -110,7 +89,6 @@ void vr41xx_select_siu_interface(siu_interface_t interface)
 
         spin_unlock_irqrestore(&port->lock, flags);
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_select_siu_interface);
 
 void vr41xx_use_irda(irda_use_t use)
@@ -132,7 +110,6 @@ void vr41xx_use_irda(irda_use_t use)
 
         spin_unlock_irqrestore(&port->lock, flags);
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_use_irda);
 
 void vr41xx_select_irda_module(irda_module_t module, irda_speed_t speed)
@@ -166,7 +143,6 @@ void vr41xx_select_irda_module(irda_module_t module, irda_speed_t speed)
 
         spin_unlock_irqrestore(&port->lock, flags);
 }
-
 EXPORT_SYMBOL_GPL(vr41xx_select_irda_module);
 
 static inline void siu_clear_fifo(struct uart_port *port)
@@ -177,21 +153,6 @@ static inline void siu_clear_fifo(struct uart_port *port)
         siu_write(port, UART_FCR, 0);
 }
 
-static inline int siu_probe_ports(void)
-{
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                return SIU_TYPE1_NR_PORTS;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                return SIU_TYPE2_NR_PORTS;
-        }
-
-        return 0;
-}
-
 static inline unsigned long siu_port_size(struct uart_port *port)
 {
         switch (port->type) {
@@ -206,21 +167,10 @@ static inline unsigned long siu_port_size(struct uart_port *port)
 
 static inline unsigned int siu_check_type(struct uart_port *port)
 {
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                if (port->line == 0)
-                        return PORT_VR41XX_SIU;
-                break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                if (port->line == 0)
-                        return PORT_VR41XX_SIU;
-                else if (port->line == 1)
-                        return PORT_VR41XX_DSIU;
-                break;
-        }
+        if (port->line == 0)
+                return PORT_VR41XX_SIU;
+        if (port->line == 1 && port->irq != -1)
+                return PORT_VR41XX_DSIU;
 
         return PORT_UNKNOWN;
 }
@@ -751,44 +701,34 @@ static struct uart_ops siu_uart_ops = {
         .verify_port    = siu_verify_port,
 };
 
-static int siu_init_ports(void)
+static int siu_init_ports(struct platform_device *pdev)
 {
-        const struct siu_port *siu;
         struct uart_port *port;
-        int i, num;
+        struct resource *res;
+        int *type = pdev->dev.platform_data;
+        int i;
 
-        switch (current_cpu_data.cputype) {
-        case CPU_VR4111:
-        case CPU_VR4121:
-                siu = siu_type1_ports;
-                break;
-        case CPU_VR4122:
-        case CPU_VR4131:
-        case CPU_VR4133:
-                siu = siu_type2_ports;
-                break;
-        default:
+        if (!type)
                 return 0;
-        }
 
         port = siu_uart_ports;
-        num = siu_probe_ports();
-        for (i = 0; i < num; i++) {
-                spin_lock_init(&port->lock);
-                port->irq = siu->irq;
+        for (i = 0; i < SIU_PORTS_MAX; i++) {
+                port->type = type[i];
+                if (port->type == PORT_UNKNOWN)
+                        continue;
+                port->irq = platform_get_irq(pdev, i);
                 port->uartclk = SIU_BAUD_BASE * 16;
                 port->fifosize = 16;
                 port->regshift = 0;
                 port->iotype = UPIO_MEM;
                 port->flags = UPF_IOREMAP | UPF_BOOT_AUTOCONF;
-                port->type = siu->type;
                 port->line = i;
-                port->mapbase = siu->start;
-                siu++;
+                res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+                port->mapbase = res->start;
                 port++;
         }
 
-        return num;
+        return i;
 }
 
 #ifdef CONFIG_SERIAL_VR41XX_CONSOLE
@@ -883,13 +823,9 @@ static struct console siu_console = {
 static int __devinit siu_console_init(void)
 {
         struct uart_port *port;
-        int num, i;
-
-        num = siu_init_ports();
-        if (num <= 0)
-                return -ENODEV;
+        int i;
 
-        for (i = 0; i < num; i++) {
+        for (i = 0; i < SIU_PORTS_MAX; i++) {
                 port = &siu_uart_ports[i];
                 port->ops = &siu_uart_ops;
         }
@@ -920,7 +856,7 @@ static int __devinit siu_probe(struct platform_device *dev)
         struct uart_port *port;
         int num, i, retval;
 
-        num = siu_init_ports();
+        num = siu_init_ports(dev);
         if (num <= 0)
                 return -ENODEV;
 
@@ -998,8 +934,6 @@ static int siu_resume(struct platform_device *dev)
         return 0;
 }
 
-static struct platform_device *siu_platform_device;
-
 static struct platform_driver siu_device_driver = {
         .probe          = siu_probe,
         .remove         = __devexit_p(siu_remove),
@@ -1013,29 +947,12 @@ static struct platform_driver siu_device_driver = {
 
 static int __init vr41xx_siu_init(void)
 {
-        int retval;
-
-        siu_platform_device = platform_device_alloc("SIU", -1);
-        if (!siu_platform_device)
-                return -ENOMEM;
-
-        retval = platform_device_add(siu_platform_device);
-        if (retval < 0) {
-                platform_device_put(siu_platform_device);
-                return retval;
-        }
-
-        retval = platform_driver_register(&siu_device_driver);
-        if (retval < 0)
-                platform_device_unregister(siu_platform_device);
-
-        return retval;
+        return platform_driver_register(&siu_device_driver);
 }
 
 static void __exit vr41xx_siu_exit(void)
 {
         platform_driver_unregister(&siu_device_driver);
-        platform_device_unregister(siu_platform_device);
 }
 
 module_init(vr41xx_siu_init);
diff --git a/drivers/spi/at25.c b/drivers/spi/at25.c
index 8efa07e8b8c2..e007833cca59 100644
--- a/drivers/spi/at25.c
+++ b/drivers/spi/at25.c
@@ -111,7 +111,8 @@ at25_ee_read(
 }
 
 static ssize_t
-at25_bin_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
+at25_bin_read(struct kobject *kobj, struct bin_attribute *bin_attr,
+              char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
         struct at25_data        *at25;
@@ -236,7 +237,8 @@ at25_ee_write(struct at25_data *at25, char *buf, loff_t off, size_t count)
 }
 
 static ssize_t
-at25_bin_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
+at25_bin_write(struct kobject *kobj, struct bin_attribute *bin_attr,
+               char *buf, loff_t off, size_t count)
 {
         struct device           *dev;
         struct at25_data        *at25;
@@ -314,7 +316,6 @@ static int at25_probe(struct spi_device *spi)
          */
         at25->bin.attr.name = "eeprom";
         at25->bin.attr.mode = S_IRUSR;
-        at25->bin.attr.owner = THIS_MODULE;
         at25->bin.read = at25_bin_read;
 
         at25->bin.size = at25->chip.byte_len;
diff --git a/drivers/tc/zs.c b/drivers/tc/zs.c
index 4fff61b32dcb..ed979f13908a 100644
--- a/drivers/tc/zs.c
+++ b/drivers/tc/zs.c
@@ -136,14 +136,14 @@ struct dec_serial *zs_chain;	/* list of all channels */
 struct tty_struct zs_ttys[NUM_CHANNELS];
 
 #ifdef CONFIG_SERIAL_DEC_CONSOLE
-static struct console sercons;
+static struct console zs_console;
 #endif
 #if defined(CONFIG_SERIAL_DEC_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ) && \
    !defined(MODULE)
 static unsigned long break_pressed; /* break, really ... */
 #endif
 
-static unsigned char zs_init_regs[16] = {
+static unsigned char zs_init_regs[16] __initdata = {
         0,                              /* write 0 */
         0,                              /* write 1 */
         0,                              /* write 2 */
@@ -383,7 +383,7 @@ static void receive_chars(struct dec_serial *info)
 
 #if defined(CONFIG_SERIAL_DEC_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ) && \
    !defined(MODULE)
-                if (break_pressed && info->line == sercons.index) {
+                if (break_pressed && info->line == zs_console.index) {
                         /* Ignore the null char got when BREAK is removed.  */
                         if (ch == 0)
                                 continue;
@@ -446,7 +446,7 @@ static void status_handle(struct dec_serial *info)
         if ((stat & BRK_ABRT) && !(info->read_reg_zero & BRK_ABRT)) {
 #if defined(CONFIG_SERIAL_DEC_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ) && \
    !defined(MODULE)
-                if (info->line == sercons.index) {
+                if (info->line == zs_console.index) {
                         if (!break_pressed)
                                 break_pressed = jiffies;
                 } else
@@ -1557,9 +1557,9 @@ static int rs_open(struct tty_struct *tty, struct file * filp)
         }
 
 #ifdef CONFIG_SERIAL_DEC_CONSOLE
-        if (sercons.cflag && sercons.index == line) {
-                tty->termios->c_cflag = sercons.cflag;
-                sercons.cflag = 0;
+        if (zs_console.cflag && zs_console.index == line) {
+                tty->termios->c_cflag = zs_console.cflag;
+                zs_console.cflag = 0;
                 change_speed(info);
         }
 #endif
@@ -1581,7 +1581,7 @@ static void __init show_serial_version(void)
 /*  Initialize Z8530s zs_channels
  */
 
-static void probe_sccs(void)
+static void __init probe_sccs(void)
 {
         struct dec_serial **pp;
         int i, n, n_chips = 0, n_channels, chip, channel;
@@ -1923,7 +1923,7 @@ static struct tty_driver *serial_console_device(struct console *c, int *index)
  *      - initialize the serial port
  *      Return non-zero if we didn't find a serial port.
  */
-static int serial_console_setup(struct console *co, char *options)
+static int __init serial_console_setup(struct console *co, char *options)
 {
         struct dec_serial *info;
         int baud = 9600;
@@ -2069,7 +2069,7 @@ static int serial_console_setup(struct console *co, char *options)
         return 0;
 }
 
-static struct console sercons = {
+static struct console zs_console = {
         .name           = "ttyS",
         .write          = serial_console_write,
         .device         = serial_console_device,
@@ -2083,7 +2083,7 @@ static struct console sercons = {
  */
 void __init zs_serial_console_init(void)
 {
-        register_console(&sercons);
+        register_console(&zs_console);
 }
 #endif /* ifdef CONFIG_SERIAL_DEC_CONSOLE */
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 24f10a19dbdb..a9cf8b30bccc 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1109,11 +1109,6 @@ void usb_root_hub_lost_power(struct usb_device *rhdev)
 
         dev_warn(&rhdev->dev, "root hub lost power or was reset\n");
 
-        /* Make sure no potential wakeup events get lost,
-         * by forcing the root hub to be resumed.
-         */
-        rhdev->dev.power.prev_state.event = PM_EVENT_ON;
-
         spin_lock_irqsave(&device_state_lock, flags);
         hub = hdev_to_hub(rhdev);
         for (port1 = 1; port1 <= rhdev->maxchild; ++port1) {
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 2ce050193018..2349e71b0083 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -2102,7 +2102,9 @@ static ssize_t radeon_show_one_edid(char *buf, loff_t off, size_t count, const u
 }
 
 
-static ssize_t radeon_show_edid1(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t radeon_show_edid1(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t off, size_t count)
 {
         struct device *dev = container_of(kobj, struct device, kobj);
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -2113,7 +2115,9 @@ static ssize_t radeon_show_edid1(struct kobject *kobj, char *buf, loff_t off, si
 }
 
 
-static ssize_t radeon_show_edid2(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t radeon_show_edid2(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t off, size_t count)
 {
         struct device *dev = container_of(kobj, struct device, kobj);
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -2126,7 +2130,6 @@ static ssize_t radeon_show_edid2(struct kobject *kobj, char *buf, loff_t off, si
 static struct bin_attribute edid1_attr = {
         .attr   = {
                 .name   = "edid1",
-                .owner  = THIS_MODULE,
                 .mode   = 0444,
         },
         .size   = EDID_LENGTH,
@@ -2136,7 +2139,6 @@ static struct bin_attribute edid1_attr = {
 static struct bin_attribute edid2_attr = {
         .attr   = {
                 .name   = "edid2",
-                .owner  = THIS_MODULE,
                 .mode   = 0444,
         },
         .size   = EDID_LENGTH,
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index c65e81ff3578..7e06223bca94 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -172,7 +172,7 @@ static struct class backlight_class = {
 
 #define DECLARE_ATTR(_name,_mode,_show,_store)                  \
 {                                                               \
-        .attr   = { .name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE },  \
+        .attr   = { .name = __stringify(_name), .mode = _mode }, \
         .show   = _show,                                        \
         .store  = _store,                                       \
 }
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 6ef8f0a7a137..648b53c1fdea 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -157,7 +157,7 @@ static struct class lcd_class = {
 
 #define DECLARE_ATTR(_name,_mode,_show,_store)                  \
 {                                                               \
-        .attr   = { .name = __stringify(_name), .mode = _mode, .owner = THIS_MODULE },  \
+        .attr   = { .name = __stringify(_name), .mode = _mode }, \
         .show   = _show,                                        \
         .store  = _store,                                       \
 }
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index 63b85bf81a65..d3b8a6be2916 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -6,7 +6,7 @@ menu "Console display driver support"
 
 config VGA_CONSOLE
         bool "VGA text console" if EMBEDDED || !X86
-        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC && !M68K && !PARISC && !FRV && !ARCH_VERSATILE && !SUPERH
+        depends on !ARCH_ACORN && !ARCH_EBSA110 && !4xx && !8xx && !SPARC && !M68K && !PARISC && !FRV && !ARCH_VERSATILE && !SUPERH && !BFIN
         default y
         help
           Saying Y here will allow you to use Linux in text mode through a
diff --git a/drivers/video/matrox/matroxfb_crtc2.h b/drivers/video/matrox/matroxfb_crtc2.h
index 608e40bb20e9..177177609be7 100644
--- a/drivers/video/matrox/matroxfb_crtc2.h
+++ b/drivers/video/matrox/matroxfb_crtc2.h
@@ -2,8 +2,6 @@
 #define __MATROXFB_CRTC2_H__
 
 #include <linux/ioctl.h>
-#include <linux/i2c.h>
-#include <linux/i2c-algo-bit.h>
 #include "matroxfb_base.h"
 
 struct matroxfb_dh_fb_info {
diff --git a/drivers/w1/slaves/w1_ds2433.c b/drivers/w1/slaves/w1_ds2433.c
index 8ea17a53eed8..cab56005dd49 100644
--- a/drivers/w1/slaves/w1_ds2433.c
+++ b/drivers/w1/slaves/w1_ds2433.c
@@ -91,8 +91,9 @@ static int w1_f23_refresh_block(struct w1_slave *sl, struct w1_f23_data *data,
 }
 #endif  /* CONFIG_W1_SLAVE_DS2433_CRC */
 
-static ssize_t w1_f23_read_bin(struct kobject *kobj, char *buf, loff_t off,
-                               size_t count)
+static ssize_t w1_f23_read_bin(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
 #ifdef CONFIG_W1_SLAVE_DS2433_CRC
@@ -199,8 +200,9 @@ static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
         return 0;
 }
 
-static ssize_t w1_f23_write_bin(struct kobject *kobj, char *buf, loff_t off,
-                                size_t count)
+static ssize_t w1_f23_write_bin(struct kobject *kobj,
+                                struct bin_attribute *bin_attr,
+                                char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
         int addr, len, idx;
@@ -252,7 +254,6 @@ static struct bin_attribute w1_f23_bin_attr = {
         .attr = {
                 .name = "eeprom",
                 .mode = S_IRUGO | S_IWUSR,
-                .owner = THIS_MODULE,
         },
         .size = W1_EEPROM_SIZE,
         .read = w1_f23_read_bin,
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1a6937dc190b..4318935678c5 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -42,13 +42,13 @@ static u8 bad_roms[][9] = {
                                 {}
                         };
 
-static ssize_t w1_therm_read_bin(struct kobject *, char *, loff_t, size_t);
+static ssize_t w1_therm_read_bin(struct kobject *, struct bin_attribute *,
+                                 char *, loff_t, size_t);
 
 static struct bin_attribute w1_therm_bin_attr = {
         .attr = {
                 .name = "w1_slave",
                 .mode = S_IRUGO,
-                .owner = THIS_MODULE,
         },
         .size = W1_SLAVE_DATA_SIZE,
         .read = w1_therm_read_bin,
@@ -159,7 +159,9 @@ static int w1_therm_check_rom(u8 rom[9])
         return 0;
 }
 
-static ssize_t w1_therm_read_bin(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t w1_therm_read_bin(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
         struct w1_master *dev = sl->master;
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 7d6876dbcc96..f5c5b760ed7b 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -105,7 +105,9 @@ static ssize_t w1_slave_read_name(struct device *dev, struct device_attribute *a
         return sprintf(buf, "%s\n", sl->name);
 }
 
-static ssize_t w1_slave_read_id(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t w1_slave_read_id(struct kobject *kobj,
+                                struct bin_attribute *bin_attr,
+                                char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
 
@@ -128,7 +130,6 @@ static struct bin_attribute w1_slave_attr_bin_id = {
       .attr = {
               .name = "id",
               .mode = S_IRUGO,
-              .owner = THIS_MODULE,
       },
       .size = 8,
       .read = w1_slave_read_id,
@@ -136,7 +137,9 @@ static struct bin_attribute w1_slave_attr_bin_id = {
 
 /* Default family */
 
-static ssize_t w1_default_write(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t w1_default_write(struct kobject *kobj,
+                                struct bin_attribute *bin_attr,
+                                char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
 
@@ -153,7 +156,9 @@ out_up:
         return count;
 }
 
-static ssize_t w1_default_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
+static ssize_t w1_default_read(struct kobject *kobj,
+                               struct bin_attribute *bin_attr,
+                               char *buf, loff_t off, size_t count)
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
 
@@ -167,7 +172,6 @@ static struct bin_attribute w1_default_attr = {
       .attr = {
               .name = "rw",
               .mode = S_IRUGO | S_IWUSR,
-              .owner = THIS_MODULE,
       },
       .size = PAGE_SIZE,
       .read = w1_default_read,
diff --git a/drivers/zorro/zorro-sysfs.c b/drivers/zorro/zorro-sysfs.c
index c3ba0ec334c4..9130f1c12c26 100644
--- a/drivers/zorro/zorro-sysfs.c
+++ b/drivers/zorro/zorro-sysfs.c
@@ -49,8 +49,9 @@ static ssize_t zorro_show_resource(struct device *dev, struct device_attribute *
 
 static DEVICE_ATTR(resource, S_IRUGO, zorro_show_resource, NULL);
 
-static ssize_t zorro_read_config(struct kobject *kobj, char *buf, loff_t off,
-                                 size_t count)
+static ssize_t zorro_read_config(struct kobject *kobj,
+                                 struct bin_attribute *bin_attr,
+                                 char *buf, loff_t off, size_t count)
 {
         struct zorro_dev *z = to_zorro_dev(container_of(kobj, struct device,
                                            kobj));
@@ -78,7 +79,6 @@ static struct bin_attribute zorro_config_attr = {
         .attr = {
                 .name = "config",
                 .mode = S_IRUGO | S_IWUSR,
-                .owner = THIS_MODULE
         },
         .size = sizeof(struct ConfigDev),
         .read = zorro_read_config,