405 files changed, 19979 insertions, 5133 deletions

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 6174965d9a4d..f916ddf63938 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -781,7 +781,8 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
         sk_for_each(s, node, head) {
                 vcc = atm_sk(s);
                 if (vcc->dev == dev && vcc->vci == vci &&
-                    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE)
+                    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
+                    test_bit(ATM_VF_READY, &vcc->flags))
                         goto out;
         }
         vcc = NULL;
@@ -907,6 +908,10 @@ static void pclose(struct atm_vcc *vcc)
         clear_bit(ATM_VF_ADDR, &vcc->flags);
         clear_bit(ATM_VF_READY, &vcc->flags);
 
+        /* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
+           tasklet has finished processing any incoming packets (and, more to
+           the point, using the vcc pointer). */
+        tasklet_unlock_wait(&card->tlet);
         return;
 }
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 2bdd8a94ec94..2872e86837b2 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -66,8 +66,7 @@ static ssize_t node_read_meminfo(struct sys_device * dev,
         struct sysinfo i;
 
         si_meminfo_node(&i, nid);
-
-        n = sprintf(buf, "\n"
+        n = sprintf(buf,
                        "Node %d MemTotal:       %8lu kB\n"
                        "Node %d MemFree:        %8lu kB\n"
                        "Node %d MemUsed:        %8lu kB\n"
@@ -78,13 +77,33 @@ static ssize_t node_read_meminfo(struct sys_device * dev,
                        "Node %d Active(file):   %8lu kB\n"
                        "Node %d Inactive(file): %8lu kB\n"
                        "Node %d Unevictable:    %8lu kB\n"
-                       "Node %d Mlocked:        %8lu kB\n"
+                       "Node %d Mlocked:        %8lu kB\n",
+                       nid, K(i.totalram),
+                       nid, K(i.freeram),
+                       nid, K(i.totalram - i.freeram),
+                       nid, K(node_page_state(nid, NR_ACTIVE_ANON) +
+                                node_page_state(nid, NR_ACTIVE_FILE)),
+                       nid, K(node_page_state(nid, NR_INACTIVE_ANON) +
+                                node_page_state(nid, NR_INACTIVE_FILE)),
+                       nid, K(node_page_state(nid, NR_ACTIVE_ANON)),
+                       nid, K(node_page_state(nid, NR_INACTIVE_ANON)),
+                       nid, K(node_page_state(nid, NR_ACTIVE_FILE)),
+                       nid, K(node_page_state(nid, NR_INACTIVE_FILE)),
+                       nid, K(node_page_state(nid, NR_UNEVICTABLE)),
+                       nid, K(node_page_state(nid, NR_MLOCK)));
+
 #ifdef CONFIG_HIGHMEM
+        n += sprintf(buf + n,
                        "Node %d HighTotal:      %8lu kB\n"
                        "Node %d HighFree:       %8lu kB\n"
                        "Node %d LowTotal:       %8lu kB\n"
-                       "Node %d LowFree:        %8lu kB\n"
+                       "Node %d LowFree:        %8lu kB\n",
+                       nid, K(i.totalhigh),
+                       nid, K(i.freehigh),
+                       nid, K(i.totalram - i.totalhigh),
+                       nid, K(i.freeram - i.freehigh));
 #endif
+        n += sprintf(buf + n,
                        "Node %d Dirty:          %8lu kB\n"
                        "Node %d Writeback:      %8lu kB\n"
                        "Node %d FilePages:      %8lu kB\n"
@@ -99,25 +118,6 @@ static ssize_t node_read_meminfo(struct sys_device * dev,
                        "Node %d Slab:           %8lu kB\n"
                        "Node %d SReclaimable:   %8lu kB\n"
                        "Node %d SUnreclaim:     %8lu kB\n",
-                       nid, K(i.totalram),
-                       nid, K(i.freeram),
-                       nid, K(i.totalram - i.freeram),
-                       nid, K(node_page_state(nid, NR_ACTIVE_ANON) +
-                                node_page_state(nid, NR_ACTIVE_FILE)),
-                       nid, K(node_page_state(nid, NR_INACTIVE_ANON) +
-                                node_page_state(nid, NR_INACTIVE_FILE)),
-                       nid, K(node_page_state(nid, NR_ACTIVE_ANON)),
-                       nid, K(node_page_state(nid, NR_INACTIVE_ANON)),
-                       nid, K(node_page_state(nid, NR_ACTIVE_FILE)),
-                       nid, K(node_page_state(nid, NR_INACTIVE_FILE)),
-                       nid, K(node_page_state(nid, NR_UNEVICTABLE)),
-                       nid, K(node_page_state(nid, NR_MLOCK)),
-#ifdef CONFIG_HIGHMEM
-                       nid, K(i.totalhigh),
-                       nid, K(i.freehigh),
-                       nid, K(i.totalram - i.totalhigh),
-                       nid, K(i.freeram - i.freehigh),
-#endif
                        nid, K(node_page_state(nid, NR_FILE_DIRTY)),
                        nid, K(node_page_state(nid, NR_WRITEBACK)),
                        nid, K(node_page_state(nid, NR_FILE_PAGES)),
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 273cee1cc77b..dc9641660605 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -9,6 +9,7 @@ FONTMAPFILE = cp437.uni
 
 obj-y    += mem.o random.o tty_io.o n_tty.o tty_ioctl.o tty_ldisc.o tty_buffer.o tty_port.o
 
+obj-y                           += tty_mutex.o
 obj-$(CONFIG_LEGACY_PTYS)       += pty.o
 obj-$(CONFIG_UNIX98_PTYS)       += pty.o
 obj-y                           += misc.o
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index 4f8d60c25a98..a11c8c9ca3d4 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -1072,7 +1072,7 @@ static int get_serial_info(struct async_struct * info,
         if (!retinfo)
                 return -EFAULT;
         memset(&tmp, 0, sizeof(tmp));
-        lock_kernel();
+        tty_lock();
         tmp.type = state->type;
         tmp.line = state->line;
         tmp.port = state->port;
@@ -1083,7 +1083,7 @@ static int get_serial_info(struct async_struct * info,
         tmp.close_delay = state->close_delay;
         tmp.closing_wait = state->closing_wait;
         tmp.custom_divisor = state->custom_divisor;
-        unlock_kernel();
+        tty_unlock();
         if (copy_to_user(retinfo,&tmp,sizeof(*retinfo)))
                 return -EFAULT;
         return 0;
@@ -1100,14 +1100,14 @@ static int set_serial_info(struct async_struct * info,
         if (copy_from_user(&new_serial,new_info,sizeof(new_serial)))
                 return -EFAULT;
 
-        lock_kernel();
+        tty_lock();
         state = info->state;
         old_state = *state;
   
         change_irq = new_serial.irq != state->irq;
         change_port = (new_serial.port != state->port);
         if(change_irq || change_port || (new_serial.xmit_fifo_size != state->xmit_fifo_size)) {
-          unlock_kernel();
+          tty_unlock();
           return -EINVAL;
         }
   
@@ -1127,7 +1127,7 @@ static int set_serial_info(struct async_struct * info,
         }
 
         if (new_serial.baud_base < 9600) {
-                unlock_kernel();
+                tty_unlock();
                 return -EINVAL;
         }
 
@@ -1163,7 +1163,7 @@ check_and_exit:
                 }
         } else
                 retval = startup(info);
-        unlock_kernel();
+        tty_unlock();
         return retval;
 }
 
@@ -1528,6 +1528,7 @@ static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
 {
         struct async_struct * info = tty->driver_data;
         unsigned long orig_jiffies, char_time;
+        int tty_was_locked = tty_locked();
         int lsr;
 
         if (serial_paranoia_check(info, tty->name, "rs_wait_until_sent"))
@@ -1538,7 +1539,12 @@ static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
 
         orig_jiffies = jiffies;
 
-        lock_kernel();
+        /*
+         * tty_wait_until_sent is called from lots of places,
+         * with or without the BTM.
+         */
+        if (!tty_was_locked)
+                tty_lock();
         /*
          * Set the check interval to be 1/5 of the estimated time to
          * send a single character, and make it at least 1.  The check
@@ -1579,7 +1585,8 @@ static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         __set_current_state(TASK_RUNNING);
-        unlock_kernel();
+        if (!tty_was_locked)
+                tty_unlock();
 #ifdef SERIAL_DEBUG_RS_WAIT_UNTIL_SENT
         printk("lsr = %d (jiff=%lu)...done\n", lsr, jiffies);
 #endif
@@ -1703,7 +1710,9 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
                 printk("block_til_ready blocking: ttys%d, count = %d\n",
                        info->line, state->count);
 #endif
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&info->open_wait, &wait);
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index 555cd93c2ee5..d5fa113afe37 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -67,15 +67,15 @@ static void set_led(char state)
 
 static int briq_panel_open(struct inode *ino, struct file *filep)
 {
-        lock_kernel();
+        tty_lock();
         /* enforce single access, vfd_is_open is protected by BKL */
         if (vfd_is_open) {
-                unlock_kernel();
+                tty_unlock();
                 return -EBUSY;
         }
         vfd_is_open = 1;
 
-        unlock_kernel();
+        tty_unlock();
         return 0;
 }
 
diff --git a/drivers/char/cyclades.c b/drivers/char/cyclades.c
index 9824b4162904..27aad9422332 100644
--- a/drivers/char/cyclades.c
+++ b/drivers/char/cyclades.c
@@ -65,7 +65,6 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
-#include <linux/smp_lock.h>
 #include <linux/major.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
@@ -1608,7 +1607,7 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
          * If the port is the middle of closing, bail out now
          */
         if (tty_hung_up_p(filp) || (info->port.flags & ASYNC_CLOSING)) {
-                wait_event_interruptible(info->port.close_wait,
+                wait_event_interruptible_tty(info->port.close_wait,
                                 !(info->port.flags & ASYNC_CLOSING));
                 return (info->port.flags & ASYNC_HUP_NOTIFY) ? -EAGAIN: -ERESTARTSYS;
         }
@@ -1655,7 +1654,6 @@ static void cy_wait_until_sent(struct tty_struct *tty, int timeout)
                 return;         /* Just in case.... */
 
         orig_jiffies = jiffies;
-        lock_kernel();
         /*
          * Set the check interval to be 1/5 of the estimated time to
          * send a single character, and make it at least 1.  The check
@@ -1702,7 +1700,6 @@ static void cy_wait_until_sent(struct tty_struct *tty, int timeout)
         }
         /* Run one more char cycle */
         msleep_interruptible(jiffies_to_msecs(char_time * 5));
-        unlock_kernel();
 #ifdef CY_DEBUG_WAIT_UNTIL_SENT
         printk(KERN_DEBUG "Clean (jiff=%lu)...done\n", jiffies);
 #endif
@@ -1959,7 +1956,6 @@ static int cy_chars_in_buffer(struct tty_struct *tty)
                 int char_count;
                 __u32 tx_put, tx_get, tx_bufsize;
 
-                lock_kernel();
                 tx_get = readl(&buf_ctrl->tx_get);
                 tx_put = readl(&buf_ctrl->tx_put);
                 tx_bufsize = readl(&buf_ctrl->tx_bufsize);
@@ -1971,7 +1967,6 @@ static int cy_chars_in_buffer(struct tty_struct *tty)
                 printk(KERN_DEBUG "cyc:cy_chars_in_buffer ttyC%d %d\n",
                         info->line, info->xmit_cnt + char_count);
 #endif
-                unlock_kernel();
                 return info->xmit_cnt + char_count;
         }
 #endif                          /* Z_EXT_CHARS_IN_BUFFER */
@@ -2359,17 +2354,22 @@ cy_set_serial_info(struct cyclades_port *info, struct tty_struct *tty,
                 struct serial_struct __user *new_info)
 {
         struct serial_struct new_serial;
+        int ret;
 
         if (copy_from_user(&new_serial, new_info, sizeof(new_serial)))
                 return -EFAULT;
 
+        mutex_lock(&info->port.mutex);
         if (!capable(CAP_SYS_ADMIN)) {
                 if (new_serial.close_delay != info->port.close_delay ||
                                 new_serial.baud_base != info->baud ||
                                 (new_serial.flags & ASYNC_FLAGS &
                                         ~ASYNC_USR_MASK) !=
                                 (info->port.flags & ASYNC_FLAGS & ~ASYNC_USR_MASK))
+                {
+                        mutex_unlock(&info->port.mutex);
                         return -EPERM;
+                }
                 info->port.flags = (info->port.flags & ~ASYNC_USR_MASK) |
                                 (new_serial.flags & ASYNC_USR_MASK);
                 info->baud = new_serial.baud_base;
@@ -2392,10 +2392,12 @@ cy_set_serial_info(struct cyclades_port *info, struct tty_struct *tty,
 check_and_exit:
         if (info->port.flags & ASYNC_INITIALIZED) {
                 cy_set_line_char(info, tty);
-                return 0;
+                ret = 0;
         } else {
-                return cy_startup(info, tty);
+                ret = cy_startup(info, tty);
         }
+        mutex_unlock(&info->port.mutex);
+        return ret;
 }                               /* set_serial_info */
 
 /*
@@ -2438,7 +2440,6 @@ static int cy_tiocmget(struct tty_struct *tty, struct file *file)
 
         card = info->card;
 
-        lock_kernel();
         if (!cy_is_Z(card)) {
                 unsigned long flags;
                 int channel = info->line - card->first_line;
@@ -2478,7 +2479,6 @@ static int cy_tiocmget(struct tty_struct *tty, struct file *file)
                         ((lstatus & C_RS_CTS) ? TIOCM_CTS : 0);
         }
 end:
-        unlock_kernel();
         return result;
 }                               /* cy_tiomget */
 
@@ -2696,7 +2696,6 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
         printk(KERN_DEBUG "cyc:cy_ioctl ttyC%d, cmd = %x arg = %lx\n",
                 info->line, cmd, arg);
 #endif
-        lock_kernel();
 
         switch (cmd) {
         case CYGETMON:
@@ -2817,7 +2816,6 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
         default:
                 ret_val = -ENOIOCTLCMD;
         }
-        unlock_kernel();
 
 #ifdef CY_DEBUG_OTHER
         printk(KERN_DEBUG "cyc:cy_ioctl done\n");
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index 6f5ffe1320f7..d9df46aa0fba 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -36,7 +36,7 @@
 #include <linux/ctype.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
-#include <linux/smp_lock.h>
+#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
@@ -2105,7 +2105,6 @@ static int pc_ioctl(struct tty_struct *tty, struct file *file,
                 break;
         case DIGI_SETAW:
         case DIGI_SETAF:
-                lock_kernel();
                 if (cmd == DIGI_SETAW) {
                         /* Setup an event to indicate when the transmit
                            buffer empties */
@@ -2118,7 +2117,6 @@ static int pc_ioctl(struct tty_struct *tty, struct file *file,
                         if (tty->ldisc->ops->flush_buffer)
                                 tty->ldisc->ops->flush_buffer(tty);
                 }
-                unlock_kernel();
                 /* Fall Thru */
         case DIGI_SETA:
                 if (copy_from_user(&ch->digiext, argp, sizeof(digi_t)))
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 911e1da6def2..07f3ea38b582 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -1486,7 +1486,9 @@ ip2_open( PTTY tty, struct file *pFile )
 
         if ( tty_hung_up_p(pFile) || ( pCh->flags & ASYNC_CLOSING )) {
                 if ( pCh->flags & ASYNC_CLOSING ) {
+                        tty_unlock();
                         schedule();
+                        tty_lock();
                 }
                 if ( tty_hung_up_p(pFile) ) {
                         set_current_state( TASK_RUNNING );
@@ -1548,7 +1550,9 @@ ip2_open( PTTY tty, struct file *pFile )
                         rc = (( pCh->flags & ASYNC_HUP_NOTIFY ) ? -EAGAIN : -ERESTARTSYS);
                         break;
                 }
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state( TASK_RUNNING );
         remove_wait_queue(&pCh->open_wait, &wait);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 094bdc355b1f..ff68e7c34ce7 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2176,6 +2176,14 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         info->io.addr_data = res->start;
 
         info->io.regspacing = DEFAULT_REGSPACING;
+        res = pnp_get_resource(dev,
+                               (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
+                                        IORESOURCE_IO : IORESOURCE_MEM,
+                               1);
+        if (res) {
+                if (res->start > info->io.addr_data)
+                        info->io.regspacing = res->start - info->io.addr_data;
+        }
         info->io.regsize = DEFAULT_REGSPACING;
         info->io.regshift = 0;
 
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 98310e1aae30..c27e9d21fea9 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -124,7 +124,6 @@
 #include <linux/fs.h>
 #include <linux/sched.h>
 #include <linux/serial.h>
-#include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
@@ -872,7 +871,6 @@ static struct tty_port *isicom_find_port(struct tty_struct *tty)
 static int isicom_open(struct tty_struct *tty, struct file *filp)
 {
         struct isi_port *port;
-        struct isi_board *card;
         struct tty_port *tport;
 
         tport = isicom_find_port(tty);
@@ -1118,8 +1116,7 @@ static int isicom_set_serial_info(struct tty_struct *tty,
         if (copy_from_user(&newinfo, info, sizeof(newinfo)))
                 return -EFAULT;
 
-        lock_kernel();
-
+        mutex_lock(&port->port.mutex);
         reconfig_port = ((port->port.flags & ASYNC_SPD_MASK) !=
                 (newinfo.flags & ASYNC_SPD_MASK));
 
@@ -1128,7 +1125,7 @@ static int isicom_set_serial_info(struct tty_struct *tty,
                                 (newinfo.closing_wait != port->port.closing_wait) ||
                                 ((newinfo.flags & ~ASYNC_USR_MASK) !=
                                 (port->port.flags & ~ASYNC_USR_MASK))) {
-                        unlock_kernel();
+                        mutex_unlock(&port->port.mutex);
                         return -EPERM;
                 }
                 port->port.flags = ((port->port.flags & ~ASYNC_USR_MASK) |
@@ -1145,7 +1142,7 @@ static int isicom_set_serial_info(struct tty_struct *tty,
                 isicom_config_port(tty);
                 spin_unlock_irqrestore(&port->card->card_lock, flags);
         }
-        unlock_kernel();
+        mutex_unlock(&port->port.mutex);
         return 0;
 }
 
@@ -1154,7 +1151,7 @@ static int isicom_get_serial_info(struct isi_port *port,
 {
         struct serial_struct out_info;
 
-        lock_kernel();
+        mutex_lock(&port->port.mutex);
         memset(&out_info, 0, sizeof(out_info));
 /*      out_info.type = ? */
         out_info.line = port - isi_ports;
@@ -1164,7 +1161,7 @@ static int isicom_get_serial_info(struct isi_port *port,
 /*      out_info.baud_base = ? */
         out_info.close_delay = port->port.close_delay;
         out_info.closing_wait = port->port.closing_wait;
-        unlock_kernel();
+        mutex_unlock(&port->port.mutex);
         if (copy_to_user(info, &out_info, sizeof(out_info)))
                 return -EFAULT;
         return 0;
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 4e395c956a09..be28391adb79 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -203,9 +203,9 @@ static int		stli_shared;
  *      the board has been detected, and whether it is actually running a slave
  *      or not.
  */
-#define BST_FOUND       0x1
-#define BST_STARTED     0x2
-#define BST_PROBED      0x4
+#define BST_FOUND       0
+#define BST_STARTED     1
+#define BST_PROBED      2
 
 /*
  *      Define the set of port state flags. These are marked for internal
@@ -816,7 +816,7 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
         brdp = stli_brds[brdnr];
         if (brdp == NULL)
                 return -ENODEV;
-        if ((brdp->state & BST_STARTED) == 0)
+        if (!test_bit(BST_STARTED, &brdp->state))
                 return -ENODEV;
         portnr = MINOR2PORT(minordev);
         if (portnr > brdp->nrports)
@@ -954,7 +954,7 @@ static int stli_rawopen(struct stlibrd *brdp, struct stliport *portp, unsigned l
  *      order of opens and closes may not be preserved across shared
  *      memory, so we must wait until it is complete.
  */
-        wait_event_interruptible(portp->raw_wait,
+        wait_event_interruptible_tty(portp->raw_wait,
                         !test_bit(ST_CLOSING, &portp->state));
         if (signal_pending(current)) {
                 return -ERESTARTSYS;
@@ -989,7 +989,7 @@ static int stli_rawopen(struct stlibrd *brdp, struct stliport *portp, unsigned l
         set_bit(ST_OPENING, &portp->state);
         spin_unlock_irqrestore(&brd_lock, flags);
 
-        wait_event_interruptible(portp->raw_wait,
+        wait_event_interruptible_tty(portp->raw_wait,
                         !test_bit(ST_OPENING, &portp->state));
         if (signal_pending(current))
                 rc = -ERESTARTSYS;
@@ -1020,7 +1020,7 @@ static int stli_rawclose(struct stlibrd *brdp, struct stliport *portp, unsigned
  *      occurs on this port.
  */
         if (wait) {
-                wait_event_interruptible(portp->raw_wait,
+                wait_event_interruptible_tty(portp->raw_wait,
                                 !test_bit(ST_CLOSING, &portp->state));
                 if (signal_pending(current)) {
                         return -ERESTARTSYS;
@@ -1052,7 +1052,7 @@ static int stli_rawclose(struct stlibrd *brdp, struct stliport *portp, unsigned
  *      to come back.
  */
         rc = 0;
-        wait_event_interruptible(portp->raw_wait,
+        wait_event_interruptible_tty(portp->raw_wait,
                         !test_bit(ST_CLOSING, &portp->state));
         if (signal_pending(current))
                 rc = -ERESTARTSYS;
@@ -1073,6 +1073,10 @@ static int stli_rawclose(struct stlibrd *brdp, struct stliport *portp, unsigned
 
 static int stli_cmdwait(struct stlibrd *brdp, struct stliport *portp, unsigned long cmd, void *arg, int size, int copyback)
 {
+        /*
+         * no need for wait_event_tty because clearing ST_CMDING cannot block
+         * on BTM
+         */
         wait_event_interruptible(portp->raw_wait,
                         !test_bit(ST_CMDING, &portp->state));
         if (signal_pending(current))
@@ -1846,7 +1850,7 @@ static void stli_portinfo(struct seq_file *m, struct stlibrd *brdp, struct stlip
         rc = stli_portcmdstats(NULL, portp);
 
         uart = "UNKNOWN";
-        if (brdp->state & BST_STARTED) {
+        if (test_bit(BST_STARTED, &brdp->state)) {
                 switch (stli_comstats.hwid) {
                 case 0: uart = "2681"; break;
                 case 1: uart = "SC26198"; break;
@@ -1855,7 +1859,7 @@ static void stli_portinfo(struct seq_file *m, struct stlibrd *brdp, struct stlip
         }
         seq_printf(m, "%d: uart:%s ", portnr, uart);
 
-        if ((brdp->state & BST_STARTED) && (rc >= 0)) {
+        if (test_bit(BST_STARTED, &brdp->state) && rc >= 0) {
                 char sep;
 
                 seq_printf(m, "tx:%d rx:%d", (int) stli_comstats.txtotal,
@@ -2355,7 +2359,7 @@ static void stli_poll(unsigned long arg)
                 brdp = stli_brds[brdnr];
                 if (brdp == NULL)
                         continue;
-                if ((brdp->state & BST_STARTED) == 0)
+                if (!test_bit(BST_STARTED, &brdp->state))
                         continue;
 
                 spin_lock(&brd_lock);
@@ -3140,7 +3144,7 @@ static int stli_initecp(struct stlibrd *brdp)
         }
 
 
-        brdp->state |= BST_FOUND;
+        set_bit(BST_FOUND, &brdp->state);
         return 0;
 err_unmap:
         iounmap(brdp->membase);
@@ -3297,7 +3301,7 @@ static int stli_initonb(struct stlibrd *brdp)
         brdp->panels[0] = brdp->nrports;
 
 
-        brdp->state |= BST_FOUND;
+        set_bit(BST_FOUND, &brdp->state);
         return 0;
 err_unmap:
         iounmap(brdp->membase);
@@ -3407,7 +3411,7 @@ stli_donestartup:
         spin_unlock_irqrestore(&brd_lock, flags);
 
         if (rc == 0)
-                brdp->state |= BST_STARTED;
+                set_bit(BST_STARTED, &brdp->state);
 
         if (! stli_timeron) {
                 stli_timeron++;
@@ -3710,7 +3714,7 @@ static int __devinit stli_pciprobe(struct pci_dev *pdev,
         if (retval)
                 goto err_null;
 
-        brdp->state |= BST_PROBED;
+        set_bit(BST_PROBED, &brdp->state);
         pci_set_drvdata(pdev, brdp);
 
         EBRDENABLE(brdp);
@@ -3841,7 +3845,7 @@ static int __init stli_initbrds(void)
                         brdp = stli_brds[i];
                         if (brdp == NULL)
                                 continue;
-                        if (brdp->state & BST_FOUND) {
+                        if (test_bit(BST_FOUND, &brdp->state)) {
                                 EBRDENABLE(brdp);
                                 brdp->enable = NULL;
                                 brdp->disable = NULL;
@@ -4011,6 +4015,7 @@ static int stli_getbrdstats(combrd_t __user *bp)
                 return -ENODEV;
 
         memset(&stli_brdstats, 0, sizeof(combrd_t));
+
         stli_brdstats.brd = brdp->brdnr;
         stli_brdstats.type = brdp->brdtype;
         stli_brdstats.hwid = 0;
@@ -4076,10 +4081,13 @@ static int stli_portcmdstats(struct tty_struct *tty, struct stliport *portp)
         if (brdp == NULL)
                 return -ENODEV;
 
-        if (brdp->state & BST_STARTED) {
+        mutex_lock(&portp->port.mutex);
+        if (test_bit(BST_STARTED, &brdp->state)) {
                 if ((rc = stli_cmdwait(brdp, portp, A_GETSTATS,
-                    &stli_cdkstats, sizeof(asystats_t), 1)) < 0)
+                    &stli_cdkstats, sizeof(asystats_t), 1)) < 0) {
+                        mutex_unlock(&portp->port.mutex);
                         return rc;
+                }
         } else {
                 memset(&stli_cdkstats, 0, sizeof(asystats_t));
         }
@@ -4124,6 +4132,7 @@ static int stli_portcmdstats(struct tty_struct *tty, struct stliport *portp)
         stli_comstats.modem = stli_cdkstats.dcdcnt;
         stli_comstats.hwid = stli_cdkstats.hwid;
         stli_comstats.signals = stli_mktiocm(stli_cdkstats.signals);
+        mutex_unlock(&portp->port.mutex);
 
         return 0;
 }
@@ -4186,15 +4195,20 @@ static int stli_clrportstats(struct stliport *portp, comstats_t __user *cp)
         if (!brdp)
                 return -ENODEV;
 
-        if (brdp->state & BST_STARTED) {
-                if ((rc = stli_cmdwait(brdp, portp, A_CLEARSTATS, NULL, 0, 0)) < 0)
+        mutex_lock(&portp->port.mutex);
+
+        if (test_bit(BST_STARTED, &brdp->state)) {
+                if ((rc = stli_cmdwait(brdp, portp, A_CLEARSTATS, NULL, 0, 0)) < 0) {
+                        mutex_unlock(&portp->port.mutex);
                         return rc;
+                }
         }
 
         memset(&stli_comstats, 0, sizeof(comstats_t));
         stli_comstats.brd = portp->brdnr;
         stli_comstats.panel = portp->panelnr;
         stli_comstats.port = portp->portnr;
+        mutex_unlock(&portp->port.mutex);
 
         if (copy_to_user(cp, &stli_comstats, sizeof(comstats_t)))
                 return -EFAULT;
@@ -4266,8 +4280,6 @@ static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
         done = 0;
         rc = 0;
 
-        lock_kernel();
-
         switch (cmd) {
         case COM_GETPORTSTATS:
                 rc = stli_getportstats(NULL, NULL, argp);
@@ -4290,8 +4302,6 @@ static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 done++;
                 break;
         }
-        unlock_kernel();
-
         if (done)
                 return rc;
 
@@ -4308,8 +4318,6 @@ static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
         if (brdp->state == 0)
                 return -ENODEV;
 
-        lock_kernel();
-
         switch (cmd) {
         case STL_BINTR:
                 EBRDINTR(brdp);
@@ -4318,10 +4326,10 @@ static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 rc = stli_startbrd(brdp);
                 break;
         case STL_BSTOP:
-                brdp->state &= ~BST_STARTED;
+                clear_bit(BST_STARTED, &brdp->state);
                 break;
         case STL_BRESET:
-                brdp->state &= ~BST_STARTED;
+                clear_bit(BST_STARTED, &brdp->state);
                 EBRDRESET(brdp);
                 if (stli_shared == 0) {
                         if (brdp->reenable != NULL)
@@ -4332,7 +4340,6 @@ static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 rc = -ENOIOCTLCMD;
                 break;
         }
-        unlock_kernel();
         return rc;
 }
 
@@ -4378,7 +4385,8 @@ static void istallion_cleanup_isa(void)
         unsigned int j;
 
         for (j = 0; (j < stli_nrbrds); j++) {
-                if ((brdp = stli_brds[j]) == NULL || (brdp->state & BST_PROBED))
+                if ((brdp = stli_brds[j]) == NULL ||
+                                test_bit(BST_PROBED, &brdp->state))
                         continue;
 
                 stli_cleanup_ports(brdp);
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 25be2102a60a..a7ca75212bfe 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -299,7 +299,7 @@ int kbd_rate(struct kbd_repeat *rep)
  */
 static void put_queue(struct vc_data *vc, int ch)
 {
-        struct tty_struct *tty = vc->vc_tty;
+        struct tty_struct *tty = vc->port.tty;
 
         if (tty) {
                 tty_insert_flip_char(tty, ch, 0);
@@ -309,7 +309,7 @@ static void put_queue(struct vc_data *vc, int ch)
 
 static void puts_queue(struct vc_data *vc, char *cp)
 {
-        struct tty_struct *tty = vc->vc_tty;
+        struct tty_struct *tty = vc->port.tty;
 
         if (!tty)
                 return;
@@ -485,7 +485,7 @@ static void fn_show_ptregs(struct vc_data *vc)
 
 static void fn_hold(struct vc_data *vc)
 {
-        struct tty_struct *tty = vc->vc_tty;
+        struct tty_struct *tty = vc->port.tty;
 
         if (rep || !tty)
                 return;
@@ -563,7 +563,7 @@ static void fn_inc_console(struct vc_data *vc)
 
 static void fn_send_intr(struct vc_data *vc)
 {
-        struct tty_struct *tty = vc->vc_tty;
+        struct tty_struct *tty = vc->port.tty;
 
         if (!tty)
                 return;
@@ -1162,7 +1162,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
         struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
         int rc;
 
-        tty = vc->vc_tty;
+        tty = vc->port.tty;
 
         if (tty && (!tty->driver_data)) {
                 /* No driver data? Strange. Okay we fix it then. */
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index cd650ca8c679..abdafd488980 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -242,7 +242,7 @@ int misc_deregister(struct miscdevice *misc)
 {
         int i = DYNAMIC_MINORS - misc->minor - 1;
 
-        if (list_empty(&misc->list))
+        if (WARN_ON(list_empty(&misc->list)))
                 return -EINVAL;
 
         mutex_lock(&misc_mtx);
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index d2692d443f7b..3fc89da856ae 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -2193,7 +2193,7 @@ static void mxser_transmit_chars(struct tty_struct *tty, struct mxser_port *port
         port->mon_data.up_txcnt += (cnt - port->xmit_cnt);
         port->icount.tx += (cnt - port->xmit_cnt);
 
-        if (port->xmit_cnt < WAKEUP_CHARS && tty)
+        if (port->xmit_cnt < WAKEUP_CHARS)
                 tty_wakeup(tty);
 
         if (port->xmit_cnt <= 0) {
diff --git a/drivers/char/n_gsm.c b/drivers/char/n_gsm.c
index e4089c432f15..099105e0894e 100644
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -43,7 +43,6 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
-#include <linux/timer.h>
 #include <linux/ctype.h>
 #include <linux/mm.h>
 #include <linux/string.h>
diff --git a/drivers/char/n_hdlc.c b/drivers/char/n_hdlc.c
index c68118efad84..47d32281032c 100644
--- a/drivers/char/n_hdlc.c
+++ b/drivers/char/n_hdlc.c
@@ -598,18 +598,18 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                 return -EFAULT;
         }
 
-        lock_kernel();
+        tty_lock();
 
         for (;;) {
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                        unlock_kernel();
+                        tty_unlock();
                         return -EIO;
                 }
 
                 n_hdlc = tty2n_hdlc (tty);
                 if (!n_hdlc || n_hdlc->magic != HDLC_MAGIC ||
                          tty != n_hdlc->tty) {
-                        unlock_kernel();
+                        tty_unlock();
                         return 0;
                 }
 
@@ -619,13 +619,13 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                         
                 /* no data */
                 if (file->f_flags & O_NONBLOCK) {
-                        unlock_kernel();
+                        tty_unlock();
                         return -EAGAIN;
                 }
                         
                 interruptible_sleep_on (&tty->read_wait);
                 if (signal_pending(current)) {
-                        unlock_kernel();
+                        tty_unlock();
                         return -EINTR;
                 }
         }
@@ -648,7 +648,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                 kfree(rbuf);
         else    
                 n_hdlc_buf_put(&n_hdlc->rx_free_buf_list,rbuf);
-        unlock_kernel();
+        tty_unlock();
         return ret;
         
 }       /* end of n_hdlc_tty_read() */
@@ -691,7 +691,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 count = maxframe;
         }
         
-        lock_kernel();
+        tty_lock();
 
         add_wait_queue(&tty->write_wait, &wait);
         set_current_state(TASK_INTERRUPTIBLE);
@@ -731,7 +731,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 n_hdlc_buf_put(&n_hdlc->tx_buf_list,tbuf);
                 n_hdlc_send_frames(n_hdlc,tty);
         }
-        unlock_kernel();
+        tty_unlock();
         return error;
         
 }       /* end of n_hdlc_tty_write() */
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index c1d8b54c816d..a98290d7a2c5 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -1067,7 +1067,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
 
         TRACE_L("read()");
 
-        lock_kernel();
+        tty_lock();
 
         pClient = findClient(pInfo, task_pid(current));
         if (pClient) {
@@ -1079,7 +1079,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                                 goto unlock;
                         }
                         /* block until there is a message: */
-                        wait_event_interruptible(pInfo->read_wait,
+                        wait_event_interruptible_tty(pInfo->read_wait,
                                         (pMsg = remove_msg(pInfo, pClient)));
                 }
 
@@ -1109,7 +1109,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
         }
         ret = -EPERM;
 unlock:
-        unlock_kernel();
+        tty_unlock();
         return ret;
 }
 
@@ -1158,7 +1158,7 @@ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
         pHeader->locks = 0;
         pHeader->owner = NULL;
 
-        lock_kernel();
+        tty_lock();
 
         pClient = findClient(pInfo, task_pid(current));
         if (pClient) {
@@ -1177,7 +1177,7 @@ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
         add_tx_queue(pInfo, pHeader);
         trigger_transmit(pInfo);
 
-        unlock_kernel();
+        tty_unlock();
 
         return 0;
 }
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index bdae8327143c..428f4fe0b5f7 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1102,6 +1102,11 @@ static inline void n_tty_receive_char(struct tty_struct *tty, unsigned char c)
         if (I_IUCLC(tty) && L_IEXTEN(tty))
                 c = tolower(c);
 
+        if (L_EXTPROC(tty)) {
+                put_tty_queue(c, tty);
+                return;
+        }
+
         if (tty->stopped && !tty->flow_stopped && I_IXON(tty) &&
             I_IXANY(tty) && c != START_CHAR(tty) && c != STOP_CHAR(tty) &&
             c != INTR_CHAR(tty) && c != QUIT_CHAR(tty) && c != SUSP_CHAR(tty)) {
@@ -1409,7 +1414,8 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 
         n_tty_set_room(tty);
 
-        if (!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) {
+        if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
+                L_EXTPROC(tty)) {
                 kill_fasync(&tty->fasync, SIGIO, POLL_IN);
                 if (waitqueue_active(&tty->read_wait))
                         wake_up_interruptible(&tty->read_wait);
@@ -1585,7 +1591,7 @@ static int n_tty_open(struct tty_struct *tty)
 static inline int input_available_p(struct tty_struct *tty, int amt)
 {
         tty_flush_to_ldisc(tty);
-        if (tty->icanon) {
+        if (tty->icanon && !L_EXTPROC(tty)) {
                 if (tty->canon_data)
                         return 1;
         } else if (tty->read_cnt >= (amt ? amt : 1))
@@ -1632,6 +1638,11 @@ static int copy_from_read_buf(struct tty_struct *tty,
                 spin_lock_irqsave(&tty->read_lock, flags);
                 tty->read_tail = (tty->read_tail + n) & (N_TTY_BUF_SIZE-1);
                 tty->read_cnt -= n;
+                /* Turn single EOF into zero-length read */
+                if (L_EXTPROC(tty) && tty->icanon && n == 1) {
+                        if (!tty->read_cnt && (*b)[n-1] == EOF_CHAR(tty))
+                                n--;
+                }
                 spin_unlock_irqrestore(&tty->read_lock, flags);
                 *b += n;
                 *nr -= n;
@@ -1812,7 +1823,7 @@ do_it_again:
                         nr--;
                 }
 
-                if (tty->icanon) {
+                if (tty->icanon && !L_EXTPROC(tty)) {
                         /* N.B. avoid overrun if nr == 0 */
                         while (nr && tty->read_cnt) {
                                 int eol;
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index a6638003f530..18af923093c3 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -1611,6 +1611,8 @@ static int ntty_install(struct tty_driver *driver, struct tty_struct *tty)
         ret = tty_init_termios(tty);
         if (ret == 0) {
                 tty_driver_kref_get(driver);
+                tty->count++;
+                tty->driver_data = port;
                 driver->ttys[tty->index] = tty;
         }
         return ret;
@@ -1639,7 +1641,7 @@ static int ntty_activate(struct tty_port *tport, struct tty_struct *tty)
 
 static int ntty_open(struct tty_struct *tty, struct file *filp)
 {
-        struct port *port = get_port_by_tty(tty);
+        struct port *port = tty->driver_data;
         return tty_port_open(&port->port, tty, filp);
 }
 
diff --git a/drivers/char/pcmcia/ipwireless/network.c b/drivers/char/pcmcia/ipwireless/network.c
index 65920163f53d..9fe538347932 100644
--- a/drivers/char/pcmcia/ipwireless/network.c
+++ b/drivers/char/pcmcia/ipwireless/network.c
@@ -239,7 +239,7 @@ static int ipwireless_ppp_ioctl(struct ppp_channel *ppp_channel,
         return err;
 }
 
-static struct ppp_channel_ops ipwireless_ppp_channel_ops = {
+static const struct ppp_channel_ops ipwireless_ppp_channel_ops = {
         .start_xmit = ipwireless_ppp_start_xmit,
         .ioctl      = ipwireless_ppp_ioctl
 };
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index d83a43130df4..ad46eae1f9bb 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -62,7 +62,9 @@ static void pty_close(struct tty_struct *tty, struct file *filp)
                 if (tty->driver == ptm_driver)
                         devpts_pty_kill(tty->link);
 #endif
+                tty_unlock();
                 tty_vhangup(tty->link);
+                tty_lock();
         }
 }
 
@@ -171,6 +173,23 @@ static int pty_set_lock(struct tty_struct *tty, int __user *arg)
         return 0;
 }
 
+/* Send a signal to the slave */
+static int pty_signal(struct tty_struct *tty, int sig)
+{
+        unsigned long flags;
+        struct pid *pgrp;
+
+        if (tty->link) {
+                spin_lock_irqsave(&tty->link->ctrl_lock, flags);
+                pgrp = get_pid(tty->link->pgrp);
+                spin_unlock_irqrestore(&tty->link->ctrl_lock, flags);
+
+                kill_pgrp(pgrp, sig, 1);
+                put_pid(pgrp);
+        }
+        return 0;
+}
+
 static void pty_flush_buffer(struct tty_struct *tty)
 {
         struct tty_struct *to = tty->link;
@@ -321,6 +340,8 @@ static int pty_bsd_ioctl(struct tty_struct *tty, struct file *file,
         switch (cmd) {
         case TIOCSPTLCK: /* Set PT Lock (disallow slave open) */
                 return pty_set_lock(tty, (int __user *) arg);
+        case TIOCSIG:    /* Send signal to other side of pty */
+                return pty_signal(tty, (int) arg);
         }
         return -ENOIOCTLCMD;
 }
@@ -476,6 +497,8 @@ static int pty_unix98_ioctl(struct tty_struct *tty, struct file *file,
                 return pty_set_lock(tty, (int __user *)arg);
         case TIOCGPTN: /* Get PT Number */
                 return put_user(tty->index, (unsigned int __user *)arg);
+        case TIOCSIG:    /* Send signal to other side of pty */
+                return pty_signal(tty, (int) arg);
         }
 
         return -ENOIOCTLCMD;
@@ -626,7 +649,7 @@ static const struct tty_operations pty_unix98_ops = {
  *              allocated_ptys_lock handles the list of free pty numbers
  */
 
-static int __ptmx_open(struct inode *inode, struct file *filp)
+static int ptmx_open(struct inode *inode, struct file *filp)
 {
         struct tty_struct *tty;
         int retval;
@@ -635,11 +658,14 @@ static int __ptmx_open(struct inode *inode, struct file *filp)
         nonseekable_open(inode, filp);
 
         /* find a device that is not in use. */
+        tty_lock();
         index = devpts_new_index(inode);
+        tty_unlock();
         if (index < 0)
                 return index;
 
         mutex_lock(&tty_mutex);
+        tty_lock();
         tty = tty_init_dev(ptm_driver, index, 1);
         mutex_unlock(&tty_mutex);
 
@@ -657,26 +683,21 @@ static int __ptmx_open(struct inode *inode, struct file *filp)
                 goto out1;
 
         retval = ptm_driver->ops->open(tty, filp);
-        if (!retval)
-                return 0;
+        if (retval)
+                goto out2;
 out1:
+        tty_unlock();
+        return retval;
+out2:
+        tty_unlock();
         tty_release(inode, filp);
         return retval;
 out:
         devpts_kill_index(inode, index);
+        tty_unlock();
         return retval;
 }
 
-static int ptmx_open(struct inode *inode, struct file *filp)
-{
-        int ret;
-
-        lock_kernel();
-        ret = __ptmx_open(inode, filp);
-        unlock_kernel();
-        return ret;
-}
-
 static struct file_operations ptmx_fops;
 
 static void __init unix98_pty_init(void)
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index b02332a5412f..af4de1fe8445 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -47,7 +47,6 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/tty_flip.h>
-#include <linux/smp_lock.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 
@@ -1184,6 +1183,7 @@ static int rc_set_serial_info(struct tty_struct *tty, struct riscom_port *port,
         if (copy_from_user(&tmp, newinfo, sizeof(tmp)))
                 return -EFAULT;
 
+        mutex_lock(&port->port.mutex);
         change_speed = ((port->port.flags & ASYNC_SPD_MASK) !=
                         (tmp.flags & ASYNC_SPD_MASK));
 
@@ -1191,8 +1191,10 @@ static int rc_set_serial_info(struct tty_struct *tty, struct riscom_port *port,
                 if ((tmp.close_delay != port->port.close_delay) ||
                     (tmp.closing_wait != port->port.closing_wait) ||
                     ((tmp.flags & ~ASYNC_USR_MASK) !=
-                     (port->port.flags & ~ASYNC_USR_MASK)))
+                     (port->port.flags & ~ASYNC_USR_MASK))) {
+                        mutex_unlock(&port->port.mutex);
                         return -EPERM;
+                }
                 port->port.flags = ((port->port.flags & ~ASYNC_USR_MASK) |
                                (tmp.flags & ASYNC_USR_MASK));
         } else  {
@@ -1208,6 +1210,7 @@ static int rc_set_serial_info(struct tty_struct *tty, struct riscom_port *port,
                 rc_change_speed(tty, bp, port);
                 spin_unlock_irqrestore(&riscom_lock, flags);
         }
+        mutex_unlock(&port->port.mutex);
         return 0;
 }
 
@@ -1220,12 +1223,15 @@ static int rc_get_serial_info(struct riscom_port *port,
         memset(&tmp, 0, sizeof(tmp));
         tmp.type = PORT_CIRRUS;
         tmp.line = port - rc_port;
+
+        mutex_lock(&port->port.mutex);
         tmp.port = bp->base;
         tmp.irq  = bp->irq;
         tmp.flags = port->port.flags;
         tmp.baud_base = (RC_OSCFREQ + CD180_TPC/2) / CD180_TPC;
         tmp.close_delay = port->port.close_delay * HZ/100;
         tmp.closing_wait = port->port.closing_wait * HZ/100;
+        mutex_unlock(&port->port.mutex);
         tmp.xmit_fifo_size = CD180_NFIFO;
         return copy_to_user(retinfo, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
@@ -1242,14 +1248,10 @@ static int rc_ioctl(struct tty_struct *tty, struct file *filp,
 
         switch (cmd) {
         case TIOCGSERIAL:
-                lock_kernel();
                 retval = rc_get_serial_info(port, argp);
-                unlock_kernel();
                 break;
         case TIOCSSERIAL:
-                lock_kernel();
                 retval = rc_set_serial_info(tty, port, argp);
-                unlock_kernel();
                 break;
         default:
                 retval = -ENOIOCTLCMD;
diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
index 0e29a23ec4c5..79c3bc69165a 100644
--- a/drivers/char/rocket.c
+++ b/drivers/char/rocket.c
@@ -73,7 +73,6 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/serial.h>
-#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
@@ -1017,6 +1016,7 @@ static void rp_close(struct tty_struct *tty, struct file *filp)
         if (tty_port_close_start(port, tty, filp) == 0)
                 return;
 
+        mutex_lock(&port->mutex);
         cp = &info->channel;
         /*
          * Before we drop DTR, make sure the UART transmitter
@@ -1060,9 +1060,13 @@ static void rp_close(struct tty_struct *tty, struct file *filp)
                         info->xmit_buf = NULL;
                 }
         }
+        spin_lock_irq(&port->lock);
         info->port.flags &= ~(ASYNC_INITIALIZED | ASYNC_CLOSING | ASYNC_NORMAL_ACTIVE);
         tty->closing = 0;
+        spin_unlock_irq(&port->lock);
+        mutex_unlock(&port->mutex);
         tty_port_tty_set(port, NULL);
+
         wake_up_interruptible(&port->close_wait);
         complete_all(&info->close_wait);
         atomic_dec(&rp_num_ports_open);
@@ -1210,11 +1214,13 @@ static int get_config(struct r_port *info, struct rocket_config __user *retinfo)
         if (!retinfo)
                 return -EFAULT;
         memset(&tmp, 0, sizeof (tmp));
+        mutex_lock(&info->port.mutex);
         tmp.line = info->line;
         tmp.flags = info->flags;
         tmp.close_delay = info->port.close_delay;
         tmp.closing_wait = info->port.closing_wait;
         tmp.port = rcktpt_io_addr[(info->line >> 5) & 3];
+        mutex_unlock(&info->port.mutex);
 
         if (copy_to_user(retinfo, &tmp, sizeof (*retinfo)))
                 return -EFAULT;
@@ -1229,10 +1235,13 @@ static int set_config(struct tty_struct *tty, struct r_port *info,
         if (copy_from_user(&new_serial, new_info, sizeof (new_serial)))
                 return -EFAULT;
 
+        mutex_lock(&info->port.mutex);
         if (!capable(CAP_SYS_ADMIN))
         {
-                if ((new_serial.flags & ~ROCKET_USR_MASK) != (info->flags & ~ROCKET_USR_MASK))
+                if ((new_serial.flags & ~ROCKET_USR_MASK) != (info->flags & ~ROCKET_USR_MASK)) {
+                        mutex_unlock(&info->port.mutex);
                         return -EPERM;
+                }
                 info->flags = ((info->flags & ~ROCKET_USR_MASK) | (new_serial.flags & ROCKET_USR_MASK));
                 configure_r_port(tty, info, NULL);
                 return 0;
@@ -1250,6 +1259,7 @@ static int set_config(struct tty_struct *tty, struct r_port *info,
                 tty->alt_speed = 230400;
         if ((info->flags & ROCKET_SPD_MASK) == ROCKET_SPD_WARP)
                 tty->alt_speed = 460800;
+        mutex_unlock(&info->port.mutex);
 
         configure_r_port(tty, info, NULL);
         return 0;
@@ -1325,8 +1335,6 @@ static int rp_ioctl(struct tty_struct *tty, struct file *file,
         if (cmd != RCKP_GET_PORTS && rocket_paranoia_check(info, "rp_ioctl"))
                 return -ENXIO;
 
-        lock_kernel();
-
         switch (cmd) {
         case RCKP_GET_STRUCT:
                 if (copy_to_user(argp, info, sizeof (struct r_port)))
@@ -1350,7 +1358,6 @@ static int rp_ioctl(struct tty_struct *tty, struct file *file,
         default:
                 ret = -ENOIOCTLCMD;
         }
-        unlock_kernel();
         return ret;
 }
 
@@ -1471,7 +1478,6 @@ static void rp_wait_until_sent(struct tty_struct *tty, int timeout)
                jiffies);
         printk(KERN_INFO "cps=%d...\n", info->cps);
 #endif
-        lock_kernel();
         while (1) {
                 txcnt = sGetTxCnt(cp);
                 if (!txcnt) {
@@ -1499,7 +1505,6 @@ static void rp_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         __set_current_state(TASK_RUNNING);
-        unlock_kernel();
 #ifdef ROCKET_DEBUG_WAIT_UNTIL_SENT
         printk(KERN_INFO "txcnt = %d (jiff=%lu)...done\n", txcnt, jiffies);
 #endif
@@ -1512,6 +1517,7 @@ static void rp_hangup(struct tty_struct *tty)
 {
         CHANNEL_t *cp;
         struct r_port *info = tty->driver_data;
+        unsigned long flags;
 
         if (rocket_paranoia_check(info, "rp_hangup"))
                 return;
@@ -1520,11 +1526,15 @@ static void rp_hangup(struct tty_struct *tty)
         printk(KERN_INFO "rp_hangup of ttyR%d...\n", info->line);
 #endif
         rp_flush_buffer(tty);
-        if (info->port.flags & ASYNC_CLOSING)
+        spin_lock_irqsave(&info->port.lock, flags);
+        if (info->port.flags & ASYNC_CLOSING) {
+                spin_unlock_irqrestore(&info->port.lock, flags);
                 return;
+        }
         if (info->port.count)
                 atomic_dec(&rp_num_ports_open);
         clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]);
+        spin_unlock_irqrestore(&info->port.lock, flags);
 
         tty_port_hangup(&info->port);
 
@@ -1535,7 +1545,7 @@ static void rp_hangup(struct tty_struct *tty)
         sDisCTSFlowCtl(cp);
         sDisTxSoftFlowCtl(cp);
         sClrTxXOFF(cp);
-        info->port.flags &= ~ASYNC_INITIALIZED;
+        clear_bit(ASYNCB_INITIALIZED, &info->port.flags);
 
         wake_up_interruptible(&info->port.open_wait);
 }
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index f97b9e848064..ebae344ce910 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -26,6 +26,7 @@
 #include <linux/selection.h>
 #include <linux/tiocl.h>
 #include <linux/console.h>
+#include <linux/smp_lock.h>
 
 /* Don't take this from <ctype.h>: 011-015 on the screen aren't spaces */
 #define isspace(c)      ((c) == ' ')
@@ -312,12 +313,20 @@ int paste_selection(struct tty_struct *tty)
         struct  tty_ldisc *ld;
         DECLARE_WAITQUEUE(wait, current);
 
+        /* always called with BTM from vt_ioctl */
+        WARN_ON(!tty_locked());
+
         acquire_console_sem();
         poke_blanked_console();
         release_console_sem();
 
-        ld = tty_ldisc_ref_wait(tty);
-        
+        ld = tty_ldisc_ref(tty);
+        if (!ld) {
+                tty_unlock();
+                ld = tty_ldisc_ref_wait(tty);
+                tty_lock();
+        }
+
         add_wait_queue(&vc->paste_wait, &wait);
         while (sel_buffer && sel_buffer_lth > pasted) {
                 set_current_state(TASK_INTERRUPTIBLE);
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index ecbe479c7d68..f646725bd567 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -1505,7 +1505,7 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
         printk("cy_ioctl %s, cmd = %x arg = %lx\n", tty->name, cmd, arg);       /* */
 #endif
 
-        lock_kernel();
+        tty_lock();
 
         switch (cmd) {
         case CYGETMON:
@@ -1561,7 +1561,7 @@ cy_ioctl(struct tty_struct *tty, struct file *file,
         default:
                 ret_val = -ENOIOCTLCMD;
         }
-        unlock_kernel();
+        tty_unlock();
 
 #ifdef SERIAL_DEBUG_OTHER
         printk("cy_ioctl done\n");
@@ -1786,7 +1786,9 @@ block_til_ready(struct tty_struct *tty, struct file *filp,
                        tty->name, info->count);
                 /**/
 #endif
-                    schedule();
+                tty_unlock();
+                schedule();
+                tty_lock();
         }
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&info->open_wait, &wait);
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index 2c24fcdc722a..9f8495b4fc8f 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -1365,7 +1365,9 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
                         retval = -ERESTARTSYS;
                         break;
                 }
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
 
         set_current_state(TASK_RUNNING);
@@ -1863,8 +1865,7 @@ static int sx_set_serial_info(struct specialix_port *port,
                 return -EFAULT;
         }
 
-        lock_kernel();
-
+        mutex_lock(&port->port.mutex);
         change_speed = ((port->port.flags & ASYNC_SPD_MASK) !=
                         (tmp.flags & ASYNC_SPD_MASK));
         change_speed |= (tmp.custom_divisor != port->custom_divisor);
@@ -1875,7 +1876,7 @@ static int sx_set_serial_info(struct specialix_port *port,
                     ((tmp.flags & ~ASYNC_USR_MASK) !=
                      (port->port.flags & ~ASYNC_USR_MASK))) {
                         func_exit();
-                        unlock_kernel();
+                        mutex_unlock(&port->port.mutex);
                         return -EPERM;
                 }
                 port->port.flags = ((port->port.flags & ~ASYNC_USR_MASK) |
@@ -1892,7 +1893,7 @@ static int sx_set_serial_info(struct specialix_port *port,
                 sx_change_speed(bp, port);
 
         func_exit();
-        unlock_kernel();
+        mutex_unlock(&port->port.mutex);
         return 0;
 }
 
@@ -1906,7 +1907,7 @@ static int sx_get_serial_info(struct specialix_port *port,
         func_enter();
 
         memset(&tmp, 0, sizeof(tmp));
-        lock_kernel();
+        mutex_lock(&port->port.mutex);
         tmp.type = PORT_CIRRUS;
         tmp.line = port - sx_port;
         tmp.port = bp->base;
@@ -1917,7 +1918,7 @@ static int sx_get_serial_info(struct specialix_port *port,
         tmp.closing_wait = port->port.closing_wait * HZ/100;
         tmp.custom_divisor =  port->custom_divisor;
         tmp.xmit_fifo_size = CD186x_NFIFO;
-        unlock_kernel();
+        mutex_unlock(&port->port.mutex);
         if (copy_to_user(retinfo, &tmp, sizeof(tmp))) {
                 func_exit();
                 return -EFAULT;
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 6049fd731924..f2167f8e5aab 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -807,7 +807,6 @@ static void stl_waituntilsent(struct tty_struct *tty, int timeout)
                 timeout = HZ;
         tend = jiffies + timeout;
 
-        lock_kernel();
         while (stl_datastate(portp)) {
                 if (signal_pending(current))
                         break;
@@ -815,7 +814,6 @@ static void stl_waituntilsent(struct tty_struct *tty, int timeout)
                 if (time_after_eq(jiffies, tend))
                         break;
         }
-        unlock_kernel();
 }
 
 /*****************************************************************************/
@@ -1029,6 +1027,8 @@ static int stl_getserial(struct stlport *portp, struct serial_struct __user *sp)
         pr_debug("stl_getserial(portp=%p,sp=%p)\n", portp, sp);
 
         memset(&sio, 0, sizeof(struct serial_struct));
+
+        mutex_lock(&portp->port.mutex);
         sio.line = portp->portnr;
         sio.port = portp->ioaddr;
         sio.flags = portp->port.flags;
@@ -1048,6 +1048,7 @@ static int stl_getserial(struct stlport *portp, struct serial_struct __user *sp)
         brdp = stl_brds[portp->brdnr];
         if (brdp != NULL)
                 sio.irq = brdp->irq;
+        mutex_unlock(&portp->port.mutex);
 
         return copy_to_user(sp, &sio, sizeof(struct serial_struct)) ? -EFAULT : 0;
 }
@@ -1069,12 +1070,15 @@ static int stl_setserial(struct tty_struct *tty, struct serial_struct __user *sp
 
         if (copy_from_user(&sio, sp, sizeof(struct serial_struct)))
                 return -EFAULT;
+        mutex_lock(&portp->port.mutex);
         if (!capable(CAP_SYS_ADMIN)) {
                 if ((sio.baud_base != portp->baud_base) ||
                     (sio.close_delay != portp->close_delay) ||
                     ((sio.flags & ~ASYNC_USR_MASK) !=
-                    (portp->port.flags & ~ASYNC_USR_MASK)))
+                    (portp->port.flags & ~ASYNC_USR_MASK))) {
+                        mutex_unlock(&portp->port.mutex);
                         return -EPERM;
+                }
         } 
 
         portp->port.flags = (portp->port.flags & ~ASYNC_USR_MASK) |
@@ -1083,6 +1087,7 @@ static int stl_setserial(struct tty_struct *tty, struct serial_struct __user *sp
         portp->close_delay = sio.close_delay;
         portp->closing_wait = sio.closing_wait;
         portp->custom_divisor = sio.custom_divisor;
+        mutex_unlock(&portp->port.mutex);
         stl_setport(portp, tty->termios);
         return 0;
 }
@@ -1147,8 +1152,6 @@ static int stl_ioctl(struct tty_struct *tty, struct file *file, unsigned int cmd
 
         rc = 0;
 
-        lock_kernel();
-
         switch (cmd) {
         case TIOCGSERIAL:
                 rc = stl_getserial(portp, argp);
@@ -1173,7 +1176,6 @@ static int stl_ioctl(struct tty_struct *tty, struct file *file, unsigned int cmd
                 rc = -ENOIOCTLCMD;
                 break;
         }
-        unlock_kernel();
         return rc;
 }
 
@@ -2327,6 +2329,7 @@ static int stl_getportstats(struct tty_struct *tty, struct stlport *portp, comst
                         return -ENODEV;
         }
 
+        mutex_lock(&portp->port.mutex);
         portp->stats.state = portp->istate;
         portp->stats.flags = portp->port.flags;
         portp->stats.hwid = portp->hwid;
@@ -2358,6 +2361,7 @@ static int stl_getportstats(struct tty_struct *tty, struct stlport *portp, comst
                 (STL_TXBUFSIZE - (tail - head));
 
         portp->stats.signals = (unsigned long) stl_getsignals(portp);
+        mutex_unlock(&portp->port.mutex);
 
         return copy_to_user(cp, &portp->stats,
                             sizeof(comstats_t)) ? -EFAULT : 0;
@@ -2382,10 +2386,12 @@ static int stl_clrportstats(struct stlport *portp, comstats_t __user *cp)
                         return -ENODEV;
         }
 
+        mutex_lock(&portp->port.mutex);
         memset(&portp->stats, 0, sizeof(comstats_t));
         portp->stats.brd = portp->brdnr;
         portp->stats.panel = portp->panelnr;
         portp->stats.port = portp->portnr;
+        mutex_unlock(&portp->port.mutex);
         return copy_to_user(cp, &portp->stats,
                             sizeof(comstats_t)) ? -EFAULT : 0;
 }
@@ -2451,7 +2457,6 @@ static long stl_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 return -ENODEV;
         rc = 0;
 
-        lock_kernel();
         switch (cmd) {
         case COM_GETPORTSTATS:
                 rc = stl_getportstats(NULL, NULL, argp);
@@ -2472,7 +2477,6 @@ static long stl_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 rc = -ENOIOCTLCMD;
                 break;
         }
-        unlock_kernel();
         return rc;
 }
 
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index a81ec4fcf6ff..5b24db4ff7f1 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1699,7 +1699,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
         if (!capable(CAP_SYS_RAWIO))
                 return -EPERM;
 
-        lock_kernel();
+        tty_lock();
 
         sx_dprintk(SX_DEBUG_FIRMWARE, "IOCTL %x: %lx\n", cmd, arg);
 
@@ -1848,7 +1848,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 break;
         }
 out:
-        unlock_kernel();
+        tty_unlock();
         func_exit();
         return rc;
 }
@@ -1859,7 +1859,7 @@ static int sx_break(struct tty_struct *tty, int flag)
         int rv;
 
         func_enter();
-        lock_kernel();
+        tty_lock();
 
         if (flag)
                 rv = sx_send_command(port, HS_START, -1, HS_IDLE_BREAK);
@@ -1868,7 +1868,7 @@ static int sx_break(struct tty_struct *tty, int flag)
         if (rv != 1)
                 printk(KERN_ERR "sx: couldn't send break (%x).\n",
                         read_sx_byte(port->board, CHAN_OFFSET(port, hi_hstat)));
-        unlock_kernel();
+        tty_unlock();
         func_exit();
         return 0;
 }
@@ -1909,7 +1909,7 @@ static int sx_ioctl(struct tty_struct *tty, struct file *filp,
         /* func_enter2(); */
 
         rc = 0;
-        lock_kernel();
+        tty_lock();
         switch (cmd) {
         case TIOCGSERIAL:
                 rc = gs_getserial(&port->gs, argp);
@@ -1921,7 +1921,7 @@ static int sx_ioctl(struct tty_struct *tty, struct file *filp,
                 rc = -ENOIOCTLCMD;
                 break;
         }
-        unlock_kernel();
+        tty_unlock();
 
         /* func_exit(); */
         return rc;
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index 0658fc548222..a2a58004e188 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -81,7 +81,6 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
@@ -2436,7 +2435,9 @@ static int mgsl_get_stats(struct mgsl_struct * info, struct mgsl_icount __user *
         if (!user_icount) {
                 memset(&info->icount, 0, sizeof(info->icount));
         } else {
+                mutex_lock(&info->port.mutex);
                 COPY_TO_USER(err, user_icount, &info->icount, sizeof(struct mgsl_icount));
+                mutex_unlock(&info->port.mutex);
                 if (err)
                         return -EFAULT;
         }
@@ -2461,7 +2462,9 @@ static int mgsl_get_params(struct mgsl_struct * info, MGSL_PARAMS __user *user_p
                 printk("%s(%d):mgsl_get_params(%s)\n",
                          __FILE__,__LINE__, info->device_name);
                         
+        mutex_lock(&info->port.mutex);
         COPY_TO_USER(err,user_params, &info->params, sizeof(MGSL_PARAMS));
+        mutex_unlock(&info->port.mutex);
         if (err) {
                 if ( debug_level >= DEBUG_LEVEL_INFO )
                         printk( "%s(%d):mgsl_get_params(%s) user buffer copy failed\n",
@@ -2501,11 +2504,13 @@ static int mgsl_set_params(struct mgsl_struct * info, MGSL_PARAMS __user *new_pa
                 return -EFAULT;
         }
         
+        mutex_lock(&info->port.mutex);
         spin_lock_irqsave(&info->irq_spinlock,flags);
         memcpy(&info->params,&tmp_params,sizeof(MGSL_PARAMS));
         spin_unlock_irqrestore(&info->irq_spinlock,flags);
         
         mgsl_change_params(info);
+        mutex_unlock(&info->port.mutex);
         
         return 0;
         
@@ -2935,7 +2940,6 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
                     unsigned int cmd, unsigned long arg)
 {
         struct mgsl_struct * info = tty->driver_data;
-        int ret;
         
         if (debug_level >= DEBUG_LEVEL_INFO)
                 printk("%s(%d):mgsl_ioctl %s cmd=%08X\n", __FILE__,__LINE__,
@@ -2950,10 +2954,7 @@ static int mgsl_ioctl(struct tty_struct *tty, struct file * file,
                     return -EIO;
         }
 
-        lock_kernel();
-        ret = mgsl_ioctl_common(info, cmd, arg);
-        unlock_kernel();
-        return ret;
+        return mgsl_ioctl_common(info, cmd, arg);
 }
 
 static int mgsl_ioctl_common(struct mgsl_struct *info, unsigned int cmd, unsigned long arg)
@@ -3109,12 +3110,14 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
 
         if (tty_port_close_start(&info->port, tty, filp) == 0)                   
                 goto cleanup;
-                        
+
+        mutex_lock(&info->port.mutex);
         if (info->port.flags & ASYNC_INITIALIZED)
                 mgsl_wait_until_sent(tty, info->timeout);
         mgsl_flush_buffer(tty);
         tty_ldisc_flush(tty);
         shutdown(info);
+        mutex_unlock(&info->port.mutex);
 
         tty_port_close_end(&info->port, tty);   
         info->port.tty = NULL;
@@ -3162,7 +3165,6 @@ static void mgsl_wait_until_sent(struct tty_struct *tty, int timeout)
          * Note: use tight timings here to satisfy the NIST-PCTS.
          */ 
 
-        lock_kernel();
         if ( info->params.data_rate ) {
                 char_time = info->timeout/(32 * 5);
                 if (!char_time)
@@ -3192,7 +3194,6 @@ static void mgsl_wait_until_sent(struct tty_struct *tty, int timeout)
                                 break;
                 }
         }
-        unlock_kernel();
       
 exit:
         if (debug_level >= DEBUG_LEVEL_INFO)
@@ -3348,7 +3349,9 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
                         printk("%s(%d):block_til_ready blocking on %s count=%d\n",
                                  __FILE__,__LINE__, tty->driver->name, port->count );
                                  
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         
         set_current_state(TASK_RUNNING);
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index 334cf5c8c8b6..fef80cfcab5c 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -40,8 +40,8 @@
 #define DBGBH(fmt) if (debug_level >= DEBUG_LEVEL_BH) printk fmt
 #define DBGISR(fmt) if (debug_level >= DEBUG_LEVEL_ISR) printk fmt
 #define DBGDATA(info, buf, size, label) if (debug_level >= DEBUG_LEVEL_DATA) trace_block((info), (buf), (size), (label))
-//#define DBGTBUF(info) dump_tbufs(info)
-//#define DBGRBUF(info) dump_rbufs(info)
+/*#define DBGTBUF(info) dump_tbufs(info)*/
+/*#define DBGRBUF(info) dump_rbufs(info)*/
 
 
 #include <linux/module.h>
@@ -62,7 +62,6 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
@@ -676,12 +675,14 @@ static int open(struct tty_struct *tty, struct file *filp)
                 goto cleanup;
         }
 
+        mutex_lock(&info->port.mutex);
         info->port.tty->low_latency = (info->port.flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 
         spin_lock_irqsave(&info->netlock, flags);
         if (info->netcount) {
                 retval = -EBUSY;
                 spin_unlock_irqrestore(&info->netlock, flags);
+                mutex_unlock(&info->port.mutex);
                 goto cleanup;
         }
         info->port.count++;
@@ -693,7 +694,7 @@ static int open(struct tty_struct *tty, struct file *filp)
                 if (retval < 0)
                         goto cleanup;
         }
-
+        mutex_unlock(&info->port.mutex);
         retval = block_til_ready(tty, filp, info);
         if (retval) {
                 DBGINFO(("%s block_til_ready rc=%d\n", info->device_name, retval));
@@ -725,12 +726,14 @@ static void close(struct tty_struct *tty, struct file *filp)
         if (tty_port_close_start(&info->port, tty, filp) == 0)
                 goto cleanup;
 
+        mutex_lock(&info->port.mutex);
         if (info->port.flags & ASYNC_INITIALIZED)
                 wait_until_sent(tty, info->timeout);
         flush_buffer(tty);
         tty_ldisc_flush(tty);
 
         shutdown(info);
+        mutex_unlock(&info->port.mutex);
 
         tty_port_close_end(&info->port, tty);
         info->port.tty = NULL;
@@ -741,17 +744,23 @@ cleanup:
 static void hangup(struct tty_struct *tty)
 {
         struct slgt_info *info = tty->driver_data;
+        unsigned long flags;
 
         if (sanity_check(info, tty->name, "hangup"))
                 return;
         DBGINFO(("%s hangup\n", info->device_name));
 
         flush_buffer(tty);
+
+        mutex_lock(&info->port.mutex);
         shutdown(info);
 
+        spin_lock_irqsave(&info->port.lock, flags);
         info->port.count = 0;
         info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
         info->port.tty = NULL;
+        spin_unlock_irqrestore(&info->port.lock, flags);
+        mutex_unlock(&info->port.mutex);
 
         wake_up_interruptible(&info->port.open_wait);
 }
@@ -901,8 +910,6 @@ static void wait_until_sent(struct tty_struct *tty, int timeout)
          * Note: use tight timings here to satisfy the NIST-PCTS.
          */
 
-        lock_kernel();
-
         if (info->params.data_rate) {
                 char_time = info->timeout/(32 * 5);
                 if (!char_time)
@@ -920,8 +927,6 @@ static void wait_until_sent(struct tty_struct *tty, int timeout)
                 if (timeout && time_after(jiffies, orig_jiffies + timeout))
                         break;
         }
-        unlock_kernel();
-
 exit:
         DBGINFO(("%s wait_until_sent exit\n", info->device_name));
 }
@@ -1041,8 +1046,37 @@ static int ioctl(struct tty_struct *tty, struct file *file,
                     return -EIO;
         }
 
-        lock_kernel();
-
+        switch (cmd) {
+        case MGSL_IOCWAITEVENT:
+                return wait_mgsl_event(info, argp);
+        case TIOCMIWAIT:
+                return modem_input_wait(info,(int)arg);
+        case TIOCGICOUNT:
+                spin_lock_irqsave(&info->lock,flags);
+                cnow = info->icount;
+                spin_unlock_irqrestore(&info->lock,flags);
+                p_cuser = argp;
+                if (put_user(cnow.cts, &p_cuser->cts) ||
+                    put_user(cnow.dsr, &p_cuser->dsr) ||
+                    put_user(cnow.rng, &p_cuser->rng) ||
+                    put_user(cnow.dcd, &p_cuser->dcd) ||
+                    put_user(cnow.rx, &p_cuser->rx) ||
+                    put_user(cnow.tx, &p_cuser->tx) ||
+                    put_user(cnow.frame, &p_cuser->frame) ||
+                    put_user(cnow.overrun, &p_cuser->overrun) ||
+                    put_user(cnow.parity, &p_cuser->parity) ||
+                    put_user(cnow.brk, &p_cuser->brk) ||
+                    put_user(cnow.buf_overrun, &p_cuser->buf_overrun))
+                        return -EFAULT;
+                return 0;
+        case MGSL_IOCSGPIO:
+                return set_gpio(info, argp);
+        case MGSL_IOCGGPIO:
+                return get_gpio(info, argp);
+        case MGSL_IOCWAITGPIO:
+                return wait_gpio(info, argp);
+        }
+        mutex_lock(&info->port.mutex);
         switch (cmd) {
         case MGSL_IOCGPARAMS:
                 ret = get_params(info, argp);
@@ -1068,50 +1102,16 @@ static int ioctl(struct tty_struct *tty, struct file *file,
         case MGSL_IOCGSTATS:
                 ret = get_stats(info, argp);
                 break;
-        case MGSL_IOCWAITEVENT:
-                ret = wait_mgsl_event(info, argp);
-                break;
-        case TIOCMIWAIT:
-                ret = modem_input_wait(info,(int)arg);
-                break;
         case MGSL_IOCGIF:
                 ret = get_interface(info, argp);
                 break;
         case MGSL_IOCSIF:
                 ret = set_interface(info,(int)arg);
                 break;
-        case MGSL_IOCSGPIO:
-                ret = set_gpio(info, argp);
-                break;
-        case MGSL_IOCGGPIO:
-                ret = get_gpio(info, argp);
-                break;
-        case MGSL_IOCWAITGPIO:
-                ret = wait_gpio(info, argp);
-                break;
-        case TIOCGICOUNT:
-                spin_lock_irqsave(&info->lock,flags);
-                cnow = info->icount;
-                spin_unlock_irqrestore(&info->lock,flags);
-                p_cuser = argp;
-                if (put_user(cnow.cts, &p_cuser->cts) ||
-                    put_user(cnow.dsr, &p_cuser->dsr) ||
-                    put_user(cnow.rng, &p_cuser->rng) ||
-                    put_user(cnow.dcd, &p_cuser->dcd) ||
-                    put_user(cnow.rx, &p_cuser->rx) ||
-                    put_user(cnow.tx, &p_cuser->tx) ||
-                    put_user(cnow.frame, &p_cuser->frame) ||
-                    put_user(cnow.overrun, &p_cuser->overrun) ||
-                    put_user(cnow.parity, &p_cuser->parity) ||
-                    put_user(cnow.brk, &p_cuser->brk) ||
-                    put_user(cnow.buf_overrun, &p_cuser->buf_overrun))
-                        ret = -EFAULT;
-                ret = 0;
-                break;
         default:
                 ret = -ENOIOCTLCMD;
         }
-        unlock_kernel();
+        mutex_unlock(&info->port.mutex);
         return ret;
 }
 
@@ -3244,7 +3244,9 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
                 }
 
                 DBGINFO(("%s block_til_ready wait\n", tty->driver->name));
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
 
         set_current_state(TASK_RUNNING);
diff --git a/drivers/char/synclinkmp.c b/drivers/char/synclinkmp.c
index 2b18adc4ee19..e56caf7d82aa 100644
--- a/drivers/char/synclinkmp.c
+++ b/drivers/char/synclinkmp.c
@@ -52,7 +52,6 @@
 #include <linux/mm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
@@ -813,13 +812,15 @@ static void close(struct tty_struct *tty, struct file *filp)
 
         if (tty_port_close_start(&info->port, tty, filp) == 0)
                 goto cleanup;
-                
+
+        mutex_lock(&info->port.mutex);
         if (info->port.flags & ASYNC_INITIALIZED)
                 wait_until_sent(tty, info->timeout);
 
         flush_buffer(tty);
         tty_ldisc_flush(tty);
         shutdown(info);
+        mutex_unlock(&info->port.mutex);
 
         tty_port_close_end(&info->port, tty);
         info->port.tty = NULL;
@@ -835,6 +836,7 @@ cleanup:
 static void hangup(struct tty_struct *tty)
 {
         SLMP_INFO *info = tty->driver_data;
+        unsigned long flags;
 
         if (debug_level >= DEBUG_LEVEL_INFO)
                 printk("%s(%d):%s hangup()\n",
@@ -843,12 +845,16 @@ static void hangup(struct tty_struct *tty)
         if (sanity_check(info, tty->name, "hangup"))
                 return;
 
+        mutex_lock(&info->port.mutex);
         flush_buffer(tty);
         shutdown(info);
 
+        spin_lock_irqsave(&info->port.lock, flags);
         info->port.count = 0;
         info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
         info->port.tty = NULL;
+        spin_unlock_irqrestore(&info->port.lock, flags);
+        mutex_unlock(&info->port.mutex);
 
         wake_up_interruptible(&info->port.open_wait);
 }
@@ -1062,9 +1068,7 @@ static void wait_until_sent(struct tty_struct *tty, int timeout)
         if (sanity_check(info, tty->name, "wait_until_sent"))
                 return;
 
-        lock_kernel();
-
-        if (!(info->port.flags & ASYNC_INITIALIZED))
+        if (!test_bit(ASYNCB_INITIALIZED, &info->port.flags))
                 goto exit;
 
         orig_jiffies = jiffies;
@@ -1094,8 +1098,10 @@ static void wait_until_sent(struct tty_struct *tty, int timeout)
                                 break;
                 }
         } else {
-                //TODO: determine if there is something similar to USC16C32
-                //      TXSTATUS_ALL_SENT status
+                /*
+                 * TODO: determine if there is something similar to USC16C32
+                 *       TXSTATUS_ALL_SENT status
+                 */
                 while ( info->tx_active && info->tx_enabled) {
                         msleep_interruptible(jiffies_to_msecs(char_time));
                         if (signal_pending(current))
@@ -1106,7 +1112,6 @@ static void wait_until_sent(struct tty_struct *tty, int timeout)
         }
 
 exit:
-        unlock_kernel();
         if (debug_level >= DEBUG_LEVEL_INFO)
                 printk("%s(%d):%s wait_until_sent() exit\n",
                          __FILE__,__LINE__, info->device_name );
@@ -1122,7 +1127,6 @@ static int write_room(struct tty_struct *tty)
         if (sanity_check(info, tty->name, "write_room"))
                 return 0;
 
-        lock_kernel();
         if (info->params.mode == MGSL_MODE_HDLC) {
                 ret = (info->tx_active) ? 0 : HDLC_MAX_FRAME_SIZE;
         } else {
@@ -1130,7 +1134,6 @@ static int write_room(struct tty_struct *tty)
                 if (ret < 0)
                         ret = 0;
         }
-        unlock_kernel();
 
         if (debug_level >= DEBUG_LEVEL_INFO)
                 printk("%s(%d):%s write_room()=%d\n",
@@ -1251,7 +1254,7 @@ static void tx_release(struct tty_struct *tty)
  *
  * Return Value:        0 if success, otherwise error code
  */
-static int do_ioctl(struct tty_struct *tty, struct file *file,
+static int ioctl(struct tty_struct *tty, struct file *file,
                  unsigned int cmd, unsigned long arg)
 {
         SLMP_INFO *info = tty->driver_data;
@@ -1341,16 +1344,6 @@ static int do_ioctl(struct tty_struct *tty, struct file *file,
         return 0;
 }
 
-static int ioctl(struct tty_struct *tty, struct file *file,
-                 unsigned int cmd, unsigned long arg)
-{
-        int ret;
-        lock_kernel();
-        ret = do_ioctl(tty, file, cmd, arg);
-        unlock_kernel();
-        return ret;
-}
-
 /*
  * /proc fs routines....
  */
@@ -2883,7 +2876,9 @@ static int get_stats(SLMP_INFO * info, struct mgsl_icount __user *user_icount)
         if (!user_icount) {
                 memset(&info->icount, 0, sizeof(info->icount));
         } else {
+                mutex_lock(&info->port.mutex);
                 COPY_TO_USER(err, user_icount, &info->icount, sizeof(struct mgsl_icount));
+                mutex_unlock(&info->port.mutex);
                 if (err)
                         return -EFAULT;
         }
@@ -2898,7 +2893,9 @@ static int get_params(SLMP_INFO * info, MGSL_PARAMS __user *user_params)
                 printk("%s(%d):%s get_params()\n",
                          __FILE__,__LINE__, info->device_name);
 
+        mutex_lock(&info->port.mutex);
         COPY_TO_USER(err,user_params, &info->params, sizeof(MGSL_PARAMS));
+        mutex_unlock(&info->port.mutex);
         if (err) {
                 if ( debug_level >= DEBUG_LEVEL_INFO )
                         printk( "%s(%d):%s get_params() user buffer copy failed\n",
@@ -2926,11 +2923,13 @@ static int set_params(SLMP_INFO * info, MGSL_PARAMS __user *new_params)
                 return -EFAULT;
         }
 
+        mutex_lock(&info->port.mutex);
         spin_lock_irqsave(&info->lock,flags);
         memcpy(&info->params,&tmp_params,sizeof(MGSL_PARAMS));
         spin_unlock_irqrestore(&info->lock,flags);
 
         change_params(info);
+        mutex_unlock(&info->port.mutex);
 
         return 0;
 }
@@ -3366,7 +3365,9 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
                         printk("%s(%d):%s block_til_ready() count=%d\n",
                                  __FILE__,__LINE__, tty->driver->name, port->count );
 
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
 
         set_current_state(TASK_RUNNING);
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 507441ac6edb..0350c42375a2 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -149,6 +149,7 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
 #else
 #define tty_compat_ioctl NULL
 #endif
+static int __tty_fasync(int fd, struct file *filp, int on);
 static int tty_fasync(int fd, struct file *filp, int on);
 static void release_tty(struct tty_struct *tty, int idx);
 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
@@ -470,7 +471,7 @@ void tty_wakeup(struct tty_struct *tty)
 EXPORT_SYMBOL_GPL(tty_wakeup);
 
 /**
- *      do_tty_hangup           -       actual handler for hangup events
+ *      __tty_hangup            -       actual handler for hangup events
  *      @work: tty device
  *
  *      This can be called by the "eventd" kernel thread.  That is process
@@ -483,7 +484,7 @@ EXPORT_SYMBOL_GPL(tty_wakeup);
  *      remains intact.
  *
  *      Locking:
- *              BKL
+ *              BTM
  *                redirect lock for undoing redirection
  *                file list lock for manipulating list of ttys
  *                tty_ldisc_lock from called functions
@@ -491,10 +492,8 @@ EXPORT_SYMBOL_GPL(tty_wakeup);
  *                tasklist_lock to walk task list for hangup event
  *                  ->siglock to protect ->signal/->sighand
  */
-static void do_tty_hangup(struct work_struct *work)
+void __tty_hangup(struct tty_struct *tty)
 {
-        struct tty_struct *tty =
-                container_of(work, struct tty_struct, hangup_work);
         struct file *cons_filp = NULL;
         struct file *filp, *f = NULL;
         struct task_struct *p;
@@ -513,9 +512,12 @@ static void do_tty_hangup(struct work_struct *work)
         }
         spin_unlock(&redirect_lock);
 
-        /* inuse_filps is protected by the single kernel lock */
-        lock_kernel();
-        check_tty_count(tty, "do_tty_hangup");
+        tty_lock();
+
+        /* inuse_filps is protected by the single tty lock,
+           this really needs to change if we want to flush the
+           workqueue with the lock held */
+        check_tty_count(tty, "tty_hangup");
 
         file_list_lock();
         /* This breaks for file handles being sent over AF_UNIX sockets ? */
@@ -525,7 +527,7 @@ static void do_tty_hangup(struct work_struct *work)
                 if (filp->f_op->write != tty_write)
                         continue;
                 closecount++;
-                tty_fasync(-1, filp, 0);        /* can't block */
+                __tty_fasync(-1, filp, 0);      /* can't block */
                 filp->f_op = &hung_up_tty_fops;
         }
         file_list_unlock();
@@ -594,11 +596,21 @@ static void do_tty_hangup(struct work_struct *work)
          */
         set_bit(TTY_HUPPED, &tty->flags);
         tty_ldisc_enable(tty);
-        unlock_kernel();
+
+        tty_unlock();
+
         if (f)
                 fput(f);
 }
 
+static void do_tty_hangup(struct work_struct *work)
+{
+        struct tty_struct *tty =
+                container_of(work, struct tty_struct, hangup_work);
+
+        __tty_hangup(tty);
+}
+
 /**
  *      tty_hangup              -       trigger a hangup event
  *      @tty: tty to hangup
@@ -634,11 +646,12 @@ void tty_vhangup(struct tty_struct *tty)
 
         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
 #endif
-        do_tty_hangup(&tty->hangup_work);
+        __tty_hangup(tty);
 }
 
 EXPORT_SYMBOL(tty_vhangup);
 
+
 /**
  *      tty_vhangup_self        -       process vhangup for own ctty
  *
@@ -696,7 +709,8 @@ static void session_clear_tty(struct pid *session)
  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
  *
  *      Locking:
- *              BKL is taken for hysterical raisins
+ *              BTM is taken for hysterical raisins, and held when
+ *                called from no_tty().
  *                tty_mutex is taken to protect tty
  *                ->siglock is taken to protect ->signal/->sighand
  *                tasklist_lock is taken to walk process list for sessions
@@ -714,10 +728,10 @@ void disassociate_ctty(int on_exit)
         tty = get_current_tty();
         if (tty) {
                 tty_pgrp = get_pid(tty->pgrp);
-                lock_kernel();
-                if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
-                        tty_vhangup(tty);
-                unlock_kernel();
+                if (on_exit) {
+                        if (tty->driver->type != TTY_DRIVER_TYPE_PTY)
+                                tty_vhangup(tty);
+                }
                 tty_kref_put(tty);
         } else if (on_exit) {
                 struct pid *old_pgrp;
@@ -774,9 +788,9 @@ void disassociate_ctty(int on_exit)
 void no_tty(void)
 {
         struct task_struct *tsk = current;
-        lock_kernel();
+        tty_lock();
         disassociate_ctty(0);
-        unlock_kernel();
+        tty_unlock();
         proc_clear_tty(tsk);
 }
 
@@ -879,7 +893,7 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
         struct inode *inode;
         struct tty_ldisc *ld;
 
-        tty = (struct tty_struct *)file->private_data;
+        tty = file->private_data;
         inode = file->f_path.dentry->d_inode;
         if (tty_paranoia_check(tty, inode, "tty_read"))
                 return -EIO;
@@ -1013,19 +1027,19 @@ out:
  * We don't put it into the syslog queue right now maybe in the future if
  * really needed.
  *
- * We must still hold the BKL and test the CLOSING flag for the moment.
+ * We must still hold the BTM and test the CLOSING flag for the moment.
  */
 
 void tty_write_message(struct tty_struct *tty, char *msg)
 {
         if (tty) {
                 mutex_lock(&tty->atomic_write_lock);
-                lock_kernel();
+                tty_lock();
                 if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
-                        unlock_kernel();
+                        tty_unlock();
                         tty->ops->write(tty, msg, strlen(msg));
                 } else
-                        unlock_kernel();
+                        tty_unlock();
                 tty_write_unlock(tty);
         }
         return;
@@ -1056,7 +1070,7 @@ static ssize_t tty_write(struct file *file, const char __user *buf,
         ssize_t ret;
         struct tty_ldisc *ld;
 
-        tty = (struct tty_struct *)file->private_data;
+        tty = file->private_data;
         if (tty_paranoia_check(tty, inode, "tty_write"))
                 return -EIO;
         if (!tty || !tty->ops->write ||
@@ -1208,18 +1222,14 @@ static int tty_driver_install_tty(struct tty_driver *driver,
         int ret;
 
         if (driver->ops->install) {
-                lock_kernel();
                 ret = driver->ops->install(driver, tty);
-                unlock_kernel();
                 return ret;
         }
 
         if (tty_init_termios(tty) == 0) {
-                lock_kernel();
                 tty_driver_kref_get(driver);
                 tty->count++;
                 driver->ttys[idx] = tty;
-                unlock_kernel();
                 return 0;
         }
         return -ENOMEM;
@@ -1312,14 +1322,11 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
         struct tty_struct *tty;
         int retval;
 
-        lock_kernel();
         /* Check if pty master is being opened multiple times */
         if (driver->subtype == PTY_TYPE_MASTER &&
                 (driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok) {
-                unlock_kernel();
                 return ERR_PTR(-EIO);
         }
-        unlock_kernel();
 
         /*
          * First time open is complex, especially for PTY devices.
@@ -1363,9 +1370,7 @@ release_mem_out:
         if (printk_ratelimit())
                 printk(KERN_INFO "tty_init_dev: ldisc open failed, "
                                  "clearing slot %d\n", idx);
-        lock_kernel();
         release_tty(tty, idx);
-        unlock_kernel();
         return ERR_PTR(retval);
 }
 
@@ -1508,14 +1513,14 @@ int tty_release(struct inode *inode, struct file *filp)
         int     idx;
         char    buf[64];
 
-        tty = (struct tty_struct *)filp->private_data;
+        tty = filp->private_data;
         if (tty_paranoia_check(tty, inode, "tty_release_dev"))
                 return 0;
 
-        lock_kernel();
+        tty_lock();
         check_tty_count(tty, "tty_release_dev");
 
-        tty_fasync(-1, filp, 0);
+        __tty_fasync(-1, filp, 0);
 
         idx = tty->index;
         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
@@ -1527,18 +1532,18 @@ int tty_release(struct inode *inode, struct file *filp)
         if (idx < 0 || idx >= tty->driver->num) {
                 printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
                                   "free (%s)\n", tty->name);
-                unlock_kernel();
+                tty_unlock();
                 return 0;
         }
         if (!devpts) {
                 if (tty != tty->driver->ttys[idx]) {
-                        unlock_kernel();
+                        tty_unlock();
                         printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
                                "for (%s)\n", idx, tty->name);
                         return 0;
                 }
                 if (tty->termios != tty->driver->termios[idx]) {
-                        unlock_kernel();
+                        tty_unlock();
                         printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
                                "for (%s)\n",
                                idx, tty->name);
@@ -1556,21 +1561,21 @@ int tty_release(struct inode *inode, struct file *filp)
         if (tty->driver->other &&
              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
                 if (o_tty != tty->driver->other->ttys[idx]) {
-                        unlock_kernel();
+                        tty_unlock();
                         printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
                                           "not o_tty for (%s)\n",
                                idx, tty->name);
                         return 0 ;
                 }
                 if (o_tty->termios != tty->driver->other->termios[idx]) {
-                        unlock_kernel();
+                        tty_unlock();
                         printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
                                           "not o_termios for (%s)\n",
                                idx, tty->name);
                         return 0;
                 }
                 if (o_tty->link != tty) {
-                        unlock_kernel();
+                        tty_unlock();
                         printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
                         return 0;
                 }
@@ -1579,7 +1584,7 @@ int tty_release(struct inode *inode, struct file *filp)
         if (tty->ops->close)
                 tty->ops->close(tty, filp);
 
-        unlock_kernel();
+        tty_unlock();
         /*
          * Sanity check: if tty->count is going to zero, there shouldn't be
          * any waiters on tty->read_wait or tty->write_wait.  We test the
@@ -1602,7 +1607,7 @@ int tty_release(struct inode *inode, struct file *filp)
                    opens on /dev/tty */
 
                 mutex_lock(&tty_mutex);
-                lock_kernel();
+                tty_lock();
                 tty_closing = tty->count <= 1;
                 o_tty_closing = o_tty &&
                         (o_tty->count <= (pty_master ? 1 : 0));
@@ -1633,7 +1638,7 @@ int tty_release(struct inode *inode, struct file *filp)
 
                 printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
                                     "active!\n", tty_name(tty, buf));
-                unlock_kernel();
+                tty_unlock();
                 mutex_unlock(&tty_mutex);
                 schedule();
         }
@@ -1698,7 +1703,7 @@ int tty_release(struct inode *inode, struct file *filp)
 
         /* check whether both sides are closing ... */
         if (!tty_closing || (o_tty && !o_tty_closing)) {
-                unlock_kernel();
+                tty_unlock();
                 return 0;
         }
 
@@ -1718,7 +1723,7 @@ int tty_release(struct inode *inode, struct file *filp)
         /* Make this pty number available for reallocation */
         if (devpts)
                 devpts_kill_index(inode, idx);
-        unlock_kernel();
+        tty_unlock();
         return 0;
 }
 
@@ -1760,12 +1765,12 @@ retry_open:
         retval = 0;
 
         mutex_lock(&tty_mutex);
-        lock_kernel();
+        tty_lock();
 
         if (device == MKDEV(TTYAUX_MAJOR, 0)) {
                 tty = get_current_tty();
                 if (!tty) {
-                        unlock_kernel();
+                        tty_unlock();
                         mutex_unlock(&tty_mutex);
                         return -ENXIO;
                 }
@@ -1797,14 +1802,14 @@ retry_open:
                                 goto got_driver;
                         }
                 }
-                unlock_kernel();
+                tty_unlock();
                 mutex_unlock(&tty_mutex);
                 return -ENODEV;
         }
 
         driver = get_tty_driver(device, &index);
         if (!driver) {
-                unlock_kernel();
+                tty_unlock();
                 mutex_unlock(&tty_mutex);
                 return -ENODEV;
         }
@@ -1814,7 +1819,7 @@ got_driver:
                 tty = tty_driver_lookup_tty(driver, inode, index);
 
                 if (IS_ERR(tty)) {
-                        unlock_kernel();
+                        tty_unlock();
                         mutex_unlock(&tty_mutex);
                         return PTR_ERR(tty);
                 }
@@ -1830,7 +1835,7 @@ got_driver:
         mutex_unlock(&tty_mutex);
         tty_driver_kref_put(driver);
         if (IS_ERR(tty)) {
-                unlock_kernel();
+                tty_unlock();
                 return PTR_ERR(tty);
         }
 
@@ -1860,29 +1865,29 @@ got_driver:
                 printk(KERN_DEBUG "error %d in opening %s...", retval,
                        tty->name);
 #endif
+                tty_unlock(); /* need to call tty_release without BTM */
                 tty_release(inode, filp);
-                if (retval != -ERESTARTSYS) {
-                        unlock_kernel();
+                if (retval != -ERESTARTSYS)
                         return retval;
-                }
-                if (signal_pending(current)) {
-                        unlock_kernel();
+
+                if (signal_pending(current))
                         return retval;
-                }
+
                 schedule();
                 /*
                  * Need to reset f_op in case a hangup happened.
                  */
+                tty_lock();
                 if (filp->f_op == &hung_up_tty_fops)
                         filp->f_op = &tty_fops;
-                unlock_kernel();
+                tty_unlock();
                 goto retry_open;
         }
-        unlock_kernel();
+        tty_unlock();
 
 
         mutex_lock(&tty_mutex);
-        lock_kernel();
+        tty_lock();
         spin_lock_irq(&current->sighand->siglock);
         if (!noctty &&
             current->signal->leader &&
@@ -1890,7 +1895,7 @@ got_driver:
             tty->session == NULL)
                 __proc_set_tty(current, tty);
         spin_unlock_irq(&current->sighand->siglock);
-        unlock_kernel();
+        tty_unlock();
         mutex_unlock(&tty_mutex);
         return 0;
 }
@@ -1915,7 +1920,7 @@ static unsigned int tty_poll(struct file *filp, poll_table *wait)
         struct tty_ldisc *ld;
         int ret = 0;
 
-        tty = (struct tty_struct *)filp->private_data;
+        tty = filp->private_data;
         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
                 return 0;
 
@@ -1926,14 +1931,13 @@ static unsigned int tty_poll(struct file *filp, poll_table *wait)
         return ret;
 }
 
-static int tty_fasync(int fd, struct file *filp, int on)
+static int __tty_fasync(int fd, struct file *filp, int on)
 {
         struct tty_struct *tty;
         unsigned long flags;
         int retval = 0;
 
-        lock_kernel();
-        tty = (struct tty_struct *)filp->private_data;
+        tty = filp->private_data;
         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
                 goto out;
 
@@ -1966,7 +1970,15 @@ static int tty_fasync(int fd, struct file *filp, int on)
         }
         retval = 0;
 out:
-        unlock_kernel();
+        return retval;
+}
+
+static int tty_fasync(int fd, struct file *filp, int on)
+{
+        int retval;
+        tty_lock();
+        retval = __tty_fasync(fd, filp, on);
+        tty_unlock();
         return retval;
 }
 
@@ -2485,7 +2497,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         struct tty_ldisc *ld;
         struct inode *inode = file->f_dentry->d_inode;
 
-        tty = (struct tty_struct *)file->private_data;
+        tty = file->private_data;
         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
                 return -EINVAL;
 
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 6bd5f8866c74..0c1889971459 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -517,19 +517,25 @@ static void change_termios(struct tty_struct *tty, struct ktermios *new_termios)
 
         /* See if packet mode change of state. */
         if (tty->link && tty->link->packet) {
+                int extproc = (old_termios.c_lflag & EXTPROC) |
+                                (tty->termios->c_lflag & EXTPROC);
                 int old_flow = ((old_termios.c_iflag & IXON) &&
                                 (old_termios.c_cc[VSTOP] == '\023') &&
                                 (old_termios.c_cc[VSTART] == '\021'));
                 int new_flow = (I_IXON(tty) &&
                                 STOP_CHAR(tty) == '\023' &&
                                 START_CHAR(tty) == '\021');
-                if (old_flow != new_flow) {
+                if ((old_flow != new_flow) || extproc) {
                         spin_lock_irqsave(&tty->ctrl_lock, flags);
-                        tty->ctrl_status &= ~(TIOCPKT_DOSTOP | TIOCPKT_NOSTOP);
-                        if (new_flow)
-                                tty->ctrl_status |= TIOCPKT_DOSTOP;
-                        else
-                                tty->ctrl_status |= TIOCPKT_NOSTOP;
+                        if (old_flow != new_flow) {
+                                tty->ctrl_status &= ~(TIOCPKT_DOSTOP | TIOCPKT_NOSTOP);
+                                if (new_flow)
+                                        tty->ctrl_status |= TIOCPKT_DOSTOP;
+                                else
+                                        tty->ctrl_status |= TIOCPKT_NOSTOP;
+                        }
+                        if (extproc)
+                                tty->ctrl_status |= TIOCPKT_IOCTL;
                         spin_unlock_irqrestore(&tty->ctrl_lock, flags);
                         wake_up_interruptible(&tty->link->read_wait);
                 }
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 500e740ec5e4..412f9775d19c 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -440,6 +440,8 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
  *
  *      A helper opening method. Also a convenient debugging and check
  *      point.
+ *
+ *      Locking: always called with BTM already held.
  */
 
 static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
@@ -447,10 +449,9 @@ static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
         WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
         if (ld->ops->open) {
                 int ret;
-                /* BKL here locks verus a hangup event */
-                lock_kernel();
+                /* BTM here locks versus a hangup event */
+                WARN_ON(!tty_locked());
                 ret = ld->ops->open(tty);
-                unlock_kernel();
                 return ret;
         }
         return 0;
@@ -553,7 +554,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         if (IS_ERR(new_ldisc))
                 return PTR_ERR(new_ldisc);
 
-        lock_kernel();
+        tty_lock();
         /*
          *      We need to look at the tty locking here for pty/tty pairs
          *      when both sides try to change in parallel.
@@ -567,12 +568,12 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
          */
 
         if (tty->ldisc->ops->num == ldisc) {
-                unlock_kernel();
+                tty_unlock();
                 tty_ldisc_put(new_ldisc);
                 return 0;
         }
 
-        unlock_kernel();
+        tty_unlock();
         /*
          *      Problem: What do we do if this blocks ?
          *      We could deadlock here
@@ -580,6 +581,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         tty_wait_until_sent(tty, 0);
 
+        tty_lock();
         mutex_lock(&tty->ldisc_mutex);
 
         /*
@@ -589,13 +591,13 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         while (test_bit(TTY_LDISC_CHANGING, &tty->flags)) {
                 mutex_unlock(&tty->ldisc_mutex);
+                tty_unlock();
                 wait_event(tty_ldisc_wait,
                         test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
+                tty_lock();
                 mutex_lock(&tty->ldisc_mutex);
         }
 
-        lock_kernel();
-
         set_bit(TTY_LDISC_CHANGING, &tty->flags);
 
         /*
@@ -607,7 +609,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         o_ldisc = tty->ldisc;
 
-        unlock_kernel();
+        tty_unlock();
         /*
          *      Make sure we don't change while someone holds a
          *      reference to the line discipline. The TTY_LDISC bit
@@ -632,15 +634,15 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 
         flush_scheduled_work();
 
+        tty_lock();
         mutex_lock(&tty->ldisc_mutex);
-        lock_kernel();
         if (test_bit(TTY_HUPPED, &tty->flags)) {
                 /* We were raced by the hangup method. It will have stomped
                    the ldisc data and closed the ldisc down */
                 clear_bit(TTY_LDISC_CHANGING, &tty->flags);
                 mutex_unlock(&tty->ldisc_mutex);
                 tty_ldisc_put(new_ldisc);
-                unlock_kernel();
+                tty_unlock();
                 return -EIO;
         }
 
@@ -682,7 +684,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
         if (o_work)
                 schedule_delayed_work(&o_tty->buf.work, 1);
         mutex_unlock(&tty->ldisc_mutex);
-        unlock_kernel();
+        tty_unlock();
         return retval;
 }
 
@@ -780,7 +782,20 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          * Avoid racing set_ldisc or tty_ldisc_release
          */
         mutex_lock(&tty->ldisc_mutex);
-        tty_ldisc_halt(tty);
+
+        /*
+         * this is like tty_ldisc_halt, but we need to give up
+         * the BTM before calling cancel_delayed_work_sync,
+         * which may need to wait for another function taking the BTM
+         */
+        clear_bit(TTY_LDISC, &tty->flags);
+        tty_unlock();
+        cancel_delayed_work_sync(&tty->buf.work);
+        mutex_unlock(&tty->ldisc_mutex);
+
+        tty_lock();
+        mutex_lock(&tty->ldisc_mutex);
+
         /* At this point we have a closed ldisc and we want to
            reopen it. We could defer this to the next open but
            it means auditing a lot of other paths so this is
@@ -851,8 +866,10 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
          * race with the set_ldisc code path.
          */
 
+        tty_unlock();
         tty_ldisc_halt(tty);
         flush_scheduled_work();
+        tty_lock();
 
         mutex_lock(&tty->ldisc_mutex);
         /*
diff --git a/drivers/char/tty_mutex.c b/drivers/char/tty_mutex.c
new file mode 100644
index 000000000000..133697540c73
--- /dev/null
+++ b/drivers/char/tty_mutex.c
@@ -0,0 +1,47 @@
+/*
+ * drivers/char/tty_lock.c
+ */
+#include <linux/tty.h>
+#include <linux/module.h>
+#include <linux/kallsyms.h>
+#include <linux/semaphore.h>
+#include <linux/sched.h>
+
+/*
+ * The 'big tty mutex'
+ *
+ * This mutex is taken and released by tty_lock() and tty_unlock(),
+ * replacing the older big kernel lock.
+ * It can no longer be taken recursively, and does not get
+ * released implicitly while sleeping.
+ *
+ * Don't use in new code.
+ */
+static DEFINE_MUTEX(big_tty_mutex);
+struct task_struct *__big_tty_mutex_owner;
+EXPORT_SYMBOL_GPL(__big_tty_mutex_owner);
+
+/*
+ * Getting the big tty mutex.
+ */
+void __lockfunc tty_lock(void)
+{
+        struct task_struct *task = current;
+
+        WARN_ON(__big_tty_mutex_owner == task);
+
+        mutex_lock(&big_tty_mutex);
+        __big_tty_mutex_owner = task;
+}
+EXPORT_SYMBOL(tty_lock);
+
+void __lockfunc tty_unlock(void)
+{
+        struct task_struct *task = current;
+
+        WARN_ON(__big_tty_mutex_owner != task);
+        __big_tty_mutex_owner = NULL;
+
+        mutex_unlock(&big_tty_mutex);
+}
+EXPORT_SYMBOL(tty_unlock);
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index a3bd1d0b66cf..33d37d230f8f 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -231,7 +231,7 @@ int tty_port_block_til_ready(struct tty_port *port,
 
         /* block if port is in the process of being closed */
         if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
-                wait_event_interruptible(port->close_wait,
+                wait_event_interruptible_tty(port->close_wait,
                                 !(port->flags & ASYNC_CLOSING));
                 if (port->flags & ASYNC_HUP_NOTIFY)
                         return -EAGAIN;
@@ -294,7 +294,9 @@ int tty_port_block_til_ready(struct tty_port *port,
                         retval = -ERESTARTSYS;
                         break;
                 }
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         finish_wait(&port->open_wait, &wait);
 
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index c1791a63d99d..bcce46c96b88 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -463,10 +463,10 @@ vcs_open(struct inode *inode, struct file *filp)
         unsigned int currcons = iminor(inode) & 127;
         int ret = 0;
         
-        lock_kernel();
+        tty_lock();
         if(currcons && !vc_cons_allocated(currcons-1))
                 ret = -ENXIO;
-        unlock_kernel();
+        tty_unlock();
         return ret;
 }
 
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 4a9eb3044e52..c734f9b1263a 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -105,6 +105,7 @@
 #include <asm/system.h>
 #include <linux/uaccess.h>
 #include <linux/kdb.h>
+#include <linux/ctype.h>
 
 #define MAX_NR_CON_DRIVER 16
 
@@ -286,8 +287,12 @@ static inline unsigned short *screenpos(struct vc_data *vc, int offset, int view
         return p;
 }
 
+/* Called  from the keyboard irq path.. */
 static inline void scrolldelta(int lines)
 {
+        /* FIXME */
+        /* scrolldelta needs some kind of consistency lock, but the BKL was
+           and still is not protecting versus the scheduled back end */
         scrollback_delta += lines;
         schedule_console_callback();
 }
@@ -704,7 +709,10 @@ void redraw_screen(struct vc_data *vc, int is_switch)
                         update_attr(vc);
                         clear_buffer_attributes(vc);
                 }
-                if (update && vc->vc_mode != KD_GRAPHICS)
+
+                /* Forcibly update if we're panicing */
+                if ((update && vc->vc_mode != KD_GRAPHICS) ||
+                    vt_force_oops_output(vc))
                         do_update_region(vc, vc->vc_origin, vc->vc_screenbuf_size / 2);
         }
         set_cursor(vc);
@@ -742,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init)
         vc->vc_hi_font_mask = 0;
         vc->vc_complement_mask = 0;
         vc->vc_can_do_color = 0;
+        vc->vc_panic_force_write = false;
         vc->vc_sw->con_init(vc, init);
         if (!vc->vc_complement_mask)
                 vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
@@ -774,6 +783,7 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
             if (!vc)
                 return -ENOMEM;
             vc_cons[currcons].d = vc;
+            tty_port_init(&vc->port);
             INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
             visual_init(vc, currcons, 1);
             if (!*vc->vc_uni_pagedir_loc)
@@ -837,9 +847,10 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
                                 unsigned int cols, unsigned int lines)
 {
         unsigned long old_origin, new_origin, new_scr_end, rlth, rrem, err = 0;
+        unsigned long end;
         unsigned int old_cols, old_rows, old_row_size, old_screen_size;
         unsigned int new_cols, new_rows, new_row_size, new_screen_size;
-        unsigned int end, user;
+        unsigned int user;
         unsigned short *newscreen;
 
         WARN_CONSOLE_UNLOCKED();
@@ -962,12 +973,12 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
  *      Resize a virtual console as seen from the console end of things. We
  *      use the common vc_do_resize methods to update the structures. The
  *      caller must hold the console sem to protect console internals and
- *      vc->vc_tty
+ *      vc->port.tty
  */
 
 int vc_resize(struct vc_data *vc, unsigned int cols, unsigned int rows)
 {
-        return vc_do_resize(vc->vc_tty, vc, cols, rows);
+        return vc_do_resize(vc->port.tty, vc, cols, rows);
 }
 
 /**
@@ -1795,8 +1806,8 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
                         vc->vc_state = ESnormal;
                 return;
         case ESpalette:
-                if ( (c>='0'&&c<='9') || (c>='A'&&c<='F') || (c>='a'&&c<='f') ) {
-                        vc->vc_par[vc->vc_npar++] = (c > '9' ? (c & 0xDF) - 'A' + 10 : c - '0');
+                if (isxdigit(c)) {
+                        vc->vc_par[vc->vc_npar++] = hex_to_bin(c);
                         if (vc->vc_npar == 7) {
                                 int i = vc->vc_par[0] * 3, j = 1;
                                 vc->vc_palette[i] = 16 * vc->vc_par[j++];
@@ -2504,7 +2515,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
                 goto quit;
         }
 
-        if (vc->vc_mode != KD_TEXT)
+        if (vc->vc_mode != KD_TEXT && !vt_force_oops_output(vc))
                 goto quit;
 
         /* undraw cursor first */
@@ -2610,8 +2621,6 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                 return -EFAULT;
         ret = 0;
 
-        lock_kernel();
-
         switch (type)
         {
                 case TIOCL_SETSEL:
@@ -2686,7 +2695,6 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                         ret = -EINVAL;
                         break;
         }
-        unlock_kernel();
         return ret;
 }
 
@@ -2799,12 +2807,12 @@ static int con_open(struct tty_struct *tty, struct file *filp)
                         struct vc_data *vc = vc_cons[currcons].d;
 
                         /* Still being freed */
-                        if (vc->vc_tty) {
+                        if (vc->port.tty) {
                                 release_console_sem();
                                 return -ERESTARTSYS;
                         }
                         tty->driver_data = vc;
-                        vc->vc_tty = tty;
+                        vc->port.tty = tty;
 
                         if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
                                 tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
@@ -2832,7 +2840,7 @@ static void con_shutdown(struct tty_struct *tty)
         struct vc_data *vc = tty->driver_data;
         BUG_ON(vc == NULL);
         acquire_console_sem();
-        vc->vc_tty = NULL;
+        vc->port.tty = NULL;
         release_console_sem();
         tty_shutdown(tty);
 }
@@ -2914,6 +2922,7 @@ static int __init con_init(void)
         for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
                 vc_cons[currcons].d = vc = kzalloc(sizeof(struct vc_data), GFP_NOWAIT);
                 INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
+                tty_port_init(&vc->port);
                 visual_init(vc, currcons, 1);
                 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT);
                 vc_init(vc, vc->vc_rows, vc->vc_cols,
@@ -3065,7 +3074,8 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
 
                 old_was_color = vc->vc_can_do_color;
                 vc->vc_sw->con_deinit(vc);
-                vc->vc_origin = (unsigned long)vc->vc_screenbuf;
+                if (!vc->vc_origin)
+                        vc->vc_origin = (unsigned long)vc->vc_screenbuf;
                 visual_init(vc, i, 0);
                 set_origin(vc);
                 update_attr(vc);
@@ -3781,7 +3791,8 @@ void do_unblank_screen(int leaving_gfx)
                 return;
         }
         vc = vc_cons[fg_console].d;
-        if (vc->vc_mode != KD_TEXT)
+        /* Try to unblank in oops case too */
+        if (vc->vc_mode != KD_TEXT && !vt_force_oops_output(vc))
                 return; /* but leave console_blanked != 0 */
 
         if (blankinterval) {
@@ -3790,7 +3801,7 @@ void do_unblank_screen(int leaving_gfx)
         }
 
         console_blanked = 0;
-        if (vc->vc_sw->con_blank(vc, 0, leaving_gfx))
+        if (vc->vc_sw->con_blank(vc, 0, leaving_gfx) || vt_force_oops_output(vc))
                 /* Low-level driver cannot restore -> do it ourselves */
                 update_screen(vc);
         if (console_blank_hook)
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index cb19dbc52136..2bbeaaea46e9 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -133,7 +133,7 @@ static void vt_event_wait(struct vt_event_wait *vw)
         list_add(&vw->list, &vt_events);
         spin_unlock_irqrestore(&vt_event_lock, flags);
         /* Wait for it to pass */
-        wait_event_interruptible(vt_event_waitqueue, vw->done);
+        wait_event_interruptible_tty(vt_event_waitqueue, vw->done);
         /* Dequeue it */
         spin_lock_irqsave(&vt_event_lock, flags);
         list_del(&vw->list);
@@ -509,7 +509,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
 
         console = vc->vc_num;
 
-        lock_kernel();
+        tty_lock();
 
         if (!vc_cons_allocated(console)) {      /* impossible? */
                 ret = -ENOIOCTLCMD;
@@ -1336,7 +1336,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 ret = -ENOIOCTLCMD;
         }
 out:
-        unlock_kernel();
+        tty_unlock();
         return ret;
 eperm:
         ret = -EPERM;
@@ -1369,7 +1369,7 @@ void vc_SAK(struct work_struct *work)
         acquire_console_sem();
         vc = vc_con->d;
         if (vc) {
-                tty = vc->vc_tty;
+                tty = vc->port.tty;
                 /*
                  * SAK should also work in all raw modes and reset
                  * them properly.
@@ -1503,7 +1503,7 @@ long vt_compat_ioctl(struct tty_struct *tty, struct file * file,
 
         console = vc->vc_num;
 
-        lock_kernel();
+        tty_lock();
 
         if (!vc_cons_allocated(console)) {      /* impossible? */
                 ret = -ENOIOCTLCMD;
@@ -1571,11 +1571,11 @@ long vt_compat_ioctl(struct tty_struct *tty, struct file * file,
                 goto fallback;
         }
 out:
-        unlock_kernel();
+        tty_unlock();
         return ret;
 
 fallback:
-        unlock_kernel();
+        tty_unlock();
         return vt_ioctl(tty, file, cmd, arg);
 }
 
@@ -1761,10 +1761,13 @@ int vt_move_to_console(unsigned int vt, int alloc)
                 return -EIO;
         }
         release_console_sem();
+        tty_lock();
         if (vt_waitactive(vt + 1)) {
                 pr_debug("Suspend: Can't switch VCs.");
+                tty_unlock();
                 return -EINTR;
         }
+        tty_unlock();
         return prev;
 }
 
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index dbefe15bd582..a50710843378 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -74,6 +74,17 @@ static void cpuidle_idle_call(void)
          */
         hrtimer_peek_ahead_timers();
 #endif
+
+        /*
+         * Call the device's prepare function before calling the
+         * governor's select function.  ->prepare gives the device's
+         * cpuidle driver a chance to update any dynamic information
+         * of its cpuidle states for the current idle period, e.g.
+         * state availability, latencies, residencies, etc.
+         */
+        if (dev->prepare)
+                dev->prepare(dev);
+
         /* ask the governor for the next state */
         next_state = cpuidle_curr_governor->select(dev);
         if (need_resched()) {
@@ -282,6 +293,26 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
 
         poll_idle_init(dev);
 
+        /*
+         * cpuidle driver should set the dev->power_specified bit
+         * before registering the device if the driver provides
+         * power_usage numbers.
+         *
+         * For those devices whose ->power_specified is not set,
+         * we fill in power_usage with decreasing values as the
+         * cpuidle code has an implicit assumption that state Cn
+         * uses less power than C(n-1).
+         *
+         * With CONFIG_ARCH_HAS_CPU_RELAX, C0 is already assigned
+         * an power value of -1.  So we use -2, -3, etc, for other
+         * c-states.
+         */
+        if (!dev->power_specified) {
+                int i;
+                for (i = CPUIDLE_DRIVER_STATE_START; i < dev->state_count; i++)
+                        dev->states[i].power_usage = -1 - i;
+        }
+
         per_cpu(cpuidle_devices, dev->cpu) = dev;
         list_add(&dev->device_list, &cpuidle_detected_devices);
         if ((ret = cpuidle_add_sysfs(sys_dev))) {
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 1b128702d300..c2408bbe9c2e 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -234,6 +234,7 @@ static int menu_select(struct cpuidle_device *dev)
 {
         struct menu_device *data = &__get_cpu_var(menu_devices);
         int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
+        unsigned int power_usage = -1;
         int i;
         int multiplier;
 
@@ -278,19 +279,27 @@ static int menu_select(struct cpuidle_device *dev)
         if (data->expected_us > 5)
                 data->last_state_idx = CPUIDLE_DRIVER_STATE_START;
 
-
-        /* find the deepest idle state that satisfies our constraints */
+        /*
+         * Find the idle state with the lowest power while satisfying
+         * our constraints.
+         */
         for (i = CPUIDLE_DRIVER_STATE_START; i < dev->state_count; i++) {
                 struct cpuidle_state *s = &dev->states[i];
 
+                if (s->flags & CPUIDLE_FLAG_IGNORE)
+                        continue;
                 if (s->target_residency > data->predicted_us)
-                        break;
+                        continue;
                 if (s->exit_latency > latency_req)
-                        break;
+                        continue;
                 if (s->exit_latency * multiplier > data->predicted_us)
-                        break;
-                data->exit_us = s->exit_latency;
-                data->last_state_idx = i;
+                        continue;
+
+                if (s->power_usage < power_usage) {
+                        power_usage = s->power_usage;
+                        data->last_state_idx = i;
+                        data->exit_us = s->exit_latency;
+                }
         }
 
         return data->last_state_idx;
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 9e01e96fee94..fed57634b6c1 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -33,6 +33,19 @@ if DMADEVICES
 
 comment "DMA Devices"
 
+config INTEL_MID_DMAC
+        tristate "Intel MID DMA support for Peripheral DMA controllers"
+        depends on PCI && X86
+        select DMA_ENGINE
+        default n
+        help
+          Enable support for the Intel(R) MID DMA engine present
+          in Intel MID chipsets.
+
+          Say Y here if you have such a chipset.
+
+          If unsure, say N.
+
 config ASYNC_TX_DISABLE_CHANNEL_SWITCH
         bool
 
@@ -175,6 +188,13 @@ config PL330_DMA
           You need to provide platform specific settings via
           platform_data for a dma-pl330 device.
 
+config PCH_DMA
+        tristate "Topcliff PCH DMA support"
+        depends on PCI && X86
+        select DMA_ENGINE
+        help
+          Enable support for the Topcliff PCH DMA engine.
+
 config DMA_ENGINE
         bool
 
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index 0fe5ebbfda5d..72bd70384d8a 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -7,6 +7,7 @@ endif
 
 obj-$(CONFIG_DMA_ENGINE) += dmaengine.o
 obj-$(CONFIG_NET_DMA) += iovlock.o
+obj-$(CONFIG_INTEL_MID_DMAC) += intel_mid_dma.o
 obj-$(CONFIG_DMATEST) += dmatest.o
 obj-$(CONFIG_INTEL_IOATDMA) += ioat/
 obj-$(CONFIG_INTEL_IOP_ADMA) += iop-adma.o
@@ -23,3 +24,4 @@ obj-$(CONFIG_AMCC_PPC440SPE_ADMA) += ppc4xx/
 obj-$(CONFIG_TIMB_DMA) += timb_dma.o
 obj-$(CONFIG_STE_DMA40) += ste_dma40.o ste_dma40_ll.o
 obj-$(CONFIG_PL330_DMA) += pl330.o
+obj-$(CONFIG_PCH_DMA) += pch_dma.o
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index e88076022a7a..a0f3e6a06e06 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -790,12 +790,12 @@ static int atc_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
         list_splice_init(&atchan->queue, &list);
         list_splice_init(&atchan->active_list, &list);
 
-        spin_unlock_bh(&atchan->lock);
-
         /* Flush all pending and queued descriptors */
         list_for_each_entry_safe(desc, _desc, &list, desc_node)
                 atc_chain_complete(atchan, desc);
 
+        spin_unlock_bh(&atchan->lock);
+
         return 0;
 }
 
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
index a724e6be1b4d..557e2272e5b3 100644
--- a/drivers/dma/coh901318.c
+++ b/drivers/dma/coh901318.c
@@ -72,6 +72,9 @@ struct coh901318_chan {
         unsigned long nbr_active_done;
         unsigned long busy;
 
+        u32 runtime_addr;
+        u32 runtime_ctrl;
+
         struct coh901318_base *base;
 };
 
@@ -190,6 +193,9 @@ static inline struct coh901318_chan *to_coh901318_chan(struct dma_chan *chan)
 static inline dma_addr_t
 cohc_dev_addr(struct coh901318_chan *cohc)
 {
+        /* Runtime supplied address will take precedence */
+        if (cohc->runtime_addr)
+                return cohc->runtime_addr;
         return cohc->base->platform->chan_conf[cohc->id].dev_addr;
 }
 
@@ -1055,6 +1061,14 @@ coh901318_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 
         params = cohc_chan_param(cohc);
         config = params->config;
+        /*
+         * Add runtime-specific control on top, make
+         * sure the bits you set per peripheral channel are
+         * cleared in the default config from the platform.
+         */
+        ctrl_chained |= cohc->runtime_ctrl;
+        ctrl_last |= cohc->runtime_ctrl;
+        ctrl |= cohc->runtime_ctrl;
 
         if (direction == DMA_TO_DEVICE) {
                 u32 tx_flags = COH901318_CX_CTRL_PRDD_SOURCE |
@@ -1113,6 +1127,12 @@ coh901318_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
         if (ret)
                 goto err_lli_fill;
 
+        /*
+         * Set the default ctrl for the channel to the one from the lli,
+         * things may have changed due to odd buffer alignment etc.
+         */
+        coh901318_set_ctrl(cohc, lli->control);
+
         COH_DBG(coh901318_list_print(cohc, lli));
 
         /* Pick a descriptor to handle this transfer */
@@ -1175,6 +1195,146 @@ coh901318_issue_pending(struct dma_chan *chan)
         spin_unlock_irqrestore(&cohc->lock, flags);
 }
 
+/*
+ * Here we wrap in the runtime dma control interface
+ */
+struct burst_table {
+        int burst_8bit;
+        int burst_16bit;
+        int burst_32bit;
+        u32 reg;
+};
+
+static const struct burst_table burst_sizes[] = {
+        {
+                .burst_8bit = 64,
+                .burst_16bit = 32,
+                .burst_32bit = 16,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_64_BYTES,
+        },
+        {
+                .burst_8bit = 48,
+                .burst_16bit = 24,
+                .burst_32bit = 12,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_48_BYTES,
+        },
+        {
+                .burst_8bit = 32,
+                .burst_16bit = 16,
+                .burst_32bit = 8,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_32_BYTES,
+        },
+        {
+                .burst_8bit = 16,
+                .burst_16bit = 8,
+                .burst_32bit = 4,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_16_BYTES,
+        },
+        {
+                .burst_8bit = 8,
+                .burst_16bit = 4,
+                .burst_32bit = 2,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_8_BYTES,
+        },
+        {
+                .burst_8bit = 4,
+                .burst_16bit = 2,
+                .burst_32bit = 1,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_4_BYTES,
+        },
+        {
+                .burst_8bit = 2,
+                .burst_16bit = 1,
+                .burst_32bit = 0,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_2_BYTES,
+        },
+        {
+                .burst_8bit = 1,
+                .burst_16bit = 0,
+                .burst_32bit = 0,
+                .reg = COH901318_CX_CTRL_BURST_COUNT_1_BYTE,
+        },
+};
+
+static void coh901318_dma_set_runtimeconfig(struct dma_chan *chan,
+                        struct dma_slave_config *config)
+{
+        struct coh901318_chan *cohc = to_coh901318_chan(chan);
+        dma_addr_t addr;
+        enum dma_slave_buswidth addr_width;
+        u32 maxburst;
+        u32 runtime_ctrl = 0;
+        int i = 0;
+
+        /* We only support mem to per or per to mem transfers */
+        if (config->direction == DMA_FROM_DEVICE) {
+                addr = config->src_addr;
+                addr_width = config->src_addr_width;
+                maxburst = config->src_maxburst;
+        } else if (config->direction == DMA_TO_DEVICE) {
+                addr = config->dst_addr;
+                addr_width = config->dst_addr_width;
+                maxburst = config->dst_maxburst;
+        } else {
+                dev_err(COHC_2_DEV(cohc), "illegal channel mode\n");
+                return;
+        }
+
+        dev_dbg(COHC_2_DEV(cohc), "configure channel for %d byte transfers\n",
+                addr_width);
+        switch (addr_width)  {
+        case DMA_SLAVE_BUSWIDTH_1_BYTE:
+                runtime_ctrl |=
+                        COH901318_CX_CTRL_SRC_BUS_SIZE_8_BITS |
+                        COH901318_CX_CTRL_DST_BUS_SIZE_8_BITS;
+
+                while (i < ARRAY_SIZE(burst_sizes)) {
+                        if (burst_sizes[i].burst_8bit <= maxburst)
+                                break;
+                        i++;
+                }
+
+                break;
+        case DMA_SLAVE_BUSWIDTH_2_BYTES:
+                runtime_ctrl |=
+                        COH901318_CX_CTRL_SRC_BUS_SIZE_16_BITS |
+                        COH901318_CX_CTRL_DST_BUS_SIZE_16_BITS;
+
+                while (i < ARRAY_SIZE(burst_sizes)) {
+                        if (burst_sizes[i].burst_16bit <= maxburst)
+                                break;
+                        i++;
+                }
+
+                break;
+        case DMA_SLAVE_BUSWIDTH_4_BYTES:
+                /* Direction doesn't matter here, it's 32/32 bits */
+                runtime_ctrl |=
+                        COH901318_CX_CTRL_SRC_BUS_SIZE_32_BITS |
+                        COH901318_CX_CTRL_DST_BUS_SIZE_32_BITS;
+
+                while (i < ARRAY_SIZE(burst_sizes)) {
+                        if (burst_sizes[i].burst_32bit <= maxburst)
+                                break;
+                        i++;
+                }
+
+                break;
+        default:
+                dev_err(COHC_2_DEV(cohc),
+                        "bad runtimeconfig: alien address width\n");
+                return;
+        }
+
+        runtime_ctrl |= burst_sizes[i].reg;
+        dev_dbg(COHC_2_DEV(cohc),
+                "selected burst size %d bytes for address width %d bytes, maxburst %d\n",
+                burst_sizes[i].burst_8bit, addr_width, maxburst);
+
+        cohc->runtime_addr = addr;
+        cohc->runtime_ctrl = runtime_ctrl;
+}
+
 static int
 coh901318_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
                   unsigned long arg)
@@ -1184,6 +1344,14 @@ coh901318_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
         struct coh901318_desc *cohd;
         void __iomem *virtbase = cohc->base->virtbase;
 
+        if (cmd == DMA_SLAVE_CONFIG) {
+                struct dma_slave_config *config =
+                        (struct dma_slave_config *) arg;
+
+                coh901318_dma_set_runtimeconfig(chan, config);
+                return 0;
+          }
+
         if (cmd == DMA_PAUSE) {
                 coh901318_pause(chan);
                 return 0;
@@ -1240,6 +1408,7 @@ coh901318_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
 
         return 0;
 }
+
 void coh901318_base_init(struct dma_device *dma, const int *pick_chans,
                          struct coh901318_base *base)
 {
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 68d58c414cf0..5589358b684d 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -540,7 +540,7 @@ static int dmatest_add_channel(struct dma_chan *chan)
         struct dmatest_chan     *dtc;
         struct dma_device       *dma_dev = chan->device;
         unsigned int            thread_count = 0;
-        unsigned int            cnt;
+        int cnt;
 
         dtc = kmalloc(sizeof(struct dmatest_chan), GFP_KERNEL);
         if (!dtc) {
diff --git a/drivers/dma/intel_mid_dma.c b/drivers/dma/intel_mid_dma.c
new file mode 100644
index 000000000000..c2591e8d9b6e
--- /dev/null
+++ b/drivers/dma/intel_mid_dma.c
@@ -0,0 +1,1143 @@
+/*
+ *  intel_mid_dma.c - Intel Langwell DMA Drivers
+ *
+ *  Copyright (C) 2008-10 Intel Corp
+ *  Author: Vinod Koul <vinod.koul@intel.com>
+ *  The driver design is based on dw_dmac driver
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *
+ */
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/intel_mid_dma.h>
+
+#define MAX_CHAN        4 /*max ch across controllers*/
+#include "intel_mid_dma_regs.h"
+
+#define INTEL_MID_DMAC1_ID              0x0814
+#define INTEL_MID_DMAC2_ID              0x0813
+#define INTEL_MID_GP_DMAC2_ID           0x0827
+#define INTEL_MFLD_DMAC1_ID             0x0830
+#define LNW_PERIPHRAL_MASK_BASE         0xFFAE8008
+#define LNW_PERIPHRAL_MASK_SIZE         0x10
+#define LNW_PERIPHRAL_STATUS            0x0
+#define LNW_PERIPHRAL_MASK              0x8
+
+struct intel_mid_dma_probe_info {
+        u8 max_chan;
+        u8 ch_base;
+        u16 block_size;
+        u32 pimr_mask;
+};
+
+#define INFO(_max_chan, _ch_base, _block_size, _pimr_mask) \
+        ((kernel_ulong_t)&(struct intel_mid_dma_probe_info) {   \
+                .max_chan = (_max_chan),                        \
+                .ch_base = (_ch_base),                          \
+                .block_size = (_block_size),                    \
+                .pimr_mask = (_pimr_mask),                      \
+        })
+
+/*****************************************************************************
+Utility Functions*/
+/**
+ * get_ch_index -       convert status to channel
+ * @status: status mask
+ * @base: dma ch base value
+ *
+ * Modify the status mask and return the channel index needing
+ * attention (or -1 if neither)
+ */
+static int get_ch_index(int *status, unsigned int base)
+{
+        int i;
+        for (i = 0; i < MAX_CHAN; i++) {
+                if (*status & (1 << (i + base))) {
+                        *status = *status & ~(1 << (i + base));
+                        pr_debug("MDMA: index %d New status %x\n", i, *status);
+                        return i;
+                }
+        }
+        return -1;
+}
+
+/**
+ * get_block_ts -       calculates dma transaction length
+ * @len: dma transfer length
+ * @tx_width: dma transfer src width
+ * @block_size: dma controller max block size
+ *
+ * Based on src width calculate the DMA trsaction length in data items
+ * return data items or FFFF if exceeds max length for block
+ */
+static int get_block_ts(int len, int tx_width, int block_size)
+{
+        int byte_width = 0, block_ts = 0;
+
+        switch (tx_width) {
+        case LNW_DMA_WIDTH_8BIT:
+                byte_width = 1;
+                break;
+        case LNW_DMA_WIDTH_16BIT:
+                byte_width = 2;
+                break;
+        case LNW_DMA_WIDTH_32BIT:
+        default:
+                byte_width = 4;
+                break;
+        }
+
+        block_ts = len/byte_width;
+        if (block_ts > block_size)
+                block_ts = 0xFFFF;
+        return block_ts;
+}
+
+/*****************************************************************************
+DMAC1 interrupt Functions*/
+
+/**
+ * dmac1_mask_periphral_intr -  mask the periphral interrupt
+ * @midc: dma channel for which masking is required
+ *
+ * Masks the DMA periphral interrupt
+ * this is valid for DMAC1 family controllers only
+ * This controller should have periphral mask registers already mapped
+ */
+static void dmac1_mask_periphral_intr(struct intel_mid_dma_chan *midc)
+{
+        u32 pimr;
+        struct middma_device *mid = to_middma_device(midc->chan.device);
+
+        if (mid->pimr_mask) {
+                pimr = readl(mid->mask_reg + LNW_PERIPHRAL_MASK);
+                pimr |= mid->pimr_mask;
+                writel(pimr, mid->mask_reg + LNW_PERIPHRAL_MASK);
+        }
+        return;
+}
+
+/**
+ * dmac1_unmask_periphral_intr -        unmask the periphral interrupt
+ * @midc: dma channel for which masking is required
+ *
+ * UnMasks the DMA periphral interrupt,
+ * this is valid for DMAC1 family controllers only
+ * This controller should have periphral mask registers already mapped
+ */
+static void dmac1_unmask_periphral_intr(struct intel_mid_dma_chan *midc)
+{
+        u32 pimr;
+        struct middma_device *mid = to_middma_device(midc->chan.device);
+
+        if (mid->pimr_mask) {
+                pimr = readl(mid->mask_reg + LNW_PERIPHRAL_MASK);
+                pimr &= ~mid->pimr_mask;
+                writel(pimr, mid->mask_reg + LNW_PERIPHRAL_MASK);
+        }
+        return;
+}
+
+/**
+ * enable_dma_interrupt -       enable the periphral interrupt
+ * @midc: dma channel for which enable interrupt is required
+ *
+ * Enable the DMA periphral interrupt,
+ * this is valid for DMAC1 family controllers only
+ * This controller should have periphral mask registers already mapped
+ */
+static void enable_dma_interrupt(struct intel_mid_dma_chan *midc)
+{
+        dmac1_unmask_periphral_intr(midc);
+
+        /*en ch interrupts*/
+        iowrite32(UNMASK_INTR_REG(midc->ch_id), midc->dma_base + MASK_TFR);
+        iowrite32(UNMASK_INTR_REG(midc->ch_id), midc->dma_base + MASK_ERR);
+        return;
+}
+
+/**
+ * disable_dma_interrupt -      disable the periphral interrupt
+ * @midc: dma channel for which disable interrupt is required
+ *
+ * Disable the DMA periphral interrupt,
+ * this is valid for DMAC1 family controllers only
+ * This controller should have periphral mask registers already mapped
+ */
+static void disable_dma_interrupt(struct intel_mid_dma_chan *midc)
+{
+        /*Check LPE PISR, make sure fwd is disabled*/
+        dmac1_mask_periphral_intr(midc);
+        iowrite32(MASK_INTR_REG(midc->ch_id), midc->dma_base + MASK_BLOCK);
+        iowrite32(MASK_INTR_REG(midc->ch_id), midc->dma_base + MASK_TFR);
+        iowrite32(MASK_INTR_REG(midc->ch_id), midc->dma_base + MASK_ERR);
+        return;
+}
+
+/*****************************************************************************
+DMA channel helper Functions*/
+/**
+ * mid_desc_get         -       get a descriptor
+ * @midc: dma channel for which descriptor is required
+ *
+ * Obtain a descriptor for the channel. Returns NULL if none are free.
+ * Once the descriptor is returned it is private until put on another
+ * list or freed
+ */
+static struct intel_mid_dma_desc *midc_desc_get(struct intel_mid_dma_chan *midc)
+{
+        struct intel_mid_dma_desc *desc, *_desc;
+        struct intel_mid_dma_desc *ret = NULL;
+
+        spin_lock_bh(&midc->lock);
+        list_for_each_entry_safe(desc, _desc, &midc->free_list, desc_node) {
+                if (async_tx_test_ack(&desc->txd)) {
+                        list_del(&desc->desc_node);
+                        ret = desc;
+                        break;
+                }
+        }
+        spin_unlock_bh(&midc->lock);
+        return ret;
+}
+
+/**
+ * mid_desc_put         -       put a descriptor
+ * @midc: dma channel for which descriptor is required
+ * @desc: descriptor to put
+ *
+ * Return a descriptor from lwn_desc_get back to the free pool
+ */
+static void midc_desc_put(struct intel_mid_dma_chan *midc,
+                        struct intel_mid_dma_desc *desc)
+{
+        if (desc) {
+                spin_lock_bh(&midc->lock);
+                list_add_tail(&desc->desc_node, &midc->free_list);
+                spin_unlock_bh(&midc->lock);
+        }
+}
+/**
+ * midc_dostart         -               begin a DMA transaction
+ * @midc: channel for which txn is to be started
+ * @first: first descriptor of series
+ *
+ * Load a transaction into the engine. This must be called with midc->lock
+ * held and bh disabled.
+ */
+static void midc_dostart(struct intel_mid_dma_chan *midc,
+                        struct intel_mid_dma_desc *first)
+{
+        struct middma_device *mid = to_middma_device(midc->chan.device);
+
+        /*  channel is idle */
+        if (midc->in_use && test_ch_en(midc->dma_base, midc->ch_id)) {
+                /*error*/
+                pr_err("ERR_MDMA: channel is busy in start\n");
+                /* The tasklet will hopefully advance the queue... */
+                return;
+        }
+
+        /*write registers and en*/
+        iowrite32(first->sar, midc->ch_regs + SAR);
+        iowrite32(first->dar, midc->ch_regs + DAR);
+        iowrite32(first->cfg_hi, midc->ch_regs + CFG_HIGH);
+        iowrite32(first->cfg_lo, midc->ch_regs + CFG_LOW);
+        iowrite32(first->ctl_lo, midc->ch_regs + CTL_LOW);
+        iowrite32(first->ctl_hi, midc->ch_regs + CTL_HIGH);
+        pr_debug("MDMA:TX SAR %x,DAR %x,CFGL %x,CFGH %x,CTLH %x, CTLL %x\n",
+                (int)first->sar, (int)first->dar, first->cfg_hi,
+                first->cfg_lo, first->ctl_hi, first->ctl_lo);
+
+        iowrite32(ENABLE_CHANNEL(midc->ch_id), mid->dma_base + DMA_CHAN_EN);
+        first->status = DMA_IN_PROGRESS;
+}
+
+/**
+ * midc_descriptor_complete     -       process completed descriptor
+ * @midc: channel owning the descriptor
+ * @desc: the descriptor itself
+ *
+ * Process a completed descriptor and perform any callbacks upon
+ * the completion. The completion handling drops the lock during the
+ * callbacks but must be called with the lock held.
+ */
+static void midc_descriptor_complete(struct intel_mid_dma_chan *midc,
+               struct intel_mid_dma_desc *desc)
+{
+        struct dma_async_tx_descriptor  *txd = &desc->txd;
+        dma_async_tx_callback callback_txd = NULL;
+        void *param_txd = NULL;
+
+        midc->completed = txd->cookie;
+        callback_txd = txd->callback;
+        param_txd = txd->callback_param;
+
+        list_move(&desc->desc_node, &midc->free_list);
+
+        spin_unlock_bh(&midc->lock);
+        if (callback_txd) {
+                pr_debug("MDMA: TXD callback set ... calling\n");
+                callback_txd(param_txd);
+                spin_lock_bh(&midc->lock);
+                return;
+        }
+        spin_lock_bh(&midc->lock);
+
+}
+/**
+ * midc_scan_descriptors -              check the descriptors in channel
+ *                                      mark completed when tx is completete
+ * @mid: device
+ * @midc: channel to scan
+ *
+ * Walk the descriptor chain for the device and process any entries
+ * that are complete.
+ */
+static void midc_scan_descriptors(struct middma_device *mid,
+                                struct intel_mid_dma_chan *midc)
+{
+        struct intel_mid_dma_desc *desc = NULL, *_desc = NULL;
+
+        /*tx is complete*/
+        list_for_each_entry_safe(desc, _desc, &midc->active_list, desc_node) {
+                if (desc->status == DMA_IN_PROGRESS)  {
+                        desc->status = DMA_SUCCESS;
+                        midc_descriptor_complete(midc, desc);
+                }
+        }
+        return;
+}
+
+/*****************************************************************************
+DMA engine callback Functions*/
+/**
+ * intel_mid_dma_tx_submit -    callback to submit DMA transaction
+ * @tx: dma engine descriptor
+ *
+ * Submit the DMA trasaction for this descriptor, start if ch idle
+ */
+static dma_cookie_t intel_mid_dma_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+        struct intel_mid_dma_desc       *desc = to_intel_mid_dma_desc(tx);
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(tx->chan);
+        dma_cookie_t            cookie;
+
+        spin_lock_bh(&midc->lock);
+        cookie = midc->chan.cookie;
+
+        if (++cookie < 0)
+                cookie = 1;
+
+        midc->chan.cookie = cookie;
+        desc->txd.cookie = cookie;
+
+
+        if (list_empty(&midc->active_list)) {
+                midc_dostart(midc, desc);
+                list_add_tail(&desc->desc_node, &midc->active_list);
+        } else {
+                list_add_tail(&desc->desc_node, &midc->queue);
+        }
+        spin_unlock_bh(&midc->lock);
+
+        return cookie;
+}
+
+/**
+ * intel_mid_dma_issue_pending -        callback to issue pending txn
+ * @chan: chan where pending trascation needs to be checked and submitted
+ *
+ * Call for scan to issue pending descriptors
+ */
+static void intel_mid_dma_issue_pending(struct dma_chan *chan)
+{
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(chan);
+
+        spin_lock_bh(&midc->lock);
+        if (!list_empty(&midc->queue))
+                midc_scan_descriptors(to_middma_device(chan->device), midc);
+        spin_unlock_bh(&midc->lock);
+}
+
+/**
+ * intel_mid_dma_tx_status -    Return status of txn
+ * @chan: chan for where status needs to be checked
+ * @cookie: cookie for txn
+ * @txstate: DMA txn state
+ *
+ * Return status of DMA txn
+ */
+static enum dma_status intel_mid_dma_tx_status(struct dma_chan *chan,
+                                                dma_cookie_t cookie,
+                                                struct dma_tx_state *txstate)
+{
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(chan);
+        dma_cookie_t            last_used;
+        dma_cookie_t            last_complete;
+        int                             ret;
+
+        last_complete = midc->completed;
+        last_used = chan->cookie;
+
+        ret = dma_async_is_complete(cookie, last_complete, last_used);
+        if (ret != DMA_SUCCESS) {
+                midc_scan_descriptors(to_middma_device(chan->device), midc);
+
+                last_complete = midc->completed;
+                last_used = chan->cookie;
+
+                ret = dma_async_is_complete(cookie, last_complete, last_used);
+        }
+
+        if (txstate) {
+                txstate->last = last_complete;
+                txstate->used = last_used;
+                txstate->residue = 0;
+        }
+        return ret;
+}
+
+/**
+ * intel_mid_dma_device_control -       DMA device control
+ * @chan: chan for DMA control
+ * @cmd: control cmd
+ * @arg: cmd arg value
+ *
+ * Perform DMA control command
+ */
+static int intel_mid_dma_device_control(struct dma_chan *chan,
+                        enum dma_ctrl_cmd cmd, unsigned long arg)
+{
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(chan);
+        struct middma_device    *mid = to_middma_device(chan->device);
+        struct intel_mid_dma_desc       *desc, *_desc;
+        LIST_HEAD(list);
+
+        if (cmd != DMA_TERMINATE_ALL)
+                return -ENXIO;
+
+        spin_lock_bh(&midc->lock);
+        if (midc->in_use == false) {
+                spin_unlock_bh(&midc->lock);
+                return 0;
+        }
+        list_splice_init(&midc->free_list, &list);
+        midc->descs_allocated = 0;
+        midc->slave = NULL;
+
+        /* Disable interrupts */
+        disable_dma_interrupt(midc);
+
+        spin_unlock_bh(&midc->lock);
+        list_for_each_entry_safe(desc, _desc, &list, desc_node) {
+                pr_debug("MDMA: freeing descriptor %p\n", desc);
+                pci_pool_free(mid->dma_pool, desc, desc->txd.phys);
+        }
+        return 0;
+}
+
+/**
+ * intel_mid_dma_prep_slave_sg -        Prep slave sg txn
+ * @chan: chan for DMA transfer
+ * @sgl: scatter gather list
+ * @sg_len: length of sg txn
+ * @direction: DMA transfer dirtn
+ * @flags: DMA flags
+ *
+ * Do DMA sg txn: NOT supported now
+ */
+static struct dma_async_tx_descriptor *intel_mid_dma_prep_slave_sg(
+                        struct dma_chan *chan, struct scatterlist *sgl,
+                        unsigned int sg_len, enum dma_data_direction direction,
+                        unsigned long flags)
+{
+        /*not supported now*/
+        return NULL;
+}
+
+/**
+ * intel_mid_dma_prep_memcpy -  Prep memcpy txn
+ * @chan: chan for DMA transfer
+ * @dest: destn address
+ * @src: src address
+ * @len: DMA transfer len
+ * @flags: DMA flags
+ *
+ * Perform a DMA memcpy. Note we support slave periphral DMA transfers only
+ * The periphral txn details should be filled in slave structure properly
+ * Returns the descriptor for this txn
+ */
+static struct dma_async_tx_descriptor *intel_mid_dma_prep_memcpy(
+                        struct dma_chan *chan, dma_addr_t dest,
+                        dma_addr_t src, size_t len, unsigned long flags)
+{
+        struct intel_mid_dma_chan *midc;
+        struct intel_mid_dma_desc *desc = NULL;
+        struct intel_mid_dma_slave *mids;
+        union intel_mid_dma_ctl_lo ctl_lo;
+        union intel_mid_dma_ctl_hi ctl_hi;
+        union intel_mid_dma_cfg_lo cfg_lo;
+        union intel_mid_dma_cfg_hi cfg_hi;
+        enum intel_mid_dma_width width = 0;
+
+        pr_debug("MDMA: Prep for memcpy\n");
+        WARN_ON(!chan);
+        if (!len)
+                return NULL;
+
+        mids = chan->private;
+        WARN_ON(!mids);
+
+        midc = to_intel_mid_dma_chan(chan);
+        WARN_ON(!midc);
+
+        pr_debug("MDMA:called for DMA %x CH %d Length %zu\n",
+                                midc->dma->pci_id, midc->ch_id, len);
+        pr_debug("MDMA:Cfg passed Mode %x, Dirn %x, HS %x, Width %x\n",
+                mids->cfg_mode, mids->dirn, mids->hs_mode, mids->src_width);
+
+        /*calculate CFG_LO*/
+        if (mids->hs_mode == LNW_DMA_SW_HS) {
+                cfg_lo.cfg_lo = 0;
+                cfg_lo.cfgx.hs_sel_dst = 1;
+                cfg_lo.cfgx.hs_sel_src = 1;
+        } else if (mids->hs_mode == LNW_DMA_HW_HS)
+                cfg_lo.cfg_lo = 0x00000;
+
+        /*calculate CFG_HI*/
+        if (mids->cfg_mode == LNW_DMA_MEM_TO_MEM) {
+                /*SW HS only*/
+                cfg_hi.cfg_hi = 0;
+        } else {
+                cfg_hi.cfg_hi = 0;
+                if (midc->dma->pimr_mask) {
+                        cfg_hi.cfgx.protctl = 0x0; /*default value*/
+                        cfg_hi.cfgx.fifo_mode = 1;
+                        if (mids->dirn == DMA_TO_DEVICE) {
+                                cfg_hi.cfgx.src_per = 0;
+                                if (mids->device_instance == 0)
+                                        cfg_hi.cfgx.dst_per = 3;
+                                if (mids->device_instance == 1)
+                                        cfg_hi.cfgx.dst_per = 1;
+                        } else if (mids->dirn == DMA_FROM_DEVICE) {
+                                if (mids->device_instance == 0)
+                                        cfg_hi.cfgx.src_per = 2;
+                                if (mids->device_instance == 1)
+                                        cfg_hi.cfgx.src_per = 0;
+                                cfg_hi.cfgx.dst_per = 0;
+                        }
+                } else {
+                        cfg_hi.cfgx.protctl = 0x1; /*default value*/
+                        cfg_hi.cfgx.src_per = cfg_hi.cfgx.dst_per =
+                                        midc->ch_id - midc->dma->chan_base;
+                }
+        }
+
+        /*calculate CTL_HI*/
+        ctl_hi.ctlx.reser = 0;
+        width = mids->src_width;
+
+        ctl_hi.ctlx.block_ts = get_block_ts(len, width, midc->dma->block_size);
+        pr_debug("MDMA:calc len %d for block size %d\n",
+                                ctl_hi.ctlx.block_ts, midc->dma->block_size);
+        /*calculate CTL_LO*/
+        ctl_lo.ctl_lo = 0;
+        ctl_lo.ctlx.int_en = 1;
+        ctl_lo.ctlx.dst_tr_width = mids->dst_width;
+        ctl_lo.ctlx.src_tr_width = mids->src_width;
+        ctl_lo.ctlx.dst_msize = mids->src_msize;
+        ctl_lo.ctlx.src_msize = mids->dst_msize;
+
+        if (mids->cfg_mode == LNW_DMA_MEM_TO_MEM) {
+                ctl_lo.ctlx.tt_fc = 0;
+                ctl_lo.ctlx.sinc = 0;
+                ctl_lo.ctlx.dinc = 0;
+        } else {
+                if (mids->dirn == DMA_TO_DEVICE) {
+                        ctl_lo.ctlx.sinc = 0;
+                        ctl_lo.ctlx.dinc = 2;
+                        ctl_lo.ctlx.tt_fc = 1;
+                } else if (mids->dirn == DMA_FROM_DEVICE) {
+                        ctl_lo.ctlx.sinc = 2;
+                        ctl_lo.ctlx.dinc = 0;
+                        ctl_lo.ctlx.tt_fc = 2;
+                }
+        }
+
+        pr_debug("MDMA:Calc CTL LO %x, CTL HI %x, CFG LO %x, CFG HI %x\n",
+                ctl_lo.ctl_lo, ctl_hi.ctl_hi, cfg_lo.cfg_lo, cfg_hi.cfg_hi);
+
+        enable_dma_interrupt(midc);
+
+        desc = midc_desc_get(midc);
+        if (desc == NULL)
+                goto err_desc_get;
+        desc->sar = src;
+        desc->dar = dest ;
+        desc->len = len;
+        desc->cfg_hi = cfg_hi.cfg_hi;
+        desc->cfg_lo = cfg_lo.cfg_lo;
+        desc->ctl_lo = ctl_lo.ctl_lo;
+        desc->ctl_hi = ctl_hi.ctl_hi;
+        desc->width = width;
+        desc->dirn = mids->dirn;
+        return &desc->txd;
+
+err_desc_get:
+        pr_err("ERR_MDMA: Failed to get desc\n");
+        midc_desc_put(midc, desc);
+        return NULL;
+}
+
+/**
+ * intel_mid_dma_free_chan_resources -  Frees dma resources
+ * @chan: chan requiring attention
+ *
+ * Frees the allocated resources on this DMA chan
+ */
+static void intel_mid_dma_free_chan_resources(struct dma_chan *chan)
+{
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(chan);
+        struct middma_device    *mid = to_middma_device(chan->device);
+        struct intel_mid_dma_desc       *desc, *_desc;
+
+        if (true == midc->in_use) {
+                /*trying to free ch in use!!!!!*/
+                pr_err("ERR_MDMA: trying to free ch in use\n");
+        }
+
+        spin_lock_bh(&midc->lock);
+        midc->descs_allocated = 0;
+        list_for_each_entry_safe(desc, _desc, &midc->active_list, desc_node) {
+                list_del(&desc->desc_node);
+                pci_pool_free(mid->dma_pool, desc, desc->txd.phys);
+        }
+        list_for_each_entry_safe(desc, _desc, &midc->free_list, desc_node) {
+                list_del(&desc->desc_node);
+                pci_pool_free(mid->dma_pool, desc, desc->txd.phys);
+        }
+        list_for_each_entry_safe(desc, _desc, &midc->queue, desc_node) {
+                list_del(&desc->desc_node);
+                pci_pool_free(mid->dma_pool, desc, desc->txd.phys);
+        }
+        spin_unlock_bh(&midc->lock);
+        midc->in_use = false;
+        /* Disable CH interrupts */
+        iowrite32(MASK_INTR_REG(midc->ch_id), mid->dma_base + MASK_BLOCK);
+        iowrite32(MASK_INTR_REG(midc->ch_id), mid->dma_base + MASK_ERR);
+}
+
+/**
+ * intel_mid_dma_alloc_chan_resources - Allocate dma resources
+ * @chan: chan requiring attention
+ *
+ * Allocates DMA resources on this chan
+ * Return the descriptors allocated
+ */
+static int intel_mid_dma_alloc_chan_resources(struct dma_chan *chan)
+{
+        struct intel_mid_dma_chan       *midc = to_intel_mid_dma_chan(chan);
+        struct middma_device    *mid = to_middma_device(chan->device);
+        struct intel_mid_dma_desc       *desc;
+        dma_addr_t              phys;
+        int     i = 0;
+
+
+        /* ASSERT:  channel is idle */
+        if (test_ch_en(mid->dma_base, midc->ch_id)) {
+                /*ch is not idle*/
+                pr_err("ERR_MDMA: ch not idle\n");
+                return -EIO;
+        }
+        midc->completed = chan->cookie = 1;
+
+        spin_lock_bh(&midc->lock);
+        while (midc->descs_allocated < DESCS_PER_CHANNEL) {
+                spin_unlock_bh(&midc->lock);
+                desc = pci_pool_alloc(mid->dma_pool, GFP_KERNEL, &phys);
+                if (!desc) {
+                        pr_err("ERR_MDMA: desc failed\n");
+                        return -ENOMEM;
+                        /*check*/
+                }
+                dma_async_tx_descriptor_init(&desc->txd, chan);
+                desc->txd.tx_submit = intel_mid_dma_tx_submit;
+                desc->txd.flags = DMA_CTRL_ACK;
+                desc->txd.phys = phys;
+                spin_lock_bh(&midc->lock);
+                i = ++midc->descs_allocated;
+                list_add_tail(&desc->desc_node, &midc->free_list);
+        }
+        spin_unlock_bh(&midc->lock);
+        midc->in_use = false;
+        pr_debug("MID_DMA: Desc alloc done ret: %d desc\n", i);
+        return i;
+}
+
+/**
+ * midc_handle_error -  Handle DMA txn error
+ * @mid: controller where error occured
+ * @midc: chan where error occured
+ *
+ * Scan the descriptor for error
+ */
+static void midc_handle_error(struct middma_device *mid,
+                struct intel_mid_dma_chan *midc)
+{
+        midc_scan_descriptors(mid, midc);
+}
+
+/**
+ * dma_tasklet -        DMA interrupt tasklet
+ * @data: tasklet arg (the controller structure)
+ *
+ * Scan the controller for interrupts for completion/error
+ * Clear the interrupt and call for handling completion/error
+ */
+static void dma_tasklet(unsigned long data)
+{
+        struct middma_device *mid = NULL;
+        struct intel_mid_dma_chan *midc = NULL;
+        u32 status;
+        int i;
+
+        mid = (struct middma_device *)data;
+        if (mid == NULL) {
+                pr_err("ERR_MDMA: tasklet Null param\n");
+                return;
+        }
+        pr_debug("MDMA: in tasklet for device %x\n", mid->pci_id);
+        status = ioread32(mid->dma_base + RAW_TFR);
+        pr_debug("MDMA:RAW_TFR %x\n", status);
+        status &= mid->intr_mask;
+        while (status) {
+                /*txn interrupt*/
+                i = get_ch_index(&status, mid->chan_base);
+                if (i < 0) {
+                        pr_err("ERR_MDMA:Invalid ch index %x\n", i);
+                        return;
+                }
+                midc = &mid->ch[i];
+                if (midc == NULL) {
+                        pr_err("ERR_MDMA:Null param midc\n");
+                        return;
+                }
+                pr_debug("MDMA:Tx complete interrupt %x, Ch No %d Index %d\n",
+                                status, midc->ch_id, i);
+                /*clearing this interrupts first*/
+                iowrite32((1 << midc->ch_id), mid->dma_base + CLEAR_TFR);
+                iowrite32((1 << midc->ch_id), mid->dma_base + CLEAR_BLOCK);
+
+                spin_lock_bh(&midc->lock);
+                midc_scan_descriptors(mid, midc);
+                pr_debug("MDMA:Scan of desc... complete, unmasking\n");
+                iowrite32(UNMASK_INTR_REG(midc->ch_id),
+                                mid->dma_base + MASK_TFR);
+                spin_unlock_bh(&midc->lock);
+        }
+
+        status = ioread32(mid->dma_base + RAW_ERR);
+        status &= mid->intr_mask;
+        while (status) {
+                /*err interrupt*/
+                i = get_ch_index(&status, mid->chan_base);
+                if (i < 0) {
+                        pr_err("ERR_MDMA:Invalid ch index %x\n", i);
+                        return;
+                }
+                midc = &mid->ch[i];
+                if (midc == NULL) {
+                        pr_err("ERR_MDMA:Null param midc\n");
+                        return;
+                }
+                pr_debug("MDMA:Tx complete interrupt %x, Ch No %d Index %d\n",
+                                status, midc->ch_id, i);
+
+                iowrite32((1 << midc->ch_id), mid->dma_base + CLEAR_ERR);
+                spin_lock_bh(&midc->lock);
+                midc_handle_error(mid, midc);
+                iowrite32(UNMASK_INTR_REG(midc->ch_id),
+                                mid->dma_base + MASK_ERR);
+                spin_unlock_bh(&midc->lock);
+        }
+        pr_debug("MDMA:Exiting takslet...\n");
+        return;
+}
+
+static void dma_tasklet1(unsigned long data)
+{
+        pr_debug("MDMA:in takslet1...\n");
+        return dma_tasklet(data);
+}
+
+static void dma_tasklet2(unsigned long data)
+{
+        pr_debug("MDMA:in takslet2...\n");
+        return dma_tasklet(data);
+}
+
+/**
+ * intel_mid_dma_interrupt -    DMA ISR
+ * @irq: IRQ where interrupt occurred
+ * @data: ISR cllback data (the controller structure)
+ *
+ * See if this is our interrupt if so then schedule the tasklet
+ * otherwise ignore
+ */
+static irqreturn_t intel_mid_dma_interrupt(int irq, void *data)
+{
+        struct middma_device *mid = data;
+        u32 status;
+        int call_tasklet = 0;
+
+        /*DMA Interrupt*/
+        pr_debug("MDMA:Got an interrupt on irq %d\n", irq);
+        if (!mid) {
+                pr_err("ERR_MDMA:null pointer mid\n");
+                return -EINVAL;
+        }
+
+        status = ioread32(mid->dma_base + RAW_TFR);
+        pr_debug("MDMA: Status %x, Mask %x\n", status, mid->intr_mask);
+        status &= mid->intr_mask;
+        if (status) {
+                /*need to disable intr*/
+                iowrite32((status << 8), mid->dma_base + MASK_TFR);
+                pr_debug("MDMA: Calling tasklet %x\n", status);
+                call_tasklet = 1;
+        }
+        status = ioread32(mid->dma_base + RAW_ERR);
+        status &= mid->intr_mask;
+        if (status) {
+                iowrite32(MASK_INTR_REG(status), mid->dma_base + MASK_ERR);
+                call_tasklet = 1;
+        }
+        if (call_tasklet)
+                tasklet_schedule(&mid->tasklet);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t intel_mid_dma_interrupt1(int irq, void *data)
+{
+        return intel_mid_dma_interrupt(irq, data);
+}
+
+static irqreturn_t intel_mid_dma_interrupt2(int irq, void *data)
+{
+        return intel_mid_dma_interrupt(irq, data);
+}
+
+/**
+ * mid_setup_dma -      Setup the DMA controller
+ * @pdev: Controller PCI device structure
+ *
+ * Initilize the DMA controller, channels, registers with DMA engine,
+ * ISR. Initilize DMA controller channels.
+ */
+static int mid_setup_dma(struct pci_dev *pdev)
+{
+        struct middma_device *dma = pci_get_drvdata(pdev);
+        int err, i;
+        unsigned int irq_level;
+
+        /* DMA coherent memory pool for DMA descriptor allocations */
+        dma->dma_pool = pci_pool_create("intel_mid_dma_desc_pool", pdev,
+                                        sizeof(struct intel_mid_dma_desc),
+                                        32, 0);
+        if (NULL == dma->dma_pool) {
+                pr_err("ERR_MDMA:pci_pool_create failed\n");
+                err = -ENOMEM;
+                kfree(dma);
+                goto err_dma_pool;
+        }
+
+        INIT_LIST_HEAD(&dma->common.channels);
+        dma->pci_id = pdev->device;
+        if (dma->pimr_mask) {
+                dma->mask_reg = ioremap(LNW_PERIPHRAL_MASK_BASE,
+                                        LNW_PERIPHRAL_MASK_SIZE);
+                if (dma->mask_reg == NULL) {
+                        pr_err("ERR_MDMA:Cant map periphral intr space !!\n");
+                        return -ENOMEM;
+                }
+        } else
+                dma->mask_reg = NULL;
+
+        pr_debug("MDMA:Adding %d channel for this controller\n", dma->max_chan);
+        /*init CH structures*/
+        dma->intr_mask = 0;
+        for (i = 0; i < dma->max_chan; i++) {
+                struct intel_mid_dma_chan *midch = &dma->ch[i];
+
+                midch->chan.device = &dma->common;
+                midch->chan.cookie =  1;
+                midch->chan.chan_id = i;
+                midch->ch_id = dma->chan_base + i;
+                pr_debug("MDMA:Init CH %d, ID %d\n", i, midch->ch_id);
+
+                midch->dma_base = dma->dma_base;
+                midch->ch_regs = dma->dma_base + DMA_CH_SIZE * midch->ch_id;
+                midch->dma = dma;
+                dma->intr_mask |= 1 << (dma->chan_base + i);
+                spin_lock_init(&midch->lock);
+
+                INIT_LIST_HEAD(&midch->active_list);
+                INIT_LIST_HEAD(&midch->queue);
+                INIT_LIST_HEAD(&midch->free_list);
+                /*mask interrupts*/
+                iowrite32(MASK_INTR_REG(midch->ch_id),
+                        dma->dma_base + MASK_BLOCK);
+                iowrite32(MASK_INTR_REG(midch->ch_id),
+                        dma->dma_base + MASK_SRC_TRAN);
+                iowrite32(MASK_INTR_REG(midch->ch_id),
+                        dma->dma_base + MASK_DST_TRAN);
+                iowrite32(MASK_INTR_REG(midch->ch_id),
+                        dma->dma_base + MASK_ERR);
+                iowrite32(MASK_INTR_REG(midch->ch_id),
+                        dma->dma_base + MASK_TFR);
+
+                disable_dma_interrupt(midch);
+                list_add_tail(&midch->chan.device_node, &dma->common.channels);
+        }
+        pr_debug("MDMA: Calc Mask as %x for this controller\n", dma->intr_mask);
+
+        /*init dma structure*/
+        dma_cap_zero(dma->common.cap_mask);
+        dma_cap_set(DMA_MEMCPY, dma->common.cap_mask);
+        dma_cap_set(DMA_SLAVE, dma->common.cap_mask);
+        dma_cap_set(DMA_PRIVATE, dma->common.cap_mask);
+        dma->common.dev = &pdev->dev;
+        dma->common.chancnt = dma->max_chan;
+
+        dma->common.device_alloc_chan_resources =
+                                        intel_mid_dma_alloc_chan_resources;
+        dma->common.device_free_chan_resources =
+                                        intel_mid_dma_free_chan_resources;
+
+        dma->common.device_tx_status = intel_mid_dma_tx_status;
+        dma->common.device_prep_dma_memcpy = intel_mid_dma_prep_memcpy;
+        dma->common.device_issue_pending = intel_mid_dma_issue_pending;
+        dma->common.device_prep_slave_sg = intel_mid_dma_prep_slave_sg;
+        dma->common.device_control = intel_mid_dma_device_control;
+
+        /*enable dma cntrl*/
+        iowrite32(REG_BIT0, dma->dma_base + DMA_CFG);
+
+        /*register irq */
+        if (dma->pimr_mask) {
+                irq_level = IRQF_SHARED;
+                pr_debug("MDMA:Requesting irq shared for DMAC1\n");
+                err = request_irq(pdev->irq, intel_mid_dma_interrupt1,
+                        IRQF_SHARED, "INTEL_MID_DMAC1", dma);
+                if (0 != err)
+                        goto err_irq;
+        } else {
+                dma->intr_mask = 0x03;
+                irq_level = 0;
+                pr_debug("MDMA:Requesting irq for DMAC2\n");
+                err = request_irq(pdev->irq, intel_mid_dma_interrupt2,
+                        0, "INTEL_MID_DMAC2", dma);
+                if (0 != err)
+                        goto err_irq;
+        }
+        /*register device w/ engine*/
+        err = dma_async_device_register(&dma->common);
+        if (0 != err) {
+                pr_err("ERR_MDMA:device_register failed: %d\n", err);
+                goto err_engine;
+        }
+        if (dma->pimr_mask) {
+                pr_debug("setting up tasklet1 for DMAC1\n");
+                tasklet_init(&dma->tasklet, dma_tasklet1, (unsigned long)dma);
+        } else {
+                pr_debug("setting up tasklet2 for DMAC2\n");
+                tasklet_init(&dma->tasklet, dma_tasklet2, (unsigned long)dma);
+        }
+        return 0;
+
+err_engine:
+        free_irq(pdev->irq, dma);
+err_irq:
+        pci_pool_destroy(dma->dma_pool);
+        kfree(dma);
+err_dma_pool:
+        pr_err("ERR_MDMA:setup_dma failed: %d\n", err);
+        return err;
+
+}
+
+/**
+ * middma_shutdown -    Shutdown the DMA controller
+ * @pdev: Controller PCI device structure
+ *
+ * Called by remove
+ * Unregister DMa controller, clear all structures and free interrupt
+ */
+static void middma_shutdown(struct pci_dev *pdev)
+{
+        struct middma_device *device = pci_get_drvdata(pdev);
+
+        dma_async_device_unregister(&device->common);
+        pci_pool_destroy(device->dma_pool);
+        if (device->mask_reg)
+                iounmap(device->mask_reg);
+        if (device->dma_base)
+                iounmap(device->dma_base);
+        free_irq(pdev->irq, device);
+        return;
+}
+
+/**
+ * intel_mid_dma_probe -        PCI Probe
+ * @pdev: Controller PCI device structure
+ * @id: pci device id structure
+ *
+ * Initilize the PCI device, map BARs, query driver data.
+ * Call setup_dma to complete contoller and chan initilzation
+ */
+static int __devinit intel_mid_dma_probe(struct pci_dev *pdev,
+                                        const struct pci_device_id *id)
+{
+        struct middma_device *device;
+        u32 base_addr, bar_size;
+        struct intel_mid_dma_probe_info *info;
+        int err;
+
+        pr_debug("MDMA: probe for %x\n", pdev->device);
+        info = (void *)id->driver_data;
+        pr_debug("MDMA: CH %d, base %d, block len %d, Periphral mask %x\n",
+                                info->max_chan, info->ch_base,
+                                info->block_size, info->pimr_mask);
+
+        err = pci_enable_device(pdev);
+        if (err)
+                goto err_enable_device;
+
+        err = pci_request_regions(pdev, "intel_mid_dmac");
+        if (err)
+                goto err_request_regions;
+
+        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (err)
+                goto err_set_dma_mask;
+
+        err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (err)
+                goto err_set_dma_mask;
+
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
+        if (!device) {
+                pr_err("ERR_MDMA:kzalloc failed probe\n");
+                err = -ENOMEM;
+                goto err_kzalloc;
+        }
+        device->pdev = pci_dev_get(pdev);
+
+        base_addr = pci_resource_start(pdev, 0);
+        bar_size  = pci_resource_len(pdev, 0);
+        device->dma_base = ioremap_nocache(base_addr, DMA_REG_SIZE);
+        if (!device->dma_base) {
+                pr_err("ERR_MDMA:ioremap failed\n");
+                err = -ENOMEM;
+                goto err_ioremap;
+        }
+        pci_set_drvdata(pdev, device);
+        pci_set_master(pdev);
+        device->max_chan = info->max_chan;
+        device->chan_base = info->ch_base;
+        device->block_size = info->block_size;
+        device->pimr_mask = info->pimr_mask;
+
+        err = mid_setup_dma(pdev);
+        if (err)
+                goto err_dma;
+
+        return 0;
+
+err_dma:
+        iounmap(device->dma_base);
+err_ioremap:
+        pci_dev_put(pdev);
+        kfree(device);
+err_kzalloc:
+err_set_dma_mask:
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+err_request_regions:
+err_enable_device:
+        pr_err("ERR_MDMA:Probe failed %d\n", err);
+        return err;
+}
+
+/**
+ * intel_mid_dma_remove -       PCI remove
+ * @pdev: Controller PCI device structure
+ *
+ * Free up all resources and data
+ * Call shutdown_dma to complete contoller and chan cleanup
+ */
+static void __devexit intel_mid_dma_remove(struct pci_dev *pdev)
+{
+        struct middma_device *device = pci_get_drvdata(pdev);
+        middma_shutdown(pdev);
+        pci_dev_put(pdev);
+        kfree(device);
+        pci_release_regions(pdev);
+        pci_disable_device(pdev);
+}
+
+/******************************************************************************
+* PCI stuff
+*/
+static struct pci_device_id intel_mid_dma_ids[] = {
+        { PCI_VDEVICE(INTEL, INTEL_MID_DMAC1_ID),       INFO(2, 6, 4095, 0x200020)},
+        { PCI_VDEVICE(INTEL, INTEL_MID_DMAC2_ID),       INFO(2, 0, 2047, 0)},
+        { PCI_VDEVICE(INTEL, INTEL_MID_GP_DMAC2_ID),    INFO(2, 0, 2047, 0)},
+        { PCI_VDEVICE(INTEL, INTEL_MFLD_DMAC1_ID),      INFO(4, 0, 4095, 0x400040)},
+        { 0, }
+};
+MODULE_DEVICE_TABLE(pci, intel_mid_dma_ids);
+
+static struct pci_driver intel_mid_dma_pci = {
+        .name           =       "Intel MID DMA",
+        .id_table       =       intel_mid_dma_ids,
+        .probe          =       intel_mid_dma_probe,
+        .remove         =       __devexit_p(intel_mid_dma_remove),
+};
+
+static int __init intel_mid_dma_init(void)
+{
+        pr_debug("INFO_MDMA: LNW DMA Driver Version %s\n",
+                        INTEL_MID_DMA_DRIVER_VERSION);
+        return pci_register_driver(&intel_mid_dma_pci);
+}
+fs_initcall(intel_mid_dma_init);
+
+static void __exit intel_mid_dma_exit(void)
+{
+        pci_unregister_driver(&intel_mid_dma_pci);
+}
+module_exit(intel_mid_dma_exit);
+
+MODULE_AUTHOR("Vinod Koul <vinod.koul@intel.com>");
+MODULE_DESCRIPTION("Intel (R) MID DMAC Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(INTEL_MID_DMA_DRIVER_VERSION);
diff --git a/drivers/dma/intel_mid_dma_regs.h b/drivers/dma/intel_mid_dma_regs.h
new file mode 100644
index 000000000000..d81aa658ab09
--- /dev/null
+++ b/drivers/dma/intel_mid_dma_regs.h
@@ -0,0 +1,260 @@
+/*
+ *  intel_mid_dma_regs.h - Intel MID DMA Drivers
+ *
+ *  Copyright (C) 2008-10 Intel Corp
+ *  Author: Vinod Koul <vinod.koul@intel.com>
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *
+ */
+#ifndef __INTEL_MID_DMAC_REGS_H__
+#define __INTEL_MID_DMAC_REGS_H__
+
+#include <linux/dmaengine.h>
+#include <linux/dmapool.h>
+#include <linux/pci_ids.h>
+
+#define INTEL_MID_DMA_DRIVER_VERSION "1.0.5"
+
+#define REG_BIT0                0x00000001
+#define REG_BIT8                0x00000100
+
+#define UNMASK_INTR_REG(chan_num) \
+        ((REG_BIT0 << chan_num) | (REG_BIT8 << chan_num))
+#define MASK_INTR_REG(chan_num) (REG_BIT8 << chan_num)
+
+#define ENABLE_CHANNEL(chan_num) \
+        ((REG_BIT0 << chan_num) | (REG_BIT8 << chan_num))
+
+#define DESCS_PER_CHANNEL       16
+/*DMA Registers*/
+/*registers associated with channel programming*/
+#define DMA_REG_SIZE            0x400
+#define DMA_CH_SIZE             0x58
+
+/*CH X REG = (DMA_CH_SIZE)*CH_NO + REG*/
+#define SAR                     0x00 /* Source Address Register*/
+#define DAR                     0x08 /* Destination Address Register*/
+#define CTL_LOW                 0x18 /* Control Register*/
+#define CTL_HIGH                0x1C /* Control Register*/
+#define CFG_LOW                 0x40 /* Configuration Register Low*/
+#define CFG_HIGH                0x44 /* Configuration Register high*/
+
+#define STATUS_TFR              0x2E8
+#define STATUS_BLOCK            0x2F0
+#define STATUS_ERR              0x308
+
+#define RAW_TFR                 0x2C0
+#define RAW_BLOCK               0x2C8
+#define RAW_ERR                 0x2E0
+
+#define MASK_TFR                0x310
+#define MASK_BLOCK              0x318
+#define MASK_SRC_TRAN           0x320
+#define MASK_DST_TRAN           0x328
+#define MASK_ERR                0x330
+
+#define CLEAR_TFR               0x338
+#define CLEAR_BLOCK             0x340
+#define CLEAR_SRC_TRAN          0x348
+#define CLEAR_DST_TRAN          0x350
+#define CLEAR_ERR               0x358
+
+#define INTR_STATUS             0x360
+#define DMA_CFG                 0x398
+#define DMA_CHAN_EN             0x3A0
+
+/*DMA channel control registers*/
+union intel_mid_dma_ctl_lo {
+        struct {
+                u32     int_en:1;       /*enable or disable interrupts*/
+                                        /*should be 0*/
+                u32     dst_tr_width:3; /*destination transfer width*/
+                                        /*usually 32 bits = 010*/
+                u32     src_tr_width:3; /*source transfer width*/
+                                        /*usually 32 bits = 010*/
+                u32     dinc:2;         /*destination address inc/dec*/
+                                        /*For mem:INC=00, Periphral NoINC=11*/
+                u32     sinc:2;         /*source address inc or dec, as above*/
+                u32     dst_msize:3;    /*destination burst transaction length*/
+                                        /*always = 16 ie 011*/
+                u32     src_msize:3;    /*source burst transaction length*/
+                                        /*always = 16 ie 011*/
+                u32     reser1:3;
+                u32     tt_fc:3;        /*transfer type and flow controller*/
+                                        /*M-M = 000
+                                          P-M = 010
+                                          M-P = 001*/
+                u32     dms:2;          /*destination master select = 0*/
+                u32     sms:2;          /*source master select = 0*/
+                u32     llp_dst_en:1;   /*enable/disable destination LLP = 0*/
+                u32     llp_src_en:1;   /*enable/disable source LLP = 0*/
+                u32     reser2:3;
+        } ctlx;
+        u32     ctl_lo;
+};
+
+union intel_mid_dma_ctl_hi {
+        struct {
+                u32     block_ts:12;    /*block transfer size*/
+                                        /*configured by DMAC*/
+                u32     reser:20;
+        } ctlx;
+        u32     ctl_hi;
+
+};
+
+/*DMA channel configuration registers*/
+union intel_mid_dma_cfg_lo {
+        struct {
+                u32     reser1:5;
+                u32     ch_prior:3;     /*channel priority = 0*/
+                u32     ch_susp:1;      /*channel suspend = 0*/
+                u32     fifo_empty:1;   /*FIFO empty or not R bit = 0*/
+                u32     hs_sel_dst:1;   /*select HW/SW destn handshaking*/
+                                        /*HW = 0, SW = 1*/
+                u32     hs_sel_src:1;   /*select HW/SW src handshaking*/
+                u32     reser2:6;
+                u32     dst_hs_pol:1;   /*dest HS interface polarity*/
+                u32     src_hs_pol:1;   /*src HS interface polarity*/
+                u32     max_abrst:10;   /*max AMBA burst len = 0 (no sw limit*/
+                u32     reload_src:1;   /*auto reload src addr =1 if src is P*/
+                u32     reload_dst:1;   /*AR destn addr =1 if dstn is P*/
+        } cfgx;
+        u32     cfg_lo;
+};
+
+union intel_mid_dma_cfg_hi {
+        struct {
+                u32     fcmode:1;       /*flow control mode = 1*/
+                u32     fifo_mode:1;    /*FIFO mode select = 1*/
+                u32     protctl:3;      /*protection control = 0*/
+                u32     rsvd:2;
+                u32     src_per:4;      /*src hw HS interface*/
+                u32     dst_per:4;      /*dstn hw HS interface*/
+                u32     reser2:17;
+        } cfgx;
+        u32     cfg_hi;
+};
+
+/**
+ * struct intel_mid_dma_chan - internal mid representation of a DMA channel
+ * @chan: dma_chan strcture represetation for mid chan
+ * @ch_regs: MMIO register space pointer to channel register
+ * @dma_base: MMIO register space DMA engine base pointer
+ * @ch_id: DMA channel id
+ * @lock: channel spinlock
+ * @completed: DMA cookie
+ * @active_list: current active descriptors
+ * @queue: current queued up descriptors
+ * @free_list: current free descriptors
+ * @slave: dma slave struture
+ * @descs_allocated: total number of decsiptors allocated
+ * @dma: dma device struture pointer
+ * @in_use: bool representing if ch is in use or not
+ */
+struct intel_mid_dma_chan {
+        struct dma_chan         chan;
+        void __iomem            *ch_regs;
+        void __iomem            *dma_base;
+        int                     ch_id;
+        spinlock_t              lock;
+        dma_cookie_t            completed;
+        struct list_head        active_list;
+        struct list_head        queue;
+        struct list_head        free_list;
+        struct intel_mid_dma_slave      *slave;
+        unsigned int            descs_allocated;
+        struct middma_device    *dma;
+        bool                    in_use;
+};
+
+static inline struct intel_mid_dma_chan *to_intel_mid_dma_chan(
+                                                struct dma_chan *chan)
+{
+        return container_of(chan, struct intel_mid_dma_chan, chan);
+}
+
+/**
+ * struct middma_device - internal representation of a DMA device
+ * @pdev: PCI device
+ * @dma_base: MMIO register space pointer of DMA
+ * @dma_pool: for allocating DMA descriptors
+ * @common: embedded struct dma_device
+ * @tasklet: dma tasklet for processing interrupts
+ * @ch: per channel data
+ * @pci_id: DMA device PCI ID
+ * @intr_mask: Interrupt mask to be used
+ * @mask_reg: MMIO register for periphral mask
+ * @chan_base: Base ch index (read from driver data)
+ * @max_chan: max number of chs supported (from drv_data)
+ * @block_size: Block size of DMA transfer supported (from drv_data)
+ * @pimr_mask: MMIO register addr for periphral interrupt (from drv_data)
+ */
+struct middma_device {
+        struct pci_dev          *pdev;
+        void __iomem            *dma_base;
+        struct pci_pool         *dma_pool;
+        struct dma_device       common;
+        struct tasklet_struct   tasklet;
+        struct intel_mid_dma_chan ch[MAX_CHAN];
+        unsigned int            pci_id;
+        unsigned int            intr_mask;
+        void __iomem            *mask_reg;
+        int                     chan_base;
+        int                     max_chan;
+        int                     block_size;
+        unsigned int            pimr_mask;
+};
+
+static inline struct middma_device *to_middma_device(struct dma_device *common)
+{
+        return container_of(common, struct middma_device, common);
+}
+
+struct intel_mid_dma_desc {
+        void __iomem                    *block; /*ch ptr*/
+        struct list_head                desc_node;
+        struct dma_async_tx_descriptor  txd;
+        size_t                          len;
+        dma_addr_t                      sar;
+        dma_addr_t                      dar;
+        u32                             cfg_hi;
+        u32                             cfg_lo;
+        u32                             ctl_lo;
+        u32                             ctl_hi;
+        dma_addr_t                      next;
+        enum dma_data_direction         dirn;
+        enum dma_status                 status;
+        enum intel_mid_dma_width        width; /*width of DMA txn*/
+        enum intel_mid_dma_mode         cfg_mode; /*mode configuration*/
+
+};
+
+static inline int test_ch_en(void __iomem *dma, u32 ch_no)
+{
+        u32 en_reg = ioread32(dma + DMA_CHAN_EN);
+        return (en_reg >> ch_no) & 0x1;
+}
+
+static inline struct intel_mid_dma_desc *to_intel_mid_dma_desc
+                (struct dma_async_tx_descriptor *txd)
+{
+        return container_of(txd, struct intel_mid_dma_desc, txd);
+}
+#endif /*__INTEL_MID_DMAC_REGS_H__*/
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 6d3a73b57e54..5216c8a92a21 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -97,6 +97,7 @@ struct ioat_chan_common {
         #define IOAT_RESET_PENDING 2
         #define IOAT_KOBJ_INIT_FAIL 3
         #define IOAT_RESHAPE_PENDING 4
+        #define IOAT_RUN 5
         struct timer_list timer;
         #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
         #define IDLE_TIMEOUT msecs_to_jiffies(2000)
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 3c8b32a83794..216f9d383b5b 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -287,7 +287,10 @@ void ioat2_timer_event(unsigned long data)
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
                         dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
                                 __func__, chanerr);
-                        BUG_ON(is_ioat_bug(chanerr));
+                        if (test_bit(IOAT_RUN, &chan->state))
+                                BUG_ON(is_ioat_bug(chanerr));
+                        else /* we never got off the ground */
+                                return;
                 }
 
                 /* if we haven't made progress and we have already
@@ -492,6 +495,8 @@ static struct ioat_ring_ent **ioat2_alloc_ring(struct dma_chan *c, int order, gf
         return ring;
 }
 
+void ioat2_free_chan_resources(struct dma_chan *c);
+
 /* ioat2_alloc_chan_resources - allocate/initialize ioat2 descriptor ring
  * @chan: channel to be initialized
  */
@@ -500,6 +505,7 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
         struct ioat_chan_common *chan = &ioat->base;
         struct ioat_ring_ent **ring;
+        u64 status;
         int order;
 
         /* have we already been set up? */
@@ -540,7 +546,20 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
         tasklet_enable(&chan->cleanup_task);
         ioat2_start_null_desc(ioat);
 
-        return 1 << ioat->alloc_order;
+        /* check that we got off the ground */
+        udelay(5);
+        status = ioat_chansts(chan);
+        if (is_ioat_active(status) || is_ioat_idle(status)) {
+                set_bit(IOAT_RUN, &chan->state);
+                return 1 << ioat->alloc_order;
+        } else {
+                u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+
+                dev_WARN(to_dev(chan),
+                        "failed to start channel chanerr: %#x\n", chanerr);
+                ioat2_free_chan_resources(c);
+                return -EFAULT;
+        }
 }
 
 bool reshape_ring(struct ioat2_dma_chan *ioat, int order)
@@ -778,6 +797,7 @@ void ioat2_free_chan_resources(struct dma_chan *c)
         del_timer_sync(&chan->timer);
         device->cleanup_fn((unsigned long) c);
         device->reset_hw(chan);
+        clear_bit(IOAT_RUN, &chan->state);
 
         spin_lock_bh(&chan->cleanup_lock);
         spin_lock_bh(&ioat->prep_lock);
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 1cdd22e1051b..d0f499098479 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -361,7 +361,10 @@ static void ioat3_timer_event(unsigned long data)
                         chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
                         dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
                                 __func__, chanerr);
-                        BUG_ON(is_ioat_bug(chanerr));
+                        if (test_bit(IOAT_RUN, &chan->state))
+                                BUG_ON(is_ioat_bug(chanerr));
+                        else /* we never got off the ground */
+                                return;
                 }
 
                 /* if we haven't made progress and we have already
diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
new file mode 100644
index 000000000000..3533948b88ba
--- /dev/null
+++ b/drivers/dma/pch_dma.c
@@ -0,0 +1,957 @@
+/*
+ * Topcliff PCH DMA controller driver
+ * Copyright (c) 2010 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/dmaengine.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pch_dma.h>
+
+#define DRV_NAME "pch-dma"
+
+#define DMA_CTL0_DISABLE                0x0
+#define DMA_CTL0_SG                     0x1
+#define DMA_CTL0_ONESHOT                0x2
+#define DMA_CTL0_MODE_MASK_BITS         0x3
+#define DMA_CTL0_DIR_SHIFT_BITS         2
+#define DMA_CTL0_BITS_PER_CH            4
+
+#define DMA_CTL2_START_SHIFT_BITS       8
+#define DMA_CTL2_IRQ_ENABLE_MASK        ((1UL << DMA_CTL2_START_SHIFT_BITS) - 1)
+
+#define DMA_STATUS_IDLE                 0x0
+#define DMA_STATUS_DESC_READ            0x1
+#define DMA_STATUS_WAIT                 0x2
+#define DMA_STATUS_ACCESS               0x3
+#define DMA_STATUS_BITS_PER_CH          2
+#define DMA_STATUS_MASK_BITS            0x3
+#define DMA_STATUS_SHIFT_BITS           16
+#define DMA_STATUS_IRQ(x)               (0x1 << (x))
+#define DMA_STATUS_ERR(x)               (0x1 << ((x) + 8))
+
+#define DMA_DESC_WIDTH_SHIFT_BITS       12
+#define DMA_DESC_WIDTH_1_BYTE           (0x3 << DMA_DESC_WIDTH_SHIFT_BITS)
+#define DMA_DESC_WIDTH_2_BYTES          (0x2 << DMA_DESC_WIDTH_SHIFT_BITS)
+#define DMA_DESC_WIDTH_4_BYTES          (0x0 << DMA_DESC_WIDTH_SHIFT_BITS)
+#define DMA_DESC_MAX_COUNT_1_BYTE       0x3FF
+#define DMA_DESC_MAX_COUNT_2_BYTES      0x3FF
+#define DMA_DESC_MAX_COUNT_4_BYTES      0x7FF
+#define DMA_DESC_END_WITHOUT_IRQ        0x0
+#define DMA_DESC_END_WITH_IRQ           0x1
+#define DMA_DESC_FOLLOW_WITHOUT_IRQ     0x2
+#define DMA_DESC_FOLLOW_WITH_IRQ        0x3
+
+#define MAX_CHAN_NR                     8
+
+static unsigned int init_nr_desc_per_channel = 64;
+module_param(init_nr_desc_per_channel, uint, 0644);
+MODULE_PARM_DESC(init_nr_desc_per_channel,
+                 "initial descriptors per channel (default: 64)");
+
+struct pch_dma_desc_regs {
+        u32     dev_addr;
+        u32     mem_addr;
+        u32     size;
+        u32     next;
+};
+
+struct pch_dma_regs {
+        u32     dma_ctl0;
+        u32     dma_ctl1;
+        u32     dma_ctl2;
+        u32     reserved1;
+        u32     dma_sts0;
+        u32     dma_sts1;
+        u32     reserved2;
+        u32     reserved3;
+        struct pch_dma_desc_regs desc[0];
+};
+
+struct pch_dma_desc {
+        struct pch_dma_desc_regs regs;
+        struct dma_async_tx_descriptor txd;
+        struct list_head        desc_node;
+        struct list_head        tx_list;
+};
+
+struct pch_dma_chan {
+        struct dma_chan         chan;
+        void __iomem *membase;
+        enum dma_data_direction dir;
+        struct tasklet_struct   tasklet;
+        unsigned long           err_status;
+
+        spinlock_t              lock;
+
+        dma_cookie_t            completed_cookie;
+        struct list_head        active_list;
+        struct list_head        queue;
+        struct list_head        free_list;
+        unsigned int            descs_allocated;
+};
+
+#define PDC_DEV_ADDR    0x00
+#define PDC_MEM_ADDR    0x04
+#define PDC_SIZE        0x08
+#define PDC_NEXT        0x0C
+
+#define channel_readl(pdc, name) \
+        readl((pdc)->membase + PDC_##name)
+#define channel_writel(pdc, name, val) \
+        writel((val), (pdc)->membase + PDC_##name)
+
+struct pch_dma {
+        struct dma_device       dma;
+        void __iomem *membase;
+        struct pci_pool         *pool;
+        struct pch_dma_regs     regs;
+        struct pch_dma_desc_regs ch_regs[MAX_CHAN_NR];
+        struct pch_dma_chan     channels[0];
+};
+
+#define PCH_DMA_CTL0    0x00
+#define PCH_DMA_CTL1    0x04
+#define PCH_DMA_CTL2    0x08
+#define PCH_DMA_STS0    0x10
+#define PCH_DMA_STS1    0x14
+
+#define dma_readl(pd, name) \
+        readl((pd)->membase + PCH_DMA_##name)
+#define dma_writel(pd, name, val) \
+        writel((val), (pd)->membase + PCH_DMA_##name)
+
+static inline struct pch_dma_desc *to_pd_desc(struct dma_async_tx_descriptor *txd)
+{
+        return container_of(txd, struct pch_dma_desc, txd);
+}
+
+static inline struct pch_dma_chan *to_pd_chan(struct dma_chan *chan)
+{
+        return container_of(chan, struct pch_dma_chan, chan);
+}
+
+static inline struct pch_dma *to_pd(struct dma_device *ddev)
+{
+        return container_of(ddev, struct pch_dma, dma);
+}
+
+static inline struct device *chan2dev(struct dma_chan *chan)
+{
+        return &chan->dev->device;
+}
+
+static inline struct device *chan2parent(struct dma_chan *chan)
+{
+        return chan->dev->device.parent;
+}
+
+static inline struct pch_dma_desc *pdc_first_active(struct pch_dma_chan *pd_chan)
+{
+        return list_first_entry(&pd_chan->active_list,
+                                struct pch_dma_desc, desc_node);
+}
+
+static inline struct pch_dma_desc *pdc_first_queued(struct pch_dma_chan *pd_chan)
+{
+        return list_first_entry(&pd_chan->queue,
+                                struct pch_dma_desc, desc_node);
+}
+
+static void pdc_enable_irq(struct dma_chan *chan, int enable)
+{
+        struct pch_dma *pd = to_pd(chan->device);
+        u32 val;
+
+        val = dma_readl(pd, CTL2);
+
+        if (enable)
+                val |= 0x1 << chan->chan_id;
+        else
+                val &= ~(0x1 << chan->chan_id);
+
+        dma_writel(pd, CTL2, val);
+
+        dev_dbg(chan2dev(chan), "pdc_enable_irq: chan %d -> %x\n",
+                chan->chan_id, val);
+}
+
+static void pdc_set_dir(struct dma_chan *chan)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        struct pch_dma *pd = to_pd(chan->device);
+        u32 val;
+
+        val = dma_readl(pd, CTL0);
+
+        if (pd_chan->dir == DMA_TO_DEVICE)
+                val |= 0x1 << (DMA_CTL0_BITS_PER_CH * chan->chan_id +
+                               DMA_CTL0_DIR_SHIFT_BITS);
+        else
+                val &= ~(0x1 << (DMA_CTL0_BITS_PER_CH * chan->chan_id +
+                                 DMA_CTL0_DIR_SHIFT_BITS));
+
+        dma_writel(pd, CTL0, val);
+
+        dev_dbg(chan2dev(chan), "pdc_set_dir: chan %d -> %x\n",
+                chan->chan_id, val);
+}
+
+static void pdc_set_mode(struct dma_chan *chan, u32 mode)
+{
+        struct pch_dma *pd = to_pd(chan->device);
+        u32 val;
+
+        val = dma_readl(pd, CTL0);
+
+        val &= ~(DMA_CTL0_MODE_MASK_BITS <<
+                (DMA_CTL0_BITS_PER_CH * chan->chan_id));
+        val |= mode << (DMA_CTL0_BITS_PER_CH * chan->chan_id);
+
+        dma_writel(pd, CTL0, val);
+
+        dev_dbg(chan2dev(chan), "pdc_set_mode: chan %d -> %x\n",
+                chan->chan_id, val);
+}
+
+static u32 pdc_get_status(struct pch_dma_chan *pd_chan)
+{
+        struct pch_dma *pd = to_pd(pd_chan->chan.device);
+        u32 val;
+
+        val = dma_readl(pd, STS0);
+        return DMA_STATUS_MASK_BITS & (val >> (DMA_STATUS_SHIFT_BITS +
+                        DMA_STATUS_BITS_PER_CH * pd_chan->chan.chan_id));
+}
+
+static bool pdc_is_idle(struct pch_dma_chan *pd_chan)
+{
+        if (pdc_get_status(pd_chan) == DMA_STATUS_IDLE)
+                return true;
+        else
+                return false;
+}
+
+static void pdc_dostart(struct pch_dma_chan *pd_chan, struct pch_dma_desc* desc)
+{
+        struct pch_dma *pd = to_pd(pd_chan->chan.device);
+        u32 val;
+
+        if (!pdc_is_idle(pd_chan)) {
+                dev_err(chan2dev(&pd_chan->chan),
+                        "BUG: Attempt to start non-idle channel\n");
+                return;
+        }
+
+        channel_writel(pd_chan, DEV_ADDR, desc->regs.dev_addr);
+        channel_writel(pd_chan, MEM_ADDR, desc->regs.mem_addr);
+        channel_writel(pd_chan, SIZE, desc->regs.size);
+        channel_writel(pd_chan, NEXT, desc->regs.next);
+
+        dev_dbg(chan2dev(&pd_chan->chan), "chan %d -> dev_addr: %x\n",
+                pd_chan->chan.chan_id, desc->regs.dev_addr);
+        dev_dbg(chan2dev(&pd_chan->chan), "chan %d -> mem_addr: %x\n",
+                pd_chan->chan.chan_id, desc->regs.mem_addr);
+        dev_dbg(chan2dev(&pd_chan->chan), "chan %d -> size: %x\n",
+                pd_chan->chan.chan_id, desc->regs.size);
+        dev_dbg(chan2dev(&pd_chan->chan), "chan %d -> next: %x\n",
+                pd_chan->chan.chan_id, desc->regs.next);
+
+        if (list_empty(&desc->tx_list))
+                pdc_set_mode(&pd_chan->chan, DMA_CTL0_ONESHOT);
+        else
+                pdc_set_mode(&pd_chan->chan, DMA_CTL0_SG);
+
+        val = dma_readl(pd, CTL2);
+        val |= 1 << (DMA_CTL2_START_SHIFT_BITS + pd_chan->chan.chan_id);
+        dma_writel(pd, CTL2, val);
+}
+
+static void pdc_chain_complete(struct pch_dma_chan *pd_chan,
+                               struct pch_dma_desc *desc)
+{
+        struct dma_async_tx_descriptor *txd = &desc->txd;
+        dma_async_tx_callback callback = txd->callback;
+        void *param = txd->callback_param;
+
+        list_splice_init(&desc->tx_list, &pd_chan->free_list);
+        list_move(&desc->desc_node, &pd_chan->free_list);
+
+        if (callback)
+                callback(param);
+}
+
+static void pdc_complete_all(struct pch_dma_chan *pd_chan)
+{
+        struct pch_dma_desc *desc, *_d;
+        LIST_HEAD(list);
+
+        BUG_ON(!pdc_is_idle(pd_chan));
+
+        if (!list_empty(&pd_chan->queue))
+                pdc_dostart(pd_chan, pdc_first_queued(pd_chan));
+
+        list_splice_init(&pd_chan->active_list, &list);
+        list_splice_init(&pd_chan->queue, &pd_chan->active_list);
+
+        list_for_each_entry_safe(desc, _d, &list, desc_node)
+                pdc_chain_complete(pd_chan, desc);
+}
+
+static void pdc_handle_error(struct pch_dma_chan *pd_chan)
+{
+        struct pch_dma_desc *bad_desc;
+
+        bad_desc = pdc_first_active(pd_chan);
+        list_del(&bad_desc->desc_node);
+
+        list_splice_init(&pd_chan->queue, pd_chan->active_list.prev);
+
+        if (!list_empty(&pd_chan->active_list))
+                pdc_dostart(pd_chan, pdc_first_active(pd_chan));
+
+        dev_crit(chan2dev(&pd_chan->chan), "Bad descriptor submitted\n");
+        dev_crit(chan2dev(&pd_chan->chan), "descriptor cookie: %d\n",
+                 bad_desc->txd.cookie);
+
+        pdc_chain_complete(pd_chan, bad_desc);
+}
+
+static void pdc_advance_work(struct pch_dma_chan *pd_chan)
+{
+        if (list_empty(&pd_chan->active_list) ||
+                list_is_singular(&pd_chan->active_list)) {
+                pdc_complete_all(pd_chan);
+        } else {
+                pdc_chain_complete(pd_chan, pdc_first_active(pd_chan));
+                pdc_dostart(pd_chan, pdc_first_active(pd_chan));
+        }
+}
+
+static dma_cookie_t pdc_assign_cookie(struct pch_dma_chan *pd_chan,
+                                      struct pch_dma_desc *desc)
+{
+        dma_cookie_t cookie = pd_chan->chan.cookie;
+
+        if (++cookie < 0)
+                cookie = 1;
+
+        pd_chan->chan.cookie = cookie;
+        desc->txd.cookie = cookie;
+
+        return cookie;
+}
+
+static dma_cookie_t pd_tx_submit(struct dma_async_tx_descriptor *txd)
+{
+        struct pch_dma_desc *desc = to_pd_desc(txd);
+        struct pch_dma_chan *pd_chan = to_pd_chan(txd->chan);
+        dma_cookie_t cookie;
+
+        spin_lock_bh(&pd_chan->lock);
+        cookie = pdc_assign_cookie(pd_chan, desc);
+
+        if (list_empty(&pd_chan->active_list)) {
+                list_add_tail(&desc->desc_node, &pd_chan->active_list);
+                pdc_dostart(pd_chan, desc);
+        } else {
+                list_add_tail(&desc->desc_node, &pd_chan->queue);
+        }
+
+        spin_unlock_bh(&pd_chan->lock);
+        return 0;
+}
+
+static struct pch_dma_desc *pdc_alloc_desc(struct dma_chan *chan, gfp_t flags)
+{
+        struct pch_dma_desc *desc = NULL;
+        struct pch_dma *pd = to_pd(chan->device);
+        dma_addr_t addr;
+
+        desc = pci_pool_alloc(pd->pool, GFP_KERNEL, &addr);
+        if (desc) {
+                memset(desc, 0, sizeof(struct pch_dma_desc));
+                INIT_LIST_HEAD(&desc->tx_list);
+                dma_async_tx_descriptor_init(&desc->txd, chan);
+                desc->txd.tx_submit = pd_tx_submit;
+                desc->txd.flags = DMA_CTRL_ACK;
+                desc->txd.phys = addr;
+        }
+
+        return desc;
+}
+
+static struct pch_dma_desc *pdc_desc_get(struct pch_dma_chan *pd_chan)
+{
+        struct pch_dma_desc *desc, *_d;
+        struct pch_dma_desc *ret = NULL;
+        int i;
+
+        spin_lock_bh(&pd_chan->lock);
+        list_for_each_entry_safe(desc, _d, &pd_chan->free_list, desc_node) {
+                i++;
+                if (async_tx_test_ack(&desc->txd)) {
+                        list_del(&desc->desc_node);
+                        ret = desc;
+                        break;
+                }
+                dev_dbg(chan2dev(&pd_chan->chan), "desc %p not ACKed\n", desc);
+        }
+        spin_unlock_bh(&pd_chan->lock);
+        dev_dbg(chan2dev(&pd_chan->chan), "scanned %d descriptors\n", i);
+
+        if (!ret) {
+                ret = pdc_alloc_desc(&pd_chan->chan, GFP_NOIO);
+                if (ret) {
+                        spin_lock_bh(&pd_chan->lock);
+                        pd_chan->descs_allocated++;
+                        spin_unlock_bh(&pd_chan->lock);
+                } else {
+                        dev_err(chan2dev(&pd_chan->chan),
+                                "failed to alloc desc\n");
+                }
+        }
+
+        return ret;
+}
+
+static void pdc_desc_put(struct pch_dma_chan *pd_chan,
+                         struct pch_dma_desc *desc)
+{
+        if (desc) {
+                spin_lock_bh(&pd_chan->lock);
+                list_splice_init(&desc->tx_list, &pd_chan->free_list);
+                list_add(&desc->desc_node, &pd_chan->free_list);
+                spin_unlock_bh(&pd_chan->lock);
+        }
+}
+
+static int pd_alloc_chan_resources(struct dma_chan *chan)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        struct pch_dma_desc *desc;
+        LIST_HEAD(tmp_list);
+        int i;
+
+        if (!pdc_is_idle(pd_chan)) {
+                dev_dbg(chan2dev(chan), "DMA channel not idle ?\n");
+                return -EIO;
+        }
+
+        if (!list_empty(&pd_chan->free_list))
+                return pd_chan->descs_allocated;
+
+        for (i = 0; i < init_nr_desc_per_channel; i++) {
+                desc = pdc_alloc_desc(chan, GFP_KERNEL);
+
+                if (!desc) {
+                        dev_warn(chan2dev(chan),
+                                "Only allocated %d initial descriptors\n", i);
+                        break;
+                }
+
+                list_add_tail(&desc->desc_node, &tmp_list);
+        }
+
+        spin_lock_bh(&pd_chan->lock);
+        list_splice(&tmp_list, &pd_chan->free_list);
+        pd_chan->descs_allocated = i;
+        pd_chan->completed_cookie = chan->cookie = 1;
+        spin_unlock_bh(&pd_chan->lock);
+
+        pdc_enable_irq(chan, 1);
+        pdc_set_dir(chan);
+
+        return pd_chan->descs_allocated;
+}
+
+static void pd_free_chan_resources(struct dma_chan *chan)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        struct pch_dma *pd = to_pd(chan->device);
+        struct pch_dma_desc *desc, *_d;
+        LIST_HEAD(tmp_list);
+
+        BUG_ON(!pdc_is_idle(pd_chan));
+        BUG_ON(!list_empty(&pd_chan->active_list));
+        BUG_ON(!list_empty(&pd_chan->queue));
+
+        spin_lock_bh(&pd_chan->lock);
+        list_splice_init(&pd_chan->free_list, &tmp_list);
+        pd_chan->descs_allocated = 0;
+        spin_unlock_bh(&pd_chan->lock);
+
+        list_for_each_entry_safe(desc, _d, &tmp_list, desc_node)
+                pci_pool_free(pd->pool, desc, desc->txd.phys);
+
+        pdc_enable_irq(chan, 0);
+}
+
+static enum dma_status pd_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
+                                    struct dma_tx_state *txstate)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        dma_cookie_t last_used;
+        dma_cookie_t last_completed;
+        int ret;
+
+        spin_lock_bh(&pd_chan->lock);
+        last_completed = pd_chan->completed_cookie;
+        last_used = chan->cookie;
+        spin_unlock_bh(&pd_chan->lock);
+
+        ret = dma_async_is_complete(cookie, last_completed, last_used);
+
+        dma_set_tx_state(txstate, last_completed, last_used, 0);
+
+        return ret;
+}
+
+static void pd_issue_pending(struct dma_chan *chan)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+
+        if (pdc_is_idle(pd_chan)) {
+                spin_lock_bh(&pd_chan->lock);
+                pdc_advance_work(pd_chan);
+                spin_unlock_bh(&pd_chan->lock);
+        }
+}
+
+static struct dma_async_tx_descriptor *pd_prep_slave_sg(struct dma_chan *chan,
+                        struct scatterlist *sgl, unsigned int sg_len,
+                        enum dma_data_direction direction, unsigned long flags)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        struct pch_dma_slave *pd_slave = chan->private;
+        struct pch_dma_desc *first = NULL;
+        struct pch_dma_desc *prev = NULL;
+        struct pch_dma_desc *desc = NULL;
+        struct scatterlist *sg;
+        dma_addr_t reg;
+        int i;
+
+        if (unlikely(!sg_len)) {
+                dev_info(chan2dev(chan), "prep_slave_sg: length is zero!\n");
+                return NULL;
+        }
+
+        if (direction == DMA_FROM_DEVICE)
+                reg = pd_slave->rx_reg;
+        else if (direction == DMA_TO_DEVICE)
+                reg = pd_slave->tx_reg;
+        else
+                return NULL;
+
+        for_each_sg(sgl, sg, sg_len, i) {
+                desc = pdc_desc_get(pd_chan);
+
+                if (!desc)
+                        goto err_desc_get;
+
+                desc->regs.dev_addr = reg;
+                desc->regs.mem_addr = sg_phys(sg);
+                desc->regs.size = sg_dma_len(sg);
+                desc->regs.next = DMA_DESC_FOLLOW_WITHOUT_IRQ;
+
+                switch (pd_slave->width) {
+                case PCH_DMA_WIDTH_1_BYTE:
+                        if (desc->regs.size > DMA_DESC_MAX_COUNT_1_BYTE)
+                                goto err_desc_get;
+                        desc->regs.size |= DMA_DESC_WIDTH_1_BYTE;
+                        break;
+                case PCH_DMA_WIDTH_2_BYTES:
+                        if (desc->regs.size > DMA_DESC_MAX_COUNT_2_BYTES)
+                                goto err_desc_get;
+                        desc->regs.size |= DMA_DESC_WIDTH_2_BYTES;
+                        break;
+                case PCH_DMA_WIDTH_4_BYTES:
+                        if (desc->regs.size > DMA_DESC_MAX_COUNT_4_BYTES)
+                                goto err_desc_get;
+                        desc->regs.size |= DMA_DESC_WIDTH_4_BYTES;
+                        break;
+                default:
+                        goto err_desc_get;
+                }
+
+
+                if (!first) {
+                        first = desc;
+                } else {
+                        prev->regs.next |= desc->txd.phys;
+                        list_add_tail(&desc->desc_node, &first->tx_list);
+                }
+
+                prev = desc;
+        }
+
+        if (flags & DMA_PREP_INTERRUPT)
+                desc->regs.next = DMA_DESC_END_WITH_IRQ;
+        else
+                desc->regs.next = DMA_DESC_END_WITHOUT_IRQ;
+
+        first->txd.cookie = -EBUSY;
+        desc->txd.flags = flags;
+
+        return &first->txd;
+
+err_desc_get:
+        dev_err(chan2dev(chan), "failed to get desc or wrong parameters\n");
+        pdc_desc_put(pd_chan, first);
+        return NULL;
+}
+
+static int pd_device_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
+                             unsigned long arg)
+{
+        struct pch_dma_chan *pd_chan = to_pd_chan(chan);
+        struct pch_dma_desc *desc, *_d;
+        LIST_HEAD(list);
+
+        if (cmd != DMA_TERMINATE_ALL)
+                return -ENXIO;
+
+        spin_lock_bh(&pd_chan->lock);
+
+        pdc_set_mode(&pd_chan->chan, DMA_CTL0_DISABLE);
+
+        list_splice_init(&pd_chan->active_list, &list);
+        list_splice_init(&pd_chan->queue, &list);
+
+        list_for_each_entry_safe(desc, _d, &list, desc_node)
+                pdc_chain_complete(pd_chan, desc);
+
+        spin_unlock_bh(&pd_chan->lock);
+
+
+        return 0;
+}
+
+static void pdc_tasklet(unsigned long data)
+{
+        struct pch_dma_chan *pd_chan = (struct pch_dma_chan *)data;
+
+        if (!pdc_is_idle(pd_chan)) {
+                dev_err(chan2dev(&pd_chan->chan),
+                        "BUG: handle non-idle channel in tasklet\n");
+                return;
+        }
+
+        spin_lock_bh(&pd_chan->lock);
+        if (test_and_clear_bit(0, &pd_chan->err_status))
+                pdc_handle_error(pd_chan);
+        else
+                pdc_advance_work(pd_chan);
+        spin_unlock_bh(&pd_chan->lock);
+}
+
+static irqreturn_t pd_irq(int irq, void *devid)
+{
+        struct pch_dma *pd = (struct pch_dma *)devid;
+        struct pch_dma_chan *pd_chan;
+        u32 sts0;
+        int i;
+        int ret = IRQ_NONE;
+
+        sts0 = dma_readl(pd, STS0);
+
+        dev_dbg(pd->dma.dev, "pd_irq sts0: %x\n", sts0);
+
+        for (i = 0; i < pd->dma.chancnt; i++) {
+                pd_chan = &pd->channels[i];
+
+                if (sts0 & DMA_STATUS_IRQ(i)) {
+                        if (sts0 & DMA_STATUS_ERR(i))
+                                set_bit(0, &pd_chan->err_status);
+
+                        tasklet_schedule(&pd_chan->tasklet);
+                        ret = IRQ_HANDLED;
+                }
+
+        }
+
+        /* clear interrupt bits in status register */
+        dma_writel(pd, STS0, sts0);
+
+        return ret;
+}
+
+static void pch_dma_save_regs(struct pch_dma *pd)
+{
+        struct pch_dma_chan *pd_chan;
+        struct dma_chan *chan, *_c;
+        int i = 0;
+
+        pd->regs.dma_ctl0 = dma_readl(pd, CTL0);
+        pd->regs.dma_ctl1 = dma_readl(pd, CTL1);
+        pd->regs.dma_ctl2 = dma_readl(pd, CTL2);
+
+        list_for_each_entry_safe(chan, _c, &pd->dma.channels, device_node) {
+                pd_chan = to_pd_chan(chan);
+
+                pd->ch_regs[i].dev_addr = channel_readl(pd_chan, DEV_ADDR);
+                pd->ch_regs[i].mem_addr = channel_readl(pd_chan, MEM_ADDR);
+                pd->ch_regs[i].size = channel_readl(pd_chan, SIZE);
+                pd->ch_regs[i].next = channel_readl(pd_chan, NEXT);
+
+                i++;
+        }
+}
+
+static void pch_dma_restore_regs(struct pch_dma *pd)
+{
+        struct pch_dma_chan *pd_chan;
+        struct dma_chan *chan, *_c;
+        int i = 0;
+
+        dma_writel(pd, CTL0, pd->regs.dma_ctl0);
+        dma_writel(pd, CTL1, pd->regs.dma_ctl1);
+        dma_writel(pd, CTL2, pd->regs.dma_ctl2);
+
+        list_for_each_entry_safe(chan, _c, &pd->dma.channels, device_node) {
+                pd_chan = to_pd_chan(chan);
+
+                channel_writel(pd_chan, DEV_ADDR, pd->ch_regs[i].dev_addr);
+                channel_writel(pd_chan, MEM_ADDR, pd->ch_regs[i].mem_addr);
+                channel_writel(pd_chan, SIZE, pd->ch_regs[i].size);
+                channel_writel(pd_chan, NEXT, pd->ch_regs[i].next);
+
+                i++;
+        }
+}
+
+static int pch_dma_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct pch_dma *pd = pci_get_drvdata(pdev);
+
+        if (pd)
+                pch_dma_save_regs(pd);
+
+        pci_save_state(pdev);
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+
+        return 0;
+}
+
+static int pch_dma_resume(struct pci_dev *pdev)
+{
+        struct pch_dma *pd = pci_get_drvdata(pdev);
+        int err;
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                dev_dbg(&pdev->dev, "failed to enable device\n");
+                return err;
+        }
+
+        if (pd)
+                pch_dma_restore_regs(pd);
+
+        return 0;
+}
+
+static int __devinit pch_dma_probe(struct pci_dev *pdev,
+                                   const struct pci_device_id *id)
+{
+        struct pch_dma *pd;
+        struct pch_dma_regs *regs;
+        unsigned int nr_channels;
+        int err;
+        int i;
+
+        nr_channels = id->driver_data;
+        pd = kzalloc(sizeof(struct pch_dma)+
+                sizeof(struct pch_dma_chan) * nr_channels, GFP_KERNEL);
+        if (!pd)
+                return -ENOMEM;
+
+        pci_set_drvdata(pdev, pd);
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "Cannot enable PCI device\n");
+                goto err_free_mem;
+        }
+
+        if (!(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+                dev_err(&pdev->dev, "Cannot find proper base address\n");
+                goto err_disable_pdev;
+        }
+
+        err = pci_request_regions(pdev, DRV_NAME);
+        if (err) {
+                dev_err(&pdev->dev, "Cannot obtain PCI resources\n");
+                goto err_disable_pdev;
+        }
+
+        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+        if (err) {
+                dev_err(&pdev->dev, "Cannot set proper DMA config\n");
+                goto err_free_res;
+        }
+
+        regs = pd->membase = pci_iomap(pdev, 1, 0);
+        if (!pd->membase) {
+                dev_err(&pdev->dev, "Cannot map MMIO registers\n");
+                err = -ENOMEM;
+                goto err_free_res;
+        }
+
+        pci_set_master(pdev);
+
+        err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to request IRQ\n");
+                goto err_iounmap;
+        }
+
+        pd->pool = pci_pool_create("pch_dma_desc_pool", pdev,
+                                   sizeof(struct pch_dma_desc), 4, 0);
+        if (!pd->pool) {
+                dev_err(&pdev->dev, "Failed to alloc DMA descriptors\n");
+                err = -ENOMEM;
+                goto err_free_irq;
+        }
+
+        pd->dma.dev = &pdev->dev;
+        pd->dma.chancnt = nr_channels;
+
+        INIT_LIST_HEAD(&pd->dma.channels);
+
+        for (i = 0; i < nr_channels; i++) {
+                struct pch_dma_chan *pd_chan = &pd->channels[i];
+
+                pd_chan->chan.device = &pd->dma;
+                pd_chan->chan.cookie = 1;
+                pd_chan->chan.chan_id = i;
+
+                pd_chan->membase = &regs->desc[i];
+
+                pd_chan->dir = (i % 2) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+
+                spin_lock_init(&pd_chan->lock);
+
+                INIT_LIST_HEAD(&pd_chan->active_list);
+                INIT_LIST_HEAD(&pd_chan->queue);
+                INIT_LIST_HEAD(&pd_chan->free_list);
+
+                tasklet_init(&pd_chan->tasklet, pdc_tasklet,
+                             (unsigned long)pd_chan);
+                list_add_tail(&pd_chan->chan.device_node, &pd->dma.channels);
+        }
+
+        dma_cap_zero(pd->dma.cap_mask);
+        dma_cap_set(DMA_PRIVATE, pd->dma.cap_mask);
+        dma_cap_set(DMA_SLAVE, pd->dma.cap_mask);
+
+        pd->dma.device_alloc_chan_resources = pd_alloc_chan_resources;
+        pd->dma.device_free_chan_resources = pd_free_chan_resources;
+        pd->dma.device_tx_status = pd_tx_status;
+        pd->dma.device_issue_pending = pd_issue_pending;
+        pd->dma.device_prep_slave_sg = pd_prep_slave_sg;
+        pd->dma.device_control = pd_device_control;
+
+        err = dma_async_device_register(&pd->dma);
+        if (err) {
+                dev_err(&pdev->dev, "Failed to register DMA device\n");
+                goto err_free_pool;
+        }
+
+        return 0;
+
+err_free_pool:
+        pci_pool_destroy(pd->pool);
+err_free_irq:
+        free_irq(pdev->irq, pd);
+err_iounmap:
+        pci_iounmap(pdev, pd->membase);
+err_free_res:
+        pci_release_regions(pdev);
+err_disable_pdev:
+        pci_disable_device(pdev);
+err_free_mem:
+        return err;
+}
+
+static void __devexit pch_dma_remove(struct pci_dev *pdev)
+{
+        struct pch_dma *pd = pci_get_drvdata(pdev);
+        struct pch_dma_chan *pd_chan;
+        struct dma_chan *chan, *_c;
+
+        if (pd) {
+                dma_async_device_unregister(&pd->dma);
+
+                list_for_each_entry_safe(chan, _c, &pd->dma.channels,
+                                         device_node) {
+                        pd_chan = to_pd_chan(chan);
+
+                        tasklet_disable(&pd_chan->tasklet);
+                        tasklet_kill(&pd_chan->tasklet);
+                }
+
+                pci_pool_destroy(pd->pool);
+                free_irq(pdev->irq, pd);
+                pci_iounmap(pdev, pd->membase);
+                pci_release_regions(pdev);
+                pci_disable_device(pdev);
+                kfree(pd);
+        }
+}
+
+/* PCI Device ID of DMA device */
+#define PCI_DEVICE_ID_PCH_DMA_8CH        0x8810
+#define PCI_DEVICE_ID_PCH_DMA_4CH        0x8815
+
+static const struct pci_device_id pch_dma_id_table[] = {
+        { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PCH_DMA_8CH), 8 },
+        { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_PCH_DMA_4CH), 4 },
+};
+
+static struct pci_driver pch_dma_driver = {
+        .name           = DRV_NAME,
+        .id_table       = pch_dma_id_table,
+        .probe          = pch_dma_probe,
+        .remove         = __devexit_p(pch_dma_remove),
+#ifdef CONFIG_PM
+        .suspend        = pch_dma_suspend,
+        .resume         = pch_dma_resume,
+#endif
+};
+
+static int __init pch_dma_init(void)
+{
+        return pci_register_driver(&pch_dma_driver);
+}
+
+static void __exit pch_dma_exit(void)
+{
+        pci_unregister_driver(&pch_dma_driver);
+}
+
+module_init(pch_dma_init);
+module_exit(pch_dma_exit);
+
+MODULE_DESCRIPTION("Topcliff PCH DMA controller driver");
+MODULE_AUTHOR("Yong Wang <yong.y.wang@intel.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index c426829f6ab8..17e2600a00cf 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -30,14 +30,16 @@
 /* Maximum iterations taken before giving up suspending a channel */
 #define D40_SUSPEND_MAX_IT 500
 
+/* Hardware requirement on LCLA alignment */
+#define LCLA_ALIGNMENT 0x40000
+/* Attempts before giving up to trying to get pages that are aligned */
+#define MAX_LCLA_ALLOC_ATTEMPTS 256
+
+/* Bit markings for allocation map */
 #define D40_ALLOC_FREE          (1 << 31)
 #define D40_ALLOC_PHY           (1 << 30)
 #define D40_ALLOC_LOG_FREE      0
 
-/* The number of free d40_desc to keep in memory before starting
- * to kfree() them */
-#define D40_DESC_CACHE_SIZE 50
-
 /* Hardware designer of the block */
 #define D40_PERIPHID2_DESIGNER 0x8
 
@@ -68,9 +70,9 @@ enum d40_command {
  */
 struct d40_lli_pool {
         void    *base;
-        int     size;
+        int      size;
         /* Space for dst and src, plus an extra for padding */
-        u8      pre_alloc_lli[3 * sizeof(struct d40_phy_lli)];
+        u8       pre_alloc_lli[3 * sizeof(struct d40_phy_lli)];
 };
 
 /**
@@ -81,9 +83,10 @@ struct d40_lli_pool {
  * lli_len equals one.
  * @lli_log: Same as above but for logical channels.
  * @lli_pool: The pool with two entries pre-allocated.
- * @lli_len: Number of LLI's in lli_pool
- * @lli_tcount: Number of LLIs processed in the transfer. When equals lli_len
- * then this transfer job is done.
+ * @lli_len: Number of llis of current descriptor.
+ * @lli_count: Number of transfered llis.
+ * @lli_tx_len: Max number of LLIs per transfer, there can be
+ * many transfer for one descriptor.
  * @txd: DMA engine struct. Used for among other things for communication
  * during a transfer.
  * @node: List entry.
@@ -100,8 +103,9 @@ struct d40_desc {
         struct d40_log_lli_bidir         lli_log;
 
         struct d40_lli_pool              lli_pool;
-        u32                              lli_len;
-        u32                              lli_tcount;
+        int                              lli_len;
+        int                              lli_count;
+        u32                              lli_tx_len;
 
         struct dma_async_tx_descriptor   txd;
         struct list_head                 node;
@@ -113,18 +117,20 @@ struct d40_desc {
 /**
  * struct d40_lcla_pool - LCLA pool settings and data.
  *
- * @base: The virtual address of LCLA.
- * @phy: Physical base address of LCLA.
- * @base_size: size of lcla.
+ * @base: The virtual address of LCLA. 18 bit aligned.
+ * @base_unaligned: The orignal kmalloc pointer, if kmalloc is used.
+ * This pointer is only there for clean-up on error.
+ * @pages: The number of pages needed for all physical channels.
+ * Only used later for clean-up on error
  * @lock: Lock to protect the content in this struct.
- * @alloc_map: Mapping between physical channel and LCLA entries.
+ * @alloc_map: Bitmap mapping between physical channel and LCLA entries.
  * @num_blocks: The number of entries of alloc_map. Equals to the
  * number of physical channels.
  */
 struct d40_lcla_pool {
         void            *base;
-        dma_addr_t       phy;
-        resource_size_t  base_size;
+        void            *base_unaligned;
+        int              pages;
         spinlock_t       lock;
         u32             *alloc_map;
         int              num_blocks;
@@ -163,15 +169,14 @@ struct d40_base;
  * @pending_tx: The number of pending transfers. Used between interrupt handler
  * and tasklet.
  * @busy: Set to true when transfer is ongoing on this channel.
- * @phy_chan: Pointer to physical channel which this instance runs on.
+ * @phy_chan: Pointer to physical channel which this instance runs on. If this
+ * point is NULL, then the channel is not allocated.
  * @chan: DMA engine handle.
  * @tasklet: Tasklet that gets scheduled from interrupt context to complete a
  * transfer and call client callback.
  * @client: Cliented owned descriptor list.
  * @active: Active descriptor.
  * @queue: Queued jobs.
- * @free: List of free descripts, ready to be reused.
- * @free_len: Number of descriptors in the free list.
  * @dma_cfg: The client configuration of this dma channel.
  * @base: Pointer to the device instance struct.
  * @src_def_cfg: Default cfg register setting for src.
@@ -195,8 +200,6 @@ struct d40_chan {
         struct list_head                 client;
         struct list_head                 active;
         struct list_head                 queue;
-        struct list_head                 free;
-        int                              free_len;
         struct stedma40_chan_cfg         dma_cfg;
         struct d40_base                 *base;
         /* Default register configurations */
@@ -205,6 +208,9 @@ struct d40_chan {
         struct d40_def_lcsp              log_def;
         struct d40_lcla_elem             lcla;
         struct d40_log_lli_full         *lcpa;
+        /* Runtime reconfiguration */
+        dma_addr_t                      runtime_addr;
+        enum dma_data_direction         runtime_direction;
 };
 
 /**
@@ -215,6 +221,7 @@ struct d40_chan {
  * the same physical register.
  * @dev: The device structure.
  * @virtbase: The virtual base address of the DMA's register.
+ * @rev: silicon revision detected.
  * @clk: Pointer to the DMA clock structure.
  * @phy_start: Physical memory start of the DMA registers.
  * @phy_size: Size of the DMA register map.
@@ -240,12 +247,14 @@ struct d40_chan {
  * @lcpa_base: The virtual mapped address of LCPA.
  * @phy_lcpa: The physical address of the LCPA.
  * @lcpa_size: The size of the LCPA area.
+ * @desc_slab: cache for descriptors.
  */
 struct d40_base {
         spinlock_t                       interrupt_lock;
         spinlock_t                       execmd_lock;
         struct device                    *dev;
         void __iomem                     *virtbase;
+        u8                                rev:4;
         struct clk                       *clk;
         phys_addr_t                       phy_start;
         resource_size_t                   phy_size;
@@ -266,6 +275,7 @@ struct d40_base {
         void                             *lcpa_base;
         dma_addr_t                        phy_lcpa;
         resource_size_t                   lcpa_size;
+        struct kmem_cache                *desc_slab;
 };
 
 /**
@@ -365,11 +375,6 @@ static dma_cookie_t d40_assign_cookie(struct d40_chan *d40c,
         return cookie;
 }
 
-static void d40_desc_reset(struct d40_desc *d40d)
-{
-        d40d->lli_tcount = 0;
-}
-
 static void d40_desc_remove(struct d40_desc *d40d)
 {
         list_del(&d40d->node);
@@ -377,7 +382,6 @@ static void d40_desc_remove(struct d40_desc *d40d)
 
 static struct d40_desc *d40_desc_get(struct d40_chan *d40c)
 {
-        struct d40_desc *desc;
         struct d40_desc *d;
         struct d40_desc *_d;
 
@@ -386,36 +390,21 @@ static struct d40_desc *d40_desc_get(struct d40_chan *d40c)
                         if (async_tx_test_ack(&d->txd)) {
                                 d40_pool_lli_free(d);
                                 d40_desc_remove(d);
-                                desc = d;
-                                goto out;
+                                break;
                         }
-        }
-
-        if (list_empty(&d40c->free)) {
-                /* Alloc new desc because we're out of used ones */
-                desc = kzalloc(sizeof(struct d40_desc), GFP_NOWAIT);
-                if (desc == NULL)
-                        goto out;
-                INIT_LIST_HEAD(&desc->node);
         } else {
-                /* Reuse an old desc. */
-                desc = list_first_entry(&d40c->free,
-                                        struct d40_desc,
-                                        node);
-                list_del(&desc->node);
-                d40c->free_len--;
+                d = kmem_cache_alloc(d40c->base->desc_slab, GFP_NOWAIT);
+                if (d != NULL) {
+                        memset(d, 0, sizeof(struct d40_desc));
+                        INIT_LIST_HEAD(&d->node);
+                }
         }
-out:
-        return desc;
+        return d;
 }
 
 static void d40_desc_free(struct d40_chan *d40c, struct d40_desc *d40d)
 {
-        if (d40c->free_len < D40_DESC_CACHE_SIZE) {
-                list_add_tail(&d40d->node, &d40c->free);
-                d40c->free_len++;
-        } else
-                kfree(d40d);
+        kmem_cache_free(d40c->base->desc_slab, d40d);
 }
 
 static void d40_desc_submit(struct d40_chan *d40c, struct d40_desc *desc)
@@ -456,37 +445,41 @@ static struct d40_desc *d40_first_queued(struct d40_chan *d40c)
 
 /* Support functions for logical channels */
 
-static int d40_lcla_id_get(struct d40_chan *d40c,
-                           struct d40_lcla_pool *pool)
+static int d40_lcla_id_get(struct d40_chan *d40c)
 {
         int src_id = 0;
         int dst_id = 0;
         struct d40_log_lli *lcla_lidx_base =
-                pool->base + d40c->phy_chan->num * 1024;
+                d40c->base->lcla_pool.base + d40c->phy_chan->num * 1024;
         int i;
         int lli_per_log = d40c->base->plat_data->llis_per_log;
+        unsigned long flags;
 
         if (d40c->lcla.src_id >= 0 && d40c->lcla.dst_id >= 0)
                 return 0;
 
-        if (pool->num_blocks > 32)
+        if (d40c->base->lcla_pool.num_blocks > 32)
                 return -EINVAL;
 
-        spin_lock(&pool->lock);
+        spin_lock_irqsave(&d40c->base->lcla_pool.lock, flags);
 
-        for (i = 0; i < pool->num_blocks; i++) {
-                if (!(pool->alloc_map[d40c->phy_chan->num] & (0x1 << i))) {
-                        pool->alloc_map[d40c->phy_chan->num] |= (0x1 << i);
+        for (i = 0; i < d40c->base->lcla_pool.num_blocks; i++) {
+                if (!(d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] &
+                      (0x1 << i))) {
+                        d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] |=
+                                (0x1 << i);
                         break;
                 }
         }
         src_id = i;
-        if (src_id >= pool->num_blocks)
+        if (src_id >= d40c->base->lcla_pool.num_blocks)
                 goto err;
 
-        for (; i < pool->num_blocks; i++) {
-                if (!(pool->alloc_map[d40c->phy_chan->num] & (0x1 << i))) {
-                        pool->alloc_map[d40c->phy_chan->num] |= (0x1 << i);
+        for (; i < d40c->base->lcla_pool.num_blocks; i++) {
+                if (!(d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] &
+                      (0x1 << i))) {
+                        d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] |=
+                                (0x1 << i);
                         break;
                 }
         }
@@ -500,28 +493,13 @@ static int d40_lcla_id_get(struct d40_chan *d40c,
         d40c->lcla.dst = lcla_lidx_base + dst_id * lli_per_log + 1;
         d40c->lcla.src = lcla_lidx_base + src_id * lli_per_log + 1;
 
-
-        spin_unlock(&pool->lock);
+        spin_unlock_irqrestore(&d40c->base->lcla_pool.lock, flags);
         return 0;
 err:
-        spin_unlock(&pool->lock);
+        spin_unlock_irqrestore(&d40c->base->lcla_pool.lock, flags);
         return -EINVAL;
 }
 
-static void d40_lcla_id_put(struct d40_chan *d40c,
-                            struct d40_lcla_pool *pool,
-                            int id)
-{
-        if (id < 0)
-                return;
-
-        d40c->lcla.src_id = -1;
-        d40c->lcla.dst_id = -1;
-
-        spin_lock(&pool->lock);
-        pool->alloc_map[d40c->phy_chan->num] &= (~(0x1 << id));
-        spin_unlock(&pool->lock);
-}
 
 static int d40_channel_execute_command(struct d40_chan *d40c,
                                        enum d40_command command)
@@ -530,6 +508,7 @@ static int d40_channel_execute_command(struct d40_chan *d40c,
         void __iomem *active_reg;
         int ret = 0;
         unsigned long flags;
+        u32 wmask;
 
         spin_lock_irqsave(&d40c->base->execmd_lock, flags);
 
@@ -547,7 +526,9 @@ static int d40_channel_execute_command(struct d40_chan *d40c,
                         goto done;
         }
 
-        writel(command << D40_CHAN_POS(d40c->phy_chan->num), active_reg);
+        wmask = 0xffffffff & ~(D40_CHAN_POS_MASK(d40c->phy_chan->num));
+        writel(wmask | (command << D40_CHAN_POS(d40c->phy_chan->num)),
+               active_reg);
 
         if (command == D40_DMA_SUSPEND_REQ) {
 
@@ -586,8 +567,7 @@ done:
 static void d40_term_all(struct d40_chan *d40c)
 {
         struct d40_desc *d40d;
-        struct d40_desc *d;
-        struct d40_desc *_d;
+        unsigned long flags;
 
         /* Release active descriptors */
         while ((d40d = d40_first_active_get(d40c))) {
@@ -605,19 +585,17 @@ static void d40_term_all(struct d40_chan *d40c)
                 d40_desc_free(d40c, d40d);
         }
 
-        /* Release client owned descriptors */
-        if (!list_empty(&d40c->client))
-                list_for_each_entry_safe(d, _d, &d40c->client, node) {
-                        d40_pool_lli_free(d);
-                        d40_desc_remove(d);
-                        /* Return desc to free-list */
-                        d40_desc_free(d40c, d40d);
-                }
+        spin_lock_irqsave(&d40c->base->lcla_pool.lock, flags);
+
+        d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] &=
+                (~(0x1 << d40c->lcla.dst_id));
+        d40c->base->lcla_pool.alloc_map[d40c->phy_chan->num] &=
+                (~(0x1 << d40c->lcla.src_id));
+
+        d40c->lcla.src_id = -1;
+        d40c->lcla.dst_id = -1;
 
-        d40_lcla_id_put(d40c, &d40c->base->lcla_pool,
-                        d40c->lcla.src_id);
-        d40_lcla_id_put(d40c, &d40c->base->lcla_pool,
-                        d40c->lcla.dst_id);
+        spin_unlock_irqrestore(&d40c->base->lcla_pool.lock, flags);
 
         d40c->pending_tx = 0;
         d40c->busy = false;
@@ -628,6 +606,7 @@ static void d40_config_set_event(struct d40_chan *d40c, bool do_enable)
         u32 val;
         unsigned long flags;
 
+        /* Notice, that disable requires the physical channel to be stopped */
         if (do_enable)
                 val = D40_ACTIVATE_EVENTLINE;
         else
@@ -732,31 +711,34 @@ static int d40_config_write(struct d40_chan *d40c)
 
 static void d40_desc_load(struct d40_chan *d40c, struct d40_desc *d40d)
 {
-
         if (d40d->lli_phy.dst && d40d->lli_phy.src) {
                 d40_phy_lli_write(d40c->base->virtbase,
                                   d40c->phy_chan->num,
                                   d40d->lli_phy.dst,
                                   d40d->lli_phy.src);
-                d40d->lli_tcount = d40d->lli_len;
         } else if (d40d->lli_log.dst && d40d->lli_log.src) {
-                u32 lli_len;
                 struct d40_log_lli *src = d40d->lli_log.src;
                 struct d40_log_lli *dst = d40d->lli_log.dst;
-
-                src += d40d->lli_tcount;
-                dst += d40d->lli_tcount;
-
-                if (d40d->lli_len <= d40c->base->plat_data->llis_per_log)
-                        lli_len = d40d->lli_len;
-                else
-                        lli_len = d40c->base->plat_data->llis_per_log;
-                d40d->lli_tcount += lli_len;
-                d40_log_lli_write(d40c->lcpa, d40c->lcla.src,
-                                  d40c->lcla.dst,
-                                  dst, src,
-                                  d40c->base->plat_data->llis_per_log);
+                int s;
+
+                src += d40d->lli_count;
+                dst += d40d->lli_count;
+                s = d40_log_lli_write(d40c->lcpa,
+                                      d40c->lcla.src, d40c->lcla.dst,
+                                      dst, src,
+                                      d40c->base->plat_data->llis_per_log);
+
+                /* If s equals to zero, the job is not linked */
+                if (s > 0) {
+                        (void) dma_map_single(d40c->base->dev, d40c->lcla.src,
+                                              s * sizeof(struct d40_log_lli),
+                                              DMA_TO_DEVICE);
+                        (void) dma_map_single(d40c->base->dev, d40c->lcla.dst,
+                                              s * sizeof(struct d40_log_lli),
+                                              DMA_TO_DEVICE);
+                }
         }
+        d40d->lli_count += d40d->lli_tx_len;
 }
 
 static dma_cookie_t d40_tx_submit(struct dma_async_tx_descriptor *tx)
@@ -780,18 +762,21 @@ static dma_cookie_t d40_tx_submit(struct dma_async_tx_descriptor *tx)
 
 static int d40_start(struct d40_chan *d40c)
 {
-        int err;
+        if (d40c->base->rev == 0) {
+                int err;
 
-        if (d40c->log_num != D40_PHY_CHAN) {
-                err = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
-                if (err)
-                        return err;
-                d40_config_set_event(d40c, true);
+                if (d40c->log_num != D40_PHY_CHAN) {
+                        err = d40_channel_execute_command(d40c,
+                                                          D40_DMA_SUSPEND_REQ);
+                        if (err)
+                                return err;
+                }
         }
 
-        err = d40_channel_execute_command(d40c, D40_DMA_RUN);
+        if (d40c->log_num != D40_PHY_CHAN)
+                d40_config_set_event(d40c, true);
 
-        return err;
+        return d40_channel_execute_command(d40c, D40_DMA_RUN);
 }
 
 static struct d40_desc *d40_queue_start(struct d40_chan *d40c)
@@ -838,7 +823,7 @@ static void dma_tc_handle(struct d40_chan *d40c)
         if (d40d == NULL)
                 return;
 
-        if (d40d->lli_tcount < d40d->lli_len) {
+        if (d40d->lli_count < d40d->lli_len) {
 
                 d40_desc_load(d40c, d40d);
                 /* Start dma job */
@@ -891,7 +876,6 @@ static void dma_tasklet(unsigned long data)
                 /* Return desc to free-list */
                 d40_desc_free(d40c, d40d_fin);
         } else {
-                d40_desc_reset(d40d_fin);
                 if (!d40d_fin->is_in_client_list) {
                         d40_desc_remove(d40d_fin);
                         list_add_tail(&d40d_fin->node, &d40c->client);
@@ -975,7 +959,8 @@ static irqreturn_t d40_handle_interrupt(int irq, void *data)
                 if (!il[row].is_error)
                         dma_tc_handle(d40c);
                 else
-                        dev_err(base->dev, "[%s] IRQ chan: %ld offset %d idx %d\n",
+                        dev_err(base->dev,
+                                "[%s] IRQ chan: %ld offset %d idx %d\n",
                                 __func__, chan, il[row].offset, idx);
 
                 spin_unlock(&d40c->lock);
@@ -1134,7 +1119,8 @@ static int d40_allocate_channel(struct d40_chan *d40c)
         int j;
         int log_num;
         bool is_src;
-        bool is_log = (d40c->dma_cfg.channel_type & STEDMA40_CHANNEL_IN_OPER_MODE)
+        bool is_log = (d40c->dma_cfg.channel_type &
+                       STEDMA40_CHANNEL_IN_OPER_MODE)
                 == STEDMA40_CHANNEL_IN_LOG_MODE;
 
 
@@ -1169,8 +1155,10 @@ static int d40_allocate_channel(struct d40_chan *d40c)
                         for (j = 0; j < d40c->base->num_phy_chans; j += 8) {
                                 int phy_num = j  + event_group * 2;
                                 for (i = phy_num; i < phy_num + 2; i++) {
-                                        if (d40_alloc_mask_set(&phys[i], is_src,
-                                                               0, is_log))
+                                        if (d40_alloc_mask_set(&phys[i],
+                                                               is_src,
+                                                               0,
+                                                               is_log))
                                                 goto found_phy;
                                 }
                         }
@@ -1221,30 +1209,6 @@ out:
 
 }
 
-static int d40_config_chan(struct d40_chan *d40c,
-                           struct stedma40_chan_cfg *info)
-{
-
-        /* Fill in basic CFG register values */
-        d40_phy_cfg(&d40c->dma_cfg, &d40c->src_def_cfg,
-                    &d40c->dst_def_cfg, d40c->log_num != D40_PHY_CHAN);
-
-        if (d40c->log_num != D40_PHY_CHAN) {
-                d40_log_cfg(&d40c->dma_cfg,
-                            &d40c->log_def.lcsp1, &d40c->log_def.lcsp3);
-
-                if (d40c->dma_cfg.dir == STEDMA40_PERIPH_TO_MEM)
-                        d40c->lcpa = d40c->base->lcpa_base +
-                                d40c->dma_cfg.src_dev_type * 32;
-                else
-                        d40c->lcpa = d40c->base->lcpa_base +
-                                d40c->dma_cfg.dst_dev_type * 32 + 16;
-        }
-
-        /* Write channel configuration to the DMA */
-        return d40_config_write(d40c);
-}
-
 static int d40_config_memcpy(struct d40_chan *d40c)
 {
         dma_cap_mask_t cap = d40c->chan.device->cap_mask;
@@ -1272,13 +1236,25 @@ static int d40_free_dma(struct d40_chan *d40c)
 {
 
         int res = 0;
-        u32 event, dir;
+        u32 event;
         struct d40_phy_res *phy = d40c->phy_chan;
         bool is_src;
+        struct d40_desc *d;
+        struct d40_desc *_d;
+
 
         /* Terminate all queued and active transfers */
         d40_term_all(d40c);
 
+        /* Release client owned descriptors */
+        if (!list_empty(&d40c->client))
+                list_for_each_entry_safe(d, _d, &d40c->client, node) {
+                        d40_pool_lli_free(d);
+                        d40_desc_remove(d);
+                        /* Return desc to free-list */
+                        d40_desc_free(d40c, d);
+                }
+
         if (phy == NULL) {
                 dev_err(&d40c->chan.dev->device, "[%s] phy == null\n",
                         __func__);
@@ -1292,22 +1268,12 @@ static int d40_free_dma(struct d40_chan *d40c)
                 return -EINVAL;
         }
 
-
-        res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
-        if (res) {
-                dev_err(&d40c->chan.dev->device, "[%s] suspend\n",
-                        __func__);
-                return res;
-        }
-
         if (d40c->dma_cfg.dir == STEDMA40_MEM_TO_PERIPH ||
             d40c->dma_cfg.dir == STEDMA40_MEM_TO_MEM) {
                 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.dst_dev_type);
-                dir = D40_CHAN_REG_SDLNK;
                 is_src = false;
         } else if (d40c->dma_cfg.dir == STEDMA40_PERIPH_TO_MEM) {
                 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.src_dev_type);
-                dir = D40_CHAN_REG_SSLNK;
                 is_src = true;
         } else {
                 dev_err(&d40c->chan.dev->device,
@@ -1315,16 +1281,17 @@ static int d40_free_dma(struct d40_chan *d40c)
                 return -EINVAL;
         }
 
+        res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
+        if (res) {
+                dev_err(&d40c->chan.dev->device, "[%s] suspend failed\n",
+                        __func__);
+                return res;
+        }
+
         if (d40c->log_num != D40_PHY_CHAN) {
-                /*
-                 * Release logical channel, deactivate the event line during
-                 * the time physical res is suspended.
-                 */
-                writel((D40_DEACTIVATE_EVENTLINE << D40_EVENTLINE_POS(event)) &
-                       D40_EVENTLINE_MASK(event),
-                       d40c->base->virtbase + D40_DREG_PCBASE +
-                       phy->num * D40_DREG_PCDELTA + dir);
+                /* Release logical channel, deactivate the event line */
 
+                d40_config_set_event(d40c, false);
                 d40c->base->lookup_log_chans[d40c->log_num] = NULL;
 
                 /*
@@ -1345,8 +1312,9 @@ static int d40_free_dma(struct d40_chan *d40c)
                         }
                         return 0;
                 }
-        } else
-                d40_alloc_mask_free(phy, is_src, 0);
+        } else {
+                (void) d40_alloc_mask_free(phy, is_src, 0);
+        }
 
         /* Release physical channel */
         res = d40_channel_execute_command(d40c, D40_DMA_STOP);
@@ -1361,8 +1329,6 @@ static int d40_free_dma(struct d40_chan *d40c)
         d40c->base->lookup_phy_chans[phy->num] = NULL;
 
         return 0;
-
-
 }
 
 static int d40_pause(struct dma_chan *chan)
@@ -1370,7 +1336,6 @@ static int d40_pause(struct dma_chan *chan)
         struct d40_chan *d40c =
                 container_of(chan, struct d40_chan, chan);
         int res;
-
         unsigned long flags;
 
         spin_lock_irqsave(&d40c->lock, flags);
@@ -1397,7 +1362,6 @@ static bool d40_is_paused(struct d40_chan *d40c)
         void __iomem *active_reg;
         u32 status;
         u32 event;
-        int res;
 
         spin_lock_irqsave(&d40c->lock, flags);
 
@@ -1416,10 +1380,6 @@ static bool d40_is_paused(struct d40_chan *d40c)
                 goto _exit;
         }
 
-        res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
-        if (res != 0)
-                goto _exit;
-
         if (d40c->dma_cfg.dir == STEDMA40_MEM_TO_PERIPH ||
             d40c->dma_cfg.dir == STEDMA40_MEM_TO_MEM)
                 event = D40_TYPE_TO_EVENT(d40c->dma_cfg.dst_dev_type);
@@ -1436,12 +1396,6 @@ static bool d40_is_paused(struct d40_chan *d40c)
 
         if (status != D40_DMA_RUN)
                 is_paused = true;
-
-        /* Resume the other logical channels if any */
-        if (d40_chan_has_events(d40c))
-                res = d40_channel_execute_command(d40c,
-                                                  D40_DMA_RUN);
-
 _exit:
         spin_unlock_irqrestore(&d40c->lock, flags);
         return is_paused;
@@ -1468,13 +1422,14 @@ static u32 d40_residue(struct d40_chan *d40c)
         u32 num_elt;
 
         if (d40c->log_num != D40_PHY_CHAN)
-                num_elt = (readl(&d40c->lcpa->lcsp2) &  D40_MEM_LCSP2_ECNT_MASK)
+                num_elt = (readl(&d40c->lcpa->lcsp2) & D40_MEM_LCSP2_ECNT_MASK)
                         >> D40_MEM_LCSP2_ECNT_POS;
         else
                 num_elt = (readl(d40c->base->virtbase + D40_DREG_PCBASE +
                                  d40c->phy_chan->num * D40_DREG_PCDELTA +
                                  D40_CHAN_REG_SDELT) &
-                           D40_SREG_ELEM_PHY_ECNT_MASK) >> D40_SREG_ELEM_PHY_ECNT_POS;
+                           D40_SREG_ELEM_PHY_ECNT_MASK) >>
+                        D40_SREG_ELEM_PHY_ECNT_POS;
         return num_elt * (1 << d40c->dma_cfg.dst_info.data_width);
 }
 
@@ -1487,20 +1442,21 @@ static int d40_resume(struct dma_chan *chan)
 
         spin_lock_irqsave(&d40c->lock, flags);
 
-        if (d40c->log_num != D40_PHY_CHAN) {
-                res = d40_channel_execute_command(d40c, D40_DMA_SUSPEND_REQ);
-                if (res)
-                        goto out;
+        if (d40c->base->rev == 0)
+                if (d40c->log_num != D40_PHY_CHAN) {
+                        res = d40_channel_execute_command(d40c,
+                                                          D40_DMA_SUSPEND_REQ);
+                        goto no_suspend;
+                }
 
-                /* If bytes left to transfer or linked tx resume job */
-                if (d40_residue(d40c) || d40_tx_is_linked(d40c)) {
+        /* If bytes left to transfer or linked tx resume job */
+        if (d40_residue(d40c) || d40_tx_is_linked(d40c)) {
+                if (d40c->log_num != D40_PHY_CHAN)
                         d40_config_set_event(d40c, true);
-                        res = d40_channel_execute_command(d40c, D40_DMA_RUN);
-                }
-        } else if (d40_residue(d40c) || d40_tx_is_linked(d40c))
                 res = d40_channel_execute_command(d40c, D40_DMA_RUN);
+        }
 
-out:
+no_suspend:
         spin_unlock_irqrestore(&d40c->lock, flags);
         return res;
 }
@@ -1534,8 +1490,10 @@ int stedma40_set_psize(struct dma_chan *chan,
         if (d40c->log_num != D40_PHY_CHAN) {
                 d40c->log_def.lcsp1 &= ~D40_MEM_LCSP1_SCFG_PSIZE_MASK;
                 d40c->log_def.lcsp3 &= ~D40_MEM_LCSP1_SCFG_PSIZE_MASK;
-                d40c->log_def.lcsp1 |= src_psize << D40_MEM_LCSP1_SCFG_PSIZE_POS;
-                d40c->log_def.lcsp3 |= dst_psize << D40_MEM_LCSP1_SCFG_PSIZE_POS;
+                d40c->log_def.lcsp1 |= src_psize <<
+                        D40_MEM_LCSP1_SCFG_PSIZE_POS;
+                d40c->log_def.lcsp3 |= dst_psize <<
+                        D40_MEM_LCSP1_SCFG_PSIZE_POS;
                 goto out;
         }
 
@@ -1566,37 +1524,42 @@ struct dma_async_tx_descriptor *stedma40_memcpy_sg(struct dma_chan *chan,
                                                    struct scatterlist *sgl_dst,
                                                    struct scatterlist *sgl_src,
                                                    unsigned int sgl_len,
-                                                   unsigned long flags)
+                                                   unsigned long dma_flags)
 {
         int res;
         struct d40_desc *d40d;
         struct d40_chan *d40c = container_of(chan, struct d40_chan,
                                              chan);
-        unsigned long flg;
-        int lli_max = d40c->base->plat_data->llis_per_log;
+        unsigned long flags;
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Unallocated channel.\n", __func__);
+                return ERR_PTR(-EINVAL);
+        }
 
-        spin_lock_irqsave(&d40c->lock, flg);
+        spin_lock_irqsave(&d40c->lock, flags);
         d40d = d40_desc_get(d40c);
 
         if (d40d == NULL)
                 goto err;
 
-        memset(d40d, 0, sizeof(struct d40_desc));
         d40d->lli_len = sgl_len;
-
-        d40d->txd.flags = flags;
+        d40d->lli_tx_len = d40d->lli_len;
+        d40d->txd.flags = dma_flags;
 
         if (d40c->log_num != D40_PHY_CHAN) {
+                if (d40d->lli_len > d40c->base->plat_data->llis_per_log)
+                        d40d->lli_tx_len = d40c->base->plat_data->llis_per_log;
+
                 if (sgl_len > 1)
                         /*
                          * Check if there is space available in lcla. If not,
                          * split list into 1-length and run only in lcpa
                          * space.
                          */
-                        if (d40_lcla_id_get(d40c,
-                                            &d40c->base->lcla_pool) != 0)
-                                lli_max = 1;
+                        if (d40_lcla_id_get(d40c) != 0)
+                                d40d->lli_tx_len = 1;
 
                 if (d40_pool_lli_alloc(d40d, sgl_len, true) < 0) {
                         dev_err(&d40c->chan.dev->device,
@@ -1610,7 +1573,8 @@ struct dma_async_tx_descriptor *stedma40_memcpy_sg(struct dma_chan *chan,
                                          d40d->lli_log.src,
                                          d40c->log_def.lcsp1,
                                          d40c->dma_cfg.src_info.data_width,
-                                         flags & DMA_PREP_INTERRUPT, lli_max,
+                                         dma_flags & DMA_PREP_INTERRUPT,
+                                         d40d->lli_tx_len,
                                          d40c->base->plat_data->llis_per_log);
 
                 (void) d40_log_sg_to_lli(d40c->lcla.dst_id,
@@ -1619,7 +1583,8 @@ struct dma_async_tx_descriptor *stedma40_memcpy_sg(struct dma_chan *chan,
                                          d40d->lli_log.dst,
                                          d40c->log_def.lcsp3,
                                          d40c->dma_cfg.dst_info.data_width,
-                                         flags & DMA_PREP_INTERRUPT, lli_max,
+                                         dma_flags & DMA_PREP_INTERRUPT,
+                                         d40d->lli_tx_len,
                                          d40c->base->plat_data->llis_per_log);
 
 
@@ -1664,11 +1629,11 @@ struct dma_async_tx_descriptor *stedma40_memcpy_sg(struct dma_chan *chan,
 
         d40d->txd.tx_submit = d40_tx_submit;
 
-        spin_unlock_irqrestore(&d40c->lock, flg);
+        spin_unlock_irqrestore(&d40c->lock, flags);
 
         return &d40d->txd;
 err:
-        spin_unlock_irqrestore(&d40c->lock, flg);
+        spin_unlock_irqrestore(&d40c->lock, flags);
         return NULL;
 }
 EXPORT_SYMBOL(stedma40_memcpy_sg);
@@ -1698,46 +1663,66 @@ static int d40_alloc_chan_resources(struct dma_chan *chan)
         unsigned long flags;
         struct d40_chan *d40c =
                 container_of(chan, struct d40_chan, chan);
-
+        bool is_free_phy;
         spin_lock_irqsave(&d40c->lock, flags);
 
         d40c->completed = chan->cookie = 1;
 
         /*
          * If no dma configuration is set (channel_type == 0)
-         * use default configuration
+         * use default configuration (memcpy)
          */
         if (d40c->dma_cfg.channel_type == 0) {
                 err = d40_config_memcpy(d40c);
-                if (err)
-                        goto err_alloc;
+                if (err) {
+                        dev_err(&d40c->chan.dev->device,
+                                "[%s] Failed to configure memcpy channel\n",
+                                __func__);
+                        goto fail;
+                }
         }
+        is_free_phy = (d40c->phy_chan == NULL);
 
         err = d40_allocate_channel(d40c);
         if (err) {
                 dev_err(&d40c->chan.dev->device,
                         "[%s] Failed to allocate channel\n", __func__);
-                goto err_alloc;
+                goto fail;
         }
 
-        err = d40_config_chan(d40c, &d40c->dma_cfg);
-        if (err) {
-                dev_err(&d40c->chan.dev->device,
-                        "[%s] Failed to configure channel\n",
-                        __func__);
-                goto err_config;
-        }
+        /* Fill in basic CFG register values */
+        d40_phy_cfg(&d40c->dma_cfg, &d40c->src_def_cfg,
+                    &d40c->dst_def_cfg, d40c->log_num != D40_PHY_CHAN);
 
-        spin_unlock_irqrestore(&d40c->lock, flags);
-        return 0;
+        if (d40c->log_num != D40_PHY_CHAN) {
+                d40_log_cfg(&d40c->dma_cfg,
+                            &d40c->log_def.lcsp1, &d40c->log_def.lcsp3);
 
- err_config:
-        (void) d40_free_dma(d40c);
- err_alloc:
+                if (d40c->dma_cfg.dir == STEDMA40_PERIPH_TO_MEM)
+                        d40c->lcpa = d40c->base->lcpa_base +
+                          d40c->dma_cfg.src_dev_type * D40_LCPA_CHAN_SIZE;
+                else
+                        d40c->lcpa = d40c->base->lcpa_base +
+                          d40c->dma_cfg.dst_dev_type *
+                          D40_LCPA_CHAN_SIZE + D40_LCPA_CHAN_DST_DELTA;
+        }
+
+        /*
+         * Only write channel configuration to the DMA if the physical
+         * resource is free. In case of multiple logical channels
+         * on the same physical resource, only the first write is necessary.
+         */
+        if (is_free_phy) {
+                err = d40_config_write(d40c);
+                if (err) {
+                        dev_err(&d40c->chan.dev->device,
+                                "[%s] Failed to configure channel\n",
+                                __func__);
+                }
+        }
+fail:
         spin_unlock_irqrestore(&d40c->lock, flags);
-        dev_err(&d40c->chan.dev->device,
-                "[%s] Channel allocation failed\n", __func__);
-        return -EINVAL;
+        return err;
 }
 
 static void d40_free_chan_resources(struct dma_chan *chan)
@@ -1747,6 +1732,13 @@ static void d40_free_chan_resources(struct dma_chan *chan)
         int err;
         unsigned long flags;
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Cannot free unallocated channel\n", __func__);
+                return;
+        }
+
+
         spin_lock_irqsave(&d40c->lock, flags);
 
         err = d40_free_dma(d40c);
@@ -1761,15 +1753,21 @@ static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
                                                        dma_addr_t dst,
                                                        dma_addr_t src,
                                                        size_t size,
-                                                       unsigned long flags)
+                                                       unsigned long dma_flags)
 {
         struct d40_desc *d40d;
         struct d40_chan *d40c = container_of(chan, struct d40_chan,
                                              chan);
-        unsigned long flg;
+        unsigned long flags;
         int err = 0;
 
-        spin_lock_irqsave(&d40c->lock, flg);
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Channel is not allocated.\n", __func__);
+                return ERR_PTR(-EINVAL);
+        }
+
+        spin_lock_irqsave(&d40c->lock, flags);
         d40d = d40_desc_get(d40c);
 
         if (d40d == NULL) {
@@ -1778,9 +1776,7 @@ static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
                 goto err;
         }
 
-        memset(d40d, 0, sizeof(struct d40_desc));
-
-        d40d->txd.flags = flags;
+        d40d->txd.flags = dma_flags;
 
         dma_async_tx_descriptor_init(&d40d->txd, chan);
 
@@ -1794,6 +1790,7 @@ static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
                         goto err;
                 }
                 d40d->lli_len = 1;
+                d40d->lli_tx_len = 1;
 
                 d40_log_fill_lli(d40d->lli_log.src,
                                  src,
@@ -1801,7 +1798,7 @@ static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
                                  0,
                                  d40c->log_def.lcsp1,
                                  d40c->dma_cfg.src_info.data_width,
-                                 true, true);
+                                 false, true);
 
                 d40_log_fill_lli(d40d->lli_log.dst,
                                  dst,
@@ -1848,7 +1845,7 @@ static struct dma_async_tx_descriptor *d40_prep_memcpy(struct dma_chan *chan,
                                       d40d->lli_pool.size, DMA_TO_DEVICE);
         }
 
-        spin_unlock_irqrestore(&d40c->lock, flg);
+        spin_unlock_irqrestore(&d40c->lock, flags);
         return &d40d->txd;
 
 err_fill_lli:
@@ -1856,7 +1853,7 @@ err_fill_lli:
                 "[%s] Failed filling in PHY LLI\n", __func__);
         d40_pool_lli_free(d40d);
 err:
-        spin_unlock_irqrestore(&d40c->lock, flg);
+        spin_unlock_irqrestore(&d40c->lock, flags);
         return NULL;
 }
 
@@ -1865,11 +1862,10 @@ static int d40_prep_slave_sg_log(struct d40_desc *d40d,
                                  struct scatterlist *sgl,
                                  unsigned int sg_len,
                                  enum dma_data_direction direction,
-                                 unsigned long flags)
+                                 unsigned long dma_flags)
 {
         dma_addr_t dev_addr = 0;
         int total_size;
-        int lli_max = d40c->base->plat_data->llis_per_log;
 
         if (d40_pool_lli_alloc(d40d, sg_len, true) < 0) {
                 dev_err(&d40c->chan.dev->device,
@@ -1878,7 +1874,10 @@ static int d40_prep_slave_sg_log(struct d40_desc *d40d,
         }
 
         d40d->lli_len = sg_len;
-        d40d->lli_tcount = 0;
+        if (d40d->lli_len <= d40c->base->plat_data->llis_per_log)
+                d40d->lli_tx_len = d40d->lli_len;
+        else
+                d40d->lli_tx_len = d40c->base->plat_data->llis_per_log;
 
         if (sg_len > 1)
                 /*
@@ -1886,35 +1885,34 @@ static int d40_prep_slave_sg_log(struct d40_desc *d40d,
                  * If not, split list into 1-length and run only
                  * in lcpa space.
                  */
-                if (d40_lcla_id_get(d40c, &d40c->base->lcla_pool) != 0)
-                        lli_max = 1;
+                if (d40_lcla_id_get(d40c) != 0)
+                        d40d->lli_tx_len = 1;
 
-        if (direction == DMA_FROM_DEVICE) {
-                dev_addr = d40c->base->plat_data->dev_rx[d40c->dma_cfg.src_dev_type];
-                total_size = d40_log_sg_to_dev(&d40c->lcla,
-                                               sgl, sg_len,
-                                               &d40d->lli_log,
-                                               &d40c->log_def,
-                                               d40c->dma_cfg.src_info.data_width,
-                                               d40c->dma_cfg.dst_info.data_width,
-                                               direction,
-                                               flags & DMA_PREP_INTERRUPT,
-                                               dev_addr, lli_max,
-                                               d40c->base->plat_data->llis_per_log);
-        } else if (direction == DMA_TO_DEVICE) {
-                dev_addr = d40c->base->plat_data->dev_tx[d40c->dma_cfg.dst_dev_type];
-                total_size = d40_log_sg_to_dev(&d40c->lcla,
-                                               sgl, sg_len,
-                                               &d40d->lli_log,
-                                               &d40c->log_def,
-                                               d40c->dma_cfg.src_info.data_width,
-                                               d40c->dma_cfg.dst_info.data_width,
-                                               direction,
-                                               flags & DMA_PREP_INTERRUPT,
-                                               dev_addr, lli_max,
-                                               d40c->base->plat_data->llis_per_log);
-        } else
+        if (direction == DMA_FROM_DEVICE)
+                if (d40c->runtime_addr)
+                        dev_addr = d40c->runtime_addr;
+                else
+                        dev_addr = d40c->base->plat_data->dev_rx[d40c->dma_cfg.src_dev_type];
+        else if (direction == DMA_TO_DEVICE)
+                if (d40c->runtime_addr)
+                        dev_addr = d40c->runtime_addr;
+                else
+                        dev_addr = d40c->base->plat_data->dev_tx[d40c->dma_cfg.dst_dev_type];
+
+        else
                 return -EINVAL;
+
+        total_size = d40_log_sg_to_dev(&d40c->lcla,
+                                       sgl, sg_len,
+                                       &d40d->lli_log,
+                                       &d40c->log_def,
+                                       d40c->dma_cfg.src_info.data_width,
+                                       d40c->dma_cfg.dst_info.data_width,
+                                       direction,
+                                       dma_flags & DMA_PREP_INTERRUPT,
+                                       dev_addr, d40d->lli_tx_len,
+                                       d40c->base->plat_data->llis_per_log);
+
         if (total_size < 0)
                 return -EINVAL;
 
@@ -1926,7 +1924,7 @@ static int d40_prep_slave_sg_phy(struct d40_desc *d40d,
                                  struct scatterlist *sgl,
                                  unsigned int sgl_len,
                                  enum dma_data_direction direction,
-                                 unsigned long flags)
+                                 unsigned long dma_flags)
 {
         dma_addr_t src_dev_addr;
         dma_addr_t dst_dev_addr;
@@ -1939,13 +1937,19 @@ static int d40_prep_slave_sg_phy(struct d40_desc *d40d,
         }
 
         d40d->lli_len = sgl_len;
-        d40d->lli_tcount = 0;
+        d40d->lli_tx_len = sgl_len;
 
         if (direction == DMA_FROM_DEVICE) {
                 dst_dev_addr = 0;
-                src_dev_addr = d40c->base->plat_data->dev_rx[d40c->dma_cfg.src_dev_type];
+                if (d40c->runtime_addr)
+                        src_dev_addr = d40c->runtime_addr;
+                else
+                        src_dev_addr = d40c->base->plat_data->dev_rx[d40c->dma_cfg.src_dev_type];
         } else if (direction == DMA_TO_DEVICE) {
-                dst_dev_addr = d40c->base->plat_data->dev_tx[d40c->dma_cfg.dst_dev_type];
+                if (d40c->runtime_addr)
+                        dst_dev_addr = d40c->runtime_addr;
+                else
+                        dst_dev_addr = d40c->base->plat_data->dev_tx[d40c->dma_cfg.dst_dev_type];
                 src_dev_addr = 0;
         } else
                 return -EINVAL;
@@ -1983,34 +1987,38 @@ static struct dma_async_tx_descriptor *d40_prep_slave_sg(struct dma_chan *chan,
                                                          struct scatterlist *sgl,
                                                          unsigned int sg_len,
                                                          enum dma_data_direction direction,
-                                                         unsigned long flags)
+                                                         unsigned long dma_flags)
 {
         struct d40_desc *d40d;
         struct d40_chan *d40c = container_of(chan, struct d40_chan,
                                              chan);
-        unsigned long flg;
+        unsigned long flags;
         int err;
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Cannot prepare unallocated channel\n", __func__);
+                return ERR_PTR(-EINVAL);
+        }
+
         if (d40c->dma_cfg.pre_transfer)
                 d40c->dma_cfg.pre_transfer(chan,
                                            d40c->dma_cfg.pre_transfer_data,
                                            sg_dma_len(sgl));
 
-        spin_lock_irqsave(&d40c->lock, flg);
+        spin_lock_irqsave(&d40c->lock, flags);
         d40d = d40_desc_get(d40c);
-        spin_unlock_irqrestore(&d40c->lock, flg);
+        spin_unlock_irqrestore(&d40c->lock, flags);
 
         if (d40d == NULL)
                 return NULL;
 
-        memset(d40d, 0, sizeof(struct d40_desc));
-
         if (d40c->log_num != D40_PHY_CHAN)
                 err = d40_prep_slave_sg_log(d40d, d40c, sgl, sg_len,
-                                            direction, flags);
+                                            direction, dma_flags);
         else
                 err = d40_prep_slave_sg_phy(d40d, d40c, sgl, sg_len,
-                                            direction, flags);
+                                            direction, dma_flags);
         if (err) {
                 dev_err(&d40c->chan.dev->device,
                         "[%s] Failed to prepare %s slave sg job: %d\n",
@@ -2019,7 +2027,7 @@ static struct dma_async_tx_descriptor *d40_prep_slave_sg(struct dma_chan *chan,
                 return NULL;
         }
 
-        d40d->txd.flags = flags;
+        d40d->txd.flags = dma_flags;
 
         dma_async_tx_descriptor_init(&d40d->txd, chan);
 
@@ -2037,6 +2045,13 @@ static enum dma_status d40_tx_status(struct dma_chan *chan,
         dma_cookie_t last_complete;
         int ret;
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Cannot read status of unallocated channel\n",
+                        __func__);
+                return -EINVAL;
+        }
+
         last_complete = d40c->completed;
         last_used = chan->cookie;
 
@@ -2056,6 +2071,12 @@ static void d40_issue_pending(struct dma_chan *chan)
         struct d40_chan *d40c = container_of(chan, struct d40_chan, chan);
         unsigned long flags;
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Channel is not allocated!\n", __func__);
+                return;
+        }
+
         spin_lock_irqsave(&d40c->lock, flags);
 
         /* Busy means that pending jobs are already being processed */
@@ -2065,12 +2086,129 @@ static void d40_issue_pending(struct dma_chan *chan)
         spin_unlock_irqrestore(&d40c->lock, flags);
 }
 
+/* Runtime reconfiguration extension */
+static void d40_set_runtime_config(struct dma_chan *chan,
+                               struct dma_slave_config *config)
+{
+        struct d40_chan *d40c = container_of(chan, struct d40_chan, chan);
+        struct stedma40_chan_cfg *cfg = &d40c->dma_cfg;
+        enum dma_slave_buswidth config_addr_width;
+        dma_addr_t config_addr;
+        u32 config_maxburst;
+        enum stedma40_periph_data_width addr_width;
+        int psize;
+
+        if (config->direction == DMA_FROM_DEVICE) {
+                dma_addr_t dev_addr_rx =
+                        d40c->base->plat_data->dev_rx[cfg->src_dev_type];
+
+                config_addr = config->src_addr;
+                if (dev_addr_rx)
+                        dev_dbg(d40c->base->dev,
+                                "channel has a pre-wired RX address %08x "
+                                "overriding with %08x\n",
+                                dev_addr_rx, config_addr);
+                if (cfg->dir != STEDMA40_PERIPH_TO_MEM)
+                        dev_dbg(d40c->base->dev,
+                                "channel was not configured for peripheral "
+                                "to memory transfer (%d) overriding\n",
+                                cfg->dir);
+                cfg->dir = STEDMA40_PERIPH_TO_MEM;
+
+                config_addr_width = config->src_addr_width;
+                config_maxburst = config->src_maxburst;
+
+        } else if (config->direction == DMA_TO_DEVICE) {
+                dma_addr_t dev_addr_tx =
+                        d40c->base->plat_data->dev_tx[cfg->dst_dev_type];
+
+                config_addr = config->dst_addr;
+                if (dev_addr_tx)
+                        dev_dbg(d40c->base->dev,
+                                "channel has a pre-wired TX address %08x "
+                                "overriding with %08x\n",
+                                dev_addr_tx, config_addr);
+                if (cfg->dir != STEDMA40_MEM_TO_PERIPH)
+                        dev_dbg(d40c->base->dev,
+                                "channel was not configured for memory "
+                                "to peripheral transfer (%d) overriding\n",
+                                cfg->dir);
+                cfg->dir = STEDMA40_MEM_TO_PERIPH;
+
+                config_addr_width = config->dst_addr_width;
+                config_maxburst = config->dst_maxburst;
+
+        } else {
+                dev_err(d40c->base->dev,
+                        "unrecognized channel direction %d\n",
+                        config->direction);
+                return;
+        }
+
+        switch (config_addr_width) {
+        case DMA_SLAVE_BUSWIDTH_1_BYTE:
+                addr_width = STEDMA40_BYTE_WIDTH;
+                break;
+        case DMA_SLAVE_BUSWIDTH_2_BYTES:
+                addr_width = STEDMA40_HALFWORD_WIDTH;
+                break;
+        case DMA_SLAVE_BUSWIDTH_4_BYTES:
+                addr_width = STEDMA40_WORD_WIDTH;
+                break;
+        case DMA_SLAVE_BUSWIDTH_8_BYTES:
+                addr_width = STEDMA40_DOUBLEWORD_WIDTH;
+                break;
+        default:
+                dev_err(d40c->base->dev,
+                        "illegal peripheral address width "
+                        "requested (%d)\n",
+                        config->src_addr_width);
+                return;
+        }
+
+        if (config_maxburst >= 16)
+                psize = STEDMA40_PSIZE_LOG_16;
+        else if (config_maxburst >= 8)
+                psize = STEDMA40_PSIZE_LOG_8;
+        else if (config_maxburst >= 4)
+                psize = STEDMA40_PSIZE_LOG_4;
+        else
+                psize = STEDMA40_PSIZE_LOG_1;
+
+        /* Set up all the endpoint configs */
+        cfg->src_info.data_width = addr_width;
+        cfg->src_info.psize = psize;
+        cfg->src_info.endianess = STEDMA40_LITTLE_ENDIAN;
+        cfg->src_info.flow_ctrl = STEDMA40_NO_FLOW_CTRL;
+        cfg->dst_info.data_width = addr_width;
+        cfg->dst_info.psize = psize;
+        cfg->dst_info.endianess = STEDMA40_LITTLE_ENDIAN;
+        cfg->dst_info.flow_ctrl = STEDMA40_NO_FLOW_CTRL;
+
+        /* These settings will take precedence later */
+        d40c->runtime_addr = config_addr;
+        d40c->runtime_direction = config->direction;
+        dev_dbg(d40c->base->dev,
+                "configured channel %s for %s, data width %d, "
+                "maxburst %d bytes, LE, no flow control\n",
+                dma_chan_name(chan),
+                (config->direction == DMA_FROM_DEVICE) ? "RX" : "TX",
+                config_addr_width,
+                config_maxburst);
+}
+
 static int d40_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
                        unsigned long arg)
 {
         unsigned long flags;
         struct d40_chan *d40c = container_of(chan, struct d40_chan, chan);
 
+        if (d40c->phy_chan == NULL) {
+                dev_err(&d40c->chan.dev->device,
+                        "[%s] Channel is not allocated!\n", __func__);
+                return -EINVAL;
+        }
+
         switch (cmd) {
         case DMA_TERMINATE_ALL:
                 spin_lock_irqsave(&d40c->lock, flags);
@@ -2081,6 +2219,12 @@ static int d40_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
                 return d40_pause(chan);
         case DMA_RESUME:
                 return d40_resume(chan);
+        case DMA_SLAVE_CONFIG:
+                d40_set_runtime_config(chan,
+                        (struct dma_slave_config *) arg);
+                return 0;
+        default:
+                break;
         }
 
         /* Other commands are unimplemented */
@@ -2111,13 +2255,10 @@ static void __init d40_chan_init(struct d40_base *base, struct dma_device *dma,
 
                 d40c->log_num = D40_PHY_CHAN;
 
-                INIT_LIST_HEAD(&d40c->free);
                 INIT_LIST_HEAD(&d40c->active);
                 INIT_LIST_HEAD(&d40c->queue);
                 INIT_LIST_HEAD(&d40c->client);
 
-                d40c->free_len = 0;
-
                 tasklet_init(&d40c->tasklet, dma_tasklet,
                              (unsigned long) d40c);
 
@@ -2243,6 +2384,14 @@ static int __init d40_phy_res_init(struct d40_base *base)
                 }
                 spin_lock_init(&base->phy_res[i].lock);
         }
+
+        /* Mark disabled channels as occupied */
+        for (i = 0; base->plat_data->disabled_channels[i] != -1; i++) {
+                        base->phy_res[i].allocated_src = D40_ALLOC_PHY;
+                        base->phy_res[i].allocated_dst = D40_ALLOC_PHY;
+                        num_phy_chans_avail--;
+        }
+
         dev_info(base->dev, "%d of %d physical DMA channels available\n",
                  num_phy_chans_avail, base->num_phy_chans);
 
@@ -2291,6 +2440,7 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
         int num_log_chans = 0;
         int num_phy_chans;
         int i;
+        u32 val;
 
         clk = clk_get(&pdev->dev, NULL);
 
@@ -2329,12 +2479,13 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
                 }
         }
 
-        i = readl(virtbase + D40_DREG_PERIPHID2);
+        /* Get silicon revision */
+        val = readl(virtbase + D40_DREG_PERIPHID2);
 
-        if ((i & 0xf) != D40_PERIPHID2_DESIGNER) {
+        if ((val & 0xf) != D40_PERIPHID2_DESIGNER) {
                 dev_err(&pdev->dev,
                         "[%s] Unknown designer! Got %x wanted %x\n",
-                        __func__, i & 0xf, D40_PERIPHID2_DESIGNER);
+                        __func__, val & 0xf, D40_PERIPHID2_DESIGNER);
                 goto failure;
         }
 
@@ -2342,7 +2493,7 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
         num_phy_chans = 4 * (readl(virtbase + D40_DREG_ICFG) & 0x7) + 4;
 
         dev_info(&pdev->dev, "hardware revision: %d @ 0x%x\n",
-                 (i >> 4) & 0xf, res->start);
+                 (val >> 4) & 0xf, res->start);
 
         plat_data = pdev->dev.platform_data;
 
@@ -2364,6 +2515,7 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
                 goto failure;
         }
 
+        base->rev = (val >> 4) & 0xf;
         base->clk = clk;
         base->num_phy_chans = num_phy_chans;
         base->num_log_chans = num_log_chans;
@@ -2402,6 +2554,12 @@ static struct d40_base * __init d40_hw_detect_init(struct platform_device *pdev)
         if (!base->lcla_pool.alloc_map)
                 goto failure;
 
+        base->desc_slab = kmem_cache_create(D40_NAME, sizeof(struct d40_desc),
+                                            0, SLAB_HWCACHE_ALIGN,
+                                            NULL);
+        if (base->desc_slab == NULL)
+                goto failure;
+
         return base;
 
 failure:
@@ -2495,6 +2653,78 @@ static void __init d40_hw_init(struct d40_base *base)
 
 }
 
+static int __init d40_lcla_allocate(struct d40_base *base)
+{
+        unsigned long *page_list;
+        int i, j;
+        int ret = 0;
+
+        /*
+         * This is somewhat ugly. We need 8192 bytes that are 18 bit aligned,
+         * To full fill this hardware requirement without wasting 256 kb
+         * we allocate pages until we get an aligned one.
+         */
+        page_list = kmalloc(sizeof(unsigned long) * MAX_LCLA_ALLOC_ATTEMPTS,
+                            GFP_KERNEL);
+
+        if (!page_list) {
+                ret = -ENOMEM;
+                goto failure;
+        }
+
+        /* Calculating how many pages that are required */
+        base->lcla_pool.pages = SZ_1K * base->num_phy_chans / PAGE_SIZE;
+
+        for (i = 0; i < MAX_LCLA_ALLOC_ATTEMPTS; i++) {
+                page_list[i] = __get_free_pages(GFP_KERNEL,
+                                                base->lcla_pool.pages);
+                if (!page_list[i]) {
+
+                        dev_err(base->dev,
+                                "[%s] Failed to allocate %d pages.\n",
+                                __func__, base->lcla_pool.pages);
+
+                        for (j = 0; j < i; j++)
+                                free_pages(page_list[j], base->lcla_pool.pages);
+                        goto failure;
+                }
+
+                if ((virt_to_phys((void *)page_list[i]) &
+                     (LCLA_ALIGNMENT - 1)) == 0)
+                        break;
+        }
+
+        for (j = 0; j < i; j++)
+                free_pages(page_list[j], base->lcla_pool.pages);
+
+        if (i < MAX_LCLA_ALLOC_ATTEMPTS) {
+                base->lcla_pool.base = (void *)page_list[i];
+        } else {
+                /* After many attempts, no succees with finding the correct
+                 * alignment try with allocating a big buffer */
+                dev_warn(base->dev,
+                         "[%s] Failed to get %d pages @ 18 bit align.\n",
+                         __func__, base->lcla_pool.pages);
+                base->lcla_pool.base_unaligned = kmalloc(SZ_1K *
+                                                         base->num_phy_chans +
+                                                         LCLA_ALIGNMENT,
+                                                         GFP_KERNEL);
+                if (!base->lcla_pool.base_unaligned) {
+                        ret = -ENOMEM;
+                        goto failure;
+                }
+
+                base->lcla_pool.base = PTR_ALIGN(base->lcla_pool.base_unaligned,
+                                                 LCLA_ALIGNMENT);
+        }
+
+        writel(virt_to_phys(base->lcla_pool.base),
+               base->virtbase + D40_DREG_LCLA);
+failure:
+        kfree(page_list);
+        return ret;
+}
+
 static int __init d40_probe(struct platform_device *pdev)
 {
         int err;
@@ -2554,41 +2784,11 @@ static int __init d40_probe(struct platform_device *pdev)
                         __func__);
                 goto failure;
         }
-        /* Get IO for logical channel link address */
-        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lcla");
-        if (!res) {
-                ret = -ENOENT;
-                dev_err(&pdev->dev,
-                        "[%s] No \"lcla\" resource defined\n",
-                        __func__);
-                goto failure;
-        }
 
-        base->lcla_pool.base_size = resource_size(res);
-        base->lcla_pool.phy = res->start;
-
-        if (request_mem_region(res->start, resource_size(res),
-                               D40_NAME " I/O lcla") == NULL) {
-                ret = -EBUSY;
-                dev_err(&pdev->dev,
-                        "[%s] Failed to request LCLA region 0x%x-0x%x\n",
-                        __func__, res->start, res->end);
-                goto failure;
-        }
-        val = readl(base->virtbase + D40_DREG_LCLA);
-        if (res->start != val && val != 0) {
-                dev_warn(&pdev->dev,
-                         "[%s] Mismatch LCLA dma 0x%x, def 0x%x\n",
-                         __func__, val, res->start);
-        } else
-                writel(res->start, base->virtbase + D40_DREG_LCLA);
-
-        base->lcla_pool.base = ioremap(res->start, resource_size(res));
-        if (!base->lcla_pool.base) {
-                ret = -ENOMEM;
-                dev_err(&pdev->dev,
-                        "[%s] Failed to ioremap LCLA 0x%x-0x%x\n",
-                        __func__, res->start, res->end);
+        ret = d40_lcla_allocate(base);
+        if (ret) {
+                dev_err(&pdev->dev, "[%s] Failed to allocate LCLA area\n",
+                        __func__);
                 goto failure;
         }
 
@@ -2616,11 +2816,15 @@ static int __init d40_probe(struct platform_device *pdev)
 
 failure:
         if (base) {
+                if (base->desc_slab)
+                        kmem_cache_destroy(base->desc_slab);
                 if (base->virtbase)
                         iounmap(base->virtbase);
-                if (base->lcla_pool.phy)
-                        release_mem_region(base->lcla_pool.phy,
-                                           base->lcla_pool.base_size);
+                if (!base->lcla_pool.base_unaligned && base->lcla_pool.base)
+                        free_pages((unsigned long)base->lcla_pool.base,
+                                   base->lcla_pool.pages);
+                if (base->lcla_pool.base_unaligned)
+                        kfree(base->lcla_pool.base_unaligned);
                 if (base->phy_lcpa)
                         release_mem_region(base->phy_lcpa,
                                            base->lcpa_size);
diff --git a/drivers/dma/ste_dma40_ll.c b/drivers/dma/ste_dma40_ll.c
index 561fdd8a80c1..d937f76d6e2e 100644
--- a/drivers/dma/ste_dma40_ll.c
+++ b/drivers/dma/ste_dma40_ll.c
@@ -315,11 +315,8 @@ int d40_log_sg_to_dev(struct d40_lcla_elem *lcla,
         int total_size = 0;
         struct scatterlist *current_sg = sg;
         int i;
-        u32 next_lli_off_dst;
-        u32 next_lli_off_src;
-
-        next_lli_off_src = 0;
-        next_lli_off_dst = 0;
+        u32 next_lli_off_dst = 0;
+        u32 next_lli_off_src = 0;
 
         for_each_sg(sg, current_sg, sg_len, i) {
                 total_size += sg_dma_len(current_sg);
@@ -351,7 +348,7 @@ int d40_log_sg_to_dev(struct d40_lcla_elem *lcla,
                                          sg_dma_len(current_sg),
                                          next_lli_off_src,
                                          lcsp->lcsp1, src_data_width,
-                                         term_int && !next_lli_off_src,
+                                         false,
                                          true);
                         d40_log_fill_lli(&lli->dst[i],
                                          dev_addr,
@@ -375,7 +372,7 @@ int d40_log_sg_to_dev(struct d40_lcla_elem *lcla,
                                          sg_dma_len(current_sg),
                                          next_lli_off_src,
                                          lcsp->lcsp1, src_data_width,
-                                         term_int && !next_lli_off_src,
+                                         false,
                                          false);
                 }
         }
@@ -423,32 +420,35 @@ int d40_log_sg_to_lli(int lcla_id,
         return total_size;
 }
 
-void d40_log_lli_write(struct d40_log_lli_full *lcpa,
+int d40_log_lli_write(struct d40_log_lli_full *lcpa,
                        struct d40_log_lli *lcla_src,
                        struct d40_log_lli *lcla_dst,
                        struct d40_log_lli *lli_dst,
                        struct d40_log_lli *lli_src,
                        int llis_per_log)
 {
-        u32 slos = 0;
-        u32 dlos = 0;
+        u32 slos;
+        u32 dlos;
         int i;
 
-        lcpa->lcsp0 = lli_src->lcsp02;
-        lcpa->lcsp1 = lli_src->lcsp13;
-        lcpa->lcsp2 = lli_dst->lcsp02;
-        lcpa->lcsp3 = lli_dst->lcsp13;
+        writel(lli_src->lcsp02, &lcpa->lcsp0);
+        writel(lli_src->lcsp13, &lcpa->lcsp1);
+        writel(lli_dst->lcsp02, &lcpa->lcsp2);
+        writel(lli_dst->lcsp13, &lcpa->lcsp3);
 
         slos = lli_src->lcsp13 & D40_MEM_LCSP1_SLOS_MASK;
         dlos = lli_dst->lcsp13 & D40_MEM_LCSP3_DLOS_MASK;
 
         for (i = 0; (i < llis_per_log) && slos && dlos; i++) {
-                writel(lli_src[i+1].lcsp02, &lcla_src[i].lcsp02);
-                writel(lli_src[i+1].lcsp13, &lcla_src[i].lcsp13);
-                writel(lli_dst[i+1].lcsp02, &lcla_dst[i].lcsp02);
-                writel(lli_dst[i+1].lcsp13, &lcla_dst[i].lcsp13);
+                writel(lli_src[i + 1].lcsp02, &lcla_src[i].lcsp02);
+                writel(lli_src[i + 1].lcsp13, &lcla_src[i].lcsp13);
+                writel(lli_dst[i + 1].lcsp02, &lcla_dst[i].lcsp02);
+                writel(lli_dst[i + 1].lcsp13, &lcla_dst[i].lcsp13);
 
-                slos = lli_src[i+1].lcsp13 & D40_MEM_LCSP1_SLOS_MASK;
-                dlos = lli_dst[i+1].lcsp13 & D40_MEM_LCSP3_DLOS_MASK;
+                slos = lli_src[i + 1].lcsp13 & D40_MEM_LCSP1_SLOS_MASK;
+                dlos = lli_dst[i + 1].lcsp13 & D40_MEM_LCSP3_DLOS_MASK;
         }
+
+        return i;
+
 }
diff --git a/drivers/dma/ste_dma40_ll.h b/drivers/dma/ste_dma40_ll.h
index 2029280cb332..9c0fa2f5fe57 100644
--- a/drivers/dma/ste_dma40_ll.h
+++ b/drivers/dma/ste_dma40_ll.h
@@ -13,6 +13,9 @@
 #define D40_DREG_PCDELTA        (8 * 4)
 #define D40_LLI_ALIGN           16 /* LLI alignment must be 16 bytes. */
 
+#define D40_LCPA_CHAN_SIZE 32
+#define D40_LCPA_CHAN_DST_DELTA 16
+
 #define D40_TYPE_TO_GROUP(type) (type / 16)
 #define D40_TYPE_TO_EVENT(type) (type % 16)
 
@@ -336,12 +339,12 @@ int d40_log_sg_to_dev(struct d40_lcla_elem *lcla,
                       bool term_int, dma_addr_t dev_addr, int max_len,
                       int llis_per_log);
 
-void d40_log_lli_write(struct d40_log_lli_full *lcpa,
-                       struct d40_log_lli *lcla_src,
-                       struct d40_log_lli *lcla_dst,
-                       struct d40_log_lli *lli_dst,
-                       struct d40_log_lli *lli_src,
-                       int llis_per_log);
+int d40_log_lli_write(struct d40_log_lli_full *lcpa,
+                      struct d40_log_lli *lcla_src,
+                      struct d40_log_lli *lcla_dst,
+                      struct d40_log_lli *lli_dst,
+                      struct d40_log_lli *lli_src,
+                      int llis_per_log);
 
 int d40_log_sg_to_lli(int lcla_id,
                       struct scatterlist *sg,
diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c
index a1bf77c1993f..2ec1ed56f204 100644
--- a/drivers/dma/timb_dma.c
+++ b/drivers/dma/timb_dma.c
@@ -200,8 +200,8 @@ static int td_fill_desc(struct timb_dma_chan *td_chan, u8 *dma_desc,
                 return -EINVAL;
         }
 
-        dev_dbg(chan2dev(&td_chan->chan), "desc: %p, addr: %p\n",
-                dma_desc, (void *)sg_dma_address(sg));
+        dev_dbg(chan2dev(&td_chan->chan), "desc: %p, addr: 0x%llx\n",
+                dma_desc, (unsigned long long)sg_dma_address(sg));
 
         dma_desc[7] = (sg_dma_address(sg) >> 24) & 0xff;
         dma_desc[6] = (sg_dma_address(sg) >> 16) & 0xff;
@@ -382,7 +382,7 @@ static struct timb_dma_desc *td_alloc_init_desc(struct timb_dma_chan *td_chan)
         td_desc = kzalloc(sizeof(struct timb_dma_desc), GFP_KERNEL);
         if (!td_desc) {
                 dev_err(chan2dev(chan), "Failed to alloc descriptor\n");
-                goto err;
+                goto out;
         }
 
         td_desc->desc_list_len = td_chan->desc_elems * TIMB_DMA_DESC_SIZE;
@@ -410,7 +410,7 @@ static struct timb_dma_desc *td_alloc_init_desc(struct timb_dma_chan *td_chan)
 err:
         kfree(td_desc->desc_list);
         kfree(td_desc);
-
+out:
         return NULL;
 
 }
diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index 110e24e50883..f287fe79edc4 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -744,7 +744,7 @@ static inline int edd_num_devices(void)
 static int __init
 edd_init(void)
 {
-        unsigned int i;
+        int i;
         int rc=0;
         struct edd_device *edev;
 
@@ -760,21 +760,27 @@ edd_init(void)
         if (!edd_kset)
                 return -ENOMEM;
 
-        for (i = 0; i < edd_num_devices() && !rc; i++) {
+        for (i = 0; i < edd_num_devices(); i++) {
                 edev = kzalloc(sizeof (*edev), GFP_KERNEL);
-                if (!edev)
-                        return -ENOMEM;
+                if (!edev) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
 
                 rc = edd_device_register(edev, i);
                 if (rc) {
                         kfree(edev);
-                        break;
+                        goto out;
                 }
                 edd_devices[i] = edev;
         }
 
-        if (rc)
-                kset_unregister(edd_kset);
+        return 0;
+
+out:
+        while (--i >= 0)
+                edd_device_unregister(edd_devices[i]);
+        kset_unregister(edd_kset);
         return rc;
 }
 
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 45981304feb8..b9e4dbfa0533 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -839,7 +839,6 @@ static void output_poll_execute(struct work_struct *work)
         struct drm_connector *connector;
         enum drm_connector_status old_status, status;
         bool repoll = false, changed = false;
-        int ret;
 
         mutex_lock(&dev->mode_config.mutex);
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
@@ -874,11 +873,8 @@ static void output_poll_execute(struct work_struct *work)
                         dev->mode_config.funcs->output_poll_changed(dev);
         }
 
-        if (repoll) {
-                ret = queue_delayed_work(system_nrt_wq, delayed_work, DRM_OUTPUT_POLL_PERIOD);
-                if (ret)
-                        DRM_ERROR("delayed enqueue failed %d\n", ret);
-        }
+        if (repoll)
+                queue_delayed_work(system_nrt_wq, delayed_work, DRM_OUTPUT_POLL_PERIOD);
 }
 
 void drm_kms_helper_poll_disable(struct drm_device *dev)
@@ -893,18 +889,14 @@ void drm_kms_helper_poll_enable(struct drm_device *dev)
 {
         bool poll = false;
         struct drm_connector *connector;
-        int ret;
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (connector->polled)
                         poll = true;
         }
 
-        if (poll) {
-                ret = queue_delayed_work(system_nrt_wq, &dev->mode_config.output_poll_work, DRM_OUTPUT_POLL_PERIOD);
-                if (ret)
-                        DRM_ERROR("delayed enqueue failed %d\n", ret);
-        }
+        if (poll)
+                queue_delayed_work(system_nrt_wq, &dev->mode_config.output_poll_work, DRM_OUTPUT_POLL_PERIOD);
 }
 EXPORT_SYMBOL(drm_kms_helper_poll_enable);
 
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 54acd8b534df..a79525f434a8 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -130,7 +130,7 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
 
         strcpy(info->fix.id, "inteldrmfb");
 
-        info->flags = FBINFO_DEFAULT;
+        info->flags = FBINFO_DEFAULT | FBINFO_CAN_FORCE_OUTPUT;
         info->fbops = &intelfb_ops;
 
         /* setup aperture base/size for vesafb takeover */
@@ -148,8 +148,6 @@ static int intelfb_create(struct intel_fbdev *ifbdev,
         info->fix.smem_start = dev->mode_config.fb_base + obj_priv->gtt_offset;
         info->fix.smem_len = size;
 
-        info->flags = FBINFO_DEFAULT;
-
         info->screen_base = ioremap_wc(dev->agp->base + obj_priv->gtt_offset,
                                        size);
         if (!info->screen_base) {
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 2fb2444d2322..099f637264aa 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -250,6 +250,7 @@ nouveau_fbcon_create(struct nouveau_fbdev *nfbdev,
                 info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
                               FBINFO_HWACCEL_FILLRECT |
                               FBINFO_HWACCEL_IMAGEBLIT;
+        info->flags |= FBINFO_CAN_FORCE_OUTPUT;
         info->fbops = &nouveau_fbcon_ops;
         info->fix.smem_start = dev->mode_config.fb_base + nvbo->bo.offset -
                                dev_priv->vm_vram_base;
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index dc1634bb0c11..dbf86962bdd1 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -224,7 +224,7 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
 
         drm_fb_helper_fill_fix(info, fb->pitch, fb->depth);
 
-        info->flags = FBINFO_DEFAULT;
+        info->flags = FBINFO_DEFAULT | FBINFO_CAN_FORCE_OUTPUT;
         info->fbops = &radeonfb_ops;
 
         tmp = radeon_bo_gpu_offset(rbo) - rdev->mc.vram_start;
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index 807dcd1555a6..724f46ed612f 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -230,7 +230,7 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
                                 input_report_key(input, BTN_RIGHT, 0);
                                 input_report_key(input, BTN_MIDDLE, 0);
                                 input_report_abs(input, ABS_DISTANCE,
-                                                input->absmax[ABS_DISTANCE]);
+                                        input_abs_get_max(input, ABS_DISTANCE));
                         } else {
                                 input_report_key(input, BTN_TOUCH, 0);
                                 input_report_key(input, BTN_STYLUS, 0);
@@ -383,38 +383,37 @@ move_on:
 
         /* Basics */
         input->evbit[0] |= BIT(EV_KEY) | BIT(EV_ABS) | BIT(EV_REL);
-        input->absbit[0] |= BIT(ABS_X) | BIT(ABS_Y) |
-                BIT(ABS_PRESSURE) | BIT(ABS_DISTANCE);
-        input->relbit[0] |= BIT(REL_WHEEL);
-        set_bit(BTN_TOOL_PEN, input->keybit);
-        set_bit(BTN_TOUCH, input->keybit);
-        set_bit(BTN_STYLUS, input->keybit);
-        set_bit(BTN_STYLUS2, input->keybit);
-        set_bit(BTN_LEFT, input->keybit);
-        set_bit(BTN_RIGHT, input->keybit);
-        set_bit(BTN_MIDDLE, input->keybit);
+
+        __set_bit(REL_WHEEL, input->relbit);
+
+        __set_bit(BTN_TOOL_PEN, input->keybit);
+        __set_bit(BTN_TOUCH, input->keybit);
+        __set_bit(BTN_STYLUS, input->keybit);
+        __set_bit(BTN_STYLUS2, input->keybit);
+        __set_bit(BTN_LEFT, input->keybit);
+        __set_bit(BTN_RIGHT, input->keybit);
+        __set_bit(BTN_MIDDLE, input->keybit);
 
         /* Pad */
         input->evbit[0] |= BIT(EV_MSC);
-        input->mscbit[0] |= BIT(MSC_SERIAL);
-        set_bit(BTN_0, input->keybit);
-        set_bit(BTN_1, input->keybit);
-        set_bit(BTN_TOOL_FINGER, input->keybit);
 
-        /* Distance, rubber and mouse */
-        input->absbit[0] |= BIT(ABS_DISTANCE);
-        set_bit(BTN_TOOL_RUBBER, input->keybit);
-        set_bit(BTN_TOOL_MOUSE, input->keybit);
+        __set_bit(MSC_SERIAL, input->mscbit);
 
-        input->absmax[ABS_PRESSURE] = 511;
-        input->absmax[ABS_DISTANCE] = 32;
+        __set_bit(BTN_0, input->keybit);
+        __set_bit(BTN_1, input->keybit);
+        __set_bit(BTN_TOOL_FINGER, input->keybit);
 
-        input->absmax[ABS_X] = 16704;
-        input->absmax[ABS_Y] = 12064;
-        input->absfuzz[ABS_X] = 4;
-        input->absfuzz[ABS_Y] = 4;
+        /* Distance, rubber and mouse */
+        __set_bit(BTN_TOOL_RUBBER, input->keybit);
+        __set_bit(BTN_TOOL_MOUSE, input->keybit);
+
+        input_set_abs_params(input, ABS_X, 0, 16704, 4, 0);
+        input_set_abs_params(input, ABS_Y, 0, 12064, 4, 0);
+        input_set_abs_params(input, ABS_PRESSURE, 0, 511, 0, 0);
+        input_set_abs_params(input, ABS_DISTANCE, 0, 32, 0, 0);
 
         return 0;
+
 err_free:
         kfree(wdata);
         return ret;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 4d382ae53092..f3adf18bfa05 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -332,11 +332,11 @@ config SENSORS_F71805F
           will be called f71805f.
 
 config SENSORS_F71882FG
-        tristate "Fintek F71858FG, F71862FG, F71882FG, F71889FG and F8000"
+        tristate "Fintek F71808E, F71858FG, F71862FG, F71882FG, F71889FG and F8000"
         depends on EXPERIMENTAL
         help
-          If you say yes here you get support for hardware monitoring
-          features of the Fintek F71858FG, F71862FG/71863FG, F71882FG/F71883FG,
+          If you say yes here you get support for hardware monitoring features
+          of the Fintek F71808E, F71858FG, F71862FG/71863FG, F71882FG/F71883FG,
           F71889FG and F8000 Super-I/O chips.
 
           This driver can also be built as a module.  If so, the module
@@ -405,7 +405,7 @@ config SENSORS_CORETEMP
         help
           If you say yes here you get support for the temperature
           sensor inside your CPU. Most of the family 6 CPUs
-          are supported. Check documentation/driver for details.
+          are supported. Check Documentation/hwmon/coretemp for details.
 
 config SENSORS_PKGTEMP
         tristate "Intel processor package temperature sensor"
@@ -463,6 +463,17 @@ config SENSORS_JZ4740
           This driver can also be build as a module. If so, the module will be
           called jz4740-hwmon.
 
+config SENSORS_JC42
+        tristate "JEDEC JC42.4 compliant temperature sensors"
+        help
+          If you say yes here you get support for Jedec JC42.4 compliant
+          temperature sensors. Support will include, but not be limited to,
+          ADT7408, CAT34TS02,, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
+          MCP9843, SE97, SE98, STTS424, TSE2002B3, and TS3000B3.
+
+          This driver can also be built as a module.  If so, the module
+          will be called jc42.
+
 config SENSORS_LM63
         tristate "National Semiconductor LM63 and LM64"
         depends on I2C
@@ -756,6 +767,21 @@ config SENSORS_SIS5595
           This driver can also be built as a module.  If so, the module
           will be called sis5595.
 
+config SENSORS_SMM665
+        tristate "Summit Microelectronics SMM665"
+        depends on I2C && EXPERIMENTAL
+        default n
+        help
+          If you say yes here you get support for the hardware monitoring
+          features of the Summit Microelectronics SMM665/SMM665B Six-Channel
+          Active DC Output Controller / Monitor.
+
+          Other supported chips are SMM465, SMM665C, SMM764, and SMM766.
+          Support for those chips is untested.
+
+          This driver can also be built as a module. If so, the module will
+          be called smm665.
+
 config SENSORS_DME1737
         tristate "SMSC DME1737, SCH311x and compatibles"
         depends on I2C && EXPERIMENTAL
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 9103bd6ea73a..13d913e34dbf 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -56,6 +56,7 @@ obj-$(CONFIG_SENSORS_I5K_AMB)	+= i5k_amb.o
 obj-$(CONFIG_SENSORS_IBMAEM)    += ibmaem.o
 obj-$(CONFIG_SENSORS_IBMPEX)    += ibmpex.o
 obj-$(CONFIG_SENSORS_IT87)      += it87.o
+obj-$(CONFIG_SENSORS_JC42)      += jc42.o
 obj-$(CONFIG_SENSORS_JZ4740)    += jz4740-hwmon.o
 obj-$(CONFIG_SENSORS_K8TEMP)    += k8temp.o
 obj-$(CONFIG_SENSORS_K10TEMP)   += k10temp.o
@@ -88,6 +89,7 @@ obj-$(CONFIG_SENSORS_PCF8591)	+= pcf8591.o
 obj-$(CONFIG_SENSORS_S3C)       += s3c-hwmon.o
 obj-$(CONFIG_SENSORS_SHT15)     += sht15.o
 obj-$(CONFIG_SENSORS_SIS5595)   += sis5595.o
+obj-$(CONFIG_SENSORS_SMM665)    += smm665.o
 obj-$(CONFIG_SENSORS_SMSC47B397)+= smsc47b397.o
 obj-$(CONFIG_SENSORS_SMSC47M1)  += smsc47m1.o
 obj-$(CONFIG_SENSORS_SMSC47M192)+= smsc47m192.o
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 05344af50734..a92e28a35767 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -480,7 +480,6 @@ exit:
         return err;
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
 static void coretemp_device_remove(unsigned int cpu)
 {
         struct pdev_entry *p, *n;
@@ -502,10 +501,13 @@ static int __cpuinit coretemp_cpu_callback(struct notifier_block *nfb,
 
         switch (action) {
         case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
         case CPU_DOWN_FAILED:
+        case CPU_DOWN_FAILED_FROZEN:
                 coretemp_device_add(cpu);
                 break;
         case CPU_DOWN_PREPARE:
+        case CPU_DOWN_PREPARE_FROZEN:
                 coretemp_device_remove(cpu);
                 break;
         }
@@ -515,7 +517,6 @@ static int __cpuinit coretemp_cpu_callback(struct notifier_block *nfb,
 static struct notifier_block coretemp_cpu_notifier __refdata = {
         .notifier_call = coretemp_cpu_callback,
 };
-#endif                          /* !CONFIG_HOTPLUG_CPU */
 
 static int __init coretemp_init(void)
 {
@@ -537,12 +538,9 @@ static int __init coretemp_init(void)
                  * sensors. We check this bit only, all the early CPUs
                  * without thermal sensors will be filtered out.
                  */
-                if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01)) {
-                        err = coretemp_device_add(i);
-                        if (err)
-                                goto exit_devices_unreg;
-
-                } else {
+                if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01))
+                        coretemp_device_add(i);
+                else {
                         printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
                                 " has no thermal sensor.\n", c->x86_model);
                 }
@@ -552,21 +550,13 @@ static int __init coretemp_init(void)
                 goto exit_driver_unreg;
         }
 
-#ifdef CONFIG_HOTPLUG_CPU
         register_hotcpu_notifier(&coretemp_cpu_notifier);
-#endif
         return 0;
 
-exit_devices_unreg:
-        mutex_lock(&pdev_list_mutex);
-        list_for_each_entry_safe(p, n, &pdev_list, list) {
-                platform_device_unregister(p->pdev);
-                list_del(&p->list);
-                kfree(p);
-        }
-        mutex_unlock(&pdev_list_mutex);
 exit_driver_unreg:
+#ifndef CONFIG_HOTPLUG_CPU
         platform_driver_unregister(&coretemp_driver);
+#endif
 exit:
         return err;
 }
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..6207120dcd4d 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -45,6 +45,7 @@
 #define SIO_REG_ADDR            0x60    /* Logical device address (2 bytes) */
 
 #define SIO_FINTEK_ID           0x1934  /* Manufacturers ID */
+#define SIO_F71808_ID           0x0901  /* Chipset ID */
 #define SIO_F71858_ID           0x0507  /* Chipset ID */
 #define SIO_F71862_ID           0x0601  /* Chipset ID */
 #define SIO_F71882_ID           0x0541  /* Chipset ID */
@@ -96,9 +97,10 @@ static unsigned short force_id;
 module_param(force_id, ushort, 0);
 MODULE_PARM_DESC(force_id, "Override the detected device ID");
 
-enum chips { f71858fg, f71862fg, f71882fg, f71889fg, f8000 };
+enum chips { f71808fg, f71858fg, f71862fg, f71882fg, f71889fg, f8000 };
 
 static const char *f71882fg_names[] = {
+        "f71808fg",
         "f71858fg",
         "f71862fg",
         "f71882fg",
@@ -306,8 +308,8 @@ static struct sensor_device_attribute_2 f71858fg_in_temp_attr[] = {
         SENSOR_ATTR_2(temp3_fault, S_IRUGO, show_temp_fault, NULL, 0, 2),
 };
 
-/* Temp and in attr common to the f71862fg, f71882fg and f71889fg */
-static struct sensor_device_attribute_2 fxxxx_in_temp_attr[] = {
+/* In attr common to the f71862fg, f71882fg and f71889fg */
+static struct sensor_device_attribute_2 fxxxx_in_attr[] = {
         SENSOR_ATTR_2(in0_input, S_IRUGO, show_in, NULL, 0, 0),
         SENSOR_ATTR_2(in1_input, S_IRUGO, show_in, NULL, 0, 1),
         SENSOR_ATTR_2(in2_input, S_IRUGO, show_in, NULL, 0, 2),
@@ -317,6 +319,22 @@ static struct sensor_device_attribute_2 fxxxx_in_temp_attr[] = {
         SENSOR_ATTR_2(in6_input, S_IRUGO, show_in, NULL, 0, 6),
         SENSOR_ATTR_2(in7_input, S_IRUGO, show_in, NULL, 0, 7),
         SENSOR_ATTR_2(in8_input, S_IRUGO, show_in, NULL, 0, 8),
+};
+
+/* In attr for the f71808fg */
+static struct sensor_device_attribute_2 f71808_in_attr[] = {
+        SENSOR_ATTR_2(in0_input, S_IRUGO, show_in, NULL, 0, 0),
+        SENSOR_ATTR_2(in1_input, S_IRUGO, show_in, NULL, 0, 1),
+        SENSOR_ATTR_2(in2_input, S_IRUGO, show_in, NULL, 0, 2),
+        SENSOR_ATTR_2(in3_input, S_IRUGO, show_in, NULL, 0, 3),
+        SENSOR_ATTR_2(in4_input, S_IRUGO, show_in, NULL, 0, 4),
+        SENSOR_ATTR_2(in5_input, S_IRUGO, show_in, NULL, 0, 5),
+        SENSOR_ATTR_2(in6_input, S_IRUGO, show_in, NULL, 0, 7),
+        SENSOR_ATTR_2(in7_input, S_IRUGO, show_in, NULL, 0, 8),
+};
+
+/* Temp attr common to the f71808fg, f71862fg, f71882fg and f71889fg */
+static struct sensor_device_attribute_2 fxxxx_temp_attr[] = {
         SENSOR_ATTR_2(temp1_input, S_IRUGO, show_temp, NULL, 0, 1),
         SENSOR_ATTR_2(temp1_max, S_IRUGO|S_IWUSR, show_temp_max,
                 store_temp_max, 0, 1),
@@ -355,6 +373,10 @@ static struct sensor_device_attribute_2 fxxxx_in_temp_attr[] = {
                 store_temp_beep, 0, 6),
         SENSOR_ATTR_2(temp2_type, S_IRUGO, show_temp_type, NULL, 0, 2),
         SENSOR_ATTR_2(temp2_fault, S_IRUGO, show_temp_fault, NULL, 0, 2),
+};
+
+/* Temp and in attr common to the f71862fg, f71882fg and f71889fg */
+static struct sensor_device_attribute_2 f71862_temp_attr[] = {
         SENSOR_ATTR_2(temp3_input, S_IRUGO, show_temp, NULL, 0, 3),
         SENSOR_ATTR_2(temp3_max, S_IRUGO|S_IWUSR, show_temp_max,
                 store_temp_max, 0, 3),
@@ -989,6 +1011,11 @@ static struct f71882fg_data *f71882fg_update_device(struct device *dev)
                                 data->temp_type[1] = 6;
                                 break;
                         }
+                } else if (data->type == f71808fg) {
+                        reg  = f71882fg_read8(data, F71882FG_REG_TEMP_TYPE);
+                        data->temp_type[1] = (reg & 0x02) ? 2 : 4;
+                        data->temp_type[2] = (reg & 0x04) ? 2 : 4;
+
                 } else {
                         reg2 = f71882fg_read8(data, F71882FG_REG_PECI);
                         if ((reg2 & 0x03) == 0x01)
@@ -1871,7 +1898,8 @@ static ssize_t store_pwm_auto_point_temp(struct device *dev,
 
         val /= 1000;
 
-        if (data->type == f71889fg)
+        if (data->type == f71889fg
+         || data->type == f71808fg)
                 val = SENSORS_LIMIT(val, -128, 127);
         else
                 val = SENSORS_LIMIT(val, 0, 127);
@@ -1974,8 +2002,28 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
                         /* fall through! */
                 case f71862fg:
                         err = f71882fg_create_sysfs_files(pdev,
-                                        fxxxx_in_temp_attr,
-                                        ARRAY_SIZE(fxxxx_in_temp_attr));
+                                        f71862_temp_attr,
+                                        ARRAY_SIZE(f71862_temp_attr));
+                        if (err)
+                                goto exit_unregister_sysfs;
+                        err = f71882fg_create_sysfs_files(pdev,
+                                        fxxxx_in_attr,
+                                        ARRAY_SIZE(fxxxx_in_attr));
+                        if (err)
+                                goto exit_unregister_sysfs;
+                        err = f71882fg_create_sysfs_files(pdev,
+                                        fxxxx_temp_attr,
+                                        ARRAY_SIZE(fxxxx_temp_attr));
+                        break;
+                case f71808fg:
+                        err = f71882fg_create_sysfs_files(pdev,
+                                        f71808_in_attr,
+                                        ARRAY_SIZE(f71808_in_attr));
+                        if (err)
+                                goto exit_unregister_sysfs;
+                        err = f71882fg_create_sysfs_files(pdev,
+                                        fxxxx_temp_attr,
+                                        ARRAY_SIZE(fxxxx_temp_attr));
                         break;
                 case f8000:
                         err = f71882fg_create_sysfs_files(pdev,
@@ -2002,6 +2050,7 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
                 case f71862fg:
                         err = (data->pwm_enable & 0x15) != 0x15;
                         break;
+                case f71808fg:
                 case f71882fg:
                 case f71889fg:
                         err = 0;
@@ -2047,6 +2096,7 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
                                         f8000_auto_pwm_attr,
                                         ARRAY_SIZE(f8000_auto_pwm_attr));
                         break;
+                case f71808fg:
                 case f71889fg:
                         for (i = 0; i < nr_fans; i++) {
                                 data->pwm_auto_point_mapping[i] =
@@ -2126,8 +2176,22 @@ static int f71882fg_remove(struct platform_device *pdev)
                         /* fall through! */
                 case f71862fg:
                         f71882fg_remove_sysfs_files(pdev,
-                                        fxxxx_in_temp_attr,
-                                        ARRAY_SIZE(fxxxx_in_temp_attr));
+                                        f71862_temp_attr,
+                                        ARRAY_SIZE(f71862_temp_attr));
+                        f71882fg_remove_sysfs_files(pdev,
+                                        fxxxx_in_attr,
+                                        ARRAY_SIZE(fxxxx_in_attr));
+                        f71882fg_remove_sysfs_files(pdev,
+                                        fxxxx_temp_attr,
+                                        ARRAY_SIZE(fxxxx_temp_attr));
+                        break;
+                case f71808fg:
+                        f71882fg_remove_sysfs_files(pdev,
+                                        f71808_in_attr,
+                                        ARRAY_SIZE(f71808_in_attr));
+                        f71882fg_remove_sysfs_files(pdev,
+                                        fxxxx_temp_attr,
+                                        ARRAY_SIZE(fxxxx_temp_attr));
                         break;
                 case f8000:
                         f71882fg_remove_sysfs_files(pdev,
@@ -2195,6 +2259,9 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 
         devid = force_id ? force_id : superio_inw(sioaddr, SIO_REG_DEVID);
         switch (devid) {
+        case SIO_F71808_ID:
+                sio_data->type = f71808fg;
+                break;
         case SIO_F71858_ID:
                 sio_data->type = f71858fg;
                 break;
diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c
index be2d131e405c..bfd42f18924b 100644
--- a/drivers/hwmon/hdaps.c
+++ b/drivers/hwmon/hdaps.c
@@ -522,6 +522,7 @@ static struct dmi_system_id __initdata hdaps_whitelist[] = {
         HDAPS_DMI_MATCH_INVERT("IBM", "ThinkPad T42p", HDAPS_BOTH_AXES),
         HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T42"),
         HDAPS_DMI_MATCH_NORMAL("IBM", "ThinkPad T43"),
+        HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T400", HDAPS_BOTH_AXES),
         HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T60", HDAPS_BOTH_AXES),
         HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61p", HDAPS_BOTH_AXES),
         HDAPS_DMI_MATCH_INVERT("LENOVO", "ThinkPad T61", HDAPS_BOTH_AXES),
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
new file mode 100644
index 000000000000..340fc78c8dde
--- /dev/null
+++ b/drivers/hwmon/jc42.c
@@ -0,0 +1,593 @@
+/*
+ * jc42.c - driver for Jedec JC42.4 compliant temperature sensors
+ *
+ * Copyright (c) 2010  Ericsson AB.
+ *
+ * Derived from lm77.c by Andras BALI <drewie@freemail.hu>.
+ *
+ * JC42.4 compliant temperature sensors are typically used on memory modules.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/i2c.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+#include <linux/mutex.h>
+
+/* Addresses to scan */
+static const unsigned short normal_i2c[] = {
+        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, I2C_CLIENT_END };
+
+/* JC42 registers. All registers are 16 bit. */
+#define JC42_REG_CAP            0x00
+#define JC42_REG_CONFIG         0x01
+#define JC42_REG_TEMP_UPPER     0x02
+#define JC42_REG_TEMP_LOWER     0x03
+#define JC42_REG_TEMP_CRITICAL  0x04
+#define JC42_REG_TEMP           0x05
+#define JC42_REG_MANID          0x06
+#define JC42_REG_DEVICEID       0x07
+
+/* Status bits in temperature register */
+#define JC42_ALARM_CRIT_BIT     15
+#define JC42_ALARM_MAX_BIT      14
+#define JC42_ALARM_MIN_BIT      13
+
+/* Configuration register defines */
+#define JC42_CFG_CRIT_ONLY      (1 << 2)
+#define JC42_CFG_SHUTDOWN       (1 << 8)
+#define JC42_CFG_HYST_SHIFT     9
+#define JC42_CFG_HYST_MASK      0x03
+
+/* Capabilities */
+#define JC42_CAP_RANGE          (1 << 2)
+
+/* Manufacturer IDs */
+#define ADT_MANID               0x11d4  /* Analog Devices */
+#define MAX_MANID               0x004d  /* Maxim */
+#define IDT_MANID               0x00b3  /* IDT */
+#define MCP_MANID               0x0054  /* Microchip */
+#define NXP_MANID               0x1131  /* NXP Semiconductors */
+#define ONS_MANID               0x1b09  /* ON Semiconductor */
+#define STM_MANID               0x104a  /* ST Microelectronics */
+
+/* Supported chips */
+
+/* Analog Devices */
+#define ADT7408_DEVID           0x0801
+#define ADT7408_DEVID_MASK      0xffff
+
+/* IDT */
+#define TS3000B3_DEVID          0x2903  /* Also matches TSE2002B3 */
+#define TS3000B3_DEVID_MASK     0xffff
+
+/* Maxim */
+#define MAX6604_DEVID           0x3e00
+#define MAX6604_DEVID_MASK      0xffff
+
+/* Microchip */
+#define MCP98242_DEVID          0x2000
+#define MCP98242_DEVID_MASK     0xfffc
+
+#define MCP98243_DEVID          0x2100
+#define MCP98243_DEVID_MASK     0xfffc
+
+#define MCP9843_DEVID           0x0000  /* Also matches mcp9805 */
+#define MCP9843_DEVID_MASK      0xfffe
+
+/* NXP */
+#define SE97_DEVID              0xa200
+#define SE97_DEVID_MASK         0xfffc
+
+#define SE98_DEVID              0xa100
+#define SE98_DEVID_MASK         0xfffc
+
+/* ON Semiconductor */
+#define CAT6095_DEVID           0x0800  /* Also matches CAT34TS02 */
+#define CAT6095_DEVID_MASK      0xffe0
+
+/* ST Microelectronics */
+#define STTS424_DEVID           0x0101
+#define STTS424_DEVID_MASK      0xffff
+
+#define STTS424E_DEVID          0x0000
+#define STTS424E_DEVID_MASK     0xfffe
+
+static u16 jc42_hysteresis[] = { 0, 1500, 3000, 6000 };
+
+struct jc42_chips {
+        u16 manid;
+        u16 devid;
+        u16 devid_mask;
+};
+
+static struct jc42_chips jc42_chips[] = {
+        { ADT_MANID, ADT7408_DEVID, ADT7408_DEVID_MASK },
+        { IDT_MANID, TS3000B3_DEVID, TS3000B3_DEVID_MASK },
+        { MAX_MANID, MAX6604_DEVID, MAX6604_DEVID_MASK },
+        { MCP_MANID, MCP98242_DEVID, MCP98242_DEVID_MASK },
+        { MCP_MANID, MCP98243_DEVID, MCP98243_DEVID_MASK },
+        { MCP_MANID, MCP9843_DEVID, MCP9843_DEVID_MASK },
+        { NXP_MANID, SE97_DEVID, SE97_DEVID_MASK },
+        { ONS_MANID, CAT6095_DEVID, CAT6095_DEVID_MASK },
+        { NXP_MANID, SE98_DEVID, SE98_DEVID_MASK },
+        { STM_MANID, STTS424_DEVID, STTS424_DEVID_MASK },
+        { STM_MANID, STTS424E_DEVID, STTS424E_DEVID_MASK },
+};
+
+/* Each client has this additional data */
+struct jc42_data {
+        struct device   *hwmon_dev;
+        struct mutex    update_lock;    /* protect register access */
+        bool            extended;       /* true if extended range supported */
+        bool            valid;
+        unsigned long   last_updated;   /* In jiffies */
+        u16             orig_config;    /* original configuration */
+        u16             config;         /* current configuration */
+        u16             temp_input;     /* Temperatures */
+        u16             temp_crit;
+        u16             temp_min;
+        u16             temp_max;
+};
+
+static int jc42_probe(struct i2c_client *client,
+                      const struct i2c_device_id *id);
+static int jc42_detect(struct i2c_client *client, struct i2c_board_info *info);
+static int jc42_remove(struct i2c_client *client);
+static int jc42_read_value(struct i2c_client *client, u8 reg);
+static int jc42_write_value(struct i2c_client *client, u8 reg, u16 value);
+
+static struct jc42_data *jc42_update_device(struct device *dev);
+
+static const struct i2c_device_id jc42_id[] = {
+        { "adt7408", 0 },
+        { "cat94ts02", 0 },
+        { "cat6095", 0 },
+        { "jc42", 0 },
+        { "max6604", 0 },
+        { "mcp9805", 0 },
+        { "mcp98242", 0 },
+        { "mcp98243", 0 },
+        { "mcp9843", 0 },
+        { "se97", 0 },
+        { "se97b", 0 },
+        { "se98", 0 },
+        { "stts424", 0 },
+        { "tse2002b3", 0 },
+        { "ts3000b3", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, jc42_id);
+
+#ifdef CONFIG_PM
+
+static int jc42_suspend(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct jc42_data *data = i2c_get_clientdata(client);
+
+        data->config |= JC42_CFG_SHUTDOWN;
+        jc42_write_value(client, JC42_REG_CONFIG, data->config);
+        return 0;
+}
+
+static int jc42_resume(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct jc42_data *data = i2c_get_clientdata(client);
+
+        data->config &= ~JC42_CFG_SHUTDOWN;
+        jc42_write_value(client, JC42_REG_CONFIG, data->config);
+        return 0;
+}
+
+static const struct dev_pm_ops jc42_dev_pm_ops = {
+        .suspend = jc42_suspend,
+        .resume = jc42_resume,
+};
+
+#define JC42_DEV_PM_OPS (&jc42_dev_pm_ops)
+#else
+#define JC42_DEV_PM_OPS NULL
+#endif /* CONFIG_PM */
+
+/* This is the driver that will be inserted */
+static struct i2c_driver jc42_driver = {
+        .class          = I2C_CLASS_HWMON,
+        .driver = {
+                .name   = "jc42",
+                .pm = JC42_DEV_PM_OPS,
+        },
+        .probe          = jc42_probe,
+        .remove         = jc42_remove,
+        .id_table       = jc42_id,
+        .detect         = jc42_detect,
+        .address_list   = normal_i2c,
+};
+
+#define JC42_TEMP_MIN_EXTENDED  (-40000)
+#define JC42_TEMP_MIN           0
+#define JC42_TEMP_MAX           125000
+
+static u16 jc42_temp_to_reg(int temp, bool extended)
+{
+        int ntemp = SENSORS_LIMIT(temp,
+                                  extended ? JC42_TEMP_MIN_EXTENDED :
+                                  JC42_TEMP_MIN, JC42_TEMP_MAX);
+
+        /* convert from 0.001 to 0.0625 resolution */
+        return (ntemp * 2 / 125) & 0x1fff;
+}
+
+static int jc42_temp_from_reg(s16 reg)
+{
+        reg &= 0x1fff;
+
+        /* sign extend register */
+        if (reg & 0x1000)
+                reg |= 0xf000;
+
+        /* convert from 0.0625 to 0.001 resolution */
+        return reg * 125 / 2;
+}
+
+/* sysfs stuff */
+
+/* read routines for temperature limits */
+#define show(value)     \
+static ssize_t show_##value(struct device *dev,                         \
+                            struct device_attribute *attr,              \
+                            char *buf)                                  \
+{                                                                       \
+        struct jc42_data *data = jc42_update_device(dev);               \
+        if (IS_ERR(data))                                               \
+                return PTR_ERR(data);                                   \
+        return sprintf(buf, "%d\n", jc42_temp_from_reg(data->value));   \
+}
+
+show(temp_input);
+show(temp_crit);
+show(temp_min);
+show(temp_max);
+
+/* read routines for hysteresis values */
+static ssize_t show_temp_crit_hyst(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        struct jc42_data *data = jc42_update_device(dev);
+        int temp, hyst;
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        temp = jc42_temp_from_reg(data->temp_crit);
+        hyst = jc42_hysteresis[(data->config >> JC42_CFG_HYST_SHIFT)
+                               & JC42_CFG_HYST_MASK];
+        return sprintf(buf, "%d\n", temp - hyst);
+}
+
+static ssize_t show_temp_max_hyst(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
+{
+        struct jc42_data *data = jc42_update_device(dev);
+        int temp, hyst;
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        temp = jc42_temp_from_reg(data->temp_max);
+        hyst = jc42_hysteresis[(data->config >> JC42_CFG_HYST_SHIFT)
+                               & JC42_CFG_HYST_MASK];
+        return sprintf(buf, "%d\n", temp - hyst);
+}
+
+/* write routines */
+#define set(value, reg) \
+static ssize_t set_##value(struct device *dev,                          \
+                           struct device_attribute *attr,               \
+                           const char *buf, size_t count)               \
+{                                                                       \
+        struct i2c_client *client = to_i2c_client(dev);                 \
+        struct jc42_data *data = i2c_get_clientdata(client);            \
+        int err, ret = count;                                           \
+        long val;                                                       \
+        if (strict_strtol(buf, 10, &val) < 0)                           \
+                return -EINVAL;                                         \
+        mutex_lock(&data->update_lock);                                 \
+        data->value = jc42_temp_to_reg(val, data->extended);            \
+        err = jc42_write_value(client, reg, data->value);               \
+        if (err < 0)                                                    \
+                ret = err;                                              \
+        mutex_unlock(&data->update_lock);                               \
+        return ret;                                                     \
+}
+
+set(temp_min, JC42_REG_TEMP_LOWER);
+set(temp_max, JC42_REG_TEMP_UPPER);
+set(temp_crit, JC42_REG_TEMP_CRITICAL);
+
+/* JC42.4 compliant chips only support four hysteresis values.
+ * Pick best choice and go from there. */
+static ssize_t set_temp_crit_hyst(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct jc42_data *data = i2c_get_clientdata(client);
+        long val;
+        int diff, hyst;
+        int err;
+        int ret = count;
+
+        if (strict_strtoul(buf, 10, &val) < 0)
+                return -EINVAL;
+
+        diff = jc42_temp_from_reg(data->temp_crit) - val;
+        hyst = 0;
+        if (diff > 0) {
+                if (diff < 2250)
+                        hyst = 1;       /* 1.5 degrees C */
+                else if (diff < 4500)
+                        hyst = 2;       /* 3.0 degrees C */
+                else
+                        hyst = 3;       /* 6.0 degrees C */
+        }
+
+        mutex_lock(&data->update_lock);
+        data->config = (data->config
+                        & ~(JC42_CFG_HYST_MASK << JC42_CFG_HYST_SHIFT))
+          | (hyst << JC42_CFG_HYST_SHIFT);
+        err = jc42_write_value(client, JC42_REG_CONFIG, data->config);
+        if (err < 0)
+                ret = err;
+        mutex_unlock(&data->update_lock);
+        return ret;
+}
+
+static ssize_t show_alarm(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        u16 bit = to_sensor_dev_attr(attr)->index;
+        struct jc42_data *data = jc42_update_device(dev);
+        u16 val;
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        val = data->temp_input;
+        if (bit != JC42_ALARM_CRIT_BIT && (data->config & JC42_CFG_CRIT_ONLY))
+                val = 0;
+        return sprintf(buf, "%u\n", (val >> bit) & 1);
+}
+
+static DEVICE_ATTR(temp1_input, S_IRUGO,
+                   show_temp_input, NULL);
+static DEVICE_ATTR(temp1_crit, S_IWUSR | S_IRUGO,
+                   show_temp_crit, set_temp_crit);
+static DEVICE_ATTR(temp1_min, S_IWUSR | S_IRUGO,
+                   show_temp_min, set_temp_min);
+static DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO,
+                   show_temp_max, set_temp_max);
+
+static DEVICE_ATTR(temp1_crit_hyst, S_IWUSR | S_IRUGO,
+                   show_temp_crit_hyst, set_temp_crit_hyst);
+static DEVICE_ATTR(temp1_max_hyst, S_IRUGO,
+                   show_temp_max_hyst, NULL);
+
+static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, show_alarm, NULL,
+                          JC42_ALARM_CRIT_BIT);
+static SENSOR_DEVICE_ATTR(temp1_min_alarm, S_IRUGO, show_alarm, NULL,
+                          JC42_ALARM_MIN_BIT);
+static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO, show_alarm, NULL,
+                          JC42_ALARM_MAX_BIT);
+
+static struct attribute *jc42_attributes[] = {
+        &dev_attr_temp1_input.attr,
+        &dev_attr_temp1_crit.attr,
+        &dev_attr_temp1_min.attr,
+        &dev_attr_temp1_max.attr,
+        &dev_attr_temp1_crit_hyst.attr,
+        &dev_attr_temp1_max_hyst.attr,
+        &sensor_dev_attr_temp1_crit_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp1_min_alarm.dev_attr.attr,
+        &sensor_dev_attr_temp1_max_alarm.dev_attr.attr,
+        NULL
+};
+
+static const struct attribute_group jc42_group = {
+        .attrs = jc42_attributes,
+};
+
+/* Return 0 if detection is successful, -ENODEV otherwise */
+static int jc42_detect(struct i2c_client *new_client,
+                       struct i2c_board_info *info)
+{
+        struct i2c_adapter *adapter = new_client->adapter;
+        int i, config, cap, manid, devid;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
+                                     I2C_FUNC_SMBUS_WORD_DATA))
+                return -ENODEV;
+
+        cap = jc42_read_value(new_client, JC42_REG_CAP);
+        config = jc42_read_value(new_client, JC42_REG_CONFIG);
+        manid = jc42_read_value(new_client, JC42_REG_MANID);
+        devid = jc42_read_value(new_client, JC42_REG_DEVICEID);
+
+        if (cap < 0 || config < 0 || manid < 0 || devid < 0)
+                return -ENODEV;
+
+        if ((cap & 0xff00) || (config & 0xf800))
+                return -ENODEV;
+
+        for (i = 0; i < ARRAY_SIZE(jc42_chips); i++) {
+                struct jc42_chips *chip = &jc42_chips[i];
+                if (manid == chip->manid &&
+                    (devid & chip->devid_mask) == chip->devid) {
+                        strlcpy(info->type, "jc42", I2C_NAME_SIZE);
+                        return 0;
+                }
+        }
+        return -ENODEV;
+}
+
+static int jc42_probe(struct i2c_client *new_client,
+                      const struct i2c_device_id *id)
+{
+        struct jc42_data *data;
+        int config, cap, err;
+
+        data = kzalloc(sizeof(struct jc42_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        i2c_set_clientdata(new_client, data);
+        mutex_init(&data->update_lock);
+
+        cap = jc42_read_value(new_client, JC42_REG_CAP);
+        if (cap < 0) {
+                err = -EINVAL;
+                goto exit_free;
+        }
+        data->extended = !!(cap & JC42_CAP_RANGE);
+
+        config = jc42_read_value(new_client, JC42_REG_CONFIG);
+        if (config < 0) {
+                err = -EINVAL;
+                goto exit_free;
+        }
+        data->orig_config = config;
+        if (config & JC42_CFG_SHUTDOWN) {
+                config &= ~JC42_CFG_SHUTDOWN;
+                jc42_write_value(new_client, JC42_REG_CONFIG, config);
+        }
+        data->config = config;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&new_client->dev.kobj, &jc42_group);
+        if (err)
+                goto exit_free;
+
+        data->hwmon_dev = hwmon_device_register(&new_client->dev);
+        if (IS_ERR(data->hwmon_dev)) {
+                err = PTR_ERR(data->hwmon_dev);
+                goto exit_remove;
+        }
+
+        return 0;
+
+exit_remove:
+        sysfs_remove_group(&new_client->dev.kobj, &jc42_group);
+exit_free:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int jc42_remove(struct i2c_client *client)
+{
+        struct jc42_data *data = i2c_get_clientdata(client);
+        hwmon_device_unregister(data->hwmon_dev);
+        sysfs_remove_group(&client->dev.kobj, &jc42_group);
+        if (data->config != data->orig_config)
+                jc42_write_value(client, JC42_REG_CONFIG, data->orig_config);
+        kfree(data);
+        return 0;
+}
+
+/* All registers are word-sized. */
+static int jc42_read_value(struct i2c_client *client, u8 reg)
+{
+        int ret = i2c_smbus_read_word_data(client, reg);
+        if (ret < 0)
+                return ret;
+        return swab16(ret);
+}
+
+static int jc42_write_value(struct i2c_client *client, u8 reg, u16 value)
+{
+        return i2c_smbus_write_word_data(client, reg, swab16(value));
+}
+
+static struct jc42_data *jc42_update_device(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct jc42_data *data = i2c_get_clientdata(client);
+        struct jc42_data *ret = data;
+        int val;
+
+        mutex_lock(&data->update_lock);
+
+        if (time_after(jiffies, data->last_updated + HZ) || !data->valid) {
+                val = jc42_read_value(client, JC42_REG_TEMP);
+                if (val < 0) {
+                        ret = ERR_PTR(val);
+                        goto abort;
+                }
+                data->temp_input = val;
+
+                val = jc42_read_value(client, JC42_REG_TEMP_CRITICAL);
+                if (val < 0) {
+                        ret = ERR_PTR(val);
+                        goto abort;
+                }
+                data->temp_crit = val;
+
+                val = jc42_read_value(client, JC42_REG_TEMP_LOWER);
+                if (val < 0) {
+                        ret = ERR_PTR(val);
+                        goto abort;
+                }
+                data->temp_min = val;
+
+                val = jc42_read_value(client, JC42_REG_TEMP_UPPER);
+                if (val < 0) {
+                        ret = ERR_PTR(val);
+                        goto abort;
+                }
+                data->temp_max = val;
+
+                data->last_updated = jiffies;
+                data->valid = true;
+        }
+abort:
+        mutex_unlock(&data->update_lock);
+        return ret;
+}
+
+static int __init sensors_jc42_init(void)
+{
+        return i2c_add_driver(&jc42_driver);
+}
+
+static void __exit sensors_jc42_exit(void)
+{
+        i2c_del_driver(&jc42_driver);
+}
+
+MODULE_AUTHOR("Guenter Roeck <guenter.roeck@ericsson.com>");
+MODULE_DESCRIPTION("JC42 driver");
+MODULE_LICENSE("GPL");
+
+module_init(sensors_jc42_init);
+module_exit(sensors_jc42_exit);
diff --git a/drivers/hwmon/smm665.c b/drivers/hwmon/smm665.c
new file mode 100644
index 000000000000..425df5bccd45
--- /dev/null
+++ b/drivers/hwmon/smm665.c
@@ -0,0 +1,743 @@
+/*
+ * Driver for SMM665 Power Controller / Monitor
+ *
+ * Copyright (C) 2010 Ericsson AB.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This driver should also work for SMM465, SMM764, and SMM766, but is untested
+ * for those chips. Only monitoring functionality is implemented.
+ *
+ * Datasheets:
+ * http://www.summitmicro.com/prod_select/summary/SMM665/SMM665B_2089_20.pdf
+ * http://www.summitmicro.com/prod_select/summary/SMM766B/SMM766B_2122.pdf
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/delay.h>
+
+/* Internal reference voltage (VREF, x 1000 */
+#define SMM665_VREF_ADC_X1000   1250
+
+/* module parameters */
+static int vref = SMM665_VREF_ADC_X1000;
+module_param(vref, int, 0);
+MODULE_PARM_DESC(vref, "Reference voltage in mV");
+
+enum chips { smm465, smm665, smm665c, smm764, smm766 };
+
+/*
+ * ADC channel addresses
+ */
+#define SMM665_MISC16_ADC_DATA_A        0x00
+#define SMM665_MISC16_ADC_DATA_B        0x01
+#define SMM665_MISC16_ADC_DATA_C        0x02
+#define SMM665_MISC16_ADC_DATA_D        0x03
+#define SMM665_MISC16_ADC_DATA_E        0x04
+#define SMM665_MISC16_ADC_DATA_F        0x05
+#define SMM665_MISC16_ADC_DATA_VDD      0x06
+#define SMM665_MISC16_ADC_DATA_12V      0x07
+#define SMM665_MISC16_ADC_DATA_INT_TEMP 0x08
+#define SMM665_MISC16_ADC_DATA_AIN1     0x09
+#define SMM665_MISC16_ADC_DATA_AIN2     0x0a
+
+/*
+ * Command registers
+ */
+#define SMM665_MISC8_CMD_STS            0x80
+#define SMM665_MISC8_STATUS1            0x81
+#define SMM665_MISC8_STATUSS2           0x82
+#define SMM665_MISC8_IO_POLARITY        0x83
+#define SMM665_MISC8_PUP_POLARITY       0x84
+#define SMM665_MISC8_ADOC_STATUS1       0x85
+#define SMM665_MISC8_ADOC_STATUS2       0x86
+#define SMM665_MISC8_WRITE_PROT         0x87
+#define SMM665_MISC8_STS_TRACK          0x88
+
+/*
+ * Configuration registers and register groups
+ */
+#define SMM665_ADOC_ENABLE              0x0d
+#define SMM665_LIMIT_BASE               0x80    /* First limit register */
+
+/*
+ * Limit register bit masks
+ */
+#define SMM665_TRIGGER_RST              0x8000
+#define SMM665_TRIGGER_HEALTHY          0x4000
+#define SMM665_TRIGGER_POWEROFF         0x2000
+#define SMM665_TRIGGER_SHUTDOWN         0x1000
+#define SMM665_ADC_MASK                 0x03ff
+
+#define smm665_is_critical(lim) ((lim) & (SMM665_TRIGGER_RST \
+                                        | SMM665_TRIGGER_POWEROFF \
+                                        | SMM665_TRIGGER_SHUTDOWN))
+/*
+ * Fault register bit definitions
+ * Values are merged from status registers 1/2,
+ * with status register 1 providing the upper 8 bits.
+ */
+#define SMM665_FAULT_A          0x0001
+#define SMM665_FAULT_B          0x0002
+#define SMM665_FAULT_C          0x0004
+#define SMM665_FAULT_D          0x0008
+#define SMM665_FAULT_E          0x0010
+#define SMM665_FAULT_F          0x0020
+#define SMM665_FAULT_VDD        0x0040
+#define SMM665_FAULT_12V        0x0080
+#define SMM665_FAULT_TEMP       0x0100
+#define SMM665_FAULT_AIN1       0x0200
+#define SMM665_FAULT_AIN2       0x0400
+
+/*
+ * I2C Register addresses
+ *
+ * The configuration register needs to be the configured base register.
+ * The command/status register address is derived from it.
+ */
+#define SMM665_REGMASK          0x78
+#define SMM665_CMDREG_BASE      0x48
+#define SMM665_CONFREG_BASE     0x50
+
+/*
+ *  Equations given by chip manufacturer to calculate voltage/temperature values
+ *  vref = Reference voltage on VREF_ADC pin (module parameter)
+ *  adc  = 10bit ADC value read back from registers
+ */
+
+/* Voltage A-F and VDD */
+#define SMM665_VMON_ADC_TO_VOLTS(adc)  ((adc) * vref / 256)
+
+/* Voltage 12VIN */
+#define SMM665_12VIN_ADC_TO_VOLTS(adc) ((adc) * vref * 3 / 256)
+
+/* Voltage AIN1, AIN2 */
+#define SMM665_AIN_ADC_TO_VOLTS(adc)   ((adc) * vref / 512)
+
+/* Temp Sensor */
+#define SMM665_TEMP_ADC_TO_CELSIUS(adc) ((adc) <= 511) ?                   \
+                                         ((int)(adc) * 1000 / 4) :         \
+                                         (((int)(adc) - 0x400) * 1000 / 4)
+
+#define SMM665_NUM_ADC          11
+
+/*
+ * Chip dependent ADC conversion time, in uS
+ */
+#define SMM665_ADC_WAIT_SMM665  70
+#define SMM665_ADC_WAIT_SMM766  185
+
+struct smm665_data {
+        enum chips type;
+        int conversion_time;            /* ADC conversion time */
+        struct device *hwmon_dev;
+        struct mutex update_lock;
+        bool valid;
+        unsigned long last_updated;     /* in jiffies */
+        u16 adc[SMM665_NUM_ADC];        /* adc values (raw) */
+        u16 faults;                     /* fault status */
+        /* The following values are in mV */
+        int critical_min_limit[SMM665_NUM_ADC];
+        int alarm_min_limit[SMM665_NUM_ADC];
+        int critical_max_limit[SMM665_NUM_ADC];
+        int alarm_max_limit[SMM665_NUM_ADC];
+        struct i2c_client *cmdreg;
+};
+
+/*
+ * smm665_read16()
+ *
+ * Read 16 bit value from <reg>, <reg+1>. Upper 8 bits are in <reg>.
+ */
+static int smm665_read16(struct i2c_client *client, int reg)
+{
+        int rv, val;
+
+        rv = i2c_smbus_read_byte_data(client, reg);
+        if (rv < 0)
+                return rv;
+        val = rv << 8;
+        rv = i2c_smbus_read_byte_data(client, reg + 1);
+        if (rv < 0)
+                return rv;
+        val |= rv;
+        return val;
+}
+
+/*
+ * Read adc value.
+ */
+static int smm665_read_adc(struct smm665_data *data, int adc)
+{
+        struct i2c_client *client = data->cmdreg;
+        int rv;
+        int radc;
+
+        /*
+         * Algorithm for reading ADC, per SMM665 datasheet
+         *
+         *  {[S][addr][W][Ack]} {[offset][Ack]} {[S][addr][R][Nack]}
+         * [wait conversion time]
+         *  {[S][addr][R][Ack]} {[datahi][Ack]} {[datalo][Ack][P]}
+         *
+         * To implement the first part of this exchange,
+         * do a full read transaction and expect a failure/Nack.
+         * This sets up the address pointer on the SMM665
+         * and starts the ADC conversion.
+         * Then do a two-byte read transaction.
+         */
+        rv = i2c_smbus_read_byte_data(client, adc << 3);
+        if (rv != -ENXIO) {
+                /*
+                 * We expect ENXIO to reflect NACK
+                 * (per Documentation/i2c/fault-codes).
+                 * Everything else is an error.
+                 */
+                dev_dbg(&client->dev,
+                        "Unexpected return code %d when setting ADC index", rv);
+                return (rv < 0) ? rv : -EIO;
+        }
+
+        udelay(data->conversion_time);
+
+        /*
+         * Now read two bytes.
+         *
+         * Neither i2c_smbus_read_byte() nor
+         * i2c_smbus_read_block_data() worked here,
+         * so use i2c_smbus_read_word_data() instead.
+         * We could also try to use i2c_master_recv(),
+         * but that is not always supported.
+         */
+        rv = i2c_smbus_read_word_data(client, 0);
+        if (rv < 0) {
+                dev_dbg(&client->dev, "Failed to read ADC value: error %d", rv);
+                return -1;
+        }
+        /*
+         * Validate/verify readback adc channel (in bit 11..14).
+         * High byte is in lower 8 bit of rv, so only shift by 3.
+         */
+        radc = (rv >> 3) & 0x0f;
+        if (radc != adc) {
+                dev_dbg(&client->dev, "Unexpected RADC: Expected %d got %d",
+                        adc, radc);
+                return -EIO;
+        }
+        /*
+         * Chip replies with H/L, while SMBus expects L/H.
+         * Thus, byte order is reversed, and we have to swap
+         * the result.
+         */
+        rv = swab16(rv) & SMM665_ADC_MASK;
+
+        return rv;
+}
+
+static struct smm665_data *smm665_update_device(struct device *dev)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct smm665_data *data = i2c_get_clientdata(client);
+        struct smm665_data *ret = data;
+
+        mutex_lock(&data->update_lock);
+
+        if (time_after(jiffies, data->last_updated + HZ) || !data->valid) {
+                int i, val;
+
+                /*
+                 * read status registers
+                 */
+                val = smm665_read16(client, SMM665_MISC8_STATUS1);
+                if (unlikely(val < 0)) {
+                        ret = ERR_PTR(val);
+                        goto abort;
+                }
+                data->faults = val;
+
+                /* Read adc registers */
+                for (i = 0; i < SMM665_NUM_ADC; i++) {
+                        val = smm665_read_adc(data, i);
+                        if (unlikely(val < 0)) {
+                                ret = ERR_PTR(val);
+                                goto abort;
+                        }
+                        data->adc[i] = val;
+                }
+                data->last_updated = jiffies;
+                data->valid = 1;
+        }
+abort:
+        mutex_unlock(&data->update_lock);
+        return ret;
+}
+
+/* Return converted value from given adc */
+static int smm665_convert(u16 adcval, int index)
+{
+        int val = 0;
+
+        switch (index) {
+        case SMM665_MISC16_ADC_DATA_12V:
+                val = SMM665_12VIN_ADC_TO_VOLTS(adcval & SMM665_ADC_MASK);
+                break;
+
+        case SMM665_MISC16_ADC_DATA_VDD:
+        case SMM665_MISC16_ADC_DATA_A:
+        case SMM665_MISC16_ADC_DATA_B:
+        case SMM665_MISC16_ADC_DATA_C:
+        case SMM665_MISC16_ADC_DATA_D:
+        case SMM665_MISC16_ADC_DATA_E:
+        case SMM665_MISC16_ADC_DATA_F:
+                val = SMM665_VMON_ADC_TO_VOLTS(adcval & SMM665_ADC_MASK);
+                break;
+
+        case SMM665_MISC16_ADC_DATA_AIN1:
+        case SMM665_MISC16_ADC_DATA_AIN2:
+                val = SMM665_AIN_ADC_TO_VOLTS(adcval & SMM665_ADC_MASK);
+                break;
+
+        case SMM665_MISC16_ADC_DATA_INT_TEMP:
+                val = SMM665_TEMP_ADC_TO_CELSIUS(adcval & SMM665_ADC_MASK);
+                break;
+
+        default:
+                /* If we get here, the developer messed up */
+                WARN_ON_ONCE(1);
+                break;
+        }
+
+        return val;
+}
+
+static int smm665_get_min(struct device *dev, int index)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct smm665_data *data = i2c_get_clientdata(client);
+
+        return data->alarm_min_limit[index];
+}
+
+static int smm665_get_max(struct device *dev, int index)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct smm665_data *data = i2c_get_clientdata(client);
+
+        return data->alarm_max_limit[index];
+}
+
+static int smm665_get_lcrit(struct device *dev, int index)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct smm665_data *data = i2c_get_clientdata(client);
+
+        return data->critical_min_limit[index];
+}
+
+static int smm665_get_crit(struct device *dev, int index)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct smm665_data *data = i2c_get_clientdata(client);
+
+        return data->critical_max_limit[index];
+}
+
+static ssize_t smm665_show_crit_alarm(struct device *dev,
+                                      struct device_attribute *da, char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+        struct smm665_data *data = smm665_update_device(dev);
+        int val = 0;
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        if (data->faults & (1 << attr->index))
+                val = 1;
+
+        return snprintf(buf, PAGE_SIZE, "%d\n", val);
+}
+
+static ssize_t smm665_show_input(struct device *dev,
+                                 struct device_attribute *da, char *buf)
+{
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+        struct smm665_data *data = smm665_update_device(dev);
+        int adc = attr->index;
+        int val;
+
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        val = smm665_convert(data->adc[adc], adc);
+        return snprintf(buf, PAGE_SIZE, "%d\n", val);
+}
+
+#define SMM665_SHOW(what) \
+  static ssize_t smm665_show_##what(struct device *dev, \
+                                    struct device_attribute *da, char *buf) \
+{ \
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(da); \
+        const int val = smm665_get_##what(dev, attr->index); \
+        return snprintf(buf, PAGE_SIZE, "%d\n", val); \
+}
+
+SMM665_SHOW(min);
+SMM665_SHOW(max);
+SMM665_SHOW(lcrit);
+SMM665_SHOW(crit);
+
+/* These macros are used below in constructing device attribute objects
+ * for use with sysfs_create_group() to make a sysfs device file
+ * for each register.
+ */
+
+#define SMM665_ATTR(name, type, cmd_idx) \
+        static SENSOR_DEVICE_ATTR(name##_##type, S_IRUGO, \
+                                  smm665_show_##type, NULL, cmd_idx)
+
+/* Construct a sensor_device_attribute structure for each register */
+
+/* Input voltages */
+SMM665_ATTR(in1, input, SMM665_MISC16_ADC_DATA_12V);
+SMM665_ATTR(in2, input, SMM665_MISC16_ADC_DATA_VDD);
+SMM665_ATTR(in3, input, SMM665_MISC16_ADC_DATA_A);
+SMM665_ATTR(in4, input, SMM665_MISC16_ADC_DATA_B);
+SMM665_ATTR(in5, input, SMM665_MISC16_ADC_DATA_C);
+SMM665_ATTR(in6, input, SMM665_MISC16_ADC_DATA_D);
+SMM665_ATTR(in7, input, SMM665_MISC16_ADC_DATA_E);
+SMM665_ATTR(in8, input, SMM665_MISC16_ADC_DATA_F);
+SMM665_ATTR(in9, input, SMM665_MISC16_ADC_DATA_AIN1);
+SMM665_ATTR(in10, input, SMM665_MISC16_ADC_DATA_AIN2);
+
+/* Input voltages min */
+SMM665_ATTR(in1, min, SMM665_MISC16_ADC_DATA_12V);
+SMM665_ATTR(in2, min, SMM665_MISC16_ADC_DATA_VDD);
+SMM665_ATTR(in3, min, SMM665_MISC16_ADC_DATA_A);
+SMM665_ATTR(in4, min, SMM665_MISC16_ADC_DATA_B);
+SMM665_ATTR(in5, min, SMM665_MISC16_ADC_DATA_C);
+SMM665_ATTR(in6, min, SMM665_MISC16_ADC_DATA_D);
+SMM665_ATTR(in7, min, SMM665_MISC16_ADC_DATA_E);
+SMM665_ATTR(in8, min, SMM665_MISC16_ADC_DATA_F);
+SMM665_ATTR(in9, min, SMM665_MISC16_ADC_DATA_AIN1);
+SMM665_ATTR(in10, min, SMM665_MISC16_ADC_DATA_AIN2);
+
+/* Input voltages max */
+SMM665_ATTR(in1, max, SMM665_MISC16_ADC_DATA_12V);
+SMM665_ATTR(in2, max, SMM665_MISC16_ADC_DATA_VDD);
+SMM665_ATTR(in3, max, SMM665_MISC16_ADC_DATA_A);
+SMM665_ATTR(in4, max, SMM665_MISC16_ADC_DATA_B);
+SMM665_ATTR(in5, max, SMM665_MISC16_ADC_DATA_C);
+SMM665_ATTR(in6, max, SMM665_MISC16_ADC_DATA_D);
+SMM665_ATTR(in7, max, SMM665_MISC16_ADC_DATA_E);
+SMM665_ATTR(in8, max, SMM665_MISC16_ADC_DATA_F);
+SMM665_ATTR(in9, max, SMM665_MISC16_ADC_DATA_AIN1);
+SMM665_ATTR(in10, max, SMM665_MISC16_ADC_DATA_AIN2);
+
+/* Input voltages lcrit */
+SMM665_ATTR(in1, lcrit, SMM665_MISC16_ADC_DATA_12V);
+SMM665_ATTR(in2, lcrit, SMM665_MISC16_ADC_DATA_VDD);
+SMM665_ATTR(in3, lcrit, SMM665_MISC16_ADC_DATA_A);
+SMM665_ATTR(in4, lcrit, SMM665_MISC16_ADC_DATA_B);
+SMM665_ATTR(in5, lcrit, SMM665_MISC16_ADC_DATA_C);
+SMM665_ATTR(in6, lcrit, SMM665_MISC16_ADC_DATA_D);
+SMM665_ATTR(in7, lcrit, SMM665_MISC16_ADC_DATA_E);
+SMM665_ATTR(in8, lcrit, SMM665_MISC16_ADC_DATA_F);
+SMM665_ATTR(in9, lcrit, SMM665_MISC16_ADC_DATA_AIN1);
+SMM665_ATTR(in10, lcrit, SMM665_MISC16_ADC_DATA_AIN2);
+
+/* Input voltages crit */
+SMM665_ATTR(in1, crit, SMM665_MISC16_ADC_DATA_12V);
+SMM665_ATTR(in2, crit, SMM665_MISC16_ADC_DATA_VDD);
+SMM665_ATTR(in3, crit, SMM665_MISC16_ADC_DATA_A);
+SMM665_ATTR(in4, crit, SMM665_MISC16_ADC_DATA_B);
+SMM665_ATTR(in5, crit, SMM665_MISC16_ADC_DATA_C);
+SMM665_ATTR(in6, crit, SMM665_MISC16_ADC_DATA_D);
+SMM665_ATTR(in7, crit, SMM665_MISC16_ADC_DATA_E);
+SMM665_ATTR(in8, crit, SMM665_MISC16_ADC_DATA_F);
+SMM665_ATTR(in9, crit, SMM665_MISC16_ADC_DATA_AIN1);
+SMM665_ATTR(in10, crit, SMM665_MISC16_ADC_DATA_AIN2);
+
+/* critical alarms */
+SMM665_ATTR(in1, crit_alarm, SMM665_FAULT_12V);
+SMM665_ATTR(in2, crit_alarm, SMM665_FAULT_VDD);
+SMM665_ATTR(in3, crit_alarm, SMM665_FAULT_A);
+SMM665_ATTR(in4, crit_alarm, SMM665_FAULT_B);
+SMM665_ATTR(in5, crit_alarm, SMM665_FAULT_C);
+SMM665_ATTR(in6, crit_alarm, SMM665_FAULT_D);
+SMM665_ATTR(in7, crit_alarm, SMM665_FAULT_E);
+SMM665_ATTR(in8, crit_alarm, SMM665_FAULT_F);
+SMM665_ATTR(in9, crit_alarm, SMM665_FAULT_AIN1);
+SMM665_ATTR(in10, crit_alarm, SMM665_FAULT_AIN2);
+
+/* Temperature */
+SMM665_ATTR(temp1, input, SMM665_MISC16_ADC_DATA_INT_TEMP);
+SMM665_ATTR(temp1, min, SMM665_MISC16_ADC_DATA_INT_TEMP);
+SMM665_ATTR(temp1, max, SMM665_MISC16_ADC_DATA_INT_TEMP);
+SMM665_ATTR(temp1, lcrit, SMM665_MISC16_ADC_DATA_INT_TEMP);
+SMM665_ATTR(temp1, crit, SMM665_MISC16_ADC_DATA_INT_TEMP);
+SMM665_ATTR(temp1, crit_alarm, SMM665_FAULT_TEMP);
+
+/*
+ * Finally, construct an array of pointers to members of the above objects,
+ * as required for sysfs_create_group()
+ */
+static struct attribute *smm665_attributes[] = {
+        &sensor_dev_attr_in1_input.dev_attr.attr,
+        &sensor_dev_attr_in1_min.dev_attr.attr,
+        &sensor_dev_attr_in1_max.dev_attr.attr,
+        &sensor_dev_attr_in1_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in1_crit.dev_attr.attr,
+        &sensor_dev_attr_in1_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in2_input.dev_attr.attr,
+        &sensor_dev_attr_in2_min.dev_attr.attr,
+        &sensor_dev_attr_in2_max.dev_attr.attr,
+        &sensor_dev_attr_in2_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in2_crit.dev_attr.attr,
+        &sensor_dev_attr_in2_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in3_input.dev_attr.attr,
+        &sensor_dev_attr_in3_min.dev_attr.attr,
+        &sensor_dev_attr_in3_max.dev_attr.attr,
+        &sensor_dev_attr_in3_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in3_crit.dev_attr.attr,
+        &sensor_dev_attr_in3_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in4_input.dev_attr.attr,
+        &sensor_dev_attr_in4_min.dev_attr.attr,
+        &sensor_dev_attr_in4_max.dev_attr.attr,
+        &sensor_dev_attr_in4_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in4_crit.dev_attr.attr,
+        &sensor_dev_attr_in4_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in5_input.dev_attr.attr,
+        &sensor_dev_attr_in5_min.dev_attr.attr,
+        &sensor_dev_attr_in5_max.dev_attr.attr,
+        &sensor_dev_attr_in5_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in5_crit.dev_attr.attr,
+        &sensor_dev_attr_in5_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in6_input.dev_attr.attr,
+        &sensor_dev_attr_in6_min.dev_attr.attr,
+        &sensor_dev_attr_in6_max.dev_attr.attr,
+        &sensor_dev_attr_in6_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in6_crit.dev_attr.attr,
+        &sensor_dev_attr_in6_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in7_input.dev_attr.attr,
+        &sensor_dev_attr_in7_min.dev_attr.attr,
+        &sensor_dev_attr_in7_max.dev_attr.attr,
+        &sensor_dev_attr_in7_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in7_crit.dev_attr.attr,
+        &sensor_dev_attr_in7_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in8_input.dev_attr.attr,
+        &sensor_dev_attr_in8_min.dev_attr.attr,
+        &sensor_dev_attr_in8_max.dev_attr.attr,
+        &sensor_dev_attr_in8_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in8_crit.dev_attr.attr,
+        &sensor_dev_attr_in8_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in9_input.dev_attr.attr,
+        &sensor_dev_attr_in9_min.dev_attr.attr,
+        &sensor_dev_attr_in9_max.dev_attr.attr,
+        &sensor_dev_attr_in9_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in9_crit.dev_attr.attr,
+        &sensor_dev_attr_in9_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_in10_input.dev_attr.attr,
+        &sensor_dev_attr_in10_min.dev_attr.attr,
+        &sensor_dev_attr_in10_max.dev_attr.attr,
+        &sensor_dev_attr_in10_lcrit.dev_attr.attr,
+        &sensor_dev_attr_in10_crit.dev_attr.attr,
+        &sensor_dev_attr_in10_crit_alarm.dev_attr.attr,
+
+        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        &sensor_dev_attr_temp1_min.dev_attr.attr,
+        &sensor_dev_attr_temp1_max.dev_attr.attr,
+        &sensor_dev_attr_temp1_lcrit.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit.dev_attr.attr,
+        &sensor_dev_attr_temp1_crit_alarm.dev_attr.attr,
+
+        NULL,
+};
+
+static const struct attribute_group smm665_group = {
+        .attrs = smm665_attributes,
+};
+
+static int smm665_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        struct i2c_adapter *adapter = client->adapter;
+        struct smm665_data *data;
+        int i, ret;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA
+                                     | I2C_FUNC_SMBUS_WORD_DATA))
+                return -ENODEV;
+
+        if (i2c_smbus_read_byte_data(client, SMM665_ADOC_ENABLE) < 0)
+                return -ENODEV;
+
+        ret = -ENOMEM;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                goto out_return;
+
+        i2c_set_clientdata(client, data);
+        mutex_init(&data->update_lock);
+
+        data->type = id->driver_data;
+        data->cmdreg = i2c_new_dummy(adapter, (client->addr & ~SMM665_REGMASK)
+                                     | SMM665_CMDREG_BASE);
+        if (!data->cmdreg)
+                goto out_kfree;
+
+        switch (data->type) {
+        case smm465:
+        case smm665:
+                data->conversion_time = SMM665_ADC_WAIT_SMM665;
+                break;
+        case smm665c:
+        case smm764:
+        case smm766:
+                data->conversion_time = SMM665_ADC_WAIT_SMM766;
+                break;
+        }
+
+        ret = -ENODEV;
+        if (i2c_smbus_read_byte_data(data->cmdreg, SMM665_MISC8_CMD_STS) < 0)
+                goto out_unregister;
+
+        /*
+         * Read limits.
+         *
+         * Limit registers start with register SMM665_LIMIT_BASE.
+         * Each channel uses 8 registers, providing four limit values
+         * per channel. Each limit value requires two registers, with the
+         * high byte in the first register and the low byte in the second
+         * register. The first two limits are under limit values, followed
+         * by two over limit values.
+         *
+         * Limit register order matches the ADC register order, so we use
+         * ADC register defines throughout the code to index limit registers.
+         *
+         * We save the first retrieved value both as "critical" and "alarm"
+         * value. The second value overwrites either the critical or the
+         * alarm value, depending on its configuration. This ensures that both
+         * critical and alarm values are initialized, even if both registers are
+         * configured as critical or non-critical.
+         */
+        for (i = 0; i < SMM665_NUM_ADC; i++) {
+                int val;
+
+                val = smm665_read16(client, SMM665_LIMIT_BASE + i * 8);
+                if (unlikely(val < 0))
+                        goto out_unregister;
+                data->critical_min_limit[i] = data->alarm_min_limit[i]
+                  = smm665_convert(val, i);
+                val = smm665_read16(client, SMM665_LIMIT_BASE + i * 8 + 2);
+                if (unlikely(val < 0))
+                        goto out_unregister;
+                if (smm665_is_critical(val))
+                        data->critical_min_limit[i] = smm665_convert(val, i);
+                else
+                        data->alarm_min_limit[i] = smm665_convert(val, i);
+                val = smm665_read16(client, SMM665_LIMIT_BASE + i * 8 + 4);
+                if (unlikely(val < 0))
+                        goto out_unregister;
+                data->critical_max_limit[i] = data->alarm_max_limit[i]
+                  = smm665_convert(val, i);
+                val = smm665_read16(client, SMM665_LIMIT_BASE + i * 8 + 6);
+                if (unlikely(val < 0))
+                        goto out_unregister;
+                if (smm665_is_critical(val))
+                        data->critical_max_limit[i] = smm665_convert(val, i);
+                else
+                        data->alarm_max_limit[i] = smm665_convert(val, i);
+        }
+
+        /* Register sysfs hooks */
+        ret = sysfs_create_group(&client->dev.kobj, &smm665_group);
+        if (ret)
+                goto out_unregister;
+
+        data->hwmon_dev = hwmon_device_register(&client->dev);
+        if (IS_ERR(data->hwmon_dev)) {
+                ret = PTR_ERR(data->hwmon_dev);
+                goto out_remove_group;
+        }
+
+        return 0;
+
+out_remove_group:
+        sysfs_remove_group(&client->dev.kobj, &smm665_group);
+out_unregister:
+        i2c_unregister_device(data->cmdreg);
+out_kfree:
+        kfree(data);
+out_return:
+        return ret;
+}
+
+static int smm665_remove(struct i2c_client *client)
+{
+        struct smm665_data *data = i2c_get_clientdata(client);
+
+        i2c_unregister_device(data->cmdreg);
+        hwmon_device_unregister(data->hwmon_dev);
+        sysfs_remove_group(&client->dev.kobj, &smm665_group);
+
+        kfree(data);
+
+        return 0;
+}
+
+static const struct i2c_device_id smm665_id[] = {
+        {"smm465", smm465},
+        {"smm665", smm665},
+        {"smm665c", smm665c},
+        {"smm764", smm764},
+        {"smm766", smm766},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, smm665_id);
+
+/* This is the driver that will be inserted */
+static struct i2c_driver smm665_driver = {
+        .driver = {
+                   .name = "smm665",
+                   },
+        .probe = smm665_probe,
+        .remove = smm665_remove,
+        .id_table = smm665_id,
+};
+
+static int __init smm665_init(void)
+{
+        return i2c_add_driver(&smm665_driver);
+}
+
+static void __exit smm665_exit(void)
+{
+        i2c_del_driver(&smm665_driver);
+}
+
+MODULE_AUTHOR("Guenter Roeck");
+MODULE_DESCRIPTION("SMM665 driver");
+MODULE_LICENSE("GPL");
+
+module_init(smm665_init);
+module_exit(smm665_exit);
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 64207df8da82..2de76cc08f61 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -506,15 +506,22 @@ int ide_cd_queue_pc(ide_drive_t *drive, const unsigned char *cmd,
         return (flags & REQ_FAILED) ? -EIO : 0;
 }
 
-static void ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
+/*
+ * returns true if rq has been completed
+ */
+static bool ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
 {
         unsigned int nr_bytes = cmd->nbytes - cmd->nleft;
 
         if (cmd->tf_flags & IDE_TFLAG_WRITE)
                 nr_bytes -= cmd->last_xfer_len;
 
-        if (nr_bytes > 0)
+        if (nr_bytes > 0) {
                 ide_complete_rq(drive, 0, nr_bytes);
+                return true;
+        }
+
+        return false;
 }
 
 static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
@@ -679,7 +686,8 @@ out_end:
                 }
 
                 if (uptodate == 0 && rq->bio)
-                        ide_cd_error_cmd(drive, cmd);
+                        if (ide_cd_error_cmd(drive, cmd))
+                                return ide_stopped;
 
                 /* make sure it's fully ended */
                 if (blk_fs_request(rq) == 0) {
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 67fb73559fd5..34b9872f35d1 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -480,13 +480,9 @@ int ide_taskfile_ioctl(ide_drive_t *drive, unsigned long arg)
         u16 nsect               = 0;
         char __user *buf = (char __user *)arg;
 
-        req_task = kzalloc(tasksize, GFP_KERNEL);
-        if (req_task == NULL)
-                return -ENOMEM;
-        if (copy_from_user(req_task, buf, tasksize)) {
-                kfree(req_task);
-                return -EFAULT;
-        }
+        req_task = memdup_user(buf, tasksize);
+        if (IS_ERR(req_task))
+                return PTR_ERR(req_task);
 
         taskout = req_task->out_size;
         taskin  = req_task->in_size;
diff --git a/drivers/ide/tx4938ide.c b/drivers/ide/tx4938ide.c
index 1d80f1fdbc97..7002765b593c 100644
--- a/drivers/ide/tx4938ide.c
+++ b/drivers/ide/tx4938ide.c
@@ -64,7 +64,7 @@ static void tx4938ide_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 
         pair = ide_get_pair_dev(drive);
         if (pair)
-                safe = min(safe, pair->pio_mode - XFER_PIO_0);
+                safe = min_t(u8, safe, pair->pio_mode - XFER_PIO_0);
         tx4938ide_tune_ebusc(pdata->ebus_ch, pdata->gbus_clock, safe);
 }
 
diff --git a/drivers/ide/tx4939ide.c b/drivers/ide/tx4939ide.c
index 3c7367751873..bed3e39aac96 100644
--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -114,7 +114,7 @@ static void tx4939ide_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 
         pair = ide_get_pair_dev(drive);
         if (pair)
-                safe = min(safe, pair->pio_mode - XFER_PIO_0);
+                safe = min_t(u8, safe, pair->pio_mode - XFER_PIO_0);
         /*
          * Update Command Transfer Mode for master/slave and Data
          * Transfer Mode for this drive.
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index 101f40022386..d2a0997b78f8 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -79,7 +79,7 @@ static struct via_isa_bridge {
         { "vt8261",     PCI_DEVICE_ID_VIA_8261,     0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vt8237s",    PCI_DEVICE_ID_VIA_8237S,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vt6410",     PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
-        { "vt6415",     PCI_DEVICE_ID_VIA_6410,     0x00, 0xff, ATA_UDMA6, VIA_BAD_AST },
+        { "vt6415",     PCI_DEVICE_ID_VIA_6415,     0x00, 0xff, ATA_UDMA6, VIA_BAD_AST },
         { "vt8251",     PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vt8237",     PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
         { "vt8237a",    PCI_DEVICE_ID_VIA_8237A,    0x00, 0x2f, ATA_UDMA6, VIA_BAD_AST },
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index d870f9c17c1e..9bbf491d5d9e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -250,12 +250,17 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
         rdev->cqshift = PAGE_SHIFT - ilog2(rdev->lldi.ucq_density);
         rdev->cqmask = rdev->lldi.ucq_density - 1;
         PDBG("%s dev %s stag start 0x%0x size 0x%0x num stags %d "
-             "pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x\n",
+             "pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x "
+             "qp qid start %u size %u cq qid start %u size %u\n",
              __func__, pci_name(rdev->lldi.pdev), rdev->lldi.vr->stag.start,
              rdev->lldi.vr->stag.size, c4iw_num_stags(rdev),
              rdev->lldi.vr->pbl.start,
              rdev->lldi.vr->pbl.size, rdev->lldi.vr->rq.start,
-             rdev->lldi.vr->rq.size);
+             rdev->lldi.vr->rq.size,
+             rdev->lldi.vr->qp.start,
+             rdev->lldi.vr->qp.size,
+             rdev->lldi.vr->cq.start,
+             rdev->lldi.vr->cq.size);
         PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p qpshift %lu "
              "qpmask 0x%x cqshift %lu cqmask 0x%x\n",
              (unsigned)pci_resource_len(rdev->lldi.pdev, 2),
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
index fb195d1d9015..83b23dfa250d 100644
--- a/drivers/infiniband/hw/cxgb4/resource.c
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -110,11 +110,12 @@ static int c4iw_init_qid_fifo(struct c4iw_rdev *rdev)
 
         spin_lock_init(&rdev->resource.qid_fifo_lock);
 
-        if (kfifo_alloc(&rdev->resource.qid_fifo, T4_MAX_QIDS * sizeof(u32),
-                        GFP_KERNEL))
+        if (kfifo_alloc(&rdev->resource.qid_fifo, rdev->lldi.vr->qp.size *
+                        sizeof(u32), GFP_KERNEL))
                 return -ENOMEM;
 
-        for (i = T4_QID_BASE; i < T4_QID_BASE + T4_MAX_QIDS; i++)
+        for (i = rdev->lldi.vr->qp.start;
+             i < rdev->lldi.vr->qp.start + rdev->lldi.vr->qp.size; i++)
                 if (!(i & rdev->qpmask))
                         kfifo_in(&rdev->resource.qid_fifo,
                                     (unsigned char *) &i, sizeof(u32));
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index aef55f42bea4..24f369046ef3 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -36,8 +36,6 @@
 #include "t4_msg.h"
 #include "t4fw_ri_api.h"
 
-#define T4_QID_BASE 1024
-#define T4_MAX_QIDS 256
 #define T4_MAX_NUM_QP (1<<16)
 #define T4_MAX_NUM_CQ (1<<15)
 #define T4_MAX_NUM_PD (1<<15)
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 054edf346e0b..c908c5f83645 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -492,13 +492,15 @@ static int str_to_user(const char *str, unsigned int maxlen, void __user *p)
 }
 
 #define OLD_KEY_MAX     0x1ff
-static int handle_eviocgbit(struct input_dev *dev, unsigned int cmd, void __user *p, int compat_mode)
+static int handle_eviocgbit(struct input_dev *dev,
+                            unsigned int type, unsigned int size,
+                            void __user *p, int compat_mode)
 {
         static unsigned long keymax_warn_time;
         unsigned long *bits;
         int len;
 
-        switch (_IOC_NR(cmd) & EV_MAX) {
+        switch (type) {
 
         case      0: bits = dev->evbit;  len = EV_MAX;  break;
         case EV_KEY: bits = dev->keybit; len = KEY_MAX; break;
@@ -517,7 +519,7 @@ static int handle_eviocgbit(struct input_dev *dev, unsigned int cmd, void __user
          * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
          * should be in bytes, not in bits.
          */
-        if ((_IOC_NR(cmd) & EV_MAX) == EV_KEY && _IOC_SIZE(cmd) == OLD_KEY_MAX) {
+        if (type == EV_KEY && size == OLD_KEY_MAX) {
                 len = OLD_KEY_MAX;
                 if (printk_timed_ratelimit(&keymax_warn_time, 10 * 1000))
                         printk(KERN_WARNING
@@ -528,7 +530,7 @@ static int handle_eviocgbit(struct input_dev *dev, unsigned int cmd, void __user
                                 BITS_TO_LONGS(OLD_KEY_MAX) * sizeof(long));
         }
 
-        return bits_to_user(bits, len, _IOC_SIZE(cmd), p, compat_mode);
+        return bits_to_user(bits, len, size, p, compat_mode);
 }
 #undef OLD_KEY_MAX
 
@@ -542,8 +544,10 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
         struct ff_effect effect;
         int __user *ip = (int __user *)p;
         unsigned int i, t, u, v;
+        unsigned int size;
         int error;
 
+        /* First we check for fixed-length commands */
         switch (cmd) {
 
         case EVIOCGVERSION:
@@ -610,112 +614,102 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                         return evdev_grab(evdev, client);
                 else
                         return evdev_ungrab(evdev, client);
+        }
 
-        default:
-
-                if (_IOC_TYPE(cmd) != 'E')
-                        return -EINVAL;
-
-                if (_IOC_DIR(cmd) == _IOC_READ) {
+        size = _IOC_SIZE(cmd);
 
-                        if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
-                                return handle_eviocgbit(dev, cmd, p, compat_mode);
+        /* Now check variable-length commands */
+#define EVIOC_MASK_SIZE(nr)     ((nr) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGKEY(0)))
-                                return bits_to_user(dev->key, KEY_MAX, _IOC_SIZE(cmd),
-                                                    p, compat_mode);
+        switch (EVIOC_MASK_SIZE(cmd)) {
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGLED(0)))
-                                return bits_to_user(dev->led, LED_MAX, _IOC_SIZE(cmd),
-                                                    p, compat_mode);
+        case EVIOCGKEY(0):
+                return bits_to_user(dev->key, KEY_MAX, size, p, compat_mode);
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSND(0)))
-                                return bits_to_user(dev->snd, SND_MAX, _IOC_SIZE(cmd),
-                                                    p, compat_mode);
+        case EVIOCGLED(0):
+                return bits_to_user(dev->led, LED_MAX, size, p, compat_mode);
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGSW(0)))
-                                return bits_to_user(dev->sw, SW_MAX, _IOC_SIZE(cmd),
-                                                    p, compat_mode);
+        case EVIOCGSND(0):
+                return bits_to_user(dev->snd, SND_MAX, size, p, compat_mode);
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGNAME(0)))
-                                return str_to_user(dev->name, _IOC_SIZE(cmd), p);
+        case EVIOCGSW(0):
+                return bits_to_user(dev->sw, SW_MAX, size, p, compat_mode);
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGPHYS(0)))
-                                return str_to_user(dev->phys, _IOC_SIZE(cmd), p);
+        case EVIOCGNAME(0):
+                return str_to_user(dev->name, size, p);
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCGUNIQ(0)))
-                                return str_to_user(dev->uniq, _IOC_SIZE(cmd), p);
+        case EVIOCGPHYS(0):
+                return str_to_user(dev->phys, size, p);
 
-                        if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
+        case EVIOCGUNIQ(0):
+                return str_to_user(dev->uniq, size, p);
 
-                                t = _IOC_NR(cmd) & ABS_MAX;
+        case EVIOC_MASK_SIZE(EVIOCSFF):
+                if (input_ff_effect_from_user(p, size, &effect))
+                        return -EFAULT;
 
-                                abs.value = dev->abs[t];
-                                abs.minimum = dev->absmin[t];
-                                abs.maximum = dev->absmax[t];
-                                abs.fuzz = dev->absfuzz[t];
-                                abs.flat = dev->absflat[t];
-                                abs.resolution = dev->absres[t];
+                error = input_ff_upload(dev, &effect, file);
 
-                                if (copy_to_user(p, &abs, min_t(size_t,
-                                                                _IOC_SIZE(cmd),
-                                                                sizeof(struct input_absinfo))))
-                                        return -EFAULT;
+                if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
+                        return -EFAULT;
 
-                                return 0;
-                        }
+                return error;
+        }
 
-                }
+        /* Multi-number variable-length handlers */
+        if (_IOC_TYPE(cmd) != 'E')
+                return -EINVAL;
 
-                if (_IOC_DIR(cmd) == _IOC_WRITE) {
+        if (_IOC_DIR(cmd) == _IOC_READ) {
 
-                        if (_IOC_NR(cmd) == _IOC_NR(EVIOCSFF)) {
+                if ((_IOC_NR(cmd) & ~EV_MAX) == _IOC_NR(EVIOCGBIT(0, 0)))
+                        return handle_eviocgbit(dev,
+                                                _IOC_NR(cmd) & EV_MAX, size,
+                                                p, compat_mode);
 
-                                if (input_ff_effect_from_user(p, _IOC_SIZE(cmd), &effect))
-                                        return -EFAULT;
+                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
 
-                                error = input_ff_upload(dev, &effect, file);
+                        t = _IOC_NR(cmd) & ABS_MAX;
+                        abs = dev->absinfo[t];
 
-                                if (put_user(effect.id, &(((struct ff_effect __user *)p)->id)))
-                                        return -EFAULT;
+                        if (copy_to_user(p, &abs, min_t(size_t,
+                                        size, sizeof(struct input_absinfo))))
+                                return -EFAULT;
 
-                                return error;
-                        }
+                        return 0;
+                }
+        }
 
-                        if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
+        if (_IOC_DIR(cmd) == _IOC_READ) {
 
-                                t = _IOC_NR(cmd) & ABS_MAX;
+                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
 
-                                if (copy_from_user(&abs, p, min_t(size_t,
-                                                                  _IOC_SIZE(cmd),
-                                                                  sizeof(struct input_absinfo))))
-                                        return -EFAULT;
+                        t = _IOC_NR(cmd) & ABS_MAX;
 
-                                /* We can't change number of reserved MT slots */
-                                if (t == ABS_MT_SLOT)
-                                        return -EINVAL;
+                        if (copy_from_user(&abs, p, min_t(size_t,
+                                        size, sizeof(struct input_absinfo))))
+                                return -EFAULT;
 
-                                /*
-                                 * Take event lock to ensure that we are not
-                                 * changing device parameters in the middle
-                                 * of event.
-                                 */
-                                spin_lock_irq(&dev->event_lock);
+                        if (size < sizeof(struct input_absinfo))
+                                abs.resolution = 0;
 
-                                dev->abs[t] = abs.value;
-                                dev->absmin[t] = abs.minimum;
-                                dev->absmax[t] = abs.maximum;
-                                dev->absfuzz[t] = abs.fuzz;
-                                dev->absflat[t] = abs.flat;
-                                dev->absres[t] = _IOC_SIZE(cmd) < sizeof(struct input_absinfo) ?
-                                                        0 : abs.resolution;
+                        /* We can't change number of reserved MT slots */
+                        if (t == ABS_MT_SLOT)
+                                return -EINVAL;
 
-                                spin_unlock_irq(&dev->event_lock);
+                        /*
+                         * Take event lock to ensure that we are not
+                         * changing device parameters in the middle
+                         * of event.
+                         */
+                        spin_lock_irq(&dev->event_lock);
+                        dev->absinfo[t] = abs;
+                        spin_unlock_irq(&dev->event_lock);
 
-                                return 0;
-                        }
+                        return 0;
                 }
         }
+
         return -EINVAL;
 }
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index e1243b4b32a5..a9b025f4147a 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -182,7 +182,7 @@ static int input_handle_abs_event(struct input_dev *dev,
         is_mt_event = code >= ABS_MT_FIRST && code <= ABS_MT_LAST;
 
         if (!is_mt_event) {
-                pold = &dev->abs[code];
+                pold = &dev->absinfo[code].value;
         } else if (dev->mt) {
                 struct input_mt_slot *mtslot = &dev->mt[dev->slot];
                 pold = &mtslot->abs[code - ABS_MT_FIRST];
@@ -196,7 +196,7 @@ static int input_handle_abs_event(struct input_dev *dev,
 
         if (pold) {
                 *pval = input_defuzz_abs_event(*pval, *pold,
-                                                dev->absfuzz[code]);
+                                                dev->absinfo[code].fuzz);
                 if (*pold == *pval)
                         return INPUT_IGNORE_EVENT;
 
@@ -204,8 +204,8 @@ static int input_handle_abs_event(struct input_dev *dev,
         }
 
         /* Flush pending "slot" event */
-        if (is_mt_event && dev->slot != dev->abs[ABS_MT_SLOT]) {
-                dev->abs[ABS_MT_SLOT] = dev->slot;
+        if (is_mt_event && dev->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
+                input_abs_set_val(dev, ABS_MT_SLOT, dev->slot);
                 input_pass_event(dev, EV_ABS, ABS_MT_SLOT, dev->slot);
         }
 
@@ -391,6 +391,43 @@ void input_inject_event(struct input_handle *handle,
 EXPORT_SYMBOL(input_inject_event);
 
 /**
+ * input_alloc_absinfo - allocates array of input_absinfo structs
+ * @dev: the input device emitting absolute events
+ *
+ * If the absinfo struct the caller asked for is already allocated, this
+ * functions will not do anything.
+ */
+void input_alloc_absinfo(struct input_dev *dev)
+{
+        if (!dev->absinfo)
+                dev->absinfo = kcalloc(ABS_CNT, sizeof(struct input_absinfo),
+                                        GFP_KERNEL);
+
+        WARN(!dev->absinfo, "%s(): kcalloc() failed?\n", __func__);
+}
+EXPORT_SYMBOL(input_alloc_absinfo);
+
+void input_set_abs_params(struct input_dev *dev, unsigned int axis,
+                          int min, int max, int fuzz, int flat)
+{
+        struct input_absinfo *absinfo;
+
+        input_alloc_absinfo(dev);
+        if (!dev->absinfo)
+                return;
+
+        absinfo = &dev->absinfo[axis];
+        absinfo->minimum = min;
+        absinfo->maximum = max;
+        absinfo->fuzz = fuzz;
+        absinfo->flat = flat;
+
+        dev->absbit[BIT_WORD(axis)] |= BIT_MASK(axis);
+}
+EXPORT_SYMBOL(input_set_abs_params);
+
+
+/**
  * input_grab_device - grabs device for exclusive use
  * @handle: input handle that wants to own the device
  *
@@ -1308,6 +1345,7 @@ static void input_dev_release(struct device *device)
 
         input_ff_destroy(dev);
         input_mt_destroy_slots(dev);
+        kfree(dev->absinfo);
         kfree(dev);
 
         module_put(THIS_MODULE);
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 63834585c283..d85bd8a7967d 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -530,7 +530,7 @@ static int joydev_ioctl_common(struct joydev *joydev,
 {
         struct input_dev *dev = joydev->handle.dev;
         size_t len;
-        int i, j;
+        int i;
         const char *name;
 
         /* Process fixed-sized commands. */
@@ -562,12 +562,11 @@ static int joydev_ioctl_common(struct joydev *joydev,
         case JSIOCSCORR:
                 if (copy_from_user(joydev->corr, argp,
                               sizeof(joydev->corr[0]) * joydev->nabs))
-                    return -EFAULT;
+                        return -EFAULT;
 
                 for (i = 0; i < joydev->nabs; i++) {
-                        j = joydev->abspam[i];
-                        joydev->abs[i] = joydev_correct(dev->abs[j],
-                                                        &joydev->corr[i]);
+                        int val = input_abs_get_val(dev, joydev->abspam[i]);
+                        joydev->abs[i] = joydev_correct(val, &joydev->corr[i]);
                 }
                 return 0;
 
@@ -848,25 +847,27 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
 
         for (i = 0; i < joydev->nabs; i++) {
                 j = joydev->abspam[i];
-                if (dev->absmax[j] == dev->absmin[j]) {
+                if (input_abs_get_max(dev, j) == input_abs_get_min(dev, j)) {
                         joydev->corr[i].type = JS_CORR_NONE;
-                        joydev->abs[i] = dev->abs[j];
+                        joydev->abs[i] = input_abs_get_val(dev, j);
                         continue;
                 }
                 joydev->corr[i].type = JS_CORR_BROKEN;
-                joydev->corr[i].prec = dev->absfuzz[j];
-                joydev->corr[i].coef[0] =
-                        (dev->absmax[j] + dev->absmin[j]) / 2 - dev->absflat[j];
-                joydev->corr[i].coef[1] =
-                        (dev->absmax[j] + dev->absmin[j]) / 2 + dev->absflat[j];
+                joydev->corr[i].prec = input_abs_get_fuzz(dev, j);
+
+                t = (input_abs_get_max(dev, j) + input_abs_get_min(dev, j)) / 2;
+                joydev->corr[i].coef[0] = t - input_abs_get_flat(dev, j);
+                joydev->corr[i].coef[1] = t + input_abs_get_flat(dev, j);
 
-                t = (dev->absmax[j] - dev->absmin[j]) / 2 - 2 * dev->absflat[j];
+                t = (input_abs_get_max(dev, j) - input_abs_get_min(dev, j)) / 2
+                        - 2 * input_abs_get_flat(dev, j);
                 if (t) {
                         joydev->corr[i].coef[2] = (1 << 29) / t;
                         joydev->corr[i].coef[3] = (1 << 29) / t;
 
-                        joydev->abs[i] = joydev_correct(dev->abs[j],
-                                                        joydev->corr + i);
+                        joydev->abs[i] =
+                                joydev_correct(input_abs_get_val(dev, j),
+                                               joydev->corr + i);
                 }
         }
 
diff --git a/drivers/input/joystick/a3d.c b/drivers/input/joystick/a3d.c
index 6489f4010c4f..d259b41354b8 100644
--- a/drivers/input/joystick/a3d.c
+++ b/drivers/input/joystick/a3d.c
@@ -342,7 +342,8 @@ static int a3d_connect(struct gameport *gameport, struct gameport_driver *drv)
 
                 for (i = 0; i < 4; i++) {
                         if (i < 2)
-                                input_set_abs_params(input_dev, axes[i], 48, input_dev->abs[axes[i]] * 2 - 48, 0, 8);
+                                input_set_abs_params(input_dev, axes[i],
+                                        48, input_abs_get_val(input_dev, axes[i]) * 2 - 48, 0, 8);
                         else
                                 input_set_abs_params(input_dev, axes[i], 2, 253, 0, 0);
                         input_set_abs_params(input_dev, ABS_HAT0X + i, -1, 1, 0, 0);
diff --git a/drivers/input/joystick/adi.c b/drivers/input/joystick/adi.c
index 89c4c084d4ad..b992fbf91f2f 100644
--- a/drivers/input/joystick/adi.c
+++ b/drivers/input/joystick/adi.c
@@ -452,7 +452,7 @@ static void adi_init_center(struct adi *adi)
         for (i = 0; i < adi->axes10 + adi->axes8 + (adi->hats + (adi->pad != -1)) * 2; i++) {
 
                 t = adi->abs[i];
-                x = adi->dev->abs[t];
+                x = input_abs_get_val(adi->dev, t);
 
                 if (t == ABS_THROTTLE || t == ABS_RUDDER || adi->id == ADI_ID_WGPE)
                         x = i < adi->axes10 ? 512 : 128;
diff --git a/drivers/input/joystick/amijoy.c b/drivers/input/joystick/amijoy.c
index 05022f07ec77..e90694fe0d5c 100644
--- a/drivers/input/joystick/amijoy.c
+++ b/drivers/input/joystick/amijoy.c
@@ -139,8 +139,8 @@ static int __init amijoy_init(void)
                 amijoy_dev[i]->keybit[BIT_WORD(BTN_LEFT)] = BIT_MASK(BTN_LEFT) |
                         BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
                 for (j = 0; j < 2; j++) {
-                        amijoy_dev[i]->absmin[ABS_X + j] = -1;
-                        amijoy_dev[i]->absmax[ABS_X + j] = 1;
+                        XXinput_set_abs_params(amijoy_dev[i], ABS_X + j,
+                                             -1, 1, 0, 0);
                 }
 
                 err = input_register_device(amijoy_dev[i]);
diff --git a/drivers/input/joystick/gf2k.c b/drivers/input/joystick/gf2k.c
index 45ac70eae0aa..0536b1b2f018 100644
--- a/drivers/input/joystick/gf2k.c
+++ b/drivers/input/joystick/gf2k.c
@@ -318,11 +318,8 @@ static int gf2k_connect(struct gameport *gameport, struct gameport_driver *drv)
         for (i = 0; i < gf2k_axes[gf2k->id]; i++)
                 set_bit(gf2k_abs[i], input_dev->absbit);
 
-        for (i = 0; i < gf2k_hats[gf2k->id]; i++) {
-                set_bit(ABS_HAT0X + i, input_dev->absbit);
-                input_dev->absmin[ABS_HAT0X + i] = -1;
-                input_dev->absmax[ABS_HAT0X + i] = 1;
-        }
+        for (i = 0; i < gf2k_hats[gf2k->id]; i++)
+                input_set_abs_params(input_dev, ABS_HAT0X + i, -1, 1, 0, 0);
 
         for (i = 0; i < gf2k_joys[gf2k->id]; i++)
                 set_bit(gf2k_btn_joy[i], input_dev->keybit);
@@ -334,11 +331,14 @@ static int gf2k_connect(struct gameport *gameport, struct gameport_driver *drv)
         gf2k_read(gf2k, data);
 
         for (i = 0; i < gf2k_axes[gf2k->id]; i++) {
-                input_dev->absmax[gf2k_abs[i]] = (i < 2) ? input_dev->abs[gf2k_abs[i]] * 2 - 32 :
-                          input_dev->abs[gf2k_abs[0]] + input_dev->abs[gf2k_abs[1]] - 32;
-                input_dev->absmin[gf2k_abs[i]] = 32;
-                input_dev->absfuzz[gf2k_abs[i]] = 8;
-                input_dev->absflat[gf2k_abs[i]] = (i < 2) ? 24 : 0;
+                int max = i < 2 ?
+                        input_abs_get_val(input_dev, gf2k_abs[i]) * 2 :
+                        input_abs_get_val(input_dev, gf2k_abs[0]) +
+                                input_abs_get_val(input_dev, gf2k_abs[1]);
+                int flat = i < 2 ? 24 : 0;
+
+                input_set_abs_params(input_dev, gf2k_abs[i],
+                                     32, max - 32, 8, flat);
         }
 
         err = input_register_device(gf2k->dev);
diff --git a/drivers/input/joystick/interact.c b/drivers/input/joystick/interact.c
index 2478289aeeea..16fb19d1ca25 100644
--- a/drivers/input/joystick/interact.c
+++ b/drivers/input/joystick/interact.c
@@ -270,18 +270,14 @@ static int interact_connect(struct gameport *gameport, struct gameport_driver *d
         input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
 
         for (i = 0; (t = interact_type[interact->type].abs[i]) >= 0; i++) {
-                set_bit(t, input_dev->absbit);
-                if (i < interact_type[interact->type].b8) {
-                        input_dev->absmin[t] = 0;
-                        input_dev->absmax[t] = 255;
-                } else {
-                        input_dev->absmin[t] = -1;
-                        input_dev->absmax[t] = 1;
-                }
+                if (i < interact_type[interact->type].b8)
+                        input_set_abs_params(input_dev, t, 0, 255, 0, 0);
+                else
+                        input_set_abs_params(input_dev, t, -1, 1, 0, 0);
         }
 
         for (i = 0; (t = interact_type[interact->type].btn[i]) >= 0; i++)
-                set_bit(t, input_dev->keybit);
+                __set_bit(t, input_dev->keybit);
 
         err = input_register_device(interact->dev);
         if (err)
diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index ca13a6bec33e..b8d86115644b 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -761,17 +761,21 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
                 input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
 
                 for (j = 0; (bits = sw_bit[sw->type][j]); j++) {
+                        int min, max, fuzz, flat;
+
                         code = sw_abs[sw->type][j];
-                        set_bit(code, input_dev->absbit);
-                        input_dev->absmax[code] = (1 << bits) - 1;
-                        input_dev->absmin[code] = (bits == 1) ? -1 : 0;
-                        input_dev->absfuzz[code] = ((bits >> 1) >= 2) ? (1 << ((bits >> 1) - 2)) : 0;
-                        if (code != ABS_THROTTLE)
-                                input_dev->absflat[code] = (bits >= 5) ? (1 << (bits - 5)) : 0;
+                        min = bits == 1 ? -1 : 0;
+                        max = (1 << bits) - 1;
+                        fuzz = (bits >> 1) >= 2 ? 1 << ((bits >> 1) - 2) : 0;
+                        flat = code == ABS_THROTTLE || bits < 5 ?
+                                0 : 1 << (bits - 5);
+
+                        input_set_abs_params(input_dev, code,
+                                             min, max, fuzz, flat);
                 }
 
                 for (j = 0; (code = sw_btn[sw->type][j]); j++)
-                        set_bit(code, input_dev->keybit);
+                        __set_bit(code, input_dev->keybit);
 
                 dbg("%s%s [%d-bit id %d data %d]\n", sw->name, comment, m, l, k);
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 269a846f3694..f9fb7fa10af3 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -148,6 +148,7 @@ static const struct xpad_device {
         { 0x0e6f, 0x0005, "Eclipse wireless Controller", 0, XTYPE_XBOX },
         { 0x0e6f, 0x0006, "Edge wireless Controller", 0, XTYPE_XBOX },
         { 0x0e6f, 0x0006, "Pelican 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
+        { 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
         { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", 0, XTYPE_XBOX },
         { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
         { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index a9fd147f2ba7..6069abe31e42 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -39,6 +39,8 @@ struct gpio_keys_drvdata {
         struct input_dev *input;
         struct mutex disable_lock;
         unsigned int n_buttons;
+        int (*enable)(struct device *dev);
+        void (*disable)(struct device *dev);
         struct gpio_button_data data[0];
 };
 
@@ -423,6 +425,21 @@ fail2:
         return error;
 }
 
+static int gpio_keys_open(struct input_dev *input)
+{
+        struct gpio_keys_drvdata *ddata = input_get_drvdata(input);
+
+        return ddata->enable ? ddata->enable(input->dev.parent) : 0;
+}
+
+static void gpio_keys_close(struct input_dev *input)
+{
+        struct gpio_keys_drvdata *ddata = input_get_drvdata(input);
+
+        if (ddata->disable)
+                ddata->disable(input->dev.parent);
+}
+
 static int __devinit gpio_keys_probe(struct platform_device *pdev)
 {
         struct gpio_keys_platform_data *pdata = pdev->dev.platform_data;
@@ -444,13 +461,18 @@ static int __devinit gpio_keys_probe(struct platform_device *pdev)
 
         ddata->input = input;
         ddata->n_buttons = pdata->nbuttons;
+        ddata->enable = pdata->enable;
+        ddata->disable = pdata->disable;
         mutex_init(&ddata->disable_lock);
 
         platform_set_drvdata(pdev, ddata);
+        input_set_drvdata(input, ddata);
 
         input->name = pdev->name;
         input->phys = "gpio-keys/input0";
         input->dev.parent = &pdev->dev;
+        input->open = gpio_keys_open;
+        input->close = gpio_keys_close;
 
         input->id.bustype = BUS_HOST;
         input->id.vendor = 0x0001;
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index c83f4b2ec7d3..ddd5afd301d4 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -232,15 +232,16 @@ static void hil_dev_handle_ptr_events(struct hil_dev *ptr)
                 if (absdev) {
                         val = lo + (hi << 8);
 #ifdef TABLET_AUTOADJUST
-                        if (val < dev->absmin[ABS_X + i])
-                                dev->absmin[ABS_X + i] = val;
-                        if (val > dev->absmax[ABS_X + i])
-                                dev->absmax[ABS_X + i] = val;
+                        if (val < input_abs_min(dev, ABS_X + i))
+                                input_abs_set_min(dev, ABS_X + i, val);
+                        if (val > input_abs_max(dev, ABS_X + i))
+                                XXinput_abs_set_max(dev, ABS_X + i, val);
 #endif
-                        if (i%3) val = dev->absmax[ABS_X + i] - val;
+                        if (i % 3)
+                                val = input_abs_max(dev, ABS_X + i) - val;
                         input_report_abs(dev, ABS_X + i, val);
                 } else {
-                        val = (int) (((int8_t)lo) | ((int8_t)hi << 8));
+                        val = (int) (((int8_t) lo) | ((int8_t) hi << 8));
                         if (i % 3)
                                 val *= -1;
                         input_report_rel(dev, REL_X + i, val);
@@ -387,9 +388,11 @@ static void hil_dev_pointer_setup(struct hil_dev *ptr)
 
 #ifdef TABLET_AUTOADJUST
                 for (i = 0; i < ABS_MAX; i++) {
-                        int diff = input_dev->absmax[ABS_X + i] / 10;
-                        input_dev->absmin[ABS_X + i] += diff;
-                        input_dev->absmax[ABS_X + i] -= diff;
+                        int diff = input_abs_max(input_dev, ABS_X + i) / 10;
+                        input_abs_set_min(input_dev, ABS_X + i,
+                                input_abs_min(input_dev, ABS_X + i) + diff)
+                        XXinput_abs_set_max(input_dev, ABS_X + i,
+                                input_abs_max(input_dev, ABS_X + i) - diff)
                 }
 #endif
 
diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index e2ca01708080..de5900d50788 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -724,7 +724,6 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
         pdata = &ac->pdata;
 
         ac->input = input_dev;
-        ac->disabled = true;
         ac->dev = dev;
         ac->irq = irq;
         ac->bops = bops;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index b71eb55f2dbc..bb53fd33cd1c 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -304,21 +304,25 @@ static int uinput_validate_absbits(struct input_dev *dev)
                 if (!test_bit(cnt, dev->absbit))
                         continue;
 
-                if ((dev->absmax[cnt] <= dev->absmin[cnt])) {
+                if (input_abs_get_max(dev, cnt) <= input_abs_get_min(dev, cnt)) {
                         printk(KERN_DEBUG
                                 "%s: invalid abs[%02x] min:%d max:%d\n",
                                 UINPUT_NAME, cnt,
-                                dev->absmin[cnt], dev->absmax[cnt]);
+                                input_abs_get_min(dev, cnt),
+                                input_abs_get_max(dev, cnt));
                         retval = -EINVAL;
                         break;
                 }
 
-                if (dev->absflat[cnt] > (dev->absmax[cnt] - dev->absmin[cnt])) {
+                if (input_abs_get_flat(dev, cnt) >
+                    input_abs_get_max(dev, cnt) - input_abs_get_min(dev, cnt)) {
                         printk(KERN_DEBUG
-                                "%s: absflat[%02x] out of range: %d "
+                                "%s: abs_flat #%02x out of range: %d "
                                 "(min:%d/max:%d)\n",
-                                UINPUT_NAME, cnt, dev->absflat[cnt],
-                                dev->absmin[cnt], dev->absmax[cnt]);
+                                UINPUT_NAME, cnt,
+                                input_abs_get_flat(dev, cnt),
+                                input_abs_get_min(dev, cnt),
+                                input_abs_get_max(dev, cnt));
                         retval = -EINVAL;
                         break;
                 }
@@ -343,7 +347,7 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
         struct uinput_user_dev  *user_dev;
         struct input_dev        *dev;
         char                    *name;
-        int                     size;
+        int                     i, size;
         int                     retval;
 
         if (count != sizeof(struct uinput_user_dev))
@@ -387,11 +391,12 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
         dev->id.product = user_dev->id.product;
         dev->id.version = user_dev->id.version;
 
-        size = sizeof(int) * ABS_CNT;
-        memcpy(dev->absmax, user_dev->absmax, size);
-        memcpy(dev->absmin, user_dev->absmin, size);
-        memcpy(dev->absfuzz, user_dev->absfuzz, size);
-        memcpy(dev->absflat, user_dev->absflat, size);
+        for (i = 0; i < ABS_CNT; i++) {
+                input_abs_set_max(dev, i, user_dev->absmax[i]);
+                input_abs_set_min(dev, i, user_dev->absmin[i]);
+                input_abs_set_fuzz(dev, i, user_dev->absfuzz[i]);
+                input_abs_set_flat(dev, i, user_dev->absflat[i]);
+        }
 
         /* check if absmin/absmax/absfuzz/absflat are filled as
          * told in Documentation/input/input-programming.txt */
diff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c
index 05edd75abca0..a9cf76831634 100644
--- a/drivers/input/mouse/appletouch.c
+++ b/drivers/input/mouse/appletouch.c
@@ -205,8 +205,8 @@ struct atp {
         bool                    overflow_warned;
         int                     x_old;          /* last reported x/y, */
         int                     y_old;          /* used for smoothing */
-        u8                      xy_cur[ATP_XSENSORS + ATP_YSENSORS];
-        u8                      xy_old[ATP_XSENSORS + ATP_YSENSORS];
+        signed char             xy_cur[ATP_XSENSORS + ATP_YSENSORS];
+        signed char             xy_old[ATP_XSENSORS + ATP_YSENSORS];
         int                     xy_acc[ATP_XSENSORS + ATP_YSENSORS];
         int                     idlecount;      /* number of empty packets */
         struct work_struct      work;
@@ -531,7 +531,7 @@ static void atp_complete_geyser_1_2(struct urb *urb)
 
         for (i = 0; i < ATP_XSENSORS + ATP_YSENSORS; i++) {
                 /* accumulate the change */
-                int change = dev->xy_old[i] - dev->xy_cur[i];
+                signed char change = dev->xy_old[i] - dev->xy_cur[i];
                 dev->xy_acc[i] -= change;
 
                 /* prevent down drifting */
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index b18862b2a70e..48311204ba51 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -185,7 +185,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         struct elantech_data *etd = psmouse->private;
         unsigned char *packet = psmouse->packet;
         int fingers;
-        static int old_fingers;
 
         if (etd->fw_version < 0x020000) {
                 /*
@@ -203,10 +202,13 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         }
 
         if (etd->jumpy_cursor) {
-                /* Discard packets that are likely to have bogus coordinates */
-                if (fingers > old_fingers) {
+                if (fingers != 1) {
+                        etd->single_finger_reports = 0;
+                } else if (etd->single_finger_reports < 2) {
+                        /* Discard first 2 reports of one finger, bogus */
+                        etd->single_finger_reports++;
                         elantech_debug("discarding packet\n");
-                        goto discard_packet_v1;
+                        return;
                 }
         }
 
@@ -238,9 +240,6 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         }
 
         input_sync(dev);
-
- discard_packet_v1:
-        old_fingers = fingers;
 }
 
 /*
@@ -258,6 +257,14 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
         input_report_key(dev, BTN_TOUCH, fingers != 0);
 
         switch (fingers) {
+        case 3:
+                /*
+                 * Same as one finger, except report of more than 3 fingers:
+                 * byte 3:  n4  .   w1  w0   .   .   .   .
+                 */
+                if (packet[3] & 0x80)
+                        fingers = 4;
+                /* pass through... */
         case 1:
                 /*
                  * byte 1:  .   .   .   .   .  x10 x9  x8
@@ -310,6 +317,7 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
         input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
         input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2);
         input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3);
+        input_report_key(dev, BTN_TOOL_QUADTAP, fingers == 4);
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
         input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
 
@@ -467,6 +475,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
                 break;
 
         case 2:
+                __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
                 input_set_abs_params(dev, ABS_X, ETP_XMIN_V2, ETP_XMAX_V2, 0, 0);
                 input_set_abs_params(dev, ABS_Y, ETP_YMIN_V2, ETP_YMAX_V2, 0, 0);
                 input_set_abs_params(dev, ABS_HAT0X, ETP_2FT_XMIN, ETP_2FT_XMAX, 0, 0);
@@ -733,13 +742,13 @@ int elantech_init(struct psmouse *psmouse)
         etd->capabilities = param[0];
 
         /*
-         * This firmware seems to suffer from misreporting coordinates when
+         * This firmware suffers from misreporting coordinates when
          * a touch action starts causing the mouse cursor or scrolled page
          * to jump. Enable a workaround.
          */
-        if (etd->fw_version == 0x020022) {
-                pr_info("firmware version 2.0.34 detected, enabling jumpy cursor workaround\n");
-                etd->jumpy_cursor = 1;
+        if (etd->fw_version == 0x020022 || etd->fw_version == 0x020600) {
+                pr_info("firmware version 2.0.34/2.6.0 detected, enabling jumpy cursor workaround\n");
+                etd->jumpy_cursor = true;
         }
 
         if (elantech_set_absolute_mode(psmouse)) {
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index ac57bde1bb9f..aa4aac5d2198 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,10 +100,11 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities;
-        unsigned char paritycheck;
-        unsigned char jumpy_cursor;
+        bool paritycheck;
+        bool jumpy_cursor;
         unsigned char hw_version;
-        unsigned int  fw_version;
+        unsigned int fw_version;
+        unsigned int single_finger_reports;
         unsigned char parity[256];
 };
 
diff --git a/drivers/input/mouse/pc110pad.c b/drivers/input/mouse/pc110pad.c
index 3941f97cfa60..7b02b652e267 100644
--- a/drivers/input/mouse/pc110pad.c
+++ b/drivers/input/mouse/pc110pad.c
@@ -145,8 +145,8 @@ static int __init pc110pad_init(void)
         pc110pad_dev->absbit[0] = BIT_MASK(ABS_X) | BIT_MASK(ABS_Y);
         pc110pad_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
 
-        pc110pad_dev->absmax[ABS_X] = 0x1ff;
-        pc110pad_dev->absmax[ABS_Y] = 0x0ff;
+        input_abs_set_max(pc110pad_dev, ABS_X, 0x1ff);
+        input_abs_set_max(pc110pad_dev, ABS_Y, 0x0ff);
 
         pc110pad_dev->open = pc110pad_open;
         pc110pad_dev->close = pc110pad_close;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 8c324403b9f2..96b70a43515f 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -635,8 +635,8 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
         __clear_bit(REL_X, dev->relbit);
         __clear_bit(REL_Y, dev->relbit);
 
-        dev->absres[ABS_X] = priv->x_res;
-        dev->absres[ABS_Y] = priv->y_res;
+        input_abs_set_res(dev, ABS_X, priv->x_res);
+        input_abs_set_res(dev, ABS_Y, priv->y_res);
 
         if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                 /* Clickpads report only left button */
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index d8f68f77007b..83c24cca234a 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -22,6 +22,7 @@
 #include <linux/random.h>
 #include <linux/major.h>
 #include <linux/device.h>
+#include <linux/kernel.h>
 #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
 #include <linux/miscdevice.h>
 #endif
@@ -134,11 +135,14 @@ static void mousedev_touchpad_event(struct input_dev *dev,
         switch (code) {
 
         case ABS_X:
+
                 fx(0) = value;
                 if (mousedev->touch && mousedev->pkt_count >= 2) {
-                        size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
+                        size = input_abs_get_min(dev, ABS_X) -
+                                        input_abs_get_max(dev, ABS_X);
                         if (size == 0)
                                 size = 256 * 2;
+
                         tmp = ((value - fx(2)) * 256 * FRACTION_DENOM) / size;
                         tmp += mousedev->frac_dx;
                         mousedev->packet.dx = tmp / FRACTION_DENOM;
@@ -150,10 +154,12 @@ static void mousedev_touchpad_event(struct input_dev *dev,
         case ABS_Y:
                 fy(0) = value;
                 if (mousedev->touch && mousedev->pkt_count >= 2) {
-                        /* use X size to keep the same scale */
-                        size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
+                        /* use X size for ABS_Y to keep the same scale */
+                        size = input_abs_get_min(dev, ABS_X) -
+                                        input_abs_get_max(dev, ABS_X);
                         if (size == 0)
                                 size = 256 * 2;
+
                         tmp = -((value - fy(2)) * 256 * FRACTION_DENOM) / size;
                         tmp += mousedev->frac_dy;
                         mousedev->packet.dy = tmp / FRACTION_DENOM;
@@ -167,33 +173,35 @@ static void mousedev_touchpad_event(struct input_dev *dev,
 static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
                                 unsigned int code, int value)
 {
-        int size;
+        int min, max, size;
 
         switch (code) {
 
         case ABS_X:
-                size = dev->absmax[ABS_X] - dev->absmin[ABS_X];
+                min = input_abs_get_min(dev, ABS_X);
+                max = input_abs_get_max(dev, ABS_X);
+
+                size = max - min;
                 if (size == 0)
                         size = xres ? : 1;
-                if (value > dev->absmax[ABS_X])
-                        value = dev->absmax[ABS_X];
-                if (value < dev->absmin[ABS_X])
-                        value = dev->absmin[ABS_X];
-                mousedev->packet.x =
-                        ((value - dev->absmin[ABS_X]) * xres) / size;
+
+                clamp(value, min, max);
+
+                mousedev->packet.x = ((value - min) * xres) / size;
                 mousedev->packet.abs_event = 1;
                 break;
 
         case ABS_Y:
-                size = dev->absmax[ABS_Y] - dev->absmin[ABS_Y];
+                min = input_abs_get_min(dev, ABS_Y);
+                max = input_abs_get_max(dev, ABS_Y);
+
+                size = max - min;
                 if (size == 0)
                         size = yres ? : 1;
-                if (value > dev->absmax[ABS_Y])
-                        value = dev->absmax[ABS_Y];
-                if (value < dev->absmin[ABS_Y])
-                        value = dev->absmin[ABS_Y];
-                mousedev->packet.y = yres -
-                        ((value - dev->absmin[ABS_Y]) * yres) / size;
+
+                clamp(value, min, max);
+
+                mousedev->packet.y = yres - ((value - min) * yres) / size;
                 mousedev->packet.abs_event = 1;
                 break;
         }
diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
index 51b80b08d467..57b25b84d1fc 100644
--- a/drivers/input/tablet/aiptek.c
+++ b/drivers/input/tablet/aiptek.c
@@ -987,20 +987,17 @@ static int aiptek_program_tablet(struct aiptek *aiptek)
         /* Query getXextension */
         if ((ret = aiptek_query(aiptek, 0x01, 0x00)) < 0)
                 return ret;
-        aiptek->inputdev->absmin[ABS_X] = 0;
-        aiptek->inputdev->absmax[ABS_X] = ret - 1;
+        input_set_abs_params(aiptek->inputdev, ABS_X, 0, ret - 1, 0, 0);
 
         /* Query getYextension */
         if ((ret = aiptek_query(aiptek, 0x01, 0x01)) < 0)
                 return ret;
-        aiptek->inputdev->absmin[ABS_Y] = 0;
-        aiptek->inputdev->absmax[ABS_Y] = ret - 1;
+        input_set_abs_params(aiptek->inputdev, ABS_Y, 0, ret - 1, 0, 0);
 
         /* Query getPressureLevels */
         if ((ret = aiptek_query(aiptek, 0x08, 0x00)) < 0)
                 return ret;
-        aiptek->inputdev->absmin[ABS_PRESSURE] = 0;
-        aiptek->inputdev->absmax[ABS_PRESSURE] = ret - 1;
+        input_set_abs_params(aiptek->inputdev, ABS_PRESSURE, 0, ret - 1, 0, 0);
 
         /* Depending on whether we are in absolute or relative mode, we will
          * do a switchToTablet(absolute) or switchToMouse(relative) command.
@@ -1054,8 +1051,8 @@ static ssize_t show_tabletSize(struct device *dev, struct device_attribute *attr
         struct aiptek *aiptek = dev_get_drvdata(dev);
 
         return snprintf(buf, PAGE_SIZE, "%dx%d\n",
-                        aiptek->inputdev->absmax[ABS_X] + 1,
-                        aiptek->inputdev->absmax[ABS_Y] + 1);
+                        input_abs_get_max(aiptek->inputdev, ABS_X) + 1,
+                        input_abs_get_max(aiptek->inputdev, ABS_Y) + 1);
 }
 
 /* These structs define the sysfs files, param #1 is the name of the
@@ -1843,7 +1840,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
         for (i = 0; i < ARRAY_SIZE(speeds); ++i) {
                 aiptek->curSetting.programmableDelay = speeds[i];
                 (void)aiptek_program_tablet(aiptek);
-                if (aiptek->inputdev->absmax[ABS_X] > 0) {
+                if (input_abs_get_max(aiptek->inputdev, ABS_X) > 0) {
                         dev_info(&intf->dev,
                                  "Aiptek using %d ms programming speed\n",
                                  aiptek->curSetting.programmableDelay);
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index ce0b4608dad9..40d77ba8fdc1 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -687,10 +687,10 @@ static void wacom_tpc_finger_in(struct wacom_wac *wacom, char *data, int idx)
          * protocol.
          */
         if (wacom->last_finger != finger) {
-                if (x == input->abs[ABS_X])
+                if (x == input_abs_get_val(input, ABS_X))
                         x++;
 
-                if (y == input->abs[ABS_Y])
+                if (y == input_abs_get_val(input, ABS_Y))
                         y++;
         }
 
diff --git a/drivers/input/touchscreen/cy8ctmg110_ts.c b/drivers/input/touchscreen/cy8ctmg110_ts.c
index 4eb7df0b7f87..5ec0946938fe 100644
--- a/drivers/input/touchscreen/cy8ctmg110_ts.c
+++ b/drivers/input/touchscreen/cy8ctmg110_ts.c
@@ -75,7 +75,7 @@ static int cy8ctmg110_write_regs(struct cy8ctmg110 *tsc, unsigned char reg,
                 unsigned char len, unsigned char *value)
 {
         struct i2c_client *client = tsc->client;
-        unsigned int ret;
+        int ret;
         unsigned char i2c_data[6];
 
         BUG_ON(len > 5);
@@ -86,7 +86,7 @@ static int cy8ctmg110_write_regs(struct cy8ctmg110 *tsc, unsigned char reg,
         ret = i2c_master_send(client, i2c_data, len + 1);
         if (ret != 1) {
                 dev_err(&client->dev, "i2c write data cmd failed\n");
-                return ret;
+                return ret ? ret : -EIO;
         }
 
         return 0;
@@ -96,7 +96,7 @@ static int cy8ctmg110_read_regs(struct cy8ctmg110 *tsc,
                 unsigned char *data, unsigned char len, unsigned char cmd)
 {
         struct i2c_client *client = tsc->client;
-        unsigned int ret;
+        int ret;
         struct i2c_msg msg[2] = {
                 /* first write slave position to i2c devices */
                 { client->addr, 0, 1, &cmd },
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0ded3640b926..707d9c94cf9e 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
          * The next command will reopen the AT channel automatically.
          */
         if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
-                kfree(cb);
                 rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (cb->wake_tasklet)
                         tasklet_schedule(cb->wake_tasklet);
-                return rc < 0 ? rc : cb->len;
+                if (!rc)
+                        rc = cb->len;
+                kfree(cb);
+                return rc;
         }
 
         spin_lock_irqsave(&cs->cmdlock, flags);
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index e5ea344a551a..bcc174e4f3b1 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -1052,6 +1052,7 @@ static inline void remove_appl_from_channel(struct bc_state *bcs,
         do {
                 if (bcap->bcnext == ap) {
                         bcap->bcnext = bcap->bcnext->bcnext;
+                        spin_unlock_irqrestore(&bcs->aplock, flags);
                         return;
                 }
                 bcap = bcap->bcnext;
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 43c5dc3516e5..4cfdbe08ffd1 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -174,7 +174,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                 pr_debug("%s: SCIOGETSPID: ioctl received\n",
                                 sc_adapter[card]->devicename);
 
-                spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
+                spid = kzalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
                 if (!spid) {
                         kfree(rcvmsg);
                         return -ENOMEM;
@@ -194,7 +194,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                         kfree(rcvmsg);
                         return status;
                 }
-                strcpy(spid, rcvmsg->msg_data.byte_array);
+                strlcpy(spid, rcvmsg->msg_data.byte_array, SCIOC_SPIDSIZE);
 
                 /*
                  * Package the switch type and send to user space
@@ -266,12 +266,12 @@ int sc_ioctl(int card, scs_ioctl *data)
                         return status;
                 }
 
-                dn = kmalloc(SCIOC_DNSIZE, GFP_KERNEL);
+                dn = kzalloc(SCIOC_DNSIZE, GFP_KERNEL);
                 if (!dn) {
                         kfree(rcvmsg);
                         return -ENOMEM;
                 }
-                strcpy(dn, rcvmsg->msg_data.byte_array);
+                strlcpy(dn, rcvmsg->msg_data.byte_array, SCIOC_DNSIZE);
                 kfree(rcvmsg);
 
                 /*
@@ -337,7 +337,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                 pr_debug("%s: SCIOSTAT: ioctl received\n",
                                 sc_adapter[card]->devicename);
 
-                bi = kmalloc (sizeof(boardInfo), GFP_KERNEL);
+                bi = kzalloc(sizeof(boardInfo), GFP_KERNEL);
                 if (!bi) {
                         kfree(rcvmsg);
                         return -ENOMEM;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 21ffd030611e..cb77197d480e 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -25,6 +25,7 @@
 #include <linux/init.h>
 #include <linux/kmod.h>
 #include <linux/slab.h>
+#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
@@ -215,28 +216,24 @@ static unsigned int v4l2_poll(struct file *filp, struct poll_table_struct *poll)
         return vdev->fops->poll(filp, poll);
 }
 
-static int v4l2_ioctl(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
+static long v4l2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct video_device *vdev = video_devdata(filp);
+        int ret;
 
-        if (!vdev->fops->ioctl)
-                return -ENOTTY;
         /* Allow ioctl to continue even if the device was unregistered.
            Things like dequeueing buffers might still be useful. */
-        return vdev->fops->ioctl(filp, cmd, arg);
-}
-
-static long v4l2_unlocked_ioctl(struct file *filp,
-                unsigned int cmd, unsigned long arg)
-{
-        struct video_device *vdev = video_devdata(filp);
+        if (vdev->fops->unlocked_ioctl) {
+                ret = vdev->fops->unlocked_ioctl(filp, cmd, arg);
+        } else if (vdev->fops->ioctl) {
+                /* TODO: convert all drivers to unlocked_ioctl */
+                lock_kernel();
+                ret = vdev->fops->ioctl(filp, cmd, arg);
+                unlock_kernel();
+        } else
+                ret = -ENOTTY;
 
-        if (!vdev->fops->unlocked_ioctl)
-                return -ENOTTY;
-        /* Allow ioctl to continue even if the device was unregistered.
-           Things like dequeueing buffers might still be useful. */
-        return vdev->fops->unlocked_ioctl(filp, cmd, arg);
+        return ret;
 }
 
 #ifdef CONFIG_MMU
@@ -307,22 +304,6 @@ static int v4l2_release(struct inode *inode, struct file *filp)
         return ret;
 }
 
-static const struct file_operations v4l2_unlocked_fops = {
-        .owner = THIS_MODULE,
-        .read = v4l2_read,
-        .write = v4l2_write,
-        .open = v4l2_open,
-        .get_unmapped_area = v4l2_get_unmapped_area,
-        .mmap = v4l2_mmap,
-        .unlocked_ioctl = v4l2_unlocked_ioctl,
-#ifdef CONFIG_COMPAT
-        .compat_ioctl = v4l2_compat_ioctl32,
-#endif
-        .release = v4l2_release,
-        .poll = v4l2_poll,
-        .llseek = no_llseek,
-};
-
 static const struct file_operations v4l2_fops = {
         .owner = THIS_MODULE,
         .read = v4l2_read,
@@ -330,7 +311,7 @@ static const struct file_operations v4l2_fops = {
         .open = v4l2_open,
         .get_unmapped_area = v4l2_get_unmapped_area,
         .mmap = v4l2_mmap,
-        .ioctl = v4l2_ioctl,
+        .unlocked_ioctl = v4l2_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = v4l2_compat_ioctl32,
 #endif
@@ -525,10 +506,7 @@ static int __video_register_device(struct video_device *vdev, int type, int nr,
                 ret = -ENOMEM;
                 goto cleanup;
         }
-        if (vdev->fops->unlocked_ioctl)
-                vdev->cdev->ops = &v4l2_unlocked_fops;
-        else
-                vdev->cdev->ops = &v4l2_fops;
+        vdev->cdev->ops = &v4l2_fops;
         vdev->cdev->owner = vdev->fops->owner;
         ret = cdev_add(vdev->cdev, MKDEV(VIDEO_MAJOR, vdev->minor), 1);
         if (ret < 0) {
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 488f25472291..0b591b658243 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -304,6 +304,23 @@ config SENSORS_TSL2550
           This driver can also be built as a module.  If so, the module
           will be called tsl2550.
 
+config SENSORS_BH1780
+        tristate "ROHM BH1780GLI ambient light sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the ROHM BH1780GLI
+          ambient light sensor.
+
+          This driver can also be built as a module.  If so, the module
+          will be called bh1780gli.
+
+config HMC6352
+        tristate "Honeywell HMC6352 compass"
+        depends on I2C
+        help
+          This driver provides support for the Honeywell HMC6352 compass,
+          providing configuration and heading data via sysfs.
+
 config EP93XX_PWM
         tristate "EP93xx PWM support"
         depends on ARCH_EP93XX
@@ -363,6 +380,16 @@ config ARM_CHARLCD
           line and the Linux version on the second line, but that's
           still useful.
 
+config BMP085
+        tristate "BMP085 digital pressure sensor"
+        depends on I2C && SYSFS
+        help
+          If you say yes here you get support for the Bosch Sensortec
+          BMP086 digital pressure sensor.
+
+          To compile this driver as a module, choose M here: the
+          module will be called bmp085.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 67552d6e9327..255a80dc9d73 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -9,11 +9,13 @@ obj-$(CONFIG_AD525X_DPOT_SPI)	+= ad525x_dpot-spi.o
 obj-$(CONFIG_ATMEL_PWM)         += atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)         += atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)       += atmel_tclib.o
+obj-$(CONFIG_BMP085)            += bmp085.o
 obj-$(CONFIG_ICS932S401)        += ics932s401.o
 obj-$(CONFIG_LKDTM)             += lkdtm.o
 obj-$(CONFIG_TIFM_CORE)         += tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
+obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
 obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)        += kgdbts.o
@@ -28,6 +30,7 @@ obj-$(CONFIG_DS1682)		+= ds1682.o
 obj-$(CONFIG_TI_DAC7512)        += ti_dac7512.o
 obj-$(CONFIG_C2PORT)            += c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
+obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
 obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
new file mode 100644
index 000000000000..714c6b487313
--- /dev/null
+++ b/drivers/misc/bh1780gli.c
@@ -0,0 +1,273 @@
+/*
+ * bh1780gli.c
+ * ROHM Ambient Light Sensor Driver
+ *
+ * Copyright (C) 2010 Texas Instruments
+ * Author: Hemanth V <hemanthv@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+
+#define BH1780_REG_CONTROL      0x80
+#define BH1780_REG_PARTID       0x8A
+#define BH1780_REG_MANFID       0x8B
+#define BH1780_REG_DLOW 0x8C
+#define BH1780_REG_DHIGH        0x8D
+
+#define BH1780_REVMASK          (0xf)
+#define BH1780_POWMASK          (0x3)
+#define BH1780_POFF             (0x0)
+#define BH1780_PON              (0x3)
+
+/* power on settling time in ms */
+#define BH1780_PON_DELAY        2
+
+struct bh1780_data {
+        struct i2c_client *client;
+        int power_state;
+        /* lock for sysfs operations */
+        struct mutex lock;
+};
+
+static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
+{
+        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
+        if (ret < 0)
+                dev_err(&ddata->client->dev,
+                        "i2c_smbus_write_byte_data failed error %d\
+                        Register (%s)\n", ret, msg);
+        return ret;
+}
+
+static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
+{
+        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
+        if (ret < 0)
+                dev_err(&ddata->client->dev,
+                        "i2c_smbus_read_byte_data failed error %d\
+                         Register (%s)\n", ret, msg);
+        return ret;
+}
+
+static ssize_t bh1780_show_lux(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        int lsb, msb;
+
+        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
+        if (lsb < 0)
+                return lsb;
+
+        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
+        if (msb < 0)
+                return msb;
+
+        return sprintf(buf, "%d\n", (msb << 8) | lsb);
+}
+
+static ssize_t bh1780_show_power_state(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        int state;
+
+        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
+        if (state < 0)
+                return state;
+
+        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
+}
+
+static ssize_t bh1780_store_power_state(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct bh1780_data *ddata = platform_get_drvdata(pdev);
+        unsigned long val;
+        int error;
+
+        error = strict_strtoul(buf, 0, &val);
+        if (error)
+                return error;
+
+        if (val < BH1780_POFF || val > BH1780_PON)
+                return -EINVAL;
+
+        mutex_lock(&ddata->lock);
+
+        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
+        if (error < 0) {
+                mutex_unlock(&ddata->lock);
+                return error;
+        }
+
+        msleep(BH1780_PON_DELAY);
+        ddata->power_state = val;
+        mutex_unlock(&ddata->lock);
+
+        return count;
+}
+
+static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
+
+static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
+                bh1780_show_power_state, bh1780_store_power_state);
+
+static struct attribute *bh1780_attributes[] = {
+        &dev_attr_power_state.attr,
+        &dev_attr_lux.attr,
+        NULL
+};
+
+static const struct attribute_group bh1780_attr_group = {
+        .attrs = bh1780_attributes,
+};
+
+static int __devinit bh1780_probe(struct i2c_client *client,
+                                                const struct i2c_device_id *id)
+{
+        int ret;
+        struct bh1780_data *ddata = NULL;
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE)) {
+                ret = -EIO;
+                goto err_op_failed;
+        }
+
+        ddata = kzalloc(sizeof(struct bh1780_data), GFP_KERNEL);
+        if (ddata == NULL) {
+                ret = -ENOMEM;
+                goto err_op_failed;
+        }
+
+        ddata->client = client;
+        i2c_set_clientdata(client, ddata);
+
+        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
+        if (ret < 0)
+                goto err_op_failed;
+
+        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
+                        (ret & BH1780_REVMASK));
+
+        mutex_init(&ddata->lock);
+
+        ret = sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
+        if (ret)
+                goto err_op_failed;
+
+        return 0;
+
+err_op_failed:
+        kfree(ddata);
+        return ret;
+}
+
+static int __devexit bh1780_remove(struct i2c_client *client)
+{
+        struct bh1780_data *ddata;
+
+        ddata = i2c_get_clientdata(client);
+        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
+        i2c_set_clientdata(client, NULL);
+        kfree(ddata);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int bh1780_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+        struct bh1780_data *ddata;
+        int state, ret;
+
+        ddata = i2c_get_clientdata(client);
+        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
+        if (state < 0)
+                return state;
+
+        ddata->power_state = state & BH1780_POWMASK;
+
+        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
+                                "CONTROL");
+
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int bh1780_resume(struct i2c_client *client)
+{
+        struct bh1780_data *ddata;
+        int state, ret;
+
+        ddata = i2c_get_clientdata(client);
+        state = ddata->power_state;
+
+        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
+                                "CONTROL");
+
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+#else
+#define bh1780_suspend NULL
+#define bh1780_resume NULL
+#endif /* CONFIG_PM */
+
+static const struct i2c_device_id bh1780_id[] = {
+        { "bh1780", 0 },
+        { },
+};
+
+static struct i2c_driver bh1780_driver = {
+        .probe          = bh1780_probe,
+        .remove         = bh1780_remove,
+        .id_table       = bh1780_id,
+        .suspend        = bh1780_suspend,
+        .resume         = bh1780_resume,
+        .driver = {
+                .name = "bh1780"
+        },
+};
+
+static int __init bh1780_init(void)
+{
+        return i2c_add_driver(&bh1780_driver);
+}
+
+static void __exit bh1780_exit(void)
+{
+        i2c_del_driver(&bh1780_driver);
+}
+
+module_init(bh1780_init)
+module_exit(bh1780_exit)
+
+MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/bmp085.c b/drivers/misc/bmp085.c
new file mode 100644
index 000000000000..63ee4c1a5315
--- /dev/null
+++ b/drivers/misc/bmp085.c
@@ -0,0 +1,482 @@
+/*  Copyright (c) 2010  Christoph Mair <christoph.mair@gmail.com>
+
+    This driver supports the bmp085 digital barometric pressure
+    and temperature sensor from Bosch Sensortec. The datasheet
+    is avaliable from their website:
+    http://www.bosch-sensortec.com/content/language1/downloads/BST-BMP085-DS000-05.pdf
+
+    A pressure measurement is issued by reading from pressure0_input.
+    The return value ranges from 30000 to 110000 pascal with a resulution
+    of 1 pascal (0.01 millibar) which enables measurements from 9000m above
+    to 500m below sea level.
+
+    The temperature can be read from temp0_input. Values range from
+    -400 to 850 representing the ambient temperature in degree celsius
+    multiplied by 10.The resolution is 0.1 celsius.
+
+    Because ambient pressure is temperature dependent, a temperature
+    measurement will be executed automatically even if the user is reading
+    from pressure0_input. This happens if the last temperature measurement
+    has been executed more then one second ago.
+
+    To decrease RMS noise from pressure measurements, the bmp085 can
+    autonomously calculate the average of up to eight samples. This is
+    set up by writing to the oversampling sysfs file. Accepted values
+    are 0, 1, 2 and 3. 2^x when x is the value written to this file
+    specifies the number of samples used to calculate the ambient pressure.
+    RMS noise is specified with six pascal (without averaging) and decreases
+    down to 3 pascal when using an oversampling setting of 3.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+
+
+#define BMP085_I2C_ADDRESS              0x77
+#define BMP085_CHIP_ID                  0x55
+
+#define BMP085_CALIBRATION_DATA_START   0xAA
+#define BMP085_CALIBRATION_DATA_LENGTH  11      /* 16 bit values */
+#define BMP085_CHIP_ID_REG              0xD0
+#define BMP085_VERSION_REG              0xD1
+#define BMP085_CTRL_REG                 0xF4
+#define BMP085_TEMP_MEASUREMENT         0x2E
+#define BMP085_PRESSURE_MEASUREMENT     0x34
+#define BMP085_CONVERSION_REGISTER_MSB  0xF6
+#define BMP085_CONVERSION_REGISTER_LSB  0xF7
+#define BMP085_CONVERSION_REGISTER_XLSB 0xF8
+#define BMP085_TEMP_CONVERSION_TIME     5
+
+#define BMP085_CLIENT_NAME              "bmp085"
+
+
+static const unsigned short normal_i2c[] = { BMP085_I2C_ADDRESS,
+                                                        I2C_CLIENT_END };
+
+struct bmp085_calibration_data {
+        s16 AC1, AC2, AC3;
+        u16 AC4, AC5, AC6;
+        s16 B1, B2;
+        s16 MB, MC, MD;
+};
+
+
+/* Each client has this additional data */
+struct bmp085_data {
+        struct i2c_client *client;
+        struct mutex lock;
+        struct bmp085_calibration_data calibration;
+        u32 raw_temperature;
+        u32 raw_pressure;
+        unsigned char oversampling_setting;
+        u32 last_temp_measurement;
+        s32 b6; /* calculated temperature correction coefficient */
+};
+
+
+static s32 bmp085_read_calibration_data(struct i2c_client *client)
+{
+        u16 tmp[BMP085_CALIBRATION_DATA_LENGTH];
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        struct bmp085_calibration_data *cali = &(data->calibration);
+        s32 status = i2c_smbus_read_i2c_block_data(client,
+                                BMP085_CALIBRATION_DATA_START,
+                                BMP085_CALIBRATION_DATA_LENGTH*sizeof(u16),
+                                (u8 *)tmp);
+        if (status < 0)
+                return status;
+
+        if (status != BMP085_CALIBRATION_DATA_LENGTH*sizeof(u16))
+                return -EIO;
+
+        cali->AC1 =  be16_to_cpu(tmp[0]);
+        cali->AC2 =  be16_to_cpu(tmp[1]);
+        cali->AC3 =  be16_to_cpu(tmp[2]);
+        cali->AC4 =  be16_to_cpu(tmp[3]);
+        cali->AC5 =  be16_to_cpu(tmp[4]);
+        cali->AC6 = be16_to_cpu(tmp[5]);
+        cali->B1 = be16_to_cpu(tmp[6]);
+        cali->B2 = be16_to_cpu(tmp[7]);
+        cali->MB = be16_to_cpu(tmp[8]);
+        cali->MC = be16_to_cpu(tmp[9]);
+        cali->MD = be16_to_cpu(tmp[10]);
+        return 0;
+}
+
+
+static s32 bmp085_update_raw_temperature(struct bmp085_data *data)
+{
+        u16 tmp;
+        s32 status;
+
+        mutex_lock(&data->lock);
+        status = i2c_smbus_write_byte_data(data->client, BMP085_CTRL_REG,
+                                                BMP085_TEMP_MEASUREMENT);
+        if (status != 0) {
+                dev_err(&data->client->dev,
+                        "Error while requesting temperature measurement.\n");
+                goto exit;
+        }
+        msleep(BMP085_TEMP_CONVERSION_TIME);
+
+        status = i2c_smbus_read_i2c_block_data(data->client,
+                BMP085_CONVERSION_REGISTER_MSB, sizeof(tmp), (u8 *)&tmp);
+        if (status < 0)
+                goto exit;
+        if (status != sizeof(tmp)) {
+                dev_err(&data->client->dev,
+                        "Error while reading temperature measurement result\n");
+                status = -EIO;
+                goto exit;
+        }
+        data->raw_temperature = be16_to_cpu(tmp);
+        data->last_temp_measurement = jiffies;
+        status = 0;     /* everything ok, return 0 */
+
+exit:
+        mutex_unlock(&data->lock);
+        return status;
+}
+
+static s32 bmp085_update_raw_pressure(struct bmp085_data *data)
+{
+        u32 tmp = 0;
+        s32 status;
+
+        mutex_lock(&data->lock);
+        status = i2c_smbus_write_byte_data(data->client, BMP085_CTRL_REG,
+                BMP085_PRESSURE_MEASUREMENT + (data->oversampling_setting<<6));
+        if (status != 0) {
+                dev_err(&data->client->dev,
+                        "Error while requesting pressure measurement.\n");
+                goto exit;
+        }
+
+        /* wait for the end of conversion */
+        msleep(2+(3 << data->oversampling_setting));
+
+        /* copy data into a u32 (4 bytes), but skip the first byte. */
+        status = i2c_smbus_read_i2c_block_data(data->client,
+                        BMP085_CONVERSION_REGISTER_MSB, 3, ((u8 *)&tmp)+1);
+        if (status < 0)
+                goto exit;
+        if (status != 3) {
+                dev_err(&data->client->dev,
+                        "Error while reading pressure measurement results\n");
+                status = -EIO;
+                goto exit;
+        }
+        data->raw_pressure = be32_to_cpu((tmp));
+        data->raw_pressure >>= (8-data->oversampling_setting);
+        status = 0;     /* everything ok, return 0 */
+
+exit:
+        mutex_unlock(&data->lock);
+        return status;
+}
+
+
+/*
+ * This function starts the temperature measurement and returns the value
+ * in tenth of a degree celsius.
+ */
+static s32 bmp085_get_temperature(struct bmp085_data *data, int *temperature)
+{
+        struct bmp085_calibration_data *cali = &data->calibration;
+        long x1, x2;
+        int status;
+
+        status = bmp085_update_raw_temperature(data);
+        if (status != 0)
+                goto exit;
+
+        x1 = ((data->raw_temperature - cali->AC6) * cali->AC5) >> 15;
+        x2 = (cali->MC << 11) / (x1 + cali->MD);
+        data->b6 = x1 + x2 - 4000;
+        /* if NULL just update b6. Used for pressure only measurements */
+        if (temperature != NULL)
+                *temperature = (x1+x2+8) >> 4;
+
+exit:
+        return status;;
+}
+
+/*
+ * This function starts the pressure measurement and returns the value
+ * in millibar. Since the pressure depends on the ambient temperature,
+ * a temperature measurement is executed if the last known value is older
+ * than one second.
+ */
+static s32 bmp085_get_pressure(struct bmp085_data *data, int *pressure)
+{
+        struct bmp085_calibration_data *cali = &data->calibration;
+        s32 x1, x2, x3, b3;
+        u32 b4, b7;
+        s32 p;
+        int status;
+
+        /* alt least every second force an update of the ambient temperature */
+        if (data->last_temp_measurement + 1*HZ < jiffies) {
+                status = bmp085_get_temperature(data, NULL);
+                if (status != 0)
+                        goto exit;
+        }
+
+        status = bmp085_update_raw_pressure(data);
+        if (status != 0)
+                goto exit;
+
+        x1 = (data->b6 * data->b6) >> 12;
+        x1 *= cali->B2;
+        x1 >>= 11;
+
+        x2 = cali->AC2 * data->b6;
+        x2 >>= 11;
+
+        x3 = x1 + x2;
+
+        b3 = (((((s32)cali->AC1) * 4 + x3) << data->oversampling_setting) + 2);
+        b3 >>= 2;
+
+        x1 = (cali->AC3 * data->b6) >> 13;
+        x2 = (cali->B1 * ((data->b6 * data->b6) >> 12)) >> 16;
+        x3 = (x1 + x2 + 2) >> 2;
+        b4 = (cali->AC4 * (u32)(x3 + 32768)) >> 15;
+
+        b7 = ((u32)data->raw_pressure - b3) *
+                                        (50000 >> data->oversampling_setting);
+        p = ((b7 < 0x80000000) ? ((b7 << 1) / b4) : ((b7 / b4) * 2));
+
+        x1 = p >> 8;
+        x1 *= x1;
+        x1 = (x1 * 3038) >> 16;
+        x2 = (-7357 * p) >> 16;
+        p += (x1 + x2 + 3791) >> 4;
+
+        *pressure = p;
+
+exit:
+        return status;
+}
+
+/*
+ * This function sets the chip-internal oversampling. Valid values are 0..3.
+ * The chip will use 2^oversampling samples for internal averaging.
+ * This influences the measurement time and the accuracy; larger values
+ * increase both. The datasheet gives on overview on how measurement time,
+ * accuracy and noise correlate.
+ */
+static void bmp085_set_oversampling(struct bmp085_data *data,
+                                                unsigned char oversampling)
+{
+        if (oversampling > 3)
+                oversampling = 3;
+        data->oversampling_setting = oversampling;
+}
+
+/*
+ * Returns the currently selected oversampling. Range: 0..3
+ */
+static unsigned char bmp085_get_oversampling(struct bmp085_data *data)
+{
+        return data->oversampling_setting;
+}
+
+/* sysfs callbacks */
+static ssize_t set_oversampling(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        unsigned long oversampling;
+        int success = strict_strtoul(buf, 10, &oversampling);
+        if (success == 0) {
+                bmp085_set_oversampling(data, oversampling);
+                return count;
+        }
+        return success;
+}
+
+static ssize_t show_oversampling(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        return sprintf(buf, "%u\n", bmp085_get_oversampling(data));
+}
+static DEVICE_ATTR(oversampling, S_IWUSR | S_IRUGO,
+                                        show_oversampling, set_oversampling);
+
+
+static ssize_t show_temperature(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        int temperature;
+        int status;
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+
+        status = bmp085_get_temperature(data, &temperature);
+        if (status != 0)
+                return status;
+        else
+                return sprintf(buf, "%d\n", temperature);
+}
+static DEVICE_ATTR(temp0_input, S_IRUGO, show_temperature, NULL);
+
+
+static ssize_t show_pressure(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        int pressure;
+        int status;
+        struct i2c_client *client = to_i2c_client(dev);
+        struct bmp085_data *data = i2c_get_clientdata(client);
+
+        status = bmp085_get_pressure(data, &pressure);
+        if (status != 0)
+                return status;
+        else
+                return sprintf(buf, "%d\n", pressure);
+}
+static DEVICE_ATTR(pressure0_input, S_IRUGO, show_pressure, NULL);
+
+
+static struct attribute *bmp085_attributes[] = {
+        &dev_attr_temp0_input.attr,
+        &dev_attr_pressure0_input.attr,
+        &dev_attr_oversampling.attr,
+        NULL
+};
+
+static const struct attribute_group bmp085_attr_group = {
+        .attrs = bmp085_attributes,
+};
+
+static int bmp085_detect(struct i2c_client *client, struct i2c_board_info *info)
+{
+        if (client->addr != BMP085_I2C_ADDRESS)
+                return -ENODEV;
+
+        if (i2c_smbus_read_byte_data(client, BMP085_CHIP_ID_REG) != BMP085_CHIP_ID)
+                return -ENODEV;
+
+        return 0;
+}
+
+static int bmp085_init_client(struct i2c_client *client)
+{
+        unsigned char version;
+        int status;
+        struct bmp085_data *data = i2c_get_clientdata(client);
+        data->client = client;
+        status = bmp085_read_calibration_data(client);
+        if (status != 0)
+                goto exit;
+        version = i2c_smbus_read_byte_data(client, BMP085_VERSION_REG);
+        data->last_temp_measurement = 0;
+        data->oversampling_setting = 3;
+        mutex_init(&data->lock);
+        dev_info(&data->client->dev, "BMP085 ver. %d.%d found.\n",
+                        (version & 0x0F), (version & 0xF0) >> 4);
+exit:
+        return status;
+}
+
+static int bmp085_probe(struct i2c_client *client,
+                         const struct i2c_device_id *id)
+{
+        struct bmp085_data *data;
+        int err = 0;
+
+        data = kzalloc(sizeof(struct bmp085_data), GFP_KERNEL);
+        if (!data) {
+                err = -ENOMEM;
+                goto exit;
+        }
+
+        /* default settings after POR */
+        data->oversampling_setting = 0x00;
+
+        i2c_set_clientdata(client, data);
+
+        /* Initialize the BMP085 chip */
+        err = bmp085_init_client(client);
+        if (err != 0)
+                goto exit_free;
+
+        /* Register sysfs hooks */
+        err = sysfs_create_group(&client->dev.kobj, &bmp085_attr_group);
+        if (err)
+                goto exit_free;
+
+        dev_info(&data->client->dev, "Succesfully initialized bmp085!\n");
+        goto exit;
+
+exit_free:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int bmp085_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &bmp085_attr_group);
+        kfree(i2c_get_clientdata(client));
+        return 0;
+}
+
+static const struct i2c_device_id bmp085_id[] = {
+        { "bmp085", 0 },
+        { }
+};
+
+static struct i2c_driver bmp085_driver = {
+        .driver = {
+                .owner = THIS_MODULE,
+                .name   = "bmp085"
+        },
+        .id_table       = bmp085_id,
+        .probe          = bmp085_probe,
+        .remove         = bmp085_remove,
+
+        .detect         = bmp085_detect,
+        .address_list   = normal_i2c
+};
+
+static int __init bmp085_init(void)
+{
+        return i2c_add_driver(&bmp085_driver);
+}
+
+static void __exit bmp085_exit(void)
+{
+        i2c_del_driver(&bmp085_driver);
+}
+
+
+MODULE_AUTHOR("Christoph Mair <christoph.mair@gmail.com");
+MODULE_DESCRIPTION("BMP085 driver");
+MODULE_LICENSE("GPL");
+
+module_init(bmp085_init);
+module_exit(bmp085_exit);
diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
new file mode 100644
index 000000000000..234bfcaf2099
--- /dev/null
+++ b/drivers/misc/hmc6352.c
@@ -0,0 +1,166 @@
+/*
+ * hmc6352.c - Honeywell Compass Driver
+ *
+ * Copyright (C) 2009 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/sysfs.h>
+
+static DEFINE_MUTEX(compass_mutex);
+
+static int compass_command(struct i2c_client *c, u8 cmd)
+{
+        int ret = i2c_master_send(c, &cmd, 1);
+        if (ret < 0)
+                dev_warn(&c->dev, "command '%c' failed.\n", cmd);
+        return ret;
+}
+
+static int compass_store(struct device *dev, const char *buf, size_t count,
+                        const char *map)
+{
+        struct i2c_client *c = to_i2c_client(dev);
+        int ret;
+        unsigned long val;
+
+        if (strict_strtoul(buf, 10, &val))
+                return -EINVAL;
+        if (val >= strlen(map))
+                return -EINVAL;
+        mutex_lock(&compass_mutex);
+        ret = compass_command(c, map[val]);
+        mutex_unlock(&compass_mutex);
+        if (ret < 0)
+                return ret;
+        return count;
+}
+
+static ssize_t compass_calibration_store(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        return compass_store(dev, buf, count, "EC");
+}
+
+static ssize_t compass_power_mode_store(struct device *dev,
+                struct device_attribute *attr, const  char *buf, size_t count)
+{
+        return compass_store(dev, buf, count, "SW");
+}
+
+static ssize_t compass_heading_data_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        unsigned char i2c_data[2];
+        unsigned int ret;
+
+        mutex_lock(&compass_mutex);
+        ret = compass_command(client, 'A');
+        if (ret != 1) {
+                mutex_unlock(&compass_mutex);
+                return ret;
+        }
+        msleep(10); /* sending 'A' cmd we need to wait for 7-10 millisecs */
+        ret = i2c_master_recv(client, i2c_data, 2);
+        mutex_unlock(&compass_mutex);
+        if (ret != 1) {
+                dev_warn(dev, "i2c read data cmd failed\n");
+                return ret;
+        }
+        ret = (i2c_data[0] << 8) | i2c_data[1];
+        return sprintf(buf, "%d.%d\n", ret/10, ret%10);
+}
+
+
+static DEVICE_ATTR(heading0_input, S_IRUGO, compass_heading_data_show, NULL);
+static DEVICE_ATTR(calibration, S_IWUSR, NULL, compass_calibration_store);
+static DEVICE_ATTR(power_state, S_IWUSR, NULL, compass_power_mode_store);
+
+static struct attribute *mid_att_compass[] = {
+        &dev_attr_heading0_input.attr,
+        &dev_attr_calibration.attr,
+        &dev_attr_power_state.attr,
+        NULL
+};
+
+static const struct attribute_group m_compass_gr = {
+        .name = "hmc6352",
+        .attrs = mid_att_compass
+};
+
+static int hmc6352_probe(struct i2c_client *client,
+                                        const struct i2c_device_id *id)
+{
+        int res;
+
+        res = sysfs_create_group(&client->dev.kobj, &m_compass_gr);
+        if (res) {
+                dev_err(&client->dev, "device_create_file failed\n");
+                return res;
+        }
+        dev_info(&client->dev, "%s HMC6352 compass chip found\n",
+                                                        client->name);
+        return 0;
+}
+
+static int hmc6352_remove(struct i2c_client *client)
+{
+        sysfs_remove_group(&client->dev.kobj, &m_compass_gr);
+        return 0;
+}
+
+static struct i2c_device_id hmc6352_id[] = {
+        { "hmc6352", 0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(i2c, hmc6352_id);
+
+static struct i2c_driver hmc6352_driver = {
+        .driver = {
+                .name = "hmc6352",
+        },
+        .probe = hmc6352_probe,
+        .remove = hmc6352_remove,
+        .id_table = hmc6352_id,
+};
+
+static int __init sensor_hmc6352_init(void)
+{
+        return i2c_add_driver(&hmc6352_driver);
+}
+
+static void  __exit sensor_hmc6352_exit(void)
+{
+        i2c_del_driver(&hmc6352_driver);
+}
+
+module_init(sensor_hmc6352_init);
+module_exit(sensor_hmc6352_exit);
+
+MODULE_AUTHOR("Kalhan Trisal <kalhan.trisal@intel.com");
+MODULE_DESCRIPTION("hmc6352 Compass Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 98ad0120aa9b..557a8c2a7336 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -256,7 +256,8 @@ static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
 
 static int ilo_ccb_setup(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 {
-        char *dma_va, *dma_pa;
+        char *dma_va;
+        dma_addr_t dma_pa;
         struct ccb *driver_ccb, *ilo_ccb;
 
         driver_ccb = &data->driver_ccb;
@@ -272,12 +273,12 @@ static int ilo_ccb_setup(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
                 return -ENOMEM;
 
         dma_va = (char *)data->dma_va;
-        dma_pa = (char *)data->dma_pa;
+        dma_pa = data->dma_pa;
 
         memset(dma_va, 0, data->dma_size);
 
         dma_va = (char *)roundup((unsigned long)dma_va, ILO_START_ALIGN);
-        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_START_ALIGN);
+        dma_pa = roundup(dma_pa, ILO_START_ALIGN);
 
         /*
          * Create two ccb's, one with virt addrs, one with phys addrs.
@@ -288,26 +289,26 @@ static int ilo_ccb_setup(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 
         fifo_setup(dma_va, NR_QENTRY);
         driver_ccb->ccb_u1.send_fifobar = dma_va + FIFOHANDLESIZE;
-        ilo_ccb->ccb_u1.send_fifobar = dma_pa + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u1.send_fifobar_pa = dma_pa + FIFOHANDLESIZE;
         dma_va += fifo_sz(NR_QENTRY);
         dma_pa += fifo_sz(NR_QENTRY);
 
         dma_va = (char *)roundup((unsigned long)dma_va, ILO_CACHE_SZ);
-        dma_pa = (char *)roundup((unsigned long)dma_pa, ILO_CACHE_SZ);
+        dma_pa = roundup(dma_pa, ILO_CACHE_SZ);
 
         fifo_setup(dma_va, NR_QENTRY);
         driver_ccb->ccb_u3.recv_fifobar = dma_va + FIFOHANDLESIZE;
-        ilo_ccb->ccb_u3.recv_fifobar = dma_pa + FIFOHANDLESIZE;
+        ilo_ccb->ccb_u3.recv_fifobar_pa = dma_pa + FIFOHANDLESIZE;
         dma_va += fifo_sz(NR_QENTRY);
         dma_pa += fifo_sz(NR_QENTRY);
 
         driver_ccb->ccb_u2.send_desc = dma_va;
-        ilo_ccb->ccb_u2.send_desc = dma_pa;
+        ilo_ccb->ccb_u2.send_desc_pa = dma_pa;
         dma_pa += desc_mem_sz(NR_QENTRY);
         dma_va += desc_mem_sz(NR_QENTRY);
 
         driver_ccb->ccb_u4.recv_desc = dma_va;
-        ilo_ccb->ccb_u4.recv_desc = dma_pa;
+        ilo_ccb->ccb_u4.recv_desc_pa = dma_pa;
 
         driver_ccb->channel = slot;
         ilo_ccb->channel = slot;
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index 247eb386a973..54e43adbdea1 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -79,21 +79,21 @@ struct ilo_hwinfo {
 struct ccb {
         union {
                 char *send_fifobar;
-                u64 padding1;
+                u64 send_fifobar_pa;
         } ccb_u1;
         union {
                 char *send_desc;
-                u64 padding2;
+                u64 send_desc_pa;
         } ccb_u2;
         u64 send_ctrl;
 
         union {
                 char *recv_fifobar;
-                u64 padding3;
+                u64 recv_fifobar_pa;
         } ccb_u3;
         union {
                 char *recv_desc;
-                u64 padding4;
+                u64 recv_desc_pa;
         } ccb_u4;
         u64 recv_ctrl;
 
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index f8210bf2d241..1e2cbf5d9aa1 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -311,15 +311,17 @@ config SM_FTL
         select MTD_BLKDEVS
         select MTD_NAND_ECC
         help
-          This enables new and very EXPERMENTAL support for SmartMedia/xD
+          This enables EXPERIMENTAL R/W support for SmartMedia/xD
           FTL (Flash translation layer).
-          Write support isn't yet well tested, therefore this code IS likely to
-          eat your card, so please don't use it together with valuable data.
-          Use readonly driver (CONFIG_SSFDC) instead.
+          Write support is only lightly tested, therefore this driver
+          isn't recommended to use with valuable data (anyway if you have
+          valuable data, do backups regardless of software/hardware you
+          use, because you never know what will eat your data...)
+          If you only need R/O access, you can use older R/O driver
+          (CONFIG_SSFDC)
 
 config MTD_OOPS
         tristate "Log panic/oops to an MTD buffer"
-        depends on MTD
         help
           This enables panic and oops messages to be logged to a circular
           buffer in a flash partition where it can be read back at some
diff --git a/drivers/mtd/afs.c b/drivers/mtd/afs.c
index cec7ab98b2a9..302372c08b56 100644
--- a/drivers/mtd/afs.c
+++ b/drivers/mtd/afs.c
@@ -2,7 +2,7 @@
 
     drivers/mtd/afs.c: ARM Flash Layout/Partitioning
 
-    Copyright (C) 2000 ARM Limited
+    Copyright © 2000 ARM Limited
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 62f3ea9de848..9e2b7e9e0ad9 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -34,7 +34,6 @@
 #include <linux/mtd/xip.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/mtd.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/mtd/cfi.h>
 
 /* #define CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE */
@@ -63,6 +62,8 @@ static int cfi_intelext_erase_varsize(struct mtd_info *, struct erase_info *);
 static void cfi_intelext_sync (struct mtd_info *);
 static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
 static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len);
+static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
+                                  uint64_t len);
 #ifdef CONFIG_MTD_OTP
 static int cfi_intelext_read_fact_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_intelext_read_user_prot_reg (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
@@ -448,6 +449,7 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
         mtd->sync    = cfi_intelext_sync;
         mtd->lock    = cfi_intelext_lock;
         mtd->unlock  = cfi_intelext_unlock;
+        mtd->is_locked = cfi_intelext_is_locked;
         mtd->suspend = cfi_intelext_suspend;
         mtd->resume  = cfi_intelext_resume;
         mtd->flags   = MTD_CAP_NORFLASH;
@@ -717,7 +719,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
                 chip = &newcfi->chips[0];
                 for (i = 0; i < cfi->numchips; i++) {
                         shared[i].writing = shared[i].erasing = NULL;
-                        spin_lock_init(&shared[i].lock);
+                        mutex_init(&shared[i].lock);
                         for (j = 0; j < numparts; j++) {
                                 *chip = cfi->chips[i];
                                 chip->start += j << partshift;
@@ -886,7 +888,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                  */
                 struct flchip_shared *shared = chip->priv;
                 struct flchip *contender;
-                spin_lock(&shared->lock);
+                mutex_lock(&shared->lock);
                 contender = shared->writing;
                 if (contender && contender != chip) {
                         /*
@@ -899,7 +901,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                          * get_chip returns success we're clear to go ahead.
                          */
                         ret = mutex_trylock(&contender->mutex);
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         if (!ret)
                                 goto retry;
                         mutex_unlock(&chip->mutex);
@@ -914,7 +916,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                                 mutex_unlock(&contender->mutex);
                                 return ret;
                         }
-                        spin_lock(&shared->lock);
+                        mutex_lock(&shared->lock);
 
                         /* We should not own chip if it is already
                          * in FL_SYNCING state. Put contender and retry. */
@@ -930,7 +932,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                  * on this chip. Sleep. */
                 if (mode == FL_ERASING && shared->erasing
                     && shared->erasing->oldstate == FL_ERASING) {
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         set_current_state(TASK_UNINTERRUPTIBLE);
                         add_wait_queue(&chip->wq, &wait);
                         mutex_unlock(&chip->mutex);
@@ -944,7 +946,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                 shared->writing = chip;
                 if (mode == FL_ERASING)
                         shared->erasing = chip;
-                spin_unlock(&shared->lock);
+                mutex_unlock(&shared->lock);
         }
         ret = chip_ready(map, chip, adr, mode);
         if (ret == -EAGAIN)
@@ -959,7 +961,7 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
 
         if (chip->priv) {
                 struct flchip_shared *shared = chip->priv;
-                spin_lock(&shared->lock);
+                mutex_lock(&shared->lock);
                 if (shared->writing == chip && chip->oldstate == FL_READY) {
                         /* We own the ability to write, but we're done */
                         shared->writing = shared->erasing;
@@ -967,7 +969,7 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
                                 /* give back ownership to who we loaned it from */
                                 struct flchip *loaner = shared->writing;
                                 mutex_lock(&loaner->mutex);
-                                spin_unlock(&shared->lock);
+                                mutex_unlock(&shared->lock);
                                 mutex_unlock(&chip->mutex);
                                 put_chip(map, loaner, loaner->start);
                                 mutex_lock(&chip->mutex);
@@ -985,11 +987,11 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
                          * Don't let the switch below mess things up since
                          * we don't have ownership to resume anything.
                          */
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         wake_up(&chip->wq);
                         return;
                 }
-                spin_unlock(&shared->lock);
+                mutex_unlock(&shared->lock);
         }
 
         switch(chip->oldstate) {
@@ -2139,6 +2141,13 @@ static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         return ret;
 }
 
+static int cfi_intelext_is_locked(struct mtd_info *mtd, loff_t ofs,
+                                  uint64_t len)
+{
+        return cfi_varsize_frob(mtd, do_getlockstatus_oneblock,
+                                ofs, len, NULL) ? 1 : 0;
+}
+
 #ifdef CONFIG_MTD_OTP
 
 typedef int (*otp_op_t)(struct map_info *map, struct flchip *chip,
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index d81079ef91a5..3e6c47bdce53 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -33,7 +33,6 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/reboot.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/cfi.h>
@@ -417,16 +416,26 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
                          */
                         cfi_fixup_major_minor(cfi, extp);
 
+                        /*
+                         * Valid primary extension versions are: 1.0, 1.1, 1.2, 1.3, 1.4
+                         * see: http://www.amd.com/us-en/assets/content_type/DownloadableAssets/cfi_r20.pdf, page 19
+                         *      http://www.amd.com/us-en/assets/content_type/DownloadableAssets/cfi_100_20011201.pdf
+                         *      http://www.spansion.com/Support/Datasheets/s29ws-p_00_a12_e.pdf
+                         */
                         if (extp->MajorVersion != '1' ||
-                            (extp->MinorVersion < '0' || extp->MinorVersion > '4')) {
+                            (extp->MajorVersion == '1' && (extp->MinorVersion < '0' || extp->MinorVersion > '4'))) {
                                 printk(KERN_ERR "  Unknown Amd/Fujitsu Extended Query "
-                                       "version %c.%c.\n",  extp->MajorVersion,
-                                       extp->MinorVersion);
+                                       "version %c.%c (%#02x/%#02x).\n",
+                                       extp->MajorVersion, extp->MinorVersion,
+                                       extp->MajorVersion, extp->MinorVersion);
                                 kfree(extp);
                                 kfree(mtd);
                                 return NULL;
                         }
 
+                        printk(KERN_INFO "  Amd/Fujitsu Extended Query version %c.%c.\n",
+                               extp->MajorVersion, extp->MinorVersion);
+
                         /* Install our own private info structure */
                         cfi->cmdset_priv = extp;
 
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index e54e8c169d76..314af1f5a370 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -33,7 +33,6 @@
 #include <linux/mtd/map.h>
 #include <linux/mtd/cfi.h>
 #include <linux/mtd/mtd.h>
-#include <linux/mtd/compatmac.h>
 
 
 static int cfi_staa_read(struct mtd_info *, loff_t, size_t, size_t *, u_char *);
diff --git a/drivers/mtd/chips/cfi_probe.c b/drivers/mtd/chips/cfi_probe.c
index b2acd32f4fbf..8f5b96aa87a0 100644
--- a/drivers/mtd/chips/cfi_probe.c
+++ b/drivers/mtd/chips/cfi_probe.c
@@ -235,9 +235,9 @@ static int __xipram cfi_chip_setup(struct map_info *map,
         cfi_qry_mode_off(base, map, cfi);
         xip_allowed(base, map);
 
-        printk(KERN_INFO "%s: Found %d x%d devices at 0x%x in %d-bit bank\n",
+        printk(KERN_INFO "%s: Found %d x%d devices at 0x%x in %d-bit bank. Manufacturer ID %#08x Chip ID %#08x\n",
                map->name, cfi->interleave, cfi->device_type*8, base,
-               map->bankwidth*8);
+               map->bankwidth*8, cfi->mfr, cfi->id);
 
         return 1;
 }
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index d7c2c672757e..e503b2ca894d 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -22,7 +22,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/cfi.h>
-#include <linux/mtd/compatmac.h>
 
 int __xipram cfi_qry_present(struct map_info *map, __u32 base,
                              struct cfi_private *cfi)
diff --git a/drivers/mtd/chips/chipreg.c b/drivers/mtd/chips/chipreg.c
index c85760968227..da1f96f385c7 100644
--- a/drivers/mtd/chips/chipreg.c
+++ b/drivers/mtd/chips/chipreg.c
@@ -10,7 +10,6 @@
 #include <linux/slab.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/mtd.h>
-#include <linux/mtd/compatmac.h>
 
 static DEFINE_SPINLOCK(chip_drvs_lock);
 static LIST_HEAD(chip_drvs_list);
diff --git a/drivers/mtd/chips/map_absent.c b/drivers/mtd/chips/map_absent.c
index 494d30d0631a..f2b872946871 100644
--- a/drivers/mtd/chips/map_absent.c
+++ b/drivers/mtd/chips/map_absent.c
@@ -25,7 +25,6 @@
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
-#include <linux/mtd/compatmac.h>
 
 static int map_absent_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int map_absent_write (struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
diff --git a/drivers/mtd/chips/map_ram.c b/drivers/mtd/chips/map_ram.c
index 6bdc50c727e7..67640ccb2d41 100644
--- a/drivers/mtd/chips/map_ram.c
+++ b/drivers/mtd/chips/map_ram.c
@@ -13,7 +13,6 @@
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
-#include <linux/mtd/compatmac.h>
 
 
 static int mapram_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 076090a67b90..593f73d480d2 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -13,7 +13,6 @@
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
-#include <linux/mtd/compatmac.h>
 
 static int maprom_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int maprom_write (struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index 1479da6d3aa6..e790f38893b0 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -1,7 +1,22 @@
 /*
  * Read flash partition table from command line
  *
- * Copyright 2002 SYSGO Real-Time Solutions GmbH
+ * Copyright © 2002      SYSGO Real-Time Solutions GmbH
+ * Copyright © 2002-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  * The format for the command line is as follows:
  *
diff --git a/drivers/mtd/devices/docecc.c b/drivers/mtd/devices/docecc.c
index a19cda52da5c..a99838bb2dc0 100644
--- a/drivers/mtd/devices/docecc.c
+++ b/drivers/mtd/devices/docecc.c
@@ -31,7 +31,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 
-#include <linux/mtd/compatmac.h> /* for min() in older kernels */
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/doc2000.h>
 
diff --git a/drivers/mtd/devices/docprobe.c b/drivers/mtd/devices/docprobe.c
index 6e62922942b1..d374603493a7 100644
--- a/drivers/mtd/devices/docprobe.c
+++ b/drivers/mtd/devices/docprobe.c
@@ -49,7 +49,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/doc2000.h>
-#include <linux/mtd/compatmac.h>
 
 /* Where to look for the devices? */
 #ifndef CONFIG_MTD_DOCPROBE_ADDRESS
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 81e49a9b017e..f90941a785e4 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -16,6 +16,8 @@
  */
 
 #include <linux/init.h>
+#include <linux/err.h>
+#include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
@@ -639,8 +641,18 @@ static const struct spi_device_id m25p_ids[] = {
         { "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K) },
         { "at26df321",  INFO(0x1f4701, 0, 64 * 1024, 64, SECT_4K) },
 
+        /* EON -- en25pxx */
+        { "en25p32", INFO(0x1c2016, 0, 64 * 1024,  64, 0) },
+        { "en25p64", INFO(0x1c2017, 0, 64 * 1024, 128, 0) },
+
+        /* Intel/Numonyx -- xxxs33b */
+        { "160s33b",  INFO(0x898911, 0, 64 * 1024,  32, 0) },
+        { "320s33b",  INFO(0x898912, 0, 64 * 1024,  64, 0) },
+        { "640s33b",  INFO(0x898913, 0, 64 * 1024, 128, 0) },
+
         /* Macronix */
         { "mx25l4005a",  INFO(0xc22013, 0, 64 * 1024,   8, SECT_4K) },
+        { "mx25l8005",   INFO(0xc22014, 0, 64 * 1024,  16, 0) },
         { "mx25l3205d",  INFO(0xc22016, 0, 64 * 1024,  64, 0) },
         { "mx25l6405d",  INFO(0xc22017, 0, 64 * 1024, 128, 0) },
         { "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
@@ -680,6 +692,16 @@ static const struct spi_device_id m25p_ids[] = {
         { "m25p64",  INFO(0x202017,  0,  64 * 1024, 128, 0) },
         { "m25p128", INFO(0x202018,  0, 256 * 1024,  64, 0) },
 
+        { "m25p05-nonjedec",  INFO(0, 0,  32 * 1024,   2, 0) },
+        { "m25p10-nonjedec",  INFO(0, 0,  32 * 1024,   4, 0) },
+        { "m25p20-nonjedec",  INFO(0, 0,  64 * 1024,   4, 0) },
+        { "m25p40-nonjedec",  INFO(0, 0,  64 * 1024,   8, 0) },
+        { "m25p80-nonjedec",  INFO(0, 0,  64 * 1024,  16, 0) },
+        { "m25p16-nonjedec",  INFO(0, 0,  64 * 1024,  32, 0) },
+        { "m25p32-nonjedec",  INFO(0, 0,  64 * 1024,  64, 0) },
+        { "m25p64-nonjedec",  INFO(0, 0,  64 * 1024, 128, 0) },
+        { "m25p128-nonjedec", INFO(0, 0, 256 * 1024,  64, 0) },
+
         { "m45pe10", INFO(0x204011,  0, 64 * 1024,    2, 0) },
         { "m45pe80", INFO(0x204014,  0, 64 * 1024,   16, 0) },
         { "m45pe16", INFO(0x204015,  0, 64 * 1024,   32, 0) },
@@ -694,6 +716,7 @@ static const struct spi_device_id m25p_ids[] = {
         { "w25x80", INFO(0xef3014, 0, 64 * 1024,  16, SECT_4K) },
         { "w25x16", INFO(0xef3015, 0, 64 * 1024,  32, SECT_4K) },
         { "w25x32", INFO(0xef3016, 0, 64 * 1024,  64, SECT_4K) },
+        { "w25q32", INFO(0xef4016, 0, 64 * 1024,  64, SECT_4K) },
         { "w25x64", INFO(0xef3017, 0, 64 * 1024, 128, SECT_4K) },
 
         /* Catalyst / On Semiconductor -- non-JEDEC */
@@ -723,7 +746,7 @@ static const struct spi_device_id *__devinit jedec_probe(struct spi_device *spi)
         if (tmp < 0) {
                 DEBUG(MTD_DEBUG_LEVEL0, "%s: error %d reading JEDEC ID\n",
                         dev_name(&spi->dev), tmp);
-                return NULL;
+                return ERR_PTR(tmp);
         }
         jedec = id[0];
         jedec = jedec << 8;
@@ -731,14 +754,6 @@ static const struct spi_device_id *__devinit jedec_probe(struct spi_device *spi)
         jedec = jedec << 8;
         jedec |= id[2];
 
-        /*
-         * Some chips (like Numonyx M25P80) have JEDEC and non-JEDEC variants,
-         * which depend on technology process. Officially RDID command doesn't
-         * exist for non-JEDEC chips, but for compatibility they return ID 0.
-         */
-        if (jedec == 0)
-                return NULL;
-
         ext_jedec = id[3] << 8 | id[4];
 
         for (tmp = 0; tmp < ARRAY_SIZE(m25p_ids) - 1; tmp++) {
@@ -749,7 +764,7 @@ static const struct spi_device_id *__devinit jedec_probe(struct spi_device *spi)
                         return &m25p_ids[tmp];
                 }
         }
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 
@@ -794,9 +809,8 @@ static int __devinit m25p_probe(struct spi_device *spi)
                 const struct spi_device_id *jid;
 
                 jid = jedec_probe(spi);
-                if (!jid) {
-                        dev_info(&spi->dev, "non-JEDEC variant of %s\n",
-                                 id->name);
+                if (IS_ERR(jid)) {
+                        return PTR_ERR(jid);
                 } else if (jid != id) {
                         /*
                          * JEDEC knows better, so overwrite platform ID. We
@@ -826,11 +840,12 @@ static int __devinit m25p_probe(struct spi_device *spi)
         dev_set_drvdata(&spi->dev, flash);
 
         /*
-         * Atmel and SST serial flash tend to power
+         * Atmel, SST and Intel/Numonyx serial flash tend to power
          * up with the software protection bits set
          */
 
         if (info->jedec_id >> 16 == 0x1f ||
+            info->jedec_id >> 16 == 0x89 ||
             info->jedec_id >> 16 == 0xbf) {
                 write_enable(flash);
                 write_sr(flash, 0);
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 19817404ce7d..c5015cc721d5 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -141,7 +141,7 @@ static int dataflash_waitready(struct spi_device *spi)
  */
 static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         struct spi_device       *spi = priv->spi;
         struct spi_transfer     x = { .tx_dma = 0, };
         struct spi_message      msg;
@@ -231,7 +231,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
 static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
                                size_t *retlen, u_char *buf)
 {
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         struct spi_transfer     x[2] = { { .tx_dma = 0, }, };
         struct spi_message      msg;
         unsigned int            addr;
@@ -304,7 +304,7 @@ static int dataflash_read(struct mtd_info *mtd, loff_t from, size_t len,
 static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
                                 size_t * retlen, const u_char * buf)
 {
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         struct spi_device       *spi = priv->spi;
         struct spi_transfer     x[2] = { { .tx_dma = 0, }, };
         struct spi_message      msg;
@@ -515,7 +515,7 @@ static ssize_t otp_read(struct spi_device *spi, unsigned base,
 static int dataflash_read_fact_otp(struct mtd_info *mtd,
                 loff_t from, size_t len, size_t *retlen, u_char *buf)
 {
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         int                     status;
 
         /* 64 bytes, from 0..63 ... start at 64 on-chip */
@@ -532,7 +532,7 @@ static int dataflash_read_fact_otp(struct mtd_info *mtd,
 static int dataflash_read_user_otp(struct mtd_info *mtd,
                 loff_t from, size_t len, size_t *retlen, u_char *buf)
 {
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         int                     status;
 
         /* 64 bytes, from 0..63 ... start at 0 on-chip */
@@ -553,7 +553,7 @@ static int dataflash_write_user_otp(struct mtd_info *mtd,
         const size_t            l = 4 + 64;
         uint8_t                 *scratch;
         struct spi_transfer     t;
-        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        struct dataflash        *priv = mtd->priv;
         int                     status;
 
         if (len > 64)
diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index fce5ff7589aa..26a6e809013d 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -14,7 +14,6 @@
 #include <linux/ioport.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/mtdram.h>
 
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index fc8ea0a57ac2..ef0aba0ce58f 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -98,7 +98,6 @@
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/pmc551.h>
-#include <linux/mtd/compatmac.h>
 
 static struct mtd_info *pmc551list;
 
diff --git a/drivers/mtd/devices/sst25l.c b/drivers/mtd/devices/sst25l.c
index ab5d8cd02a15..684247a8a5ed 100644
--- a/drivers/mtd/devices/sst25l.c
+++ b/drivers/mtd/devices/sst25l.c
@@ -454,7 +454,7 @@ static int __init sst25l_probe(struct spi_device *spi)
                                                   parts, nr_parts);
                 }
 
-        } else if (data->nr_parts) {
+        } else if (data && data->nr_parts) {
                 dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
                          data->nr_parts, data->name);
         }
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index 62da9eb7032b..4d6a64c387ec 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -26,7 +26,7 @@
 
     The initial developer of the original code is David A. Hinds
     <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
-    are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
+    are Copyright © 1999 David A. Hinds.  All Rights Reserved.
 
     Alternatively, the contents of this file may be used under the
     terms of the GNU General Public License version 2 (the "GPL"), in
diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 015a7fe1b6ee..d7592e67d048 100644
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
@@ -1,11 +1,11 @@
 /*
  * inftlcore.c -- Linux driver for Inverse Flash Translation Layer (INFTL)
  *
- * (C) Copyright 2002, Greg Ungerer (gerg@snapgear.com)
+ * Copyright © 2002, Greg Ungerer (gerg@snapgear.com)
  *
  * Based heavily on the nftlcore.c code which is:
- * (c) 1999 Machine Vision Holdings, Inc.
- * Author: David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 1999 Machine Vision Holdings, Inc.
+ * Copyright © 1999 David Woodhouse <dwmw2@infradead.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 8f988d7d3c5c..104052e774b0 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -2,11 +2,11 @@
  * inftlmount.c -- INFTL mount code with extensive checks.
  *
  * Author: Greg Ungerer (gerg@snapgear.com)
- * (C) Copyright 2002-2003, Greg Ungerer (gerg@snapgear.com)
+ * Copyright © 2002-2003, Greg Ungerer (gerg@snapgear.com)
  *
  * Based heavily on the nftlmount.c code which is:
  * Author: Fabrice Bellard (fabrice.bellard@netgem.com)
- * Copyright (C) 2000 Netgem S.A.
+ * Copyright © 2000 Netgem S.A.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,7 +34,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nftl.h>
 #include <linux/mtd/inftl.h>
-#include <linux/mtd/compatmac.h>
 
 /*
  * find_boot_record: Find the INFTL Media Header and its Spare copy which
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index fece5be58715..04fdfcca93f7 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -98,7 +98,7 @@ struct mtd_info *lpddr_cmdset(struct map_info *map)
         numchips = lpddr->numchips / lpddr->qinfo->HWPartsNum;
         for (i = 0; i < numchips; i++) {
                 shared[i].writing = shared[i].erasing = NULL;
-                spin_lock_init(&shared[i].lock);
+                mutex_init(&shared[i].lock);
                 for (j = 0; j < lpddr->qinfo->HWPartsNum; j++) {
                         *chip = lpddr->chips[i];
                         chip->start += j << lpddr->chipshift;
@@ -217,7 +217,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
                  */
                 struct flchip_shared *shared = chip->priv;
                 struct flchip *contender;
-                spin_lock(&shared->lock);
+                mutex_lock(&shared->lock);
                 contender = shared->writing;
                 if (contender && contender != chip) {
                         /*
@@ -230,7 +230,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
                          * get_chip returns success we're clear to go ahead.
                          */
                         ret = mutex_trylock(&contender->mutex);
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         if (!ret)
                                 goto retry;
                         mutex_unlock(&chip->mutex);
@@ -245,7 +245,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
                                 mutex_unlock(&contender->mutex);
                                 return ret;
                         }
-                        spin_lock(&shared->lock);
+                        mutex_lock(&shared->lock);
 
                         /* We should not own chip if it is already in FL_SYNCING
                          * state. Put contender and retry. */
@@ -261,7 +261,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
                    Must sleep in such a case. */
                 if (mode == FL_ERASING && shared->erasing
                     && shared->erasing->oldstate == FL_ERASING) {
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         set_current_state(TASK_UNINTERRUPTIBLE);
                         add_wait_queue(&chip->wq, &wait);
                         mutex_unlock(&chip->mutex);
@@ -275,7 +275,7 @@ static int get_chip(struct map_info *map, struct flchip *chip, int mode)
                 shared->writing = chip;
                 if (mode == FL_ERASING)
                         shared->erasing = chip;
-                spin_unlock(&shared->lock);
+                mutex_unlock(&shared->lock);
         }
 
         ret = chip_ready(map, chip, mode);
@@ -348,7 +348,7 @@ static void put_chip(struct map_info *map, struct flchip *chip)
 {
         if (chip->priv) {
                 struct flchip_shared *shared = chip->priv;
-                spin_lock(&shared->lock);
+                mutex_lock(&shared->lock);
                 if (shared->writing == chip && chip->oldstate == FL_READY) {
                         /* We own the ability to write, but we're done */
                         shared->writing = shared->erasing;
@@ -356,7 +356,7 @@ static void put_chip(struct map_info *map, struct flchip *chip)
                                 /* give back the ownership */
                                 struct flchip *loaner = shared->writing;
                                 mutex_lock(&loaner->mutex);
-                                spin_unlock(&shared->lock);
+                                mutex_unlock(&shared->lock);
                                 mutex_unlock(&chip->mutex);
                                 put_chip(map, loaner);
                                 mutex_lock(&chip->mutex);
@@ -374,11 +374,11 @@ static void put_chip(struct map_info *map, struct flchip *chip)
                          * Don't let the switch below mess things up since
                          * we don't have ownership to resume anything.
                          */
-                        spin_unlock(&shared->lock);
+                        mutex_unlock(&shared->lock);
                         wake_up(&chip->wq);
                         return;
                 }
-                spin_unlock(&shared->lock);
+                mutex_unlock(&shared->lock);
         }
 
         switch (chip->oldstate) {
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 6629d09f3b38..701d942c6795 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -319,14 +319,6 @@ config MTD_CFI_FLAGADM
           Mapping for the Flaga digital module. If you don't have one, ignore
           this setting.
 
-config MTD_REDWOOD
-        tristate "CFI Flash devices mapped on IBM Redwood"
-        depends on MTD_CFI
-        help
-          This enables access routines for the flash chips on the IBM
-          Redwood board. If you have one of these boards and would like to
-          use the flash chips on it, say 'Y'.
-
 config MTD_SOLUTIONENGINE
         tristate "CFI Flash device mapped on Hitachi SolutionEngine"
         depends on SUPERH && SOLUTION_ENGINE && MTD_CFI && MTD_REDBOOT_PARTS
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index bb035cd54c72..f216bb573713 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -44,7 +44,6 @@ obj-$(CONFIG_MTD_AUTCPU12)	+= autcpu12-nvram.o
 obj-$(CONFIG_MTD_EDB7312)       += edb7312.o
 obj-$(CONFIG_MTD_IMPA7)         += impa7.o
 obj-$(CONFIG_MTD_FORTUNET)      += fortunet.o
-obj-$(CONFIG_MTD_REDWOOD)       += redwood.o
 obj-$(CONFIG_MTD_UCLINUX)       += uclinux.o
 obj-$(CONFIG_MTD_NETtel)        += nettel.o
 obj-$(CONFIG_MTD_SCB2_FLASH)    += scb2_flash.o
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index e0a5e0426ead..1f9fde0dad35 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -118,7 +118,7 @@ static void ixp4xx_copy_from(struct map_info *map, void *to,
                 *dest++ = BYTE1(data);
                 src += 2;
                 len -= 2;
-        }
+        }
 
         if (len > 0)
                 *dest++ = BYTE0(flash_read16(src));
@@ -185,6 +185,8 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
 {
         struct flash_platform_data *plat = dev->dev.platform_data;
         struct ixp4xx_flash_info *info;
+        const char *part_type = NULL;
+        int nr_parts = 0;
         int err = -1;
 
         if (!plat)
@@ -218,9 +220,9 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
          */
         info->map.bankwidth = 2;
         info->map.name = dev_name(&dev->dev);
-        info->map.read = ixp4xx_read16,
-        info->map.write = ixp4xx_probe_write16,
-        info->map.copy_from = ixp4xx_copy_from,
+        info->map.read = ixp4xx_read16;
+        info->map.write = ixp4xx_probe_write16;
+        info->map.copy_from = ixp4xx_copy_from;
 
         info->res = request_mem_region(dev->resource->start,
                         resource_size(dev->resource),
@@ -248,11 +250,28 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
         info->mtd->owner = THIS_MODULE;
 
         /* Use the fast version */
-        info->map.write = ixp4xx_write16,
+        info->map.write = ixp4xx_write16;
+
+#ifdef CONFIG_MTD_PARTITIONS
+        nr_parts = parse_mtd_partitions(info->mtd, probes, &info->partitions,
+                                        dev->resource->start);
+#endif
+        if (nr_parts > 0) {
+                part_type = "dynamic";
+        } else {
+                info->partitions = plat->parts;
+                nr_parts = plat->nr_parts;
+                part_type = "static";
+        }
+        if (nr_parts == 0) {
+                printk(KERN_NOTICE "IXP4xx flash: no partition info "
+                        "available, registering whole flash\n");
+                err = add_mtd_device(info->mtd);
+        } else {
+                printk(KERN_NOTICE "IXP4xx flash: using %s partition "
+                        "definition\n", part_type);
+                err = add_mtd_partitions(info->mtd, info->partitions, nr_parts);
 
-        err = parse_mtd_partitions(info->mtd, probes, &info->partitions, dev->resource->start);
-        if (err > 0) {
-                err = add_mtd_partitions(info->mtd, info->partitions, err);
                 if(err)
                         printk(KERN_ERR "Could not parse partitions\n");
         }
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 426461a5f0d4..4c18b98a3110 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -106,12 +106,12 @@ static int physmap_flash_probe(struct platform_device *dev)
 
         for (i = 0; i < dev->num_resources; i++) {
                 printk(KERN_NOTICE "physmap platform flash device: %.8llx at %.8llx\n",
-                       (unsigned long long)(dev->resource[i].end - dev->resource[i].start + 1),
+                       (unsigned long long)resource_size(&dev->resource[i]),
                        (unsigned long long)dev->resource[i].start);
 
                 if (!devm_request_mem_region(&dev->dev,
                         dev->resource[i].start,
-                        dev->resource[i].end - dev->resource[i].start + 1,
+                        resource_size(&dev->resource[i]),
                         dev_name(&dev->dev))) {
                         dev_err(&dev->dev, "Could not reserve memory region\n");
                         err = -ENOMEM;
@@ -120,7 +120,7 @@ static int physmap_flash_probe(struct platform_device *dev)
 
                 info->map[i].name = dev_name(&dev->dev);
                 info->map[i].phys = dev->resource[i].start;
-                info->map[i].size = dev->resource[i].end - dev->resource[i].start + 1;
+                info->map[i].size = resource_size(&dev->resource[i]);
                 info->map[i].bankwidth = physmap_data->width;
                 info->map[i].set_vpp = physmap_data->set_vpp;
                 info->map[i].pfow_base = physmap_data->pfow_base;
@@ -136,8 +136,12 @@ static int physmap_flash_probe(struct platform_device *dev)
                 simple_map_init(&info->map[i]);
 
                 probe_type = rom_probe_types;
-                for (; info->mtd[i] == NULL && *probe_type != NULL; probe_type++)
-                        info->mtd[i] = do_map_probe(*probe_type, &info->map[i]);
+                if (physmap_data->probe_type == NULL) {
+                        for (; info->mtd[i] == NULL && *probe_type != NULL; probe_type++)
+                                info->mtd[i] = do_map_probe(*probe_type, &info->map[i]);
+                } else
+                        info->mtd[i] = do_map_probe(physmap_data->probe_type, &info->map[i]);
+
                 if (info->mtd[i] == NULL) {
                         dev_err(&dev->dev, "map_probe failed\n");
                         err = -ENXIO;
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index ba124baa646d..6ac5f9f28ac3 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -353,7 +353,7 @@ static int __devinit of_flash_probe(struct of_device *dev,
                                    &info->parts, 0);
         if (err < 0) {
                 of_free_probes(part_probe_types);
-                return err;
+                goto err_out;
         }
         of_free_probes(part_probe_types);
 
@@ -361,14 +361,14 @@ static int __devinit of_flash_probe(struct of_device *dev,
         if (err == 0) {
                 err = of_mtd_parse_partitions(&dev->dev, dp, &info->parts);
                 if (err < 0)
-                        return err;
+                        goto err_out;
         }
 #endif
 
         if (err == 0) {
                 err = parse_obsolete_partitions(dev, info, dp);
                 if (err < 0)
-                        return err;
+                        goto err_out;
         }
 
         if (err > 0)
diff --git a/drivers/mtd/maps/redwood.c b/drivers/mtd/maps/redwood.c
deleted file mode 100644
index d2c9db00db0c..000000000000
--- a/drivers/mtd/maps/redwood.c
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * drivers/mtd/maps/redwood.c
- *
- * FLASH map for the IBM Redwood 4/5/6 boards.
- *
- * Author: MontaVista Software, Inc. <source@mvista.com>
- *
- * 2001-2003 (c) MontaVista, Software, Inc. This file is licensed under
- * the terms of the GNU General Public License version 2. This program
- * is licensed "as is" without any warranty of any kind, whether express
- * or implied.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-
-#include <asm/io.h>
-
-#define WINDOW_ADDR 0xffc00000
-#define WINDOW_SIZE 0x00400000
-
-#define RW_PART0_OF     0
-#define RW_PART0_SZ     0x10000
-#define RW_PART1_OF     RW_PART0_SZ
-#define RW_PART1_SZ     0x200000 - 0x10000
-#define RW_PART2_OF     0x200000
-#define RW_PART2_SZ     0x10000
-#define RW_PART3_OF     0x210000
-#define RW_PART3_SZ     0x200000 - (0x10000 + 0x20000)
-#define RW_PART4_OF     0x3e0000
-#define RW_PART4_SZ     0x20000
-
-static struct mtd_partition redwood_flash_partitions[] = {
-        {
-                .name = "Redwood OpenBIOS Vital Product Data",
-                .offset = RW_PART0_OF,
-                .size = RW_PART0_SZ,
-                .mask_flags = MTD_WRITEABLE     /* force read-only */
-        },
-        {
-                .name = "Redwood kernel",
-                .offset = RW_PART1_OF,
-                .size = RW_PART1_SZ
-        },
-        {
-                .name = "Redwood OpenBIOS non-volatile storage",
-                .offset = RW_PART2_OF,
-                .size = RW_PART2_SZ,
-                .mask_flags = MTD_WRITEABLE     /* force read-only */
-        },
-        {
-                .name = "Redwood filesystem",
-                .offset = RW_PART3_OF,
-                .size = RW_PART3_SZ
-        },
-        {
-                .name = "Redwood OpenBIOS",
-                .offset = RW_PART4_OF,
-                .size = RW_PART4_SZ,
-                .mask_flags = MTD_WRITEABLE     /* force read-only */
-        }
-};
-
-struct map_info redwood_flash_map = {
-        .name = "IBM Redwood",
-        .size = WINDOW_SIZE,
-        .bankwidth = 2,
-        .phys = WINDOW_ADDR,
-};
-
-
-#define NUM_REDWOOD_FLASH_PARTITIONS ARRAY_SIZE(redwood_flash_partitions)
-
-static struct mtd_info *redwood_mtd;
-
-static int __init init_redwood_flash(void)
-{
-        int err;
-
-        printk(KERN_NOTICE "redwood: flash mapping: %x at %x\n",
-                        WINDOW_SIZE, WINDOW_ADDR);
-
-        redwood_flash_map.virt = ioremap(WINDOW_ADDR, WINDOW_SIZE);
-
-        if (!redwood_flash_map.virt) {
-                printk("init_redwood_flash: failed to ioremap\n");
-                return -EIO;
-        }
-        simple_map_init(&redwood_flash_map);
-
-        redwood_mtd = do_map_probe("cfi_probe",&redwood_flash_map);
-
-        if (redwood_mtd) {
-                redwood_mtd->owner = THIS_MODULE;
-                err = add_mtd_partitions(redwood_mtd,
-                                redwood_flash_partitions,
-                                NUM_REDWOOD_FLASH_PARTITIONS);
-                if (err) {
-                        printk("init_redwood_flash: add_mtd_partitions failed\n");
-                        iounmap(redwood_flash_map.virt);
-                }
-                return err;
-
-        }
-
-        iounmap(redwood_flash_map.virt);
-        return -ENXIO;
-}
-
-static void __exit cleanup_redwood_flash(void)
-{
-        if (redwood_mtd) {
-                del_mtd_partitions(redwood_mtd);
-                /* moved iounmap after map_destroy - armin */
-                map_destroy(redwood_mtd);
-                iounmap((void *)redwood_flash_map.virt);
-        }
-}
-
-module_init(init_redwood_flash);
-module_exit(cleanup_redwood_flash);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("MontaVista Software <source@mvista.com>");
-MODULE_DESCRIPTION("MTD map driver for the IBM Redwood reference boards");
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 03e19c1965cc..1d2144d77470 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -1,7 +1,21 @@
 /*
- * (C) 2003 David Woodhouse <dwmw2@infradead.org>
+ * Interface to Linux block layer for MTD 'translation layers'.
  *
- * Interface to Linux 2.5 block layer for MTD 'translation layers'.
+ * Copyright © 2003-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
 
@@ -245,6 +259,7 @@ static int blktrans_ioctl(struct block_device *bdev, fmode_t mode,
         switch (cmd) {
         case BLKFLSBUF:
                 ret = dev->tr->flush ? dev->tr->flush(dev) : 0;
+                break;
         default:
                 ret = -ENOTTY;
         }
@@ -409,13 +424,14 @@ int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old)
                 BUG();
         }
 
-        /* Stop new requests to arrive */
-        del_gendisk(old->disk);
-
         if (old->disk_attributes)
                 sysfs_remove_group(&disk_to_dev(old->disk)->kobj,
                                                 old->disk_attributes);
 
+        /* Stop new requests to arrive */
+        del_gendisk(old->disk);
+
+
         /* Stop the thread */
         kthread_stop(old->thread);
 
diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c
index e6edbec609fd..1e74ad961040 100644
--- a/drivers/mtd/mtdblock.c
+++ b/drivers/mtd/mtdblock.c
@@ -1,8 +1,23 @@
 /*
  * Direct MTD block device access
  *
- * (C) 2000-2003 Nicolas Pitre <nico@fluxnic.net>
- * (C) 1999-2003 David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 2000-2003 Nicolas Pitre <nico@fluxnic.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
  */
 
 #include <linux/fs.h>
diff --git a/drivers/mtd/mtdblock_ro.c b/drivers/mtd/mtdblock_ro.c
index d0d3f79f9d03..795a8c0a05b8 100644
--- a/drivers/mtd/mtdblock_ro.c
+++ b/drivers/mtd/mtdblock_ro.c
@@ -1,7 +1,22 @@
 /*
- * (C) 2003 David Woodhouse <dwmw2@infradead.org>
- *
  * Simple read-only (writable only for RAM) mtdblock driver
+ *
+ * Copyright © 2001-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
  */
 
 #include <linux/init.h>
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 91c8013cf0d9..a825002123c8 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -1,5 +1,19 @@
 /*
- * Character-device access to raw MTD devices.
+ * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
 
@@ -18,7 +32,7 @@
 #include <linux/mount.h>
 
 #include <linux/mtd/mtd.h>
-#include <linux/mtd/compatmac.h>
+#include <linux/mtd/map.h>
 
 #include <asm/uaccess.h>
 
@@ -675,6 +689,20 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
                 break;
         }
 
+        case MEMISLOCKED:
+        {
+                struct erase_info_user einfo;
+
+                if (copy_from_user(&einfo, argp, sizeof(einfo)))
+                        return -EFAULT;
+
+                if (!mtd->is_locked)
+                        ret = -EOPNOTSUPP;
+                else
+                        ret = mtd->is_locked(mtd, einfo.start, einfo.length);
+                break;
+        }
+
         /* Legacy interface */
         case MEMGETOOBSEL:
         {
@@ -950,9 +978,34 @@ static int mtd_mmap(struct file *file, struct vm_area_struct *vma)
 #ifdef CONFIG_MMU
         struct mtd_file_info *mfi = file->private_data;
         struct mtd_info *mtd = mfi->mtd;
+        struct map_info *map = mtd->priv;
+        unsigned long start;
+        unsigned long off;
+        u32 len;
+
+        if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
+                off = vma->vm_pgoff << PAGE_SHIFT;
+                start = map->phys;
+                len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
+                start &= PAGE_MASK;
+                if ((vma->vm_end - vma->vm_start + off) > len)
+                        return -EINVAL;
+
+                off += start;
+                vma->vm_pgoff = off >> PAGE_SHIFT;
+                vma->vm_flags |= VM_IO | VM_RESERVED;
+
+#ifdef pgprot_noncached
+                if (file->f_flags & O_DSYNC || off >= __pa(high_memory))
+                        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+#endif
+                if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+                                       vma->vm_end - vma->vm_start,
+                                       vma->vm_page_prot))
+                        return -EAGAIN;
 
-        if (mtd->type == MTD_RAM || mtd->type == MTD_ROM)
                 return 0;
+        }
         return -ENOSYS;
 #else
         return vma->vm_flags & VM_SHARED ? 0 : -ENOSYS;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 7e075621bbf4..bf8de0943103 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -1,11 +1,25 @@
 /*
  * MTD device concatenation layer
  *
- * (C) 2002 Robert Kaiser <rkaiser@sysgo.de>
+ * Copyright © 2002 Robert Kaiser <rkaiser@sysgo.de>
+ * Copyright © 2002-2010 David Woodhouse <dwmw2@infradead.org>
  *
  * NAND support by Christian Gan <cgan@iders.ca>
  *
- * This code is GPL
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
  */
 
 #include <linux/kernel.h>
@@ -540,10 +554,12 @@ static int concat_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
                 else
                         size = len;
 
-                err = subdev->lock(subdev, ofs, size);
-
-                if (err)
-                        break;
+                if (subdev->lock) {
+                        err = subdev->lock(subdev, ofs, size);
+                        if (err)
+                                break;
+                } else
+                        err = -EOPNOTSUPP;
 
                 len -= size;
                 if (len == 0)
@@ -578,10 +594,12 @@ static int concat_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
                 else
                         size = len;
 
-                err = subdev->unlock(subdev, ofs, size);
-
-                if (err)
-                        break;
+                if (subdev->unlock) {
+                        err = subdev->unlock(subdev, ofs, size);
+                        if (err)
+                                break;
+                } else
+                        err = -EOPNOTSUPP;
 
                 len -= size;
                 if (len == 0)
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index a1b8b70d2d0a..527cebf58da4 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -2,9 +2,23 @@
  * Core registration and callback routines for MTD
  * drivers and users.
  *
- * bdi bits are:
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
+ * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 2006      Red Hat UK Limited 
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
  */
 
 #include <linux/module.h>
@@ -17,7 +31,6 @@
 #include <linux/err.h>
 #include <linux/ioctl.h>
 #include <linux/init.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/proc_fs.h>
 #include <linux/idr.h>
 #include <linux/backing-dev.h>
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 328313c3dccb..1ee72f3f0512 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -1,7 +1,7 @@
 /*
  * MTD Oops/Panic logger
  *
- * Copyright (C) 2007 Nokia Corporation. All rights reserved.
+ * Copyright © 2007 Nokia Corporation. All rights reserved.
  *
  * Author: Richard Purdie <rpurdie@openedhand.com>
  *
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index b8043a9ba32d..dc6558568876 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -1,12 +1,24 @@
 /*
  * Simple MTD partitioning layer
  *
- * (C) 2000 Nicolas Pitre <nico@fluxnic.net>
+ * Copyright © 2000 Nicolas Pitre <nico@fluxnic.net>
+ * Copyright © 2002 Thomas Gleixner <gleixner@linutronix.de>
+ * Copyright © 2000-2010 David Woodhouse <dwmw2@infradead.org>
  *
- * This code is GPL
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
- *      02-21-2002      Thomas Gleixner <gleixner@autronix.de>
- *                      added support for read_oob, write_oob
  */
 
 #include <linux/module.h>
@@ -17,7 +29,6 @@
 #include <linux/kmod.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
-#include <linux/mtd/compatmac.h>
 
 /* Our partition linked list */
 static LIST_HEAD(mtd_partitions);
@@ -264,6 +275,14 @@ static int part_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         return part->master->unlock(part->master, ofs + part->offset, len);
 }
 
+static int part_is_locked(struct mtd_info *mtd, loff_t ofs, uint64_t len)
+{
+        struct mtd_part *part = PART(mtd);
+        if ((len + ofs) > mtd->size)
+                return -EINVAL;
+        return part->master->is_locked(part->master, ofs + part->offset, len);
+}
+
 static void part_sync(struct mtd_info *mtd)
 {
         struct mtd_part *part = PART(mtd);
@@ -402,6 +421,8 @@ static struct mtd_part *add_one_partition(struct mtd_info *master,
                 slave->mtd.lock = part_lock;
         if (master->unlock)
                 slave->mtd.unlock = part_unlock;
+        if (master->is_locked)
+                slave->mtd.is_locked = part_is_locked;
         if (master->block_isbad)
                 slave->mtd.block_isbad = part_block_isbad;
         if (master->block_markbad)
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index bd9a443ccf69..38e2ab07e7a3 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -1,6 +1,8 @@
 /* MTD-based superblock management
  *
  * Copyright © 2001-2007 Red Hat, Inc. All Rights Reserved.
+ * Copyright © 2001-2010 David Woodhouse <dwmw2@infradead.org>
+ *
  * Written by:  David Howells <dhowells@redhat.com>
  *              David Woodhouse <dwmw2@infradead.org>
  *
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 362d177efe1b..8b4b67c8a391 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -37,7 +37,6 @@ config MTD_SM_COMMON
 
 config MTD_NAND_MUSEUM_IDS
         bool "Enable chip ids for obsolete ancient NAND devices"
-        depends on MTD_NAND
         default n
         help
           Enable this option only when your board has first generation
@@ -61,6 +60,7 @@ config MTD_NAND_DENALI
 config MTD_NAND_DENALI_SCRATCH_REG_ADDR
         hex "Denali NAND size scratch register address"
         default "0xFF108018"
+        depends on MTD_NAND_DENALI
         help
           Some platforms place the NAND chip size in a scratch register
           because (some versions of) the driver aren't able to automatically
@@ -101,13 +101,13 @@ config MTD_NAND_AMS_DELTA
 
 config MTD_NAND_OMAP2
         tristate "NAND Flash device on OMAP2 and OMAP3"
-        depends on ARM && MTD_NAND && (ARCH_OMAP2 || ARCH_OMAP3)
+        depends on ARM && (ARCH_OMAP2 || ARCH_OMAP3)
         help
           Support for NAND flash on Texas Instruments OMAP2 and OMAP3 platforms.
 
 config MTD_NAND_OMAP_PREFETCH
         bool "GPMC prefetch support for NAND Flash device"
-        depends on MTD_NAND && MTD_NAND_OMAP2
+        depends on MTD_NAND_OMAP2
         default y
         help
          The NAND device can be accessed for Read/Write using GPMC PREFETCH engine
@@ -146,7 +146,7 @@ config MTD_NAND_AU1550
 
 config MTD_NAND_BF5XX
         tristate "Blackfin on-chip NAND Flash Controller driver"
-        depends on (BF54x || BF52x) && MTD_NAND
+        depends on BF54x || BF52x
         help
           This enables the Blackfin on-chip NAND flash controller
 
@@ -236,7 +236,7 @@ config MTD_NAND_S3C2410_CLKSTOP
 
 config MTD_NAND_BCM_UMI
         tristate "NAND Flash support for BCM Reference Boards"
-        depends on ARCH_BCMRING && MTD_NAND
+        depends on ARCH_BCMRING
         help
           This enables the NAND flash controller on the BCM UMI block.
 
@@ -395,7 +395,7 @@ endchoice
 
 config MTD_NAND_PXA3xx
         tristate "Support for NAND flash devices on PXA3xx"
-        depends on MTD_NAND && (PXA3xx || ARCH_MMP)
+        depends on PXA3xx || ARCH_MMP
         help
           This enables the driver for the NAND flash device found on
           PXA3xx processors
@@ -409,18 +409,18 @@ config MTD_NAND_PXA3xx_BUILTIN
 
 config MTD_NAND_CM_X270
         tristate "Support for NAND Flash on CM-X270 modules"
-        depends on MTD_NAND && MACH_ARMCORE
+        depends on MACH_ARMCORE
 
 config MTD_NAND_PASEMI
         tristate "NAND support for PA Semi PWRficient"
-        depends on MTD_NAND && PPC_PASEMI
+        depends on PPC_PASEMI
         help
           Enables support for NAND Flash interface on PA Semi PWRficient
           based boards
 
 config MTD_NAND_TMIO
         tristate "NAND Flash device on Toshiba Mobile IO Controller"
-        depends on MTD_NAND && MFD_TMIO
+        depends on MFD_TMIO
         help
           Support for NAND flash connected to a Toshiba Mobile IO
           Controller in some PDAs, including the Sharp SL6000x.
@@ -434,7 +434,6 @@ config MTD_NAND_NANDSIM
 
 config MTD_NAND_PLATFORM
         tristate "Support for generic platform NAND driver"
-        depends on MTD_NAND
         help
           This implements a generic NAND driver for on-SOC platform
           devices. You will need to provide platform-specific functions
@@ -442,14 +441,14 @@ config MTD_NAND_PLATFORM
 
 config MTD_ALAUDA
         tristate "MTD driver for Olympus MAUSB-10 and Fujifilm DPC-R1"
-        depends on MTD_NAND && USB
+        depends on USB
         help
           These two (and possibly other) Alauda-based cardreaders for
           SmartMedia and xD allow raw flash access.
 
 config MTD_NAND_ORION
         tristate "NAND Flash support for Marvell Orion SoC"
-        depends on PLAT_ORION && MTD_NAND
+        depends on PLAT_ORION
         help
           This enables the NAND flash controller on Orion machines.
 
@@ -458,7 +457,7 @@ config MTD_NAND_ORION
 
 config MTD_NAND_FSL_ELBC
         tristate "NAND support for Freescale eLBC controllers"
-        depends on MTD_NAND && PPC_OF
+        depends on PPC_OF
         help
           Various Freescale chips, including the 8313, include a NAND Flash
           Controller Module with built-in hardware ECC capabilities.
@@ -467,7 +466,7 @@ config MTD_NAND_FSL_ELBC
 
 config MTD_NAND_FSL_UPM
         tristate "Support for NAND on Freescale UPM"
-        depends on MTD_NAND && (PPC_83xx || PPC_85xx)
+        depends on PPC_83xx || PPC_85xx
         select FSL_LBC
         help
           Enables support for NAND Flash chips wired onto Freescale PowerPC
@@ -482,7 +481,7 @@ config MTD_NAND_MPC5121_NFC
 
 config MTD_NAND_MXC
         tristate "MXC NAND support"
-        depends on ARCH_MX2 || ARCH_MX25 || ARCH_MX3
+        depends on ARCH_MX2 || ARCH_MX25 || ARCH_MX3 || ARCH_MX51
         help
           This enables the driver for the NAND flash controller on the
           MXC processors.
@@ -495,7 +494,7 @@ config MTD_NAND_NOMADIK
 
 config MTD_NAND_SH_FLCTL
         tristate "Support for NAND on Renesas SuperH FLCTL"
-        depends on MTD_NAND && (SUPERH || ARCH_SHMOBILE)
+        depends on SUPERH || ARCH_SHMOBILE
         help
           Several Renesas SuperH CPU has FLCTL. This option enables support
           for NAND Flash using FLCTL.
@@ -515,7 +514,7 @@ config MTD_NAND_TXX9NDFMC
 
 config MTD_NAND_SOCRATES
         tristate "Support for NAND on Socrates board"
-        depends on MTD_NAND && SOCRATES
+        depends on SOCRATES
         help
           Enables support for NAND Flash chips wired onto Socrates board.
 
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 04d30887ca7f..ccce0f03b5dc 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -364,7 +364,7 @@ static void atmel_nand_hwctl(struct mtd_info *mtd, int mode)
         }
 }
 
-#ifdef CONFIG_MTD_PARTITIONS
+#ifdef CONFIG_MTD_CMDLINE_PARTS
 static const char *part_probes[] = { "cmdlinepart", NULL };
 #endif
 
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
index 2974995e194d..a382e3dd0a5d 100644
--- a/drivers/mtd/nand/bf5xx_nand.c
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -20,9 +20,6 @@
  *              - DMA supported in ECC_HW
  *              - YAFFS tested as rootfs in both ECC_HW and ECC_SW
  *
- * TODO:
- *      Enable JFFS2 over NAND as rootfs
- *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -206,7 +203,7 @@ static void bf5xx_nand_hwcontrol(struct mtd_info *mtd, int cmd,
 
         if (ctrl & NAND_CLE)
                 bfin_write_NFC_CMD(cmd);
-        else
+        else if (ctrl & NAND_ALE)
                 bfin_write_NFC_ADDR(cmd);
         SSYNC();
 }
@@ -218,9 +215,9 @@ static void bf5xx_nand_hwcontrol(struct mtd_info *mtd, int cmd,
  */
 static int bf5xx_nand_devready(struct mtd_info *mtd)
 {
-        unsigned short val = bfin_read_NFC_IRQSTAT();
+        unsigned short val = bfin_read_NFC_STAT();
 
-        if ((val & NBUSYIRQ) == NBUSYIRQ)
+        if ((val & NBUSY) == NBUSY)
                 return 1;
         else
                 return 0;
@@ -317,18 +314,16 @@ static int bf5xx_nand_correct_data_256(struct mtd_info *mtd, u_char *dat,
 static int bf5xx_nand_correct_data(struct mtd_info *mtd, u_char *dat,
                                         u_char *read_ecc, u_char *calc_ecc)
 {
-        struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
-        struct bf5xx_nand_platform *plat = info->platform;
-        unsigned short page_size = (plat->page_size ? 512 : 256);
+        struct nand_chip *chip = mtd->priv;
         int ret;
 
         ret = bf5xx_nand_correct_data_256(mtd, dat, read_ecc, calc_ecc);
 
-        /* If page size is 512, correct second 256 bytes */
-        if (page_size == 512) {
+        /* If ecc size is 512, correct second 256 bytes */
+        if (chip->ecc.size == 512) {
                 dat += 256;
-                read_ecc += 8;
-                calc_ecc += 8;
+                read_ecc += 3;
+                calc_ecc += 3;
                 ret |= bf5xx_nand_correct_data_256(mtd, dat, read_ecc, calc_ecc);
         }
 
@@ -344,13 +339,12 @@ static int bf5xx_nand_calculate_ecc(struct mtd_info *mtd,
                 const u_char *dat, u_char *ecc_code)
 {
         struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
-        struct bf5xx_nand_platform *plat = info->platform;
-        u16 page_size = (plat->page_size ? 512 : 256);
+        struct nand_chip *chip = mtd->priv;
         u16 ecc0, ecc1;
         u32 code[2];
         u8 *p;
 
-        /* first 4 bytes ECC code for 256 page size */
+        /* first 3 bytes ECC code for 256 page size */
         ecc0 = bfin_read_NFC_ECC0();
         ecc1 = bfin_read_NFC_ECC1();
 
@@ -358,12 +352,11 @@ static int bf5xx_nand_calculate_ecc(struct mtd_info *mtd,
 
         dev_dbg(info->device, "returning ecc 0x%08x\n", code[0]);
 
-        /* first 3 bytes in ecc_code for 256 page size */
         p = (u8 *) code;
         memcpy(ecc_code, p, 3);
 
-        /* second 4 bytes ECC code for 512 page size */
-        if (page_size == 512) {
+        /* second 3 bytes ECC code for 512 ecc size */
+        if (chip->ecc.size == 512) {
                 ecc0 = bfin_read_NFC_ECC2();
                 ecc1 = bfin_read_NFC_ECC3();
                 code[1] = (ecc0 & 0x7ff) | ((ecc1 & 0x7ff) << 11);
@@ -483,8 +476,7 @@ static void bf5xx_nand_dma_rw(struct mtd_info *mtd,
                                 uint8_t *buf, int is_read)
 {
         struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
-        struct bf5xx_nand_platform *plat = info->platform;
-        unsigned short page_size = (plat->page_size ? 512 : 256);
+        struct nand_chip *chip = mtd->priv;
         unsigned short val;
 
         dev_dbg(info->device, " mtd->%p, buf->%p, is_read %d\n",
@@ -498,10 +490,10 @@ static void bf5xx_nand_dma_rw(struct mtd_info *mtd,
          */
         if (is_read)
                 invalidate_dcache_range((unsigned int)buf,
-                                (unsigned int)(buf + page_size));
+                                (unsigned int)(buf + chip->ecc.size));
         else
                 flush_dcache_range((unsigned int)buf,
-                                (unsigned int)(buf + page_size));
+                                (unsigned int)(buf + chip->ecc.size));
 
         /*
          * This register must be written before each page is
@@ -510,6 +502,8 @@ static void bf5xx_nand_dma_rw(struct mtd_info *mtd,
          */
         bfin_write_NFC_RST(ECC_RST);
         SSYNC();
+        while (bfin_read_NFC_RST() & ECC_RST)
+                cpu_relax();
 
         disable_dma(CH_NFC);
         clear_dma_irqstat(CH_NFC);
@@ -520,13 +514,13 @@ static void bf5xx_nand_dma_rw(struct mtd_info *mtd,
 
         /* The DMAs have different size on BF52x and BF54x */
 #ifdef CONFIG_BF52x
-        set_dma_x_count(CH_NFC, (page_size >> 1));
+        set_dma_x_count(CH_NFC, (chip->ecc.size >> 1));
         set_dma_x_modify(CH_NFC, 2);
         val = DI_EN | WDSIZE_16;
 #endif
 
 #ifdef CONFIG_BF54x
-        set_dma_x_count(CH_NFC, (page_size >> 2));
+        set_dma_x_count(CH_NFC, (chip->ecc.size >> 2));
         set_dma_x_modify(CH_NFC, 4);
         val = DI_EN | WDSIZE_32;
 #endif
@@ -548,12 +542,11 @@ static void bf5xx_nand_dma_read_buf(struct mtd_info *mtd,
                                         uint8_t *buf, int len)
 {
         struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
-        struct bf5xx_nand_platform *plat = info->platform;
-        unsigned short page_size = (plat->page_size ? 512 : 256);
+        struct nand_chip *chip = mtd->priv;
 
         dev_dbg(info->device, "mtd->%p, buf->%p, int %d\n", mtd, buf, len);
 
-        if (len == page_size)
+        if (len == chip->ecc.size)
                 bf5xx_nand_dma_rw(mtd, buf, 1);
         else
                 bf5xx_nand_read_buf(mtd, buf, len);
@@ -563,17 +556,32 @@ static void bf5xx_nand_dma_write_buf(struct mtd_info *mtd,
                                 const uint8_t *buf, int len)
 {
         struct bf5xx_nand_info *info = mtd_to_nand_info(mtd);
-        struct bf5xx_nand_platform *plat = info->platform;
-        unsigned short page_size = (plat->page_size ? 512 : 256);
+        struct nand_chip *chip = mtd->priv;
 
         dev_dbg(info->device, "mtd->%p, buf->%p, len %d\n", mtd, buf, len);
 
-        if (len == page_size)
+        if (len == chip->ecc.size)
                 bf5xx_nand_dma_rw(mtd, (uint8_t *)buf, 0);
         else
                 bf5xx_nand_write_buf(mtd, buf, len);
 }
 
+static int bf5xx_nand_read_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
+                uint8_t *buf, int page)
+{
+        bf5xx_nand_read_buf(mtd, buf, mtd->writesize);
+        bf5xx_nand_read_buf(mtd, chip->oob_poi, mtd->oobsize);
+
+        return 0;
+}
+
+static void bf5xx_nand_write_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
+                const uint8_t *buf)
+{
+        bf5xx_nand_write_buf(mtd, buf, mtd->writesize);
+        bf5xx_nand_write_buf(mtd, chip->oob_poi, mtd->oobsize);
+}
+
 /*
  * System initialization functions
  */
@@ -627,15 +635,14 @@ static int bf5xx_nand_hw_init(struct bf5xx_nand_info *info)
 
         /* setup NFC_CTL register */
         dev_info(info->device,
-                "page_size=%d, data_width=%d, wr_dly=%d, rd_dly=%d\n",
-                (plat->page_size ? 512 : 256),
+                "data_width=%d, wr_dly=%d, rd_dly=%d\n",
                 (plat->data_width ? 16 : 8),
                 plat->wr_dly, plat->rd_dly);
 
-        val = (plat->page_size << NFC_PG_SIZE_OFFSET) |
+        val = (1 << NFC_PG_SIZE_OFFSET) |
                 (plat->data_width << NFC_NWIDTH_OFFSET) |
                 (plat->rd_dly << NFC_RDDLY_OFFSET) |
-                (plat->rd_dly << NFC_WRDLY_OFFSET);
+                (plat->wr_dly << NFC_WRDLY_OFFSET);
         dev_dbg(info->device, "NFC_CTL is 0x%04x\n", val);
 
         bfin_write_NFC_CTL(val);
@@ -698,6 +705,33 @@ static int __devexit bf5xx_nand_remove(struct platform_device *pdev)
         return 0;
 }
 
+static int bf5xx_nand_scan(struct mtd_info *mtd)
+{
+        struct nand_chip *chip = mtd->priv;
+        int ret;
+
+        ret = nand_scan_ident(mtd, 1);
+        if (ret)
+                return ret;
+
+        if (hardware_ecc) {
+                /*
+                 * for nand with page size > 512B, think it as several sections with 512B
+                 */
+                if (likely(mtd->writesize >= 512)) {
+                        chip->ecc.size = 512;
+                        chip->ecc.bytes = 6;
+                } else {
+                        chip->ecc.size = 256;
+                        chip->ecc.bytes = 3;
+                        bfin_write_NFC_CTL(bfin_read_NFC_CTL() & ~(1 << NFC_PG_SIZE_OFFSET));
+                        SSYNC();
+                }
+        }
+
+        return  nand_scan_tail(mtd);
+}
+
 /*
  * bf5xx_nand_probe
  *
@@ -783,27 +817,20 @@ static int __devinit bf5xx_nand_probe(struct platform_device *pdev)
                 chip->badblock_pattern = &bootrom_bbt;
                 chip->ecc.layout = &bootrom_ecclayout;
 #endif
-
-                if (plat->page_size == NFC_PG_SIZE_256) {
-                        chip->ecc.bytes = 3;
-                        chip->ecc.size = 256;
-                } else if (plat->page_size == NFC_PG_SIZE_512) {
-                        chip->ecc.bytes = 6;
-                        chip->ecc.size = 512;
-                }
-
                 chip->read_buf      = bf5xx_nand_dma_read_buf;
                 chip->write_buf     = bf5xx_nand_dma_write_buf;
                 chip->ecc.calculate = bf5xx_nand_calculate_ecc;
                 chip->ecc.correct   = bf5xx_nand_correct_data;
                 chip->ecc.mode      = NAND_ECC_HW;
                 chip->ecc.hwctl     = bf5xx_nand_enable_hwecc;
+                chip->ecc.read_page_raw = bf5xx_nand_read_page_raw;
+                chip->ecc.write_page_raw = bf5xx_nand_write_page_raw;
         } else {
                 chip->ecc.mode      = NAND_ECC_SOFT;
         }
 
         /* scan hardware nand chip and setup mtd info data struct */
-        if (nand_scan(mtd, 1)) {
+        if (bf5xx_nand_scan(mtd)) {
                 err = -ENXIO;
                 goto out_err_nand_scan;
         }
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 9c9d893affeb..2ac7367afe77 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -311,7 +311,9 @@ static int nand_davinci_correct_4bit(struct mtd_info *mtd,
         unsigned short ecc10[8];
         unsigned short *ecc16;
         u32 syndrome[4];
+        u32 ecc_state;
         unsigned num_errors, corrected;
+        unsigned long timeo = jiffies + msecs_to_jiffies(100);
 
         /* All bytes 0xff?  It's an erased page; ignore its ECC. */
         for (i = 0; i < 10; i++) {
@@ -361,6 +363,21 @@ compare:
          */
         davinci_nand_writel(info, NANDFCR_OFFSET,
                         davinci_nand_readl(info, NANDFCR_OFFSET) | BIT(13));
+
+        /*
+         * ECC_STATE field reads 0x3 (Error correction complete) immediately
+         * after setting the 4BITECC_ADD_CALC_START bit. So if you immediately
+         * begin trying to poll for the state, you may fall right out of your
+         * loop without any of the correction calculations having taken place.
+         * The recommendation from the hardware team is to wait till ECC_STATE
+         * reads less than 4, which means ECC HW has entered correction state.
+         */
+        do {
+                ecc_state = (davinci_nand_readl(info,
+                                NANDFSR_OFFSET) >> 8) & 0x0f;
+                cpu_relax();
+        } while ((ecc_state < 4) && time_before(jiffies, timeo));
+
         for (;;) {
                 u32     fsr = davinci_nand_readl(info, NANDFSR_OFFSET);
 
diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
index 3dfda9cc677d..618fb42b86b0 100644
--- a/drivers/mtd/nand/denali.c
+++ b/drivers/mtd/nand/denali.c
@@ -21,6 +21,7 @@
 #include <linux/delay.h>
 #include <linux/wait.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/mtd/mtd.h>
 #include <linux/module.h>
@@ -29,15 +30,15 @@
 
 MODULE_LICENSE("GPL");
 
-/* We define a module parameter that allows the user to override 
+/* We define a module parameter that allows the user to override
  * the hardware and decide what timing mode should be used.
  */
 #define NAND_DEFAULT_TIMINGS    -1
 
 static int onfi_timing_mode = NAND_DEFAULT_TIMINGS;
 module_param(onfi_timing_mode, int, S_IRUGO);
-MODULE_PARM_DESC(onfi_timing_mode, "Overrides default ONFI setting. -1 indicates"
-                                        " use default timings");
+MODULE_PARM_DESC(onfi_timing_mode, "Overrides default ONFI setting."
+                        " -1 indicates use default timings");
 
 #define DENALI_NAND_NAME    "denali-nand"
 
@@ -54,13 +55,13 @@ MODULE_PARM_DESC(onfi_timing_mode, "Overrides default ONFI setting. -1 indicates
                         INTR_STATUS0__RST_COMP | \
                         INTR_STATUS0__ERASE_COMP)
 
-/* indicates whether or not the internal value for the flash bank is 
+/* indicates whether or not the internal value for the flash bank is
    valid or not */
-#define CHIP_SELECT_INVALID     -1
+#define CHIP_SELECT_INVALID     -1
 
 #define SUPPORT_8BITECC         1
 
-/* This macro divides two integers and rounds fractional values up 
+/* This macro divides two integers and rounds fractional values up
  * to the nearest integer value. */
 #define CEIL_DIV(X, Y) (((X)%(Y)) ? ((X)/(Y)+1) : ((X)/(Y)))
 
@@ -83,7 +84,7 @@ MODULE_PARM_DESC(onfi_timing_mode, "Overrides default ONFI setting. -1 indicates
 #define ADDR_CYCLE      1
 #define STATUS_CYCLE    2
 
-/* this is a helper macro that allows us to 
+/* this is a helper macro that allows us to
  * format the bank into the proper bits for the controller */
 #define BANK(x) ((x) << 24)
 
@@ -95,59 +96,64 @@ static const struct pci_device_id denali_pci_ids[] = {
 };
 
 
-/* these are static lookup tables that give us easy access to 
-   registers in the NAND controller.  
+/* these are static lookup tables that give us easy access to
+   registers in the NAND controller.
  */
-static const uint32_t intr_status_addresses[4] = {INTR_STATUS0, 
-                                                  INTR_STATUS1, 
-                                                  INTR_STATUS2, 
+static const uint32_t intr_status_addresses[4] = {INTR_STATUS0,
+                                                  INTR_STATUS1,
+                                                  INTR_STATUS2,
                                                   INTR_STATUS3};
 
 static const uint32_t device_reset_banks[4] = {DEVICE_RESET__BANK0,
-                                               DEVICE_RESET__BANK1,
-                                               DEVICE_RESET__BANK2,
-                                               DEVICE_RESET__BANK3};
+                                                        DEVICE_RESET__BANK1,
+                                                        DEVICE_RESET__BANK2,
+                                                        DEVICE_RESET__BANK3};
 
 static const uint32_t operation_timeout[4] = {INTR_STATUS0__TIME_OUT,
-                                              INTR_STATUS1__TIME_OUT,
-                                              INTR_STATUS2__TIME_OUT,
-                                              INTR_STATUS3__TIME_OUT};
+                                                        INTR_STATUS1__TIME_OUT,
+                                                        INTR_STATUS2__TIME_OUT,
+                                                        INTR_STATUS3__TIME_OUT};
 
 static const uint32_t reset_complete[4] = {INTR_STATUS0__RST_COMP,
-                                           INTR_STATUS1__RST_COMP,
-                                           INTR_STATUS2__RST_COMP,
-                                           INTR_STATUS3__RST_COMP};
+                                                        INTR_STATUS1__RST_COMP,
+                                                        INTR_STATUS2__RST_COMP,
+                                                        INTR_STATUS3__RST_COMP};
 
 /* specifies the debug level of the driver */
-static int nand_debug_level = 0;
+static int nand_debug_level;
 
 /* forward declarations */
 static void clear_interrupts(struct denali_nand_info *denali);
-static uint32_t wait_for_irq(struct denali_nand_info *denali, uint32_t irq_mask);
-static void denali_irq_enable(struct denali_nand_info *denali, uint32_t int_mask);
+static uint32_t wait_for_irq(struct denali_nand_info *denali,
+                                                        uint32_t irq_mask);
+static void denali_irq_enable(struct denali_nand_info *denali,
+                                                        uint32_t int_mask);
 static uint32_t read_interrupt_status(struct denali_nand_info *denali);
 
 #define DEBUG_DENALI 0
 
 /* This is a wrapper for writing to the denali registers.
  * this allows us to create debug information so we can
- * observe how the driver is programming the device. 
+ * observe how the driver is programming the device.
  * it uses standard linux convention for (val, addr) */
 static void denali_write32(uint32_t value, void *addr)
 {
-        iowrite32(value, addr); 
+        iowrite32(value, addr);
 
 #if DEBUG_DENALI
-        printk(KERN_ERR "wrote: 0x%x -> 0x%x\n", value, (uint32_t)((uint32_t)addr & 0x1fff));
+        printk(KERN_INFO "wrote: 0x%x -> 0x%x\n", value,
+                        (uint32_t)((uint32_t)addr & 0x1fff));
 #endif
-} 
+}
 
-/* Certain operations for the denali NAND controller use an indexed mode to read/write 
-   data. The operation is performed by writing the address value of the command to 
-   the device memory followed by the data. This function abstracts this common 
-   operation. 
+/* Certain operations for the denali NAND controller use
+ * an indexed mode to read/write data. The operation is
+ * performed by writing the address value of the command
+ * to the device memory followed by the data. This function
+ * abstracts this common operation.
 */
-static void index_addr(struct denali_nand_info *denali, uint32_t address, uint32_t data)
+static void index_addr(struct denali_nand_info *denali,
+                                uint32_t address, uint32_t data)
 {
         denali_write32(address, denali->flash_mem);
         denali_write32(data, denali->flash_mem + 0x10);
@@ -161,7 +167,7 @@ static void index_addr_read_data(struct denali_nand_info *denali,
         *pdata = ioread32(denali->flash_mem + 0x10);
 }
 
-/* We need to buffer some data for some of the NAND core routines. 
+/* We need to buffer some data for some of the NAND core routines.
  * The operations manage buffering that data. */
 static void reset_buf(struct denali_nand_info *denali)
 {
@@ -183,7 +189,7 @@ static void read_status(struct denali_nand_info *denali)
         reset_buf(denali);
 
         /* initiate a device status read */
-        cmd = MODE_11 | BANK(denali->flash_bank); 
+        cmd = MODE_11 | BANK(denali->flash_bank);
         index_addr(denali, cmd | COMMAND_CYCLE, 0x70);
         denali_write32(cmd | STATUS_CYCLE, denali->flash_mem);
 
@@ -191,7 +197,8 @@ static void read_status(struct denali_nand_info *denali)
         write_byte_to_buf(denali, ioread32(denali->flash_mem + 0x10));
 
 #if DEBUG_DENALI
-        printk("device reporting status value of 0x%2x\n", denali->buf.buf[0]);
+        printk(KERN_INFO "device reporting status value of 0x%2x\n",
+                        denali->buf.buf[0]);
 #endif
 }
 
@@ -199,7 +206,7 @@ static void read_status(struct denali_nand_info *denali)
 static void reset_bank(struct denali_nand_info *denali)
 {
         uint32_t irq_status = 0;
-        uint32_t irq_mask = reset_complete[denali->flash_bank] | 
+        uint32_t irq_mask = reset_complete[denali->flash_bank] |
                             operation_timeout[denali->flash_bank];
         int bank = 0;
 
@@ -209,15 +216,13 @@ static void reset_bank(struct denali_nand_info *denali)
         denali_write32(bank, denali->flash_reg + DEVICE_RESET);
 
         irq_status = wait_for_irq(denali, irq_mask);
-        
+
         if (irq_status & operation_timeout[denali->flash_bank])
-        {
                 printk(KERN_ERR "reset bank failed.\n");
-        }
 }
 
 /* Reset the flash controller */
-static uint16_t NAND_Flash_Reset(struct denali_nand_info *denali)
+static uint16_t denali_nand_reset(struct denali_nand_info *denali)
 {
         uint32_t i;
 
@@ -229,8 +234,10 @@ static uint16_t NAND_Flash_Reset(struct denali_nand_info *denali)
                 denali->flash_reg + intr_status_addresses[i]);
 
         for (i = 0 ; i < LLD_MAX_FLASH_BANKS; i++) {
-                denali_write32(device_reset_banks[i], denali->flash_reg + DEVICE_RESET);
-                while (!(ioread32(denali->flash_reg + intr_status_addresses[i]) &
+                denali_write32(device_reset_banks[i],
+                                denali->flash_reg + DEVICE_RESET);
+                while (!(ioread32(denali->flash_reg +
+                                                intr_status_addresses[i]) &
                         (reset_complete[i] | operation_timeout[i])))
                         ;
                 if (ioread32(denali->flash_reg + intr_status_addresses[i]) &
@@ -246,11 +253,12 @@ static uint16_t NAND_Flash_Reset(struct denali_nand_info *denali)
         return PASS;
 }
 
-/* this routine calculates the ONFI timing values for a given mode and programs
- * the clocking register accordingly. The mode is determined by the get_onfi_nand_para
-   routine.
+/* this routine calculates the ONFI timing values for a given mode and
+ * programs the clocking register accordingly. The mode is determined by
+ * the get_onfi_nand_para routine.
  */
-static void NAND_ONFi_Timing_Mode(struct denali_nand_info *denali, uint16_t mode)
+static void nand_onfi_timing_set(struct denali_nand_info *denali,
+                                                                uint16_t mode)
 {
         uint16_t Trea[6] = {40, 30, 25, 20, 20, 16};
         uint16_t Trp[6] = {50, 25, 17, 15, 12, 10};
@@ -347,136 +355,24 @@ static void NAND_ONFi_Timing_Mode(struct denali_nand_info *denali, uint16_t mode
         denali_write32(cs_cnt, denali->flash_reg + CS_SETUP_CNT);
 }
 
-/* configures the initial ECC settings for the controller */
-static void set_ecc_config(struct denali_nand_info *denali)
-{
-#if SUPPORT_8BITECC
-        if ((ioread32(denali->flash_reg + DEVICE_MAIN_AREA_SIZE) < 4096) ||
-                (ioread32(denali->flash_reg + DEVICE_SPARE_AREA_SIZE) <= 128))
-                denali_write32(8, denali->flash_reg + ECC_CORRECTION);
-#endif
-
-        if ((ioread32(denali->flash_reg + ECC_CORRECTION) & ECC_CORRECTION__VALUE)
-                == 1) {
-                denali->dev_info.wECCBytesPerSector = 4;
-                denali->dev_info.wECCBytesPerSector *= denali->dev_info.wDevicesConnected;
-                denali->dev_info.wNumPageSpareFlag =
-                        denali->dev_info.wPageSpareSize -
-                        denali->dev_info.wPageDataSize /
-                        (ECC_SECTOR_SIZE * denali->dev_info.wDevicesConnected) *
-                        denali->dev_info.wECCBytesPerSector
-                        - denali->dev_info.wSpareSkipBytes;
-        } else {
-                denali->dev_info.wECCBytesPerSector =
-                        (ioread32(denali->flash_reg + ECC_CORRECTION) &
-                        ECC_CORRECTION__VALUE) * 13 / 8;
-                if ((denali->dev_info.wECCBytesPerSector) % 2 == 0)
-                        denali->dev_info.wECCBytesPerSector += 2;
-                else
-                        denali->dev_info.wECCBytesPerSector += 1;
-
-                denali->dev_info.wECCBytesPerSector *= denali->dev_info.wDevicesConnected;
-                denali->dev_info.wNumPageSpareFlag = denali->dev_info.wPageSpareSize -
-                        denali->dev_info.wPageDataSize /
-                        (ECC_SECTOR_SIZE * denali->dev_info.wDevicesConnected) *
-                        denali->dev_info.wECCBytesPerSector
-                        - denali->dev_info.wSpareSkipBytes;
-        }
-}
-
 /* queries the NAND device to see what ONFI modes it supports. */
 static uint16_t get_onfi_nand_para(struct denali_nand_info *denali)
 {
         int i;
-        uint16_t blks_lun_l, blks_lun_h, n_of_luns;
-        uint32_t blockperlun, id;
-
-        denali_write32(DEVICE_RESET__BANK0, denali->flash_reg + DEVICE_RESET);
-
-        while (!((ioread32(denali->flash_reg + INTR_STATUS0) &
-                INTR_STATUS0__RST_COMP) |
-                (ioread32(denali->flash_reg + INTR_STATUS0) &
-                INTR_STATUS0__TIME_OUT)))
-                ;
-
-        if (ioread32(denali->flash_reg + INTR_STATUS0) & INTR_STATUS0__RST_COMP) {
-                denali_write32(DEVICE_RESET__BANK1, denali->flash_reg + DEVICE_RESET);
-                while (!((ioread32(denali->flash_reg + INTR_STATUS1) &
-                        INTR_STATUS1__RST_COMP) |
-                        (ioread32(denali->flash_reg + INTR_STATUS1) &
-                        INTR_STATUS1__TIME_OUT)))
-                        ;
-
-                if (ioread32(denali->flash_reg + INTR_STATUS1) &
-                        INTR_STATUS1__RST_COMP) {
-                        denali_write32(DEVICE_RESET__BANK2,
-                                denali->flash_reg + DEVICE_RESET);
-                        while (!((ioread32(denali->flash_reg + INTR_STATUS2) &
-                                INTR_STATUS2__RST_COMP) |
-                                (ioread32(denali->flash_reg + INTR_STATUS2) &
-                                INTR_STATUS2__TIME_OUT)))
-                                ;
-
-                        if (ioread32(denali->flash_reg + INTR_STATUS2) &
-                                INTR_STATUS2__RST_COMP) {
-                                denali_write32(DEVICE_RESET__BANK3,
-                                        denali->flash_reg + DEVICE_RESET);
-                                while (!((ioread32(denali->flash_reg + INTR_STATUS3) &
-                                        INTR_STATUS3__RST_COMP) |
-                                        (ioread32(denali->flash_reg + INTR_STATUS3) &
-                                        INTR_STATUS3__TIME_OUT)))
-                                        ;
-                        } else {
-                                printk(KERN_ERR "Getting a time out for bank 2!\n");
-                        }
-                } else {
-                        printk(KERN_ERR "Getting a time out for bank 1!\n");
-                }
-        }
-
-        denali_write32(INTR_STATUS0__TIME_OUT, denali->flash_reg + INTR_STATUS0);
-        denali_write32(INTR_STATUS1__TIME_OUT, denali->flash_reg + INTR_STATUS1);
-        denali_write32(INTR_STATUS2__TIME_OUT, denali->flash_reg + INTR_STATUS2);
-        denali_write32(INTR_STATUS3__TIME_OUT, denali->flash_reg + INTR_STATUS3);
-
-        denali->dev_info.wONFIDevFeatures =
-                ioread32(denali->flash_reg + ONFI_DEVICE_FEATURES);
-        denali->dev_info.wONFIOptCommands =
-                ioread32(denali->flash_reg + ONFI_OPTIONAL_COMMANDS);
-        denali->dev_info.wONFITimingMode =
-                ioread32(denali->flash_reg + ONFI_TIMING_MODE);
-        denali->dev_info.wONFIPgmCacheTimingMode =
-                ioread32(denali->flash_reg + ONFI_PGM_CACHE_TIMING_MODE);
-
-        n_of_luns = ioread32(denali->flash_reg + ONFI_DEVICE_NO_OF_LUNS) &
-                ONFI_DEVICE_NO_OF_LUNS__NO_OF_LUNS;
-        blks_lun_l = ioread32(denali->flash_reg + ONFI_DEVICE_NO_OF_BLOCKS_PER_LUN_L);
-        blks_lun_h = ioread32(denali->flash_reg + ONFI_DEVICE_NO_OF_BLOCKS_PER_LUN_U);
-
-        blockperlun = (blks_lun_h << 16) | blks_lun_l;
-
-        denali->dev_info.wTotalBlocks = n_of_luns * blockperlun;
-
+        /* we needn't to do a reset here because driver has already
+         * reset all the banks before
+         * */
         if (!(ioread32(denali->flash_reg + ONFI_TIMING_MODE) &
                 ONFI_TIMING_MODE__VALUE))
                 return FAIL;
 
         for (i = 5; i > 0; i--) {
-                if (ioread32(denali->flash_reg + ONFI_TIMING_MODE) & (0x01 << i))
+                if (ioread32(denali->flash_reg + ONFI_TIMING_MODE) &
+                        (0x01 << i))
                         break;
         }
 
-        NAND_ONFi_Timing_Mode(denali, i);
-
-        index_addr(denali, MODE_11 | 0, 0x90);
-        index_addr(denali, MODE_11 | 1, 0);
-
-        for (i = 0; i < 3; i++)
-                index_addr_read_data(denali, MODE_11 | 2, &id);
-
-        nand_dbg_print(NAND_DBG_DEBUG, "3rd ID: 0x%x\n", id);
-
-        denali->dev_info.MLCDevice = id & 0x0C;
+        nand_onfi_timing_set(denali, i);
 
         /* By now, all the ONFI devices we know support the page cache */
         /* rw feature. So here we enable the pipeline_rw_ahead feature */
@@ -486,25 +382,10 @@ static uint16_t get_onfi_nand_para(struct denali_nand_info *denali)
         return PASS;
 }
 
-static void get_samsung_nand_para(struct denali_nand_info *denali)
+static void get_samsung_nand_para(struct denali_nand_info *denali,
+                                                        uint8_t device_id)
 {
-        uint8_t no_of_planes;
-        uint32_t blk_size;
-        uint64_t plane_size, capacity;
-        uint32_t id_bytes[5];
-        int i;
-
-        index_addr(denali, (uint32_t)(MODE_11 | 0), 0x90);
-        index_addr(denali, (uint32_t)(MODE_11 | 1), 0);
-        for (i = 0; i < 5; i++)
-                index_addr_read_data(denali, (uint32_t)(MODE_11 | 2), &id_bytes[i]);
-
-        nand_dbg_print(NAND_DBG_DEBUG,
-                "ID bytes: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x\n",
-                id_bytes[0], id_bytes[1], id_bytes[2],
-                id_bytes[3], id_bytes[4]);
-
-        if ((id_bytes[1] & 0xff) == 0xd3) { /* Samsung K9WAG08U1A */
+        if (device_id == 0xd3) { /* Samsung K9WAG08U1A */
                 /* Set timing register values according to datasheet */
                 denali_write32(5, denali->flash_reg + ACC_CLKS);
                 denali_write32(20, denali->flash_reg + RE_2_WE);
@@ -514,19 +395,10 @@ static void get_samsung_nand_para(struct denali_nand_info *denali)
                 denali_write32(2, denali->flash_reg + RDWR_EN_HI_CNT);
                 denali_write32(2, denali->flash_reg + CS_SETUP_CNT);
         }
-
-        no_of_planes = 1 << ((id_bytes[4] & 0x0c) >> 2);
-        plane_size  = (uint64_t)64 << ((id_bytes[4] & 0x70) >> 4);
-        blk_size = 64 << ((ioread32(denali->flash_reg + DEVICE_PARAM_1) & 0x30) >> 4);
-        capacity = (uint64_t)128 * plane_size * no_of_planes;
-
-        do_div(capacity, blk_size);
-        denali->dev_info.wTotalBlocks = capacity;
 }
 
 static void get_toshiba_nand_para(struct denali_nand_info *denali)
 {
-        void __iomem *scratch_reg;
         uint32_t tmp;
 
         /* Workaround to fix a controller bug which reports a wrong */
@@ -536,81 +408,52 @@ static void get_toshiba_nand_para(struct denali_nand_info *denali)
                 denali_write32(216, denali->flash_reg + DEVICE_SPARE_AREA_SIZE);
                 tmp = ioread32(denali->flash_reg + DEVICES_CONNECTED) *
                         ioread32(denali->flash_reg + DEVICE_SPARE_AREA_SIZE);
-                denali_write32(tmp, denali->flash_reg + LOGICAL_PAGE_SPARE_SIZE);
+                denali_write32(tmp,
+                                denali->flash_reg + LOGICAL_PAGE_SPARE_SIZE);
 #if SUPPORT_15BITECC
                 denali_write32(15, denali->flash_reg + ECC_CORRECTION);
 #elif SUPPORT_8BITECC
                 denali_write32(8, denali->flash_reg + ECC_CORRECTION);
 #endif
         }
-
-        /* As Toshiba NAND can not provide it's block number, */
-        /* so here we need user to provide the correct block */
-        /* number in a scratch register before the Linux NAND */
-        /* driver is loaded. If no valid value found in the scratch */
-        /* register, then we use default block number value */
-        scratch_reg = ioremap_nocache(SCRATCH_REG_ADDR, SCRATCH_REG_SIZE);
-        if (!scratch_reg) {
-                printk(KERN_ERR "Spectra: ioremap failed in %s, Line %d",
-                        __FILE__, __LINE__);
-                denali->dev_info.wTotalBlocks = GLOB_HWCTL_DEFAULT_BLKS;
-        } else {
-                nand_dbg_print(NAND_DBG_WARN,
-                        "Spectra: ioremap reg address: 0x%p\n", scratch_reg);
-                denali->dev_info.wTotalBlocks = 1 << ioread8(scratch_reg);
-                if (denali->dev_info.wTotalBlocks < 512)
-                        denali->dev_info.wTotalBlocks = GLOB_HWCTL_DEFAULT_BLKS;
-                iounmap(scratch_reg);
-        }
 }
 
-static void get_hynix_nand_para(struct denali_nand_info *denali)
+static void get_hynix_nand_para(struct denali_nand_info *denali,
+                                                        uint8_t device_id)
 {
-        void __iomem *scratch_reg;
         uint32_t main_size, spare_size;
 
-        switch (denali->dev_info.wDeviceID) {
+        switch (device_id) {
         case 0xD5: /* Hynix H27UAG8T2A, H27UBG8U5A or H27UCG8VFA */
         case 0xD7: /* Hynix H27UDG8VEM, H27UCG8UDM or H27UCG8V5A */
                 denali_write32(128, denali->flash_reg + PAGES_PER_BLOCK);
                 denali_write32(4096, denali->flash_reg + DEVICE_MAIN_AREA_SIZE);
                 denali_write32(224, denali->flash_reg + DEVICE_SPARE_AREA_SIZE);
-                main_size = 4096 * ioread32(denali->flash_reg + DEVICES_CONNECTED);
-                spare_size = 224 * ioread32(denali->flash_reg + DEVICES_CONNECTED);
-                denali_write32(main_size, denali->flash_reg + LOGICAL_PAGE_DATA_SIZE);
-                denali_write32(spare_size, denali->flash_reg + LOGICAL_PAGE_SPARE_SIZE);
+                main_size = 4096 *
+                        ioread32(denali->flash_reg + DEVICES_CONNECTED);
+                spare_size = 224 *
+                        ioread32(denali->flash_reg + DEVICES_CONNECTED);
+                denali_write32(main_size,
+                                denali->flash_reg + LOGICAL_PAGE_DATA_SIZE);
+                denali_write32(spare_size,
+                                denali->flash_reg + LOGICAL_PAGE_SPARE_SIZE);
                 denali_write32(0, denali->flash_reg + DEVICE_WIDTH);
 #if SUPPORT_15BITECC
                 denali_write32(15, denali->flash_reg + ECC_CORRECTION);
 #elif SUPPORT_8BITECC
                 denali_write32(8, denali->flash_reg + ECC_CORRECTION);
 #endif
-                denali->dev_info.MLCDevice  = 1;
                 break;
         default:
                 nand_dbg_print(NAND_DBG_WARN,
                         "Spectra: Unknown Hynix NAND (Device ID: 0x%x)."
                         "Will use default parameter values instead.\n",
-                        denali->dev_info.wDeviceID);
-        }
-
-        scratch_reg = ioremap_nocache(SCRATCH_REG_ADDR, SCRATCH_REG_SIZE);
-        if (!scratch_reg) {
-                printk(KERN_ERR "Spectra: ioremap failed in %s, Line %d",
-                        __FILE__, __LINE__);
-                denali->dev_info.wTotalBlocks = GLOB_HWCTL_DEFAULT_BLKS;
-        } else {
-                nand_dbg_print(NAND_DBG_WARN,
-                        "Spectra: ioremap reg address: 0x%p\n", scratch_reg);
-                denali->dev_info.wTotalBlocks = 1 << ioread8(scratch_reg);
-                if (denali->dev_info.wTotalBlocks < 512)
-                        denali->dev_info.wTotalBlocks = GLOB_HWCTL_DEFAULT_BLKS;
-                iounmap(scratch_reg);
+                        device_id);
         }
 }
 
 /* determines how many NAND chips are connected to the controller. Note for
-   Intel CE4100 devices we don't support more than one device. 
+   Intel CE4100 devices we don't support more than one device.
  */
 static void find_valid_banks(struct denali_nand_info *denali)
 {
@@ -621,7 +464,8 @@ static void find_valid_banks(struct denali_nand_info *denali)
         for (i = 0; i < LLD_MAX_FLASH_BANKS; i++) {
                 index_addr(denali, (uint32_t)(MODE_11 | (i << 24) | 0), 0x90);
                 index_addr(denali, (uint32_t)(MODE_11 | (i << 24) | 1), 0);
-                index_addr_read_data(denali, (uint32_t)(MODE_11 | (i << 24) | 2), &id[i]);
+                index_addr_read_data(denali,
+                                (uint32_t)(MODE_11 | (i << 24) | 2), &id[i]);
 
                 nand_dbg_print(NAND_DBG_DEBUG,
                         "Return 1st ID for bank[%d]: %x\n", i, id[i]);
@@ -637,14 +481,12 @@ static void find_valid_banks(struct denali_nand_info *denali)
                 }
         }
 
-        if (denali->platform == INTEL_CE4100)
-        {
+        if (denali->platform == INTEL_CE4100) {
                 /* Platform limitations of the CE4100 device limit
                  * users to a single chip solution for NAND.
-                 * Multichip support is not enabled. 
-                 */ 
-                if (denali->total_used_banks != 1)
-                {
+                 * Multichip support is not enabled.
+                 */
+                if (denali->total_used_banks != 1) {
                         printk(KERN_ERR "Sorry, Intel CE4100 only supports "
                                         "a single NAND device.\n");
                         BUG();
@@ -656,150 +498,60 @@ static void find_valid_banks(struct denali_nand_info *denali)
 
 static void detect_partition_feature(struct denali_nand_info *denali)
 {
+        /* For MRST platform, denali->fwblks represent the
+         * number of blocks firmware is taken,
+         * FW is in protect partition and MTD driver has no
+         * permission to access it. So let driver know how many
+         * blocks it can't touch.
+         * */
         if (ioread32(denali->flash_reg + FEATURES) & FEATURES__PARTITION) {
                 if ((ioread32(denali->flash_reg + PERM_SRC_ID_1) &
                         PERM_SRC_ID_1__SRCID) == SPECTRA_PARTITION_ID) {
-                        denali->dev_info.wSpectraStartBlock =
+                        denali->fwblks =
                             ((ioread32(denali->flash_reg + MIN_MAX_BANK_1) &
                               MIN_MAX_BANK_1__MIN_VALUE) *
-                             denali->dev_info.wTotalBlocks)
+                             denali->blksperchip)
                             +
                             (ioread32(denali->flash_reg + MIN_BLK_ADDR_1) &
                             MIN_BLK_ADDR_1__VALUE);
-
-                        denali->dev_info.wSpectraEndBlock =
-                            (((ioread32(denali->flash_reg + MIN_MAX_BANK_1) &
-                               MIN_MAX_BANK_1__MAX_VALUE) >> 2) *
-                             denali->dev_info.wTotalBlocks)
-                            +
-                            (ioread32(denali->flash_reg + MAX_BLK_ADDR_1) &
-                            MAX_BLK_ADDR_1__VALUE);
-
-                        denali->dev_info.wTotalBlocks *= denali->total_used_banks;
-
-                        if (denali->dev_info.wSpectraEndBlock >=
-                            denali->dev_info.wTotalBlocks) {
-                                denali->dev_info.wSpectraEndBlock =
-                                    denali->dev_info.wTotalBlocks - 1;
-                        }
-
-                        denali->dev_info.wDataBlockNum =
-                                denali->dev_info.wSpectraEndBlock -
-                                denali->dev_info.wSpectraStartBlock + 1;
-                } else {
-                        denali->dev_info.wTotalBlocks *= denali->total_used_banks;
-                        denali->dev_info.wSpectraStartBlock = SPECTRA_START_BLOCK;
-                        denali->dev_info.wSpectraEndBlock =
-                                denali->dev_info.wTotalBlocks - 1;
-                        denali->dev_info.wDataBlockNum =
-                                denali->dev_info.wSpectraEndBlock -
-                                denali->dev_info.wSpectraStartBlock + 1;
-                }
-        } else {
-                denali->dev_info.wTotalBlocks *= denali->total_used_banks;
-                denali->dev_info.wSpectraStartBlock = SPECTRA_START_BLOCK;
-                denali->dev_info.wSpectraEndBlock = denali->dev_info.wTotalBlocks - 1;
-                denali->dev_info.wDataBlockNum =
-                        denali->dev_info.wSpectraEndBlock -
-                        denali->dev_info.wSpectraStartBlock + 1;
-        }
+                } else
+                        denali->fwblks = SPECTRA_START_BLOCK;
+        } else
+                denali->fwblks = SPECTRA_START_BLOCK;
 }
 
-static void dump_device_info(struct denali_nand_info *denali)
-{
-        nand_dbg_print(NAND_DBG_DEBUG, "denali->dev_info:\n");
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceMaker: 0x%x\n",
-                denali->dev_info.wDeviceMaker);
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceID: 0x%x\n",
-                denali->dev_info.wDeviceID);
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceType: 0x%x\n",
-                denali->dev_info.wDeviceType);
-        nand_dbg_print(NAND_DBG_DEBUG, "SpectraStartBlock: %d\n",
-                denali->dev_info.wSpectraStartBlock);
-        nand_dbg_print(NAND_DBG_DEBUG, "SpectraEndBlock: %d\n",
-                denali->dev_info.wSpectraEndBlock);
-        nand_dbg_print(NAND_DBG_DEBUG, "TotalBlocks: %d\n",
-                denali->dev_info.wTotalBlocks);
-        nand_dbg_print(NAND_DBG_DEBUG, "PagesPerBlock: %d\n",
-                denali->dev_info.wPagesPerBlock);
-        nand_dbg_print(NAND_DBG_DEBUG, "PageSize: %d\n",
-                denali->dev_info.wPageSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "PageDataSize: %d\n",
-                denali->dev_info.wPageDataSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "PageSpareSize: %d\n",
-                denali->dev_info.wPageSpareSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "NumPageSpareFlag: %d\n",
-                denali->dev_info.wNumPageSpareFlag);
-        nand_dbg_print(NAND_DBG_DEBUG, "ECCBytesPerSector: %d\n",
-                denali->dev_info.wECCBytesPerSector);
-        nand_dbg_print(NAND_DBG_DEBUG, "BlockSize: %d\n",
-                denali->dev_info.wBlockSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "BlockDataSize: %d\n",
-                denali->dev_info.wBlockDataSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "DataBlockNum: %d\n",
-                denali->dev_info.wDataBlockNum);
-        nand_dbg_print(NAND_DBG_DEBUG, "PlaneNum: %d\n",
-                denali->dev_info.bPlaneNum);
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceMainAreaSize: %d\n",
-                denali->dev_info.wDeviceMainAreaSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceSpareAreaSize: %d\n",
-                denali->dev_info.wDeviceSpareAreaSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "DevicesConnected: %d\n",
-                denali->dev_info.wDevicesConnected);
-        nand_dbg_print(NAND_DBG_DEBUG, "DeviceWidth: %d\n",
-                denali->dev_info.wDeviceWidth);
-        nand_dbg_print(NAND_DBG_DEBUG, "HWRevision: 0x%x\n",
-                denali->dev_info.wHWRevision);
-        nand_dbg_print(NAND_DBG_DEBUG, "HWFeatures: 0x%x\n",
-                denali->dev_info.wHWFeatures);
-        nand_dbg_print(NAND_DBG_DEBUG, "ONFIDevFeatures: 0x%x\n",
-                denali->dev_info.wONFIDevFeatures);
-        nand_dbg_print(NAND_DBG_DEBUG, "ONFIOptCommands: 0x%x\n",
-                denali->dev_info.wONFIOptCommands);
-        nand_dbg_print(NAND_DBG_DEBUG, "ONFITimingMode: 0x%x\n",
-                denali->dev_info.wONFITimingMode);
-        nand_dbg_print(NAND_DBG_DEBUG, "ONFIPgmCacheTimingMode: 0x%x\n",
-                denali->dev_info.wONFIPgmCacheTimingMode);
-        nand_dbg_print(NAND_DBG_DEBUG, "MLCDevice: %s\n",
-                denali->dev_info.MLCDevice ? "Yes" : "No");
-        nand_dbg_print(NAND_DBG_DEBUG, "SpareSkipBytes: %d\n",
-                denali->dev_info.wSpareSkipBytes);
-        nand_dbg_print(NAND_DBG_DEBUG, "BitsInPageNumber: %d\n",
-                denali->dev_info.nBitsInPageNumber);
-        nand_dbg_print(NAND_DBG_DEBUG, "BitsInPageDataSize: %d\n",
-                denali->dev_info.nBitsInPageDataSize);
-        nand_dbg_print(NAND_DBG_DEBUG, "BitsInBlockDataSize: %d\n",
-                denali->dev_info.nBitsInBlockDataSize);
-}
-
-static uint16_t NAND_Read_Device_ID(struct denali_nand_info *denali)
+static uint16_t denali_nand_timing_set(struct denali_nand_info *denali)
 {
         uint16_t status = PASS;
-        uint8_t no_of_planes;
+        uint32_t id_bytes[5], addr;
+        uint8_t i, maf_id, device_id;
 
         nand_dbg_print(NAND_DBG_TRACE, "%s, Line %d, Function: %s\n",
                        __FILE__, __LINE__, __func__);
 
-        denali->dev_info.wDeviceMaker = ioread32(denali->flash_reg + MANUFACTURER_ID);
-        denali->dev_info.wDeviceID = ioread32(denali->flash_reg + DEVICE_ID);
-        denali->dev_info.bDeviceParam0 = ioread32(denali->flash_reg + DEVICE_PARAM_0);
-        denali->dev_info.bDeviceParam1 = ioread32(denali->flash_reg + DEVICE_PARAM_1);
-        denali->dev_info.bDeviceParam2 = ioread32(denali->flash_reg + DEVICE_PARAM_2);
-
-        denali->dev_info.MLCDevice = ioread32(denali->flash_reg + DEVICE_PARAM_0) & 0x0c;
+        /* Use read id method to get device ID and other
+         * params. For some NAND chips, controller can't
+         * report the correct device ID by reading from
+         * DEVICE_ID register
+         * */
+        addr = (uint32_t)MODE_11 | BANK(denali->flash_bank);
+        index_addr(denali, (uint32_t)addr | 0, 0x90);
+        index_addr(denali, (uint32_t)addr | 1, 0);
+        for (i = 0; i < 5; i++)
+                index_addr_read_data(denali, addr | 2, &id_bytes[i]);
+        maf_id = id_bytes[0];
+        device_id = id_bytes[1];
 
         if (ioread32(denali->flash_reg + ONFI_DEVICE_NO_OF_LUNS) &
                 ONFI_DEVICE_NO_OF_LUNS__ONFI_DEVICE) { /* ONFI 1.0 NAND */
                 if (FAIL == get_onfi_nand_para(denali))
                         return FAIL;
-        } else if (denali->dev_info.wDeviceMaker == 0xEC) { /* Samsung NAND */
-                get_samsung_nand_para(denali);
-        } else if (denali->dev_info.wDeviceMaker == 0x98) { /* Toshiba NAND */
+        } else if (maf_id == 0xEC) { /* Samsung NAND */
+                get_samsung_nand_para(denali, device_id);
+        } else if (maf_id == 0x98) { /* Toshiba NAND */
                 get_toshiba_nand_para(denali);
-        } else if (denali->dev_info.wDeviceMaker == 0xAD) { /* Hynix NAND */
-                get_hynix_nand_para(denali);
-        } else {
-                denali->dev_info.wTotalBlocks = GLOB_HWCTL_DEFAULT_BLKS;
+        } else if (maf_id == 0xAD) { /* Hynix NAND */
+                get_hynix_nand_para(denali, device_id);
         }
 
         nand_dbg_print(NAND_DBG_DEBUG, "Dump timing register values:"
@@ -814,88 +566,20 @@ static uint16_t NAND_Read_Device_ID(struct denali_nand_info *denali)
                         ioread32(denali->flash_reg + RDWR_EN_HI_CNT),
                         ioread32(denali->flash_reg + CS_SETUP_CNT));
 
-        denali->dev_info.wHWRevision = ioread32(denali->flash_reg + REVISION);
-        denali->dev_info.wHWFeatures = ioread32(denali->flash_reg + FEATURES);
-
-        denali->dev_info.wDeviceMainAreaSize =
-                ioread32(denali->flash_reg + DEVICE_MAIN_AREA_SIZE);
-        denali->dev_info.wDeviceSpareAreaSize =
-                ioread32(denali->flash_reg + DEVICE_SPARE_AREA_SIZE);
-
-        denali->dev_info.wPageDataSize =
-                ioread32(denali->flash_reg + LOGICAL_PAGE_DATA_SIZE);
-
-        /* Note: When using the Micon 4K NAND device, the controller will report
-         * Page Spare Size as 216 bytes. But Micron's Spec say it's 218 bytes.
-         * And if force set it to 218 bytes, the controller can not work
-         * correctly. So just let it be. But keep in mind that this bug may
-         * cause
-         * other problems in future.       - Yunpeng  2008-10-10
-         */
-        denali->dev_info.wPageSpareSize =
-                ioread32(denali->flash_reg + LOGICAL_PAGE_SPARE_SIZE);
-
-        denali->dev_info.wPagesPerBlock = ioread32(denali->flash_reg + PAGES_PER_BLOCK);
-
-        denali->dev_info.wPageSize =
-            denali->dev_info.wPageDataSize + denali->dev_info.wPageSpareSize;
-        denali->dev_info.wBlockSize =
-            denali->dev_info.wPageSize * denali->dev_info.wPagesPerBlock;
-        denali->dev_info.wBlockDataSize =
-            denali->dev_info.wPagesPerBlock * denali->dev_info.wPageDataSize;
-
-        denali->dev_info.wDeviceWidth = ioread32(denali->flash_reg + DEVICE_WIDTH);
-        denali->dev_info.wDeviceType =
-                ((ioread32(denali->flash_reg + DEVICE_WIDTH) > 0) ? 16 : 8);
-
-        denali->dev_info.wDevicesConnected = ioread32(denali->flash_reg + DEVICES_CONNECTED);
-
-        denali->dev_info.wSpareSkipBytes =
-                ioread32(denali->flash_reg + SPARE_AREA_SKIP_BYTES) *
-                denali->dev_info.wDevicesConnected;
-
-        denali->dev_info.nBitsInPageNumber =
-                ilog2(denali->dev_info.wPagesPerBlock);
-        denali->dev_info.nBitsInPageDataSize =
-                ilog2(denali->dev_info.wPageDataSize);
-        denali->dev_info.nBitsInBlockDataSize =
-                ilog2(denali->dev_info.wBlockDataSize);
-
-        set_ecc_config(denali);
-
-        no_of_planes = ioread32(denali->flash_reg + NUMBER_OF_PLANES) &
-                NUMBER_OF_PLANES__VALUE;
-
-        switch (no_of_planes) {
-        case 0:
-        case 1:
-        case 3:
-        case 7:
-                denali->dev_info.bPlaneNum = no_of_planes + 1;
-                break;
-        default:
-                status = FAIL;
-                break;
-        }
-
         find_valid_banks(denali);
 
         detect_partition_feature(denali);
 
-        dump_device_info(denali);
-
         /* If the user specified to override the default timings
-         * with a specific ONFI mode, we apply those changes here. 
+         * with a specific ONFI mode, we apply those changes here.
          */
         if (onfi_timing_mode != NAND_DEFAULT_TIMINGS)
-        {
-                NAND_ONFi_Timing_Mode(denali, onfi_timing_mode);
-        }
+                nand_onfi_timing_set(denali, onfi_timing_mode);
 
         return status;
 }
 
-static void NAND_LLD_Enable_Disable_Interrupts(struct denali_nand_info *denali,
+static void denali_set_intr_modes(struct denali_nand_info *denali,
                                         uint16_t INT_ENABLE)
 {
         nand_dbg_print(NAND_DBG_TRACE, "%s, Line %d, Function: %s\n",
@@ -912,7 +596,7 @@ static void NAND_LLD_Enable_Disable_Interrupts(struct denali_nand_info *denali,
  */
 static inline bool is_flash_bank_valid(int flash_bank)
 {
-        return (flash_bank >= 0 && flash_bank < 4); 
+        return (flash_bank >= 0 && flash_bank < 4);
 }
 
 static void denali_irq_init(struct denali_nand_info *denali)
@@ -920,7 +604,7 @@ static void denali_irq_init(struct denali_nand_info *denali)
         uint32_t int_mask = 0;
 
         /* Disable global interrupts */
-        NAND_LLD_Enable_Disable_Interrupts(denali, false);
+        denali_set_intr_modes(denali, false);
 
         int_mask = DENALI_IRQ_ALL;
 
@@ -935,11 +619,12 @@ static void denali_irq_init(struct denali_nand_info *denali)
 
 static void denali_irq_cleanup(int irqnum, struct denali_nand_info *denali)
 {
-        NAND_LLD_Enable_Disable_Interrupts(denali, false);
+        denali_set_intr_modes(denali, false);
         free_irq(irqnum, denali);
 }
 
-static void denali_irq_enable(struct denali_nand_info *denali, uint32_t int_mask)
+static void denali_irq_enable(struct denali_nand_info *denali,
+                                                        uint32_t int_mask)
 {
         denali_write32(int_mask, denali->flash_reg + INTR_EN0);
         denali_write32(int_mask, denali->flash_reg + INTR_EN1);
@@ -948,15 +633,16 @@ static void denali_irq_enable(struct denali_nand_info *denali, uint32_t int_mask
 }
 
 /* This function only returns when an interrupt that this driver cares about
- * occurs. This is to reduce the overhead of servicing interrupts 
+ * occurs. This is to reduce the overhead of servicing interrupts
  */
 static inline uint32_t denali_irq_detected(struct denali_nand_info *denali)
 {
-        return (read_interrupt_status(denali) & DENALI_IRQ_ALL);
+        return read_interrupt_status(denali) & DENALI_IRQ_ALL;
 }
 
 /* Interrupts are cleared by writing a 1 to the appropriate status bit */
-static inline void clear_interrupt(struct denali_nand_info *denali, uint32_t irq_mask)
+static inline void clear_interrupt(struct denali_nand_info *denali,
+                                                        uint32_t irq_mask)
 {
         uint32_t intr_status_reg = 0;
 
@@ -995,17 +681,15 @@ static void print_irq_log(struct denali_nand_info *denali)
 {
         int i = 0;
 
-        printk("ISR debug log index = %X\n", denali->idx);
+        printk(KERN_INFO "ISR debug log index = %X\n", denali->idx);
         for (i = 0; i < 32; i++)
-        {
-                printk("%08X: %08X\n", i, denali->irq_debug_array[i]);
-        }
+                printk(KERN_INFO "%08X: %08X\n", i, denali->irq_debug_array[i]);
 }
 #endif
 
-/* This is the interrupt service routine. It handles all interrupts 
- * sent to this device. Note that on CE4100, this is a shared 
- * interrupt. 
+/* This is the interrupt service routine. It handles all interrupts
+ * sent to this device. Note that on CE4100, this is a shared
+ * interrupt.
  */
 static irqreturn_t denali_isr(int irq, void *dev_id)
 {
@@ -1015,20 +699,20 @@ static irqreturn_t denali_isr(int irq, void *dev_id)
 
         spin_lock(&denali->irq_lock);
 
-        /* check to see if a valid NAND chip has 
-         * been selected. 
+        /* check to see if a valid NAND chip has
+         * been selected.
          */
-        if (is_flash_bank_valid(denali->flash_bank))
-        {
-                /* check to see if controller generated 
+        if (is_flash_bank_valid(denali->flash_bank)) {
+                /* check to see if controller generated
                  * the interrupt, since this is a shared interrupt */
-                if ((irq_status = denali_irq_detected(denali)) != 0)
-                {
+                irq_status = denali_irq_detected(denali);
+                if (irq_status != 0) {
 #if DEBUG_DENALI
-                        denali->irq_debug_array[denali->idx++] = 0x10000000 | irq_status;
+                        denali->irq_debug_array[denali->idx++] =
+                                0x10000000 | irq_status;
                         denali->idx %= 32;
 
-                        printk("IRQ status = 0x%04x\n", irq_status);
+                        printk(KERN_INFO "IRQ status = 0x%04x\n", irq_status);
 #endif
                         /* handle interrupt */
                         /* first acknowledge it */
@@ -1054,61 +738,62 @@ static uint32_t wait_for_irq(struct denali_nand_info *denali, uint32_t irq_mask)
         bool retry = false;
         unsigned long timeout = msecs_to_jiffies(1000);
 
-        do
-        {
+        do {
 #if DEBUG_DENALI
-                printk("waiting for 0x%x\n", irq_mask);
+                printk(KERN_INFO "waiting for 0x%x\n", irq_mask);
 #endif
-                comp_res = wait_for_completion_timeout(&denali->complete, timeout);
+                comp_res =
+                        wait_for_completion_timeout(&denali->complete, timeout);
                 spin_lock_irq(&denali->irq_lock);
                 intr_status = denali->irq_status;
 
 #if DEBUG_DENALI
-                denali->irq_debug_array[denali->idx++] = 0x20000000 | (irq_mask << 16) | intr_status;
+                denali->irq_debug_array[denali->idx++] =
+                        0x20000000 | (irq_mask << 16) | intr_status;
                 denali->idx %= 32;
 #endif
 
-                if (intr_status & irq_mask)
-                {
+                if (intr_status & irq_mask) {
                         denali->irq_status &= ~irq_mask;
                         spin_unlock_irq(&denali->irq_lock);
 #if DEBUG_DENALI
-                        if (retry) printk("status on retry = 0x%x\n", intr_status);
+                        if (retry)
+                                printk(KERN_INFO "status on retry = 0x%x\n",
+                                                intr_status);
 #endif
                         /* our interrupt was detected */
                         break;
-                }
-                else 
-                {
-                        /* these are not the interrupts you are looking for - 
-                           need to wait again */
+                } else {
+                        /* these are not the interrupts you are looking for -
+                         * need to wait again */
                         spin_unlock_irq(&denali->irq_lock);
 #if DEBUG_DENALI
                         print_irq_log(denali);
-                        printk("received irq nobody cared: irq_status = 0x%x,"
-                                " irq_mask = 0x%x, timeout = %ld\n", intr_status, irq_mask, comp_res);
+                        printk(KERN_INFO "received irq nobody cared:"
+                                        " irq_status = 0x%x, irq_mask = 0x%x,"
+                                        " timeout = %ld\n", intr_status,
+                                        irq_mask, comp_res);
 #endif
                         retry = true;
                 }
         } while (comp_res != 0);
 
-        if (comp_res == 0)
-        {
+        if (comp_res == 0) {
                 /* timeout */
-                printk(KERN_ERR "timeout occurred, status = 0x%x, mask = 0x%x\n", 
-                                intr_status, irq_mask);
+                printk(KERN_ERR "timeout occurred, status = 0x%x, mask = 0x%x\n",
+                                intr_status, irq_mask);
 
                 intr_status = 0;
         }
         return intr_status;
 }
 
-/* This helper function setups the registers for ECC and whether or not 
+/* This helper function setups the registers for ECC and whether or not
    the spare area will be transfered. */
-static void setup_ecc_for_xfer(struct denali_nand_info *denali, bool ecc_en, 
+static void setup_ecc_for_xfer(struct denali_nand_info *denali, bool ecc_en,
                                 bool transfer_spare)
 {
-        int ecc_en_flag = 0, transfer_spare_flag = 0; 
+        int ecc_en_flag = 0, transfer_spare_flag = 0;
 
         /* set ECC, transfer spare bits if needed */
         ecc_en_flag = ecc_en ? ECC_ENABLE__FLAG : 0;
@@ -1116,85 +801,85 @@ static void setup_ecc_for_xfer(struct denali_nand_info *denali, bool ecc_en,
 
         /* Enable spare area/ECC per user's request. */
         denali_write32(ecc_en_flag, denali->flash_reg + ECC_ENABLE);
-        denali_write32(transfer_spare_flag, denali->flash_reg + TRANSFER_SPARE_REG);
+        denali_write32(transfer_spare_flag,
+                        denali->flash_reg + TRANSFER_SPARE_REG);
 }
 
-/* sends a pipeline command operation to the controller. See the Denali NAND 
-   controller's user guide for more information (section 4.2.3.6). 
+/* sends a pipeline command operation to the controller. See the Denali NAND
+   controller's user guide for more information (section 4.2.3.6).
  */
-static int denali_send_pipeline_cmd(struct denali_nand_info *denali, bool ecc_en, 
-                                        bool transfer_spare, int access_type, 
-                                        int op)
+static int denali_send_pipeline_cmd(struct denali_nand_info *denali,
+                                                        bool ecc_en,
+                                                        bool transfer_spare,
+                                                        int access_type,
+                                                        int op)
 {
         int status = PASS;
-        uint32_t addr = 0x0, cmd = 0x0, page_count = 1, irq_status = 0, 
+        uint32_t addr = 0x0, cmd = 0x0, page_count = 1, irq_status = 0,
                  irq_mask = 0;
 
-        if (op == DENALI_READ) irq_mask = INTR_STATUS0__LOAD_COMP;
-        else if (op == DENALI_WRITE) irq_mask = 0;
-        else BUG();
+        if (op == DENALI_READ)
+                irq_mask = INTR_STATUS0__LOAD_COMP;
+        else if (op == DENALI_WRITE)
+                irq_mask = 0;
+        else
+                BUG();
 
         setup_ecc_for_xfer(denali, ecc_en, transfer_spare);
 
 #if DEBUG_DENALI
         spin_lock_irq(&denali->irq_lock);
-        denali->irq_debug_array[denali->idx++] = 0x40000000 | ioread32(denali->flash_reg + ECC_ENABLE) | (access_type << 4);
+        denali->irq_debug_array[denali->idx++] =
+                0x40000000 | ioread32(denali->flash_reg + ECC_ENABLE) |
+                (access_type << 4);
         denali->idx %= 32;
         spin_unlock_irq(&denali->irq_lock);
 #endif
 
 
         /* clear interrupts */
-        clear_interrupts(denali);       
+        clear_interrupts(denali);
 
         addr = BANK(denali->flash_bank) | denali->page;
 
-        if (op == DENALI_WRITE && access_type != SPARE_ACCESS)
-        {
-                cmd = MODE_01 | addr; 
+        if (op == DENALI_WRITE && access_type != SPARE_ACCESS) {
+                cmd = MODE_01 | addr;
                 denali_write32(cmd, denali->flash_mem);
-        }
-        else if (op == DENALI_WRITE && access_type == SPARE_ACCESS)
-        {
+        } else if (op == DENALI_WRITE && access_type == SPARE_ACCESS) {
                 /* read spare area */
-                cmd = MODE_10 | addr; 
+                cmd = MODE_10 | addr;
                 index_addr(denali, (uint32_t)cmd, access_type);
 
-                cmd = MODE_01 | addr; 
+                cmd = MODE_01 | addr;
                 denali_write32(cmd, denali->flash_mem);
-        }
-        else if (op == DENALI_READ)
-        {
+        } else if (op == DENALI_READ) {
                 /* setup page read request for access type */
-                cmd = MODE_10 | addr; 
+                cmd = MODE_10 | addr;
                 index_addr(denali, (uint32_t)cmd, access_type);
 
                 /* page 33 of the NAND controller spec indicates we should not
-                   use the pipeline commands in Spare area only mode. So we 
+                   use the pipeline commands in Spare area only mode. So we
                    don't.
                  */
-                if (access_type == SPARE_ACCESS)
-                {
+                if (access_type == SPARE_ACCESS) {
                         cmd = MODE_01 | addr;
                         denali_write32(cmd, denali->flash_mem);
-                }
-                else
-                {
-                        index_addr(denali, (uint32_t)cmd, 0x2000 | op | page_count);
-        
-                        /* wait for command to be accepted  
-                         * can always use status0 bit as the mask is identical for each
+                } else {
+                        index_addr(denali, (uint32_t)cmd,
+                                        0x2000 | op | page_count);
+
+                        /* wait for command to be accepted
+                         * can always use status0 bit as the
+                         * mask is identical for each
                          * bank. */
                         irq_status = wait_for_irq(denali, irq_mask);
 
-                        if (irq_status == 0)
-                        {
+                        if (irq_status == 0) {
                                 printk(KERN_ERR "cmd, page, addr on timeout "
-                                        "(0x%x, 0x%x, 0x%x)\n", cmd, denali->page, addr);
+                                        "(0x%x, 0x%x, 0x%x)\n", cmd,
+                                        denali->page, addr);
                                 status = FAIL;
-                        }
-                        else
-                        {
+                        } else {
                                 cmd = MODE_01 | addr;
                                 denali_write32(cmd, denali->flash_mem);
                         }
@@ -1204,36 +889,35 @@ static int denali_send_pipeline_cmd(struct denali_nand_info *denali, bool ecc_en
 }
 
 /* helper function that simply writes a buffer to the flash */
-static int write_data_to_flash_mem(struct denali_nand_info *denali, const uint8_t *buf, 
-                                        int len) 
+static int write_data_to_flash_mem(struct denali_nand_info *denali,
+                                                        const uint8_t *buf,
+                                                        int len)
 {
         uint32_t i = 0, *buf32;
 
-        /* verify that the len is a multiple of 4. see comment in 
-         * read_data_from_flash_mem() */        
+        /* verify that the len is a multiple of 4. see comment in
+         * read_data_from_flash_mem() */
         BUG_ON((len % 4) != 0);
 
         /* write the data to the flash memory */
         buf32 = (uint32_t *)buf;
         for (i = 0; i < len / 4; i++)
-        {
                 denali_write32(*buf32++, denali->flash_mem + 0x10);
-        }
-        return i*4; /* intent is to return the number of bytes read */ 
+        return i*4; /* intent is to return the number of bytes read */
 }
 
 /* helper function that simply reads a buffer from the flash */
-static int read_data_from_flash_mem(struct denali_nand_info *denali, uint8_t *buf, 
-                                        int len)
+static int read_data_from_flash_mem(struct denali_nand_info *denali,
+                                                                uint8_t *buf,
+                                                                int len)
 {
         uint32_t i = 0, *buf32;
 
         /* we assume that len will be a multiple of 4, if not
          * it would be nice to know about it ASAP rather than
-         * have random failures... 
-         *      
-         * This assumption is based on the fact that this 
-         * function is designed to be used to read flash pages, 
+         * have random failures...
+         * This assumption is based on the fact that this
+         * function is designed to be used to read flash pages,
          * which are typically multiples of 4...
          */
 
@@ -1242,10 +926,8 @@ static int read_data_from_flash_mem(struct denali_nand_info *denali, uint8_t *bu
         /* transfer the data from the flash */
         buf32 = (uint32_t *)buf;
         for (i = 0; i < len / 4; i++)
-        {
                 *buf32++ = ioread32(denali->flash_mem + 0x10);
-        }
-        return i*4; /* intent is to return the number of bytes read */ 
+        return i*4; /* intent is to return the number of bytes read */
 }
 
 /* writes OOB data to the device */
@@ -1253,38 +935,35 @@ static int write_oob_data(struct mtd_info *mtd, uint8_t *buf, int page)
 {
         struct denali_nand_info *denali = mtd_to_denali(mtd);
         uint32_t irq_status = 0;
-        uint32_t irq_mask = INTR_STATUS0__PROGRAM_COMP | 
+        uint32_t irq_mask = INTR_STATUS0__PROGRAM_COMP |
                                                 INTR_STATUS0__PROGRAM_FAIL;
         int status = 0;
 
         denali->page = page;
 
-        if (denali_send_pipeline_cmd(denali, false, false, SPARE_ACCESS, 
-                                                        DENALI_WRITE) == PASS) 
-        {
+        if (denali_send_pipeline_cmd(denali, false, false, SPARE_ACCESS,
+                                                        DENALI_WRITE) == PASS) {
                 write_data_to_flash_mem(denali, buf, mtd->oobsize);
 
 #if DEBUG_DENALI
                 spin_lock_irq(&denali->irq_lock);
-                denali->irq_debug_array[denali->idx++] = 0x80000000 | mtd->oobsize;
+                denali->irq_debug_array[denali->idx++] =
+                        0x80000000 | mtd->oobsize;
                 denali->idx %= 32;
                 spin_unlock_irq(&denali->irq_lock);
 #endif
 
-        
+
                 /* wait for operation to complete */
                 irq_status = wait_for_irq(denali, irq_mask);
 
-                if (irq_status == 0)
-                {
+                if (irq_status == 0) {
                         printk(KERN_ERR "OOB write failed\n");
                         status = -EIO;
                 }
-        }
-        else 
-        {       
+        } else {
                 printk(KERN_ERR "unable to send pipeline command\n");
-                status = -EIO; 
+                status = -EIO;
         }
         return status;
 }
@@ -1293,60 +972,56 @@ static int write_oob_data(struct mtd_info *mtd, uint8_t *buf, int page)
 static void read_oob_data(struct mtd_info *mtd, uint8_t *buf, int page)
 {
         struct denali_nand_info *denali = mtd_to_denali(mtd);
-        uint32_t irq_mask = INTR_STATUS0__LOAD_COMP, irq_status = 0, addr = 0x0, cmd = 0x0;
+        uint32_t irq_mask = INTR_STATUS0__LOAD_COMP,
+                         irq_status = 0, addr = 0x0, cmd = 0x0;
 
         denali->page = page;
 
 #if DEBUG_DENALI
-        printk("read_oob %d\n", page);
+        printk(KERN_INFO "read_oob %d\n", page);
 #endif
-        if (denali_send_pipeline_cmd(denali, false, true, SPARE_ACCESS, 
-                                                        DENALI_READ) == PASS) 
-        {
-                read_data_from_flash_mem(denali, buf, mtd->oobsize);    
+        if (denali_send_pipeline_cmd(denali, false, true, SPARE_ACCESS,
+                                                        DENALI_READ) == PASS) {
+                read_data_from_flash_mem(denali, buf, mtd->oobsize);
 
-                /* wait for command to be accepted  
+                /* wait for command to be accepted
                  * can always use status0 bit as the mask is identical for each
                  * bank. */
                 irq_status = wait_for_irq(denali, irq_mask);
 
                 if (irq_status == 0)
-                {
-                        printk(KERN_ERR "page on OOB timeout %d\n", denali->page);
-                }
+                        printk(KERN_ERR "page on OOB timeout %d\n",
+                                        denali->page);
 
                 /* We set the device back to MAIN_ACCESS here as I observed
                  * instability with the controller if you do a block erase
                  * and the last transaction was a SPARE_ACCESS. Block erase
                  * is reliable (according to the MTD test infrastructure)
-                 * if you are in MAIN_ACCESS. 
+                 * if you are in MAIN_ACCESS.
                  */
                 addr = BANK(denali->flash_bank) | denali->page;
-                cmd = MODE_10 | addr; 
+                cmd = MODE_10 | addr;
                 index_addr(denali, (uint32_t)cmd, MAIN_ACCESS);
 
 #if DEBUG_DENALI
                 spin_lock_irq(&denali->irq_lock);
-                denali->irq_debug_array[denali->idx++] = 0x60000000 | mtd->oobsize;
+                denali->irq_debug_array[denali->idx++] =
+                        0x60000000 | mtd->oobsize;
                 denali->idx %= 32;
                 spin_unlock_irq(&denali->irq_lock);
 #endif
         }
 }
 
-/* this function examines buffers to see if they contain data that 
+/* this function examines buffers to see if they contain data that
  * indicate that the buffer is part of an erased region of flash.
  */
 bool is_erased(uint8_t *buf, int len)
 {
         int i = 0;
         for (i = 0; i < len; i++)
-        {       
                 if (buf[i] != 0xFF)
-                {
                         return false;
-                }
-        }
         return true;
 }
 #define ECC_SECTOR_SIZE 512
@@ -1358,65 +1033,59 @@ bool is_erased(uint8_t *buf, int len)
 #define ECC_ERR_DEVICE(x)       ((x) & ERR_CORRECTION_INFO__DEVICE_NR >> 8)
 #define ECC_LAST_ERR(x)         ((x) & ERR_CORRECTION_INFO__LAST_ERR_INFO)
 
-static bool handle_ecc(struct denali_nand_info *denali, uint8_t *buf, 
+static bool handle_ecc(struct denali_nand_info *denali, uint8_t *buf,
                         uint8_t *oobbuf, uint32_t irq_status)
 {
         bool check_erased_page = false;
 
-        if (irq_status & INTR_STATUS0__ECC_ERR)
-        {
+        if (irq_status & INTR_STATUS0__ECC_ERR) {
                 /* read the ECC errors. we'll ignore them for now */
                 uint32_t err_address = 0, err_correction_info = 0;
                 uint32_t err_byte = 0, err_sector = 0, err_device = 0;
                 uint32_t err_correction_value = 0;
 
-                do 
-                {
-                        err_address = ioread32(denali->flash_reg + 
+                do {
+                        err_address = ioread32(denali->flash_reg +
                                                 ECC_ERROR_ADDRESS);
                         err_sector = ECC_SECTOR(err_address);
                         err_byte = ECC_BYTE(err_address);
 
 
-                        err_correction_info = ioread32(denali->flash_reg + 
+                        err_correction_info = ioread32(denali->flash_reg +
                                                 ERR_CORRECTION_INFO);
-                        err_correction_value = 
+                        err_correction_value =
                                 ECC_CORRECTION_VALUE(err_correction_info);
                         err_device = ECC_ERR_DEVICE(err_correction_info);
 
-                        if (ECC_ERROR_CORRECTABLE(err_correction_info))
-                        {
+                        if (ECC_ERROR_CORRECTABLE(err_correction_info)) {
                                 /* offset in our buffer is computed as:
-                                   sector number * sector size + offset in 
+                                   sector number * sector size + offset in
                                    sector
                                  */
-                                int offset = err_sector * ECC_SECTOR_SIZE + 
+                                int offset = err_sector * ECC_SECTOR_SIZE +
                                                                 err_byte;
-                                if (offset < denali->mtd.writesize)
-                                {
+                                if (offset < denali->mtd.writesize) {
                                         /* correct the ECC error */
                                         buf[offset] ^= err_correction_value;
                                         denali->mtd.ecc_stats.corrected++;
-                                }
-                                else
-                                {
+                                } else {
                                         /* bummer, couldn't correct the error */
                                         printk(KERN_ERR "ECC offset invalid\n");
                                         denali->mtd.ecc_stats.failed++;
                                 }
-                        }
-                        else
-                        {
-                                /* if the error is not correctable, need to 
-                                 * look at the page to see if it is an erased page.
-                                 * if so, then it's not a real ECC error */     
+                        } else {
+                                /* if the error is not correctable, need to
+                                 * look at the page to see if it is an erased
+                                 * page. if so, then it's not a real ECC error
+                                 * */
                                 check_erased_page = true;
                         }
 
-#if DEBUG_DENALI 
-                        printk("Detected ECC error in page %d: err_addr = 0x%08x,"
-                                " info to fix is 0x%08x\n", denali->page, err_address, 
-                                err_correction_info);
+#if DEBUG_DENALI
+                        printk(KERN_INFO "Detected ECC error in page %d:"
+                                        " err_addr = 0x%08x, info to fix is"
+                                        " 0x%08x\n", denali->page, err_address,
+                                        err_correction_info);
 #endif
                 } while (!ECC_LAST_ERR(err_correction_info));
         }
@@ -1428,7 +1097,8 @@ static void denali_enable_dma(struct denali_nand_info *denali, bool en)
 {
         uint32_t reg_val = 0x0;
 
-        if (en) reg_val = DMA_ENABLE__FLAG;
+        if (en)
+                reg_val = DMA_ENABLE__FLAG;
 
         denali_write32(reg_val, denali->flash_reg + DMA_ENABLE);
         ioread32(denali->flash_reg + DMA_ENABLE);
@@ -1458,9 +1128,9 @@ static void denali_setup_dma(struct denali_nand_info *denali, int op)
         index_addr(denali, mode | 0x14000, 0x2400);
 }
 
-/* writes a page. user specifies type, and this function handles the 
+/* writes a page. user specifies type, and this function handles the
    configuration details. */
-static void write_page(struct mtd_info *mtd, struct nand_chip *chip, 
+static void write_page(struct mtd_info *mtd, struct nand_chip *chip,
                         const uint8_t *buf, bool raw_xfer)
 {
         struct denali_nand_info *denali = mtd_to_denali(mtd);
@@ -1470,7 +1140,7 @@ static void write_page(struct mtd_info *mtd, struct nand_chip *chip,
         size_t size = denali->mtd.writesize + denali->mtd.oobsize;
 
         uint32_t irq_status = 0;
-        uint32_t irq_mask = INTR_STATUS0__DMA_CMD_COMP | 
+        uint32_t irq_mask = INTR_STATUS0__DMA_CMD_COMP |
                                                 INTR_STATUS0__PROGRAM_FAIL;
 
         /* if it is a raw xfer, we want to disable ecc, and send
@@ -1483,74 +1153,73 @@ static void write_page(struct mtd_info *mtd, struct nand_chip *chip,
         /* copy buffer into DMA buffer */
         memcpy(denali->buf.buf, buf, mtd->writesize);
 
-        if (raw_xfer)
-        {
+        if (raw_xfer) {
                 /* transfer the data to the spare area */
-                memcpy(denali->buf.buf + mtd->writesize, 
-                        chip->oob_poi, 
-                        mtd->oobsize); 
+                memcpy(denali->buf.buf + mtd->writesize,
+                        chip->oob_poi,
+                        mtd->oobsize);
         }
 
         pci_dma_sync_single_for_device(pci_dev, addr, size, PCI_DMA_TODEVICE);
 
         clear_interrupts(denali);
-        denali_enable_dma(denali, true);        
+        denali_enable_dma(denali, true);
 
         denali_setup_dma(denali, DENALI_WRITE);
 
         /* wait for operation to complete */
         irq_status = wait_for_irq(denali, irq_mask);
 
-        if (irq_status == 0)
-        {
-                printk(KERN_ERR "timeout on write_page (type = %d)\n", raw_xfer);
-                denali->status = 
-                   (irq_status & INTR_STATUS0__PROGRAM_FAIL) ? NAND_STATUS_FAIL : 
-                                                             PASS;
+        if (irq_status == 0) {
+                printk(KERN_ERR "timeout on write_page"
+                                " (type = %d)\n", raw_xfer);
+                denali->status =
+                        (irq_status & INTR_STATUS0__PROGRAM_FAIL) ?
+                        NAND_STATUS_FAIL : PASS;
         }
 
-        denali_enable_dma(denali, false);       
+        denali_enable_dma(denali, false);
         pci_dma_sync_single_for_cpu(pci_dev, addr, size, PCI_DMA_TODEVICE);
 }
 
 /* NAND core entry points */
 
-/* this is the callback that the NAND core calls to write a page. Since 
-   writing a page with ECC or without is similar, all the work is done 
+/* this is the callback that the NAND core calls to write a page. Since
+   writing a page with ECC or without is similar, all the work is done
    by write_page above.   */
-static void denali_write_page(struct mtd_info *mtd, struct nand_chip *chip, 
+static void denali_write_page(struct mtd_info *mtd, struct nand_chip *chip,
                                 const uint8_t *buf)
 {
         /* for regular page writes, we let HW handle all the ECC
-         * data written to the device. */
+         * data written to the device. */
         write_page(mtd, chip, buf, false);
 }
 
-/* This is the callback that the NAND core calls to write a page without ECC. 
+/* This is the callback that the NAND core calls to write a page without ECC.
    raw access is similiar to ECC page writes, so all the work is done in the
-   write_page() function above. 
+   write_page() function above.
  */
-static void denali_write_page_raw(struct mtd_info *mtd, struct nand_chip *chip, 
+static void denali_write_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
                                         const uint8_t *buf)
 {
-        /* for raw page writes, we want to disable ECC and simply write 
+        /* for raw page writes, we want to disable ECC and simply write
            whatever data is in the buffer. */
         write_page(mtd, chip, buf, true);
 }
 
-static int denali_write_oob(struct mtd_info *mtd, struct nand_chip *chip, 
+static int denali_write_oob(struct mtd_info *mtd, struct nand_chip *chip,
                             int page)
 {
-        return write_oob_data(mtd, chip->oob_poi, page);        
+        return write_oob_data(mtd, chip->oob_poi, page);
 }
 
-static int denali_read_oob(struct mtd_info *mtd, struct nand_chip *chip, 
+static int denali_read_oob(struct mtd_info *mtd, struct nand_chip *chip,
                            int page, int sndcmd)
 {
         read_oob_data(mtd, chip->oob_poi, page);
 
-        return 0; /* notify NAND core to send command to 
-                   * NAND device. */
+        return 0; /* notify NAND core to send command to
+                           NAND device. */
 }
 
 static int denali_read_page(struct mtd_info *mtd, struct nand_chip *chip,
@@ -1563,7 +1232,7 @@ static int denali_read_page(struct mtd_info *mtd, struct nand_chip *chip,
         size_t size = denali->mtd.writesize + denali->mtd.oobsize;
 
         uint32_t irq_status = 0;
-        uint32_t irq_mask = INTR_STATUS0__ECC_TRANSACTION_DONE | 
+        uint32_t irq_mask = INTR_STATUS0__ECC_TRANSACTION_DONE |
                             INTR_STATUS0__ECC_ERR;
         bool check_erased_page = false;
 
@@ -1581,26 +1250,20 @@ static int denali_read_page(struct mtd_info *mtd, struct nand_chip *chip,
         pci_dma_sync_single_for_cpu(pci_dev, addr, size, PCI_DMA_FROMDEVICE);
 
         memcpy(buf, denali->buf.buf, mtd->writesize);
-        
+
         check_erased_page = handle_ecc(denali, buf, chip->oob_poi, irq_status);
         denali_enable_dma(denali, false);
 
-        if (check_erased_page)
-        {
+        if (check_erased_page) {
                 read_oob_data(&denali->mtd, chip->oob_poi, denali->page);
 
                 /* check ECC failures that may have occurred on erased pages */
-                if (check_erased_page)
-                {
+                if (check_erased_page) {
                         if (!is_erased(buf, denali->mtd.writesize))
-                        {
                                 denali->mtd.ecc_stats.failed++;
-                        }
                         if (!is_erased(buf, denali->mtd.oobsize))
-                        {
                                 denali->mtd.ecc_stats.failed++;
-                        }
-                }       
+                }
         }
         return 0;
 }
@@ -1616,7 +1279,7 @@ static int denali_read_page_raw(struct mtd_info *mtd, struct nand_chip *chip,
 
         uint32_t irq_status = 0;
         uint32_t irq_mask = INTR_STATUS0__DMA_CMD_COMP;
-                                                
+
         setup_ecc_for_xfer(denali, false, true);
         denali_enable_dma(denali, true);
 
@@ -1644,12 +1307,10 @@ static uint8_t denali_read_byte(struct mtd_info *mtd)
         uint8_t result = 0xff;
 
         if (denali->buf.head < denali->buf.tail)
-        {
                 result = denali->buf.buf[denali->buf.head++];
-        }
 
 #if DEBUG_DENALI
-        printk("read byte -> 0x%02x\n", result);
+        printk(KERN_INFO "read byte -> 0x%02x\n", result);
 #endif
         return result;
 }
@@ -1658,7 +1319,7 @@ static void denali_select_chip(struct mtd_info *mtd, int chip)
 {
         struct denali_nand_info *denali = mtd_to_denali(mtd);
 #if DEBUG_DENALI
-        printk("denali select chip %d\n", chip);
+        printk(KERN_INFO "denali select chip %d\n", chip);
 #endif
         spin_lock_irq(&denali->irq_lock);
         denali->flash_bank = chip;
@@ -1672,7 +1333,7 @@ static int denali_waitfunc(struct mtd_info *mtd, struct nand_chip *chip)
         denali->status = 0;
 
 #if DEBUG_DENALI
-        printk("waitfunc %d\n", status);
+        printk(KERN_INFO "waitfunc %d\n", status);
 #endif
         return status;
 }
@@ -1684,76 +1345,74 @@ static void denali_erase(struct mtd_info *mtd, int page)
         uint32_t cmd = 0x0, irq_status = 0;
 
 #if DEBUG_DENALI
-        printk("erase page: %d\n", page);
+        printk(KERN_INFO "erase page: %d\n", page);
 #endif
         /* clear interrupts */
-        clear_interrupts(denali);       
+        clear_interrupts(denali);
 
         /* setup page read request for access type */
         cmd = MODE_10 | BANK(denali->flash_bank) | page;
         index_addr(denali, (uint32_t)cmd, 0x1);
 
         /* wait for erase to complete or failure to occur */
-        irq_status = wait_for_irq(denali, INTR_STATUS0__ERASE_COMP | 
+        irq_status = wait_for_irq(denali, INTR_STATUS0__ERASE_COMP |
                                         INTR_STATUS0__ERASE_FAIL);
 
-        denali->status = (irq_status & INTR_STATUS0__ERASE_FAIL) ? NAND_STATUS_FAIL : 
-                                                                 PASS;
+        denali->status = (irq_status & INTR_STATUS0__ERASE_FAIL) ?
+                                                NAND_STATUS_FAIL : PASS;
 }
 
-static void denali_cmdfunc(struct mtd_info *mtd, unsigned int cmd, int col, 
+static void denali_cmdfunc(struct mtd_info *mtd, unsigned int cmd, int col,
                            int page)
 {
         struct denali_nand_info *denali = mtd_to_denali(mtd);
+        uint32_t addr, id;
+        int i;
 
 #if DEBUG_DENALI
-        printk("cmdfunc: 0x%x %d %d\n", cmd, col, page);
+        printk(KERN_INFO "cmdfunc: 0x%x %d %d\n", cmd, col, page);
 #endif
-        switch (cmd)
-        { 
-                case NAND_CMD_PAGEPROG:
-                        break;
-                case NAND_CMD_STATUS:
-                        read_status(denali);
-                        break;
-                case NAND_CMD_READID:
-                        reset_buf(denali);
-                        if (denali->flash_bank < denali->total_used_banks)
-                        {
-                                /* write manufacturer information into nand 
-                                   buffer for NAND subsystem to fetch.
-                                 */ 
-                                write_byte_to_buf(denali, denali->dev_info.wDeviceMaker);
-                                write_byte_to_buf(denali, denali->dev_info.wDeviceID);
-                                write_byte_to_buf(denali, denali->dev_info.bDeviceParam0);
-                                write_byte_to_buf(denali, denali->dev_info.bDeviceParam1);
-                                write_byte_to_buf(denali, denali->dev_info.bDeviceParam2);
-                        }
-                        else 
-                        {
-                                int i;
-                                for (i = 0; i < 5; i++) 
-                                        write_byte_to_buf(denali, 0xff);
-                        }
-                        break;
-                case NAND_CMD_READ0:
-                case NAND_CMD_SEQIN:
-                        denali->page = page;
-                        break;
-                case NAND_CMD_RESET:
-                        reset_bank(denali);
-                        break;
-                case NAND_CMD_READOOB:
-                        /* TODO: Read OOB data */
-                        break;
-                default:
-                        printk(KERN_ERR ": unsupported command received 0x%x\n", cmd);
-                        break;
+        switch (cmd) {
+        case NAND_CMD_PAGEPROG:
+                break;
+        case NAND_CMD_STATUS:
+                read_status(denali);
+                break;
+        case NAND_CMD_READID:
+                reset_buf(denali);
+                /*sometimes ManufactureId read from register is not right
+                 * e.g. some of Micron MT29F32G08QAA MLC NAND chips
+                 * So here we send READID cmd to NAND insteand
+                 * */
+                addr = (uint32_t)MODE_11 | BANK(denali->flash_bank);
+                index_addr(denali, (uint32_t)addr | 0, 0x90);
+                index_addr(denali, (uint32_t)addr | 1, 0);
+                for (i = 0; i < 5; i++) {
+                        index_addr_read_data(denali,
+                                                (uint32_t)addr | 2,
+                                                &id);
+                        write_byte_to_buf(denali, id);
+                }
+                break;
+        case NAND_CMD_READ0:
+        case NAND_CMD_SEQIN:
+                denali->page = page;
+                break;
+        case NAND_CMD_RESET:
+                reset_bank(denali);
+                break;
+        case NAND_CMD_READOOB:
+                /* TODO: Read OOB data */
+                break;
+        default:
+                printk(KERN_ERR ": unsupported command"
+                                " received 0x%x\n", cmd);
+                break;
         }
 }
 
 /* stubs for ECC functions not used by the NAND core */
-static int denali_ecc_calculate(struct mtd_info *mtd, const uint8_t *data, 
+static int denali_ecc_calculate(struct mtd_info *mtd, const uint8_t *data,
                                 uint8_t *ecc_code)
 {
         printk(KERN_ERR "denali_ecc_calculate called unexpectedly\n");
@@ -1761,7 +1420,7 @@ static int denali_ecc_calculate(struct mtd_info *mtd, const uint8_t *data,
         return -EIO;
 }
 
-static int denali_ecc_correct(struct mtd_info *mtd, uint8_t *data, 
+static int denali_ecc_correct(struct mtd_info *mtd, uint8_t *data,
                                 uint8_t *read_ecc, uint8_t *calc_ecc)
 {
         printk(KERN_ERR "denali_ecc_correct called unexpectedly\n");
@@ -1779,10 +1438,18 @@ static void denali_ecc_hwctl(struct mtd_info *mtd, int mode)
 /* Initialization code to bring the device up to a known good state */
 static void denali_hw_init(struct denali_nand_info *denali)
 {
+        /* tell driver how many bit controller will skip before
+         * writing ECC code in OOB, this register may be already
+         * set by firmware. So we read this value out.
+         * if this value is 0, just let it be.
+         * */
+        denali->bbtskipbytes = ioread32(denali->flash_reg +
+                                                SPARE_AREA_SKIP_BYTES);
         denali_irq_init(denali);
-        NAND_Flash_Reset(denali);
+        denali_nand_reset(denali);
         denali_write32(0x0F, denali->flash_reg + RB_PIN_ENABLED);
-        denali_write32(CHIP_EN_DONT_CARE__FLAG, denali->flash_reg + CHIP_ENABLE_DONT_CARE);
+        denali_write32(CHIP_EN_DONT_CARE__FLAG,
+                        denali->flash_reg + CHIP_ENABLE_DONT_CARE);
 
         denali_write32(0x0, denali->flash_reg + SPARE_AREA_SKIP_BYTES);
         denali_write32(0xffff, denali->flash_reg + SPARE_AREA_MARKER);
@@ -1792,25 +1459,18 @@ static void denali_hw_init(struct denali_nand_info *denali)
         denali_write32(1, denali->flash_reg + ECC_ENABLE);
 }
 
-/* ECC layout for SLC devices. Denali spec indicates SLC fixed at 4 bytes */
-#define ECC_BYTES_SLC   4 * (2048 / ECC_SECTOR_SIZE)
-static struct nand_ecclayout nand_oob_slc = {
-        .eccbytes = 4,
-        .eccpos = { 0, 1, 2, 3 }, /* not used */
-        .oobfree = {{ 
-                        .offset = ECC_BYTES_SLC, 
-                        .length = 64 - ECC_BYTES_SLC  
-                   }}
+/* Althogh controller spec said SLC ECC is forceb to be 4bit,
+ * but denali controller in MRST only support 15bit and 8bit ECC
+ * correction
+ * */
+#define ECC_8BITS       14
+static struct nand_ecclayout nand_8bit_oob = {
+        .eccbytes = 14,
 };
 
-#define ECC_BYTES_MLC   14 * (2048 / ECC_SECTOR_SIZE)
-static struct nand_ecclayout nand_oob_mlc_14bit = {
-        .eccbytes = 14,
-        .eccpos = { 0, 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13 }, /* not used */
-        .oobfree = {{ 
-                        .offset = ECC_BYTES_MLC, 
-                        .length = 64 - ECC_BYTES_MLC  
-                   }}
+#define ECC_15BITS      26
+static struct nand_ecclayout nand_15bit_oob = {
+        .eccbytes = 26,
 };
 
 static uint8_t bbt_pattern[] = {'B', 'b', 't', '0' };
@@ -1842,12 +1502,12 @@ void denali_drv_init(struct denali_nand_info *denali)
         denali->idx = 0;
 
         /* setup interrupt handler */
-        /* the completion object will be used to notify 
+        /* the completion object will be used to notify
          * the callee that the interrupt is done */
         init_completion(&denali->complete);
 
         /* the spinlock will be used to synchronize the ISR
-         * with any element that might be access shared 
+         * with any element that might be access shared
          * data (interrupt status) */
         spin_lock_init(&denali->irq_lock);
 
@@ -1880,13 +1540,12 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         }
 
         if (id->driver_data == INTEL_CE4100) {
-                /* Due to a silicon limitation, we can only support 
-                 * ONFI timing mode 1 and below. 
-                 */ 
-                if (onfi_timing_mode < -1 || onfi_timing_mode > 1)
-                {
-                        printk("Intel CE4100 only supports ONFI timing mode 1 "
-                                "or below\n");
+                /* Due to a silicon limitation, we can only support
+                 * ONFI timing mode 1 and below.
+                 */
+                if (onfi_timing_mode < -1 || onfi_timing_mode > 1) {
+                        printk(KERN_ERR "Intel CE4100 only supports"
+                                        " ONFI timing mode 1 or below\n");
                         ret = -EINVAL;
                         goto failed_enable;
                 }
@@ -1905,7 +1564,9 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         mem_base = csr_base + csr_len;
                         mem_len = csr_len;
                         nand_dbg_print(NAND_DBG_WARN,
-                                       "Spectra: No second BAR for PCI device; assuming %08Lx\n",
+                                       "Spectra: No second"
+                                           " BAR for PCI device;"
+                                           " assuming %08Lx\n",
                                        (uint64_t)csr_base);
                 }
         }
@@ -1913,16 +1574,16 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         /* Is 32-bit DMA supported? */
         ret = pci_set_dma_mask(dev, DMA_BIT_MASK(32));
 
-        if (ret)
-        {
+        if (ret) {
                 printk(KERN_ERR "Spectra: no usable DMA configuration\n");
                 goto failed_enable;
         }
-        denali->buf.dma_buf = pci_map_single(dev, denali->buf.buf, DENALI_BUF_SIZE, 
-                                         PCI_DMA_BIDIRECTIONAL);
+        denali->buf.dma_buf =
+                pci_map_single(dev, denali->buf.buf,
+                                                DENALI_BUF_SIZE,
+                                                PCI_DMA_BIDIRECTIONAL);
 
-        if (pci_dma_mapping_error(dev, denali->buf.dma_buf))
-        {
+        if (pci_dma_mapping_error(dev, denali->buf.dma_buf)) {
                 printk(KERN_ERR "Spectra: failed to map DMA buffer\n");
                 goto failed_enable;
         }
@@ -1970,22 +1631,11 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         }
 
         /* now that our ISR is registered, we can enable interrupts */
-        NAND_LLD_Enable_Disable_Interrupts(denali, true);
+        denali_set_intr_modes(denali, true);
 
         pci_set_drvdata(dev, denali);
 
-        NAND_Read_Device_ID(denali);
-
-        /* MTD supported page sizes vary by kernel. We validate our 
-           kernel supports the device here.
-         */
-        if (denali->dev_info.wPageSize > NAND_MAX_PAGESIZE + NAND_MAX_OOBSIZE)
-        {
-                ret = -ENODEV;
-                printk(KERN_ERR "Spectra: device size not supported by this "
-                        "version of MTD.");
-                goto failed_nand;
-        }
+        denali_nand_timing_set(denali);
 
         nand_dbg_print(NAND_DBG_DEBUG, "Dump timing register values:"
                         "acc_clks: %d, re_2_we: %d, we_2_re: %d,"
@@ -2009,18 +1659,46 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         denali->nand.read_byte = denali_read_byte;
         denali->nand.waitfunc = denali_waitfunc;
 
-        /* scan for NAND devices attached to the controller 
+        /* scan for NAND devices attached to the controller
          * this is the first stage in a two step process to register
-         * with the nand subsystem */   
-        if (nand_scan_ident(&denali->mtd, LLD_MAX_FLASH_BANKS, NULL))
-        {
+         * with the nand subsystem */
+        if (nand_scan_ident(&denali->mtd, LLD_MAX_FLASH_BANKS, NULL)) {
                 ret = -ENXIO;
                 goto failed_nand;
         }
-        
-        /* second stage of the NAND scan 
-         * this stage requires information regarding ECC and 
-         * bad block management. */
+
+        /* MTD supported page sizes vary by kernel. We validate our
+         * kernel supports the device here.
+         */
+        if (denali->mtd.writesize > NAND_MAX_PAGESIZE + NAND_MAX_OOBSIZE) {
+                ret = -ENODEV;
+                printk(KERN_ERR "Spectra: device size not supported by this "
+                        "version of MTD.");
+                goto failed_nand;
+        }
+
+        /* support for multi nand
+         * MTD known nothing about multi nand,
+         * so we should tell it the real pagesize
+         * and anything necessery
+         */
+        denali->devnum = ioread32(denali->flash_reg + DEVICES_CONNECTED);
+        denali->nand.chipsize <<= (denali->devnum - 1);
+        denali->nand.page_shift += (denali->devnum - 1);
+        denali->nand.pagemask = (denali->nand.chipsize >>
+                                                denali->nand.page_shift) - 1;
+        denali->nand.bbt_erase_shift += (denali->devnum - 1);
+        denali->nand.phys_erase_shift = denali->nand.bbt_erase_shift;
+        denali->nand.chip_shift += (denali->devnum - 1);
+        denali->mtd.writesize <<= (denali->devnum - 1);
+        denali->mtd.oobsize <<= (denali->devnum - 1);
+        denali->mtd.erasesize <<= (denali->devnum - 1);
+        denali->mtd.size = denali->nand.numchips * denali->nand.chipsize;
+        denali->bbtskipbytes *= denali->devnum;
+
+        /* second stage of the NAND scan
+         * this stage requires information regarding ECC and
+         * bad block management. */
 
         /* Bad block management */
         denali->nand.bbt_td = &bbt_main_descr;
@@ -2030,26 +1708,57 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         denali->nand.options |= NAND_USE_FLASH_BBT | NAND_SKIP_BBTSCAN;
         denali->nand.ecc.mode = NAND_ECC_HW_SYNDROME;
 
-        if (denali->dev_info.MLCDevice)
-        {
-                denali->nand.ecc.layout = &nand_oob_mlc_14bit;
-                denali->nand.ecc.bytes = ECC_BYTES_MLC;
-        }
-        else /* SLC */
-        {
-                denali->nand.ecc.layout = &nand_oob_slc;
-                denali->nand.ecc.bytes = ECC_BYTES_SLC;
+        /* Denali Controller only support 15bit and 8bit ECC in MRST,
+         * so just let controller do 15bit ECC for MLC and 8bit ECC for
+         * SLC if possible.
+         * */
+        if (denali->nand.cellinfo & 0xc &&
+                        (denali->mtd.oobsize > (denali->bbtskipbytes +
+                        ECC_15BITS * (denali->mtd.writesize /
+                        ECC_SECTOR_SIZE)))) {
+                /* if MLC OOB size is large enough, use 15bit ECC*/
+                denali->nand.ecc.layout = &nand_15bit_oob;
+                denali->nand.ecc.bytes = ECC_15BITS;
+                denali_write32(15, denali->flash_reg + ECC_CORRECTION);
+        } else if (denali->mtd.oobsize < (denali->bbtskipbytes +
+                        ECC_8BITS * (denali->mtd.writesize /
+                        ECC_SECTOR_SIZE))) {
+                printk(KERN_ERR "Your NAND chip OOB is not large enough to"
+                                " contain 8bit ECC correction codes");
+                goto failed_nand;
+        } else {
+                denali->nand.ecc.layout = &nand_8bit_oob;
+                denali->nand.ecc.bytes = ECC_8BITS;
+                denali_write32(8, denali->flash_reg + ECC_CORRECTION);
         }
 
-        /* These functions are required by the NAND core framework, otherwise, 
-           the NAND core will assert. However, we don't need them, so we'll stub 
-           them out. */
+        denali->nand.ecc.bytes *= denali->devnum;
+        denali->nand.ecc.layout->eccbytes *=
+                denali->mtd.writesize / ECC_SECTOR_SIZE;
+        denali->nand.ecc.layout->oobfree[0].offset =
+                denali->bbtskipbytes + denali->nand.ecc.layout->eccbytes;
+        denali->nand.ecc.layout->oobfree[0].length =
+                denali->mtd.oobsize - denali->nand.ecc.layout->eccbytes -
+                denali->bbtskipbytes;
+
+        /* Let driver know the total blocks number and
+         * how many blocks contained by each nand chip.
+         * blksperchip will help driver to know how many
+         * blocks is taken by FW.
+         * */
+        denali->totalblks = denali->mtd.size >>
+                                denali->nand.phys_erase_shift;
+        denali->blksperchip = denali->totalblks / denali->nand.numchips;
+
+        /* These functions are required by the NAND core framework, otherwise,
+         * the NAND core will assert. However, we don't need them, so we'll stub
+         * them out. */
         denali->nand.ecc.calculate = denali_ecc_calculate;
         denali->nand.ecc.correct = denali_ecc_correct;
         denali->nand.ecc.hwctl = denali_ecc_hwctl;
 
         /* override the default read operations */
-        denali->nand.ecc.size = denali->mtd.writesize;
+        denali->nand.ecc.size = ECC_SECTOR_SIZE * denali->devnum;
         denali->nand.ecc.read_page = denali_read_page;
         denali->nand.ecc.read_page_raw = denali_read_page_raw;
         denali->nand.ecc.write_page = denali_write_page;
@@ -2058,15 +1767,15 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         denali->nand.ecc.write_oob = denali_write_oob;
         denali->nand.erase_cmd = denali_erase;
 
-        if (nand_scan_tail(&denali->mtd))
-        {
+        if (nand_scan_tail(&denali->mtd)) {
                 ret = -ENXIO;
                 goto failed_nand;
         }
 
         ret = add_mtd_device(&denali->mtd);
         if (ret) {
-                printk(KERN_ERR "Spectra: Failed to register MTD device: %d\n", ret);
+                printk(KERN_ERR "Spectra: Failed to register"
+                                " MTD device: %d\n", ret);
                 goto failed_nand;
         }
         return 0;
@@ -2079,7 +1788,7 @@ static int denali_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
  failed_remap_csr:
         pci_release_regions(dev);
  failed_req_csr:
-        pci_unmap_single(dev, denali->buf.dma_buf, DENALI_BUF_SIZE, 
+        pci_unmap_single(dev, denali->buf.dma_buf, DENALI_BUF_SIZE,
                                                         PCI_DMA_BIDIRECTIONAL);
  failed_enable:
         kfree(denali);
@@ -2103,7 +1812,7 @@ static void denali_pci_remove(struct pci_dev *dev)
         iounmap(denali->flash_mem);
         pci_release_regions(dev);
         pci_disable_device(dev);
-        pci_unmap_single(dev, denali->buf.dma_buf, DENALI_BUF_SIZE, 
+        pci_unmap_single(dev, denali->buf.dma_buf, DENALI_BUF_SIZE,
                                                         PCI_DMA_BIDIRECTIONAL);
         pci_set_drvdata(dev, NULL);
         kfree(denali);
@@ -2120,7 +1829,8 @@ static struct pci_driver denali_pci_driver = {
 
 static int __devinit denali_init(void)
 {
-        printk(KERN_INFO "Spectra MTD driver built on %s @ %s\n", __DATE__, __TIME__);
+        printk(KERN_INFO "Spectra MTD driver built on %s @ %s\n",
+                        __DATE__, __TIME__);
         return pci_register_driver(&denali_pci_driver);
 }
 
diff --git a/drivers/mtd/nand/denali.h b/drivers/mtd/nand/denali.h
index 422a29ab2f60..b680474e6333 100644
--- a/drivers/mtd/nand/denali.h
+++ b/drivers/mtd/nand/denali.h
@@ -17,7 +17,7 @@
  *
  */
 
-#include <linux/mtd/nand.h> 
+#include <linux/mtd/nand.h>
 
 #define DEVICE_RESET                            0x0
 #define     DEVICE_RESET__BANK0                         0x0001
@@ -29,7 +29,7 @@
 #define     TRANSFER_SPARE_REG__FLAG                    0x0001
 
 #define LOAD_WAIT_CNT                           0x20
-#define     LOAD_WAIT_CNT__VALUE                                0xffff
+#define     LOAD_WAIT_CNT__VALUE                        0xffff
 
 #define PROGRAM_WAIT_CNT                        0x30
 #define     PROGRAM_WAIT_CNT__VALUE                     0xffff
@@ -83,7 +83,7 @@
 #define RE_2_WE                                 0x120
 #define     RE_2_WE__VALUE                              0x003f
 
-#define ACC_CLKS                                0x130
+#define ACC_CLKS                                0x130
 #define     ACC_CLKS__VALUE                             0x000f
 
 #define NUMBER_OF_PLANES                        0x140
@@ -140,7 +140,7 @@
 #define DEVICES_CONNECTED                       0x250
 #define     DEVICES_CONNECTED__VALUE                    0x0007
 
-#define DIE_MASK                                        0x260
+#define DIE_MASK                                0x260
 #define     DIE_MASK__VALUE                             0x00ff
 
 #define FIRST_BLOCK_OF_NEXT_PLANE               0x270
@@ -152,7 +152,7 @@
 #define RE_2_RE                                 0x290
 #define     RE_2_RE__VALUE                              0x003f
 
-#define MANUFACTURER_ID                 0x300
+#define MANUFACTURER_ID                         0x300
 #define     MANUFACTURER_ID__VALUE                      0x00ff
 
 #define DEVICE_ID                               0x310
@@ -173,13 +173,13 @@
 #define LOGICAL_PAGE_SPARE_SIZE                 0x360
 #define     LOGICAL_PAGE_SPARE_SIZE__VALUE              0xffff
 
-#define REVISION                                        0x370
+#define REVISION                                0x370
 #define     REVISION__VALUE                             0xffff
 
 #define ONFI_DEVICE_FEATURES                    0x380
 #define     ONFI_DEVICE_FEATURES__VALUE                 0x003f
 
-#define ONFI_OPTIONAL_COMMANDS          0x390
+#define ONFI_OPTIONAL_COMMANDS                  0x390
 #define     ONFI_OPTIONAL_COMMANDS__VALUE               0x003f
 
 #define ONFI_TIMING_MODE                        0x3a0
@@ -201,12 +201,12 @@
 #define FEATURES                                        0x3f0
 #define     FEATURES__N_BANKS                           0x0003
 #define     FEATURES__ECC_MAX_ERR                       0x003c
-#define     FEATURES__DMA                                       0x0040
+#define     FEATURES__DMA                               0x0040
 #define     FEATURES__CMD_DMA                           0x0080
 #define     FEATURES__PARTITION                         0x0100
 #define     FEATURES__XDMA_SIDEBAND                     0x0200
 #define     FEATURES__GPREG                             0x0400
-#define     FEATURES__INDEX_ADDR                                0x0800
+#define     FEATURES__INDEX_ADDR                        0x0800
 
 #define TRANSFER_MODE                           0x400
 #define     TRANSFER_MODE__VALUE                        0x0003
@@ -235,12 +235,12 @@
 #define     INTR_EN0__DMA_CMD_COMP                      0x0004
 #define     INTR_EN0__TIME_OUT                          0x0008
 #define     INTR_EN0__PROGRAM_FAIL                      0x0010
-#define     INTR_EN0__ERASE_FAIL                                0x0020
+#define     INTR_EN0__ERASE_FAIL                        0x0020
 #define     INTR_EN0__LOAD_COMP                         0x0040
 #define     INTR_EN0__PROGRAM_COMP                      0x0080
-#define     INTR_EN0__ERASE_COMP                                0x0100
+#define     INTR_EN0__ERASE_COMP                        0x0100
 #define     INTR_EN0__PIPE_CPYBCK_CMD_COMP              0x0200
-#define     INTR_EN0__LOCKED_BLK                                0x0400
+#define     INTR_EN0__LOCKED_BLK                        0x0400
 #define     INTR_EN0__UNSUP_CMD                         0x0800
 #define     INTR_EN0__INT_ACT                           0x1000
 #define     INTR_EN0__RST_COMP                          0x2000
@@ -253,7 +253,7 @@
 #define ERR_PAGE_ADDR0                          0x440
 #define     ERR_PAGE_ADDR0__VALUE                       0xffff
 
-#define ERR_BLOCK_ADDR0                 0x450
+#define ERR_BLOCK_ADDR0                         0x450
 #define     ERR_BLOCK_ADDR0__VALUE                      0xffff
 
 #define INTR_STATUS1                            0x460
@@ -280,12 +280,12 @@
 #define     INTR_EN1__DMA_CMD_COMP                      0x0004
 #define     INTR_EN1__TIME_OUT                          0x0008
 #define     INTR_EN1__PROGRAM_FAIL                      0x0010
-#define     INTR_EN1__ERASE_FAIL                                0x0020
+#define     INTR_EN1__ERASE_FAIL                        0x0020
 #define     INTR_EN1__LOAD_COMP                         0x0040
 #define     INTR_EN1__PROGRAM_COMP                      0x0080
-#define     INTR_EN1__ERASE_COMP                                0x0100
+#define     INTR_EN1__ERASE_COMP                        0x0100
 #define     INTR_EN1__PIPE_CPYBCK_CMD_COMP              0x0200
-#define     INTR_EN1__LOCKED_BLK                                0x0400
+#define     INTR_EN1__LOCKED_BLK                        0x0400
 #define     INTR_EN1__UNSUP_CMD                         0x0800
 #define     INTR_EN1__INT_ACT                           0x1000
 #define     INTR_EN1__RST_COMP                          0x2000
@@ -298,7 +298,7 @@
 #define ERR_PAGE_ADDR1                          0x490
 #define     ERR_PAGE_ADDR1__VALUE                       0xffff
 
-#define ERR_BLOCK_ADDR1                 0x4a0
+#define ERR_BLOCK_ADDR1                         0x4a0
 #define     ERR_BLOCK_ADDR1__VALUE                      0xffff
 
 #define INTR_STATUS2                            0x4b0
@@ -325,12 +325,12 @@
 #define     INTR_EN2__DMA_CMD_COMP                      0x0004
 #define     INTR_EN2__TIME_OUT                          0x0008
 #define     INTR_EN2__PROGRAM_FAIL                      0x0010
-#define     INTR_EN2__ERASE_FAIL                                0x0020
+#define     INTR_EN2__ERASE_FAIL                        0x0020
 #define     INTR_EN2__LOAD_COMP                         0x0040
 #define     INTR_EN2__PROGRAM_COMP                      0x0080
-#define     INTR_EN2__ERASE_COMP                                0x0100
+#define     INTR_EN2__ERASE_COMP                        0x0100
 #define     INTR_EN2__PIPE_CPYBCK_CMD_COMP              0x0200
-#define     INTR_EN2__LOCKED_BLK                                0x0400
+#define     INTR_EN2__LOCKED_BLK                        0x0400
 #define     INTR_EN2__UNSUP_CMD                         0x0800
 #define     INTR_EN2__INT_ACT                           0x1000
 #define     INTR_EN2__RST_COMP                          0x2000
@@ -343,7 +343,7 @@
 #define ERR_PAGE_ADDR2                          0x4e0
 #define     ERR_PAGE_ADDR2__VALUE                       0xffff
 
-#define ERR_BLOCK_ADDR2                 0x4f0
+#define ERR_BLOCK_ADDR2                         0x4f0
 #define     ERR_BLOCK_ADDR2__VALUE                      0xffff
 
 #define INTR_STATUS3                            0x500
@@ -370,12 +370,12 @@
 #define     INTR_EN3__DMA_CMD_COMP                      0x0004
 #define     INTR_EN3__TIME_OUT                          0x0008
 #define     INTR_EN3__PROGRAM_FAIL                      0x0010
-#define     INTR_EN3__ERASE_FAIL                                0x0020
+#define     INTR_EN3__ERASE_FAIL                        0x0020
 #define     INTR_EN3__LOAD_COMP                         0x0040
 #define     INTR_EN3__PROGRAM_COMP                      0x0080
-#define     INTR_EN3__ERASE_COMP                                0x0100
+#define     INTR_EN3__ERASE_COMP                        0x0100
 #define     INTR_EN3__PIPE_CPYBCK_CMD_COMP              0x0200
-#define     INTR_EN3__LOCKED_BLK                                0x0400
+#define     INTR_EN3__LOCKED_BLK                        0x0400
 #define     INTR_EN3__UNSUP_CMD                         0x0800
 #define     INTR_EN3__INT_ACT                           0x1000
 #define     INTR_EN3__RST_COMP                          0x2000
@@ -388,7 +388,7 @@
 #define ERR_PAGE_ADDR3                          0x530
 #define     ERR_PAGE_ADDR3__VALUE                       0xffff
 
-#define ERR_BLOCK_ADDR3                 0x540
+#define ERR_BLOCK_ADDR3                         0x540
 #define     ERR_BLOCK_ADDR3__VALUE                      0xffff
 
 #define DATA_INTR                               0x550
@@ -412,9 +412,9 @@
 #define     GPREG_3__VALUE                              0xffff
 
 #define ECC_THRESHOLD                           0x600
-#define     ECC_THRESHOLD__VALUE                                0x03ff
+#define     ECC_THRESHOLD__VALUE                        0x03ff
 
-#define ECC_ERROR_BLOCK_ADDRESS         0x610
+#define ECC_ERROR_BLOCK_ADDRESS                 0x610
 #define     ECC_ERROR_BLOCK_ADDRESS__VALUE              0xffff
 
 #define ECC_ERROR_PAGE_ADDRESS                  0x620
@@ -466,7 +466,7 @@
 #define     CHNL_ACTIVE__CHANNEL3                       0x0008
 
 #define ACTIVE_SRC_ID                           0x800
-#define     ACTIVE_SRC_ID__VALUE                                0x00ff
+#define     ACTIVE_SRC_ID__VALUE                        0x00ff
 
 #define PTN_INTR                                        0x810
 #define     PTN_INTR__CONFIG_ERROR                      0x0001
@@ -485,7 +485,7 @@
 #define     PTN_INTR_EN__REG_ACCESS_ERROR               0x0020
 
 #define PERM_SRC_ID_0                           0x830
-#define     PERM_SRC_ID_0__SRCID                                0x00ff
+#define     PERM_SRC_ID_0__SRCID                        0x00ff
 #define     PERM_SRC_ID_0__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_0__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_0__READ_ACTIVE                  0x4000
@@ -502,7 +502,7 @@
 #define     MIN_MAX_BANK_0__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_1                           0x870
-#define     PERM_SRC_ID_1__SRCID                                0x00ff
+#define     PERM_SRC_ID_1__SRCID                        0x00ff
 #define     PERM_SRC_ID_1__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_1__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_1__READ_ACTIVE                  0x4000
@@ -519,7 +519,7 @@
 #define     MIN_MAX_BANK_1__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_2                           0x8b0
-#define     PERM_SRC_ID_2__SRCID                                0x00ff
+#define     PERM_SRC_ID_2__SRCID                        0x00ff
 #define     PERM_SRC_ID_2__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_2__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_2__READ_ACTIVE                  0x4000
@@ -536,7 +536,7 @@
 #define     MIN_MAX_BANK_2__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_3                           0x8f0
-#define     PERM_SRC_ID_3__SRCID                                0x00ff
+#define     PERM_SRC_ID_3__SRCID                        0x00ff
 #define     PERM_SRC_ID_3__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_3__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_3__READ_ACTIVE                  0x4000
@@ -553,7 +553,7 @@
 #define     MIN_MAX_BANK_3__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_4                           0x930
-#define     PERM_SRC_ID_4__SRCID                                0x00ff
+#define     PERM_SRC_ID_4__SRCID                        0x00ff
 #define     PERM_SRC_ID_4__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_4__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_4__READ_ACTIVE                  0x4000
@@ -570,7 +570,7 @@
 #define     MIN_MAX_BANK_4__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_5                           0x970
-#define     PERM_SRC_ID_5__SRCID                                0x00ff
+#define     PERM_SRC_ID_5__SRCID                        0x00ff
 #define     PERM_SRC_ID_5__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_5__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_5__READ_ACTIVE                  0x4000
@@ -587,7 +587,7 @@
 #define     MIN_MAX_BANK_5__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_6                           0x9b0
-#define     PERM_SRC_ID_6__SRCID                                0x00ff
+#define     PERM_SRC_ID_6__SRCID                        0x00ff
 #define     PERM_SRC_ID_6__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_6__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_6__READ_ACTIVE                  0x4000
@@ -604,7 +604,7 @@
 #define     MIN_MAX_BANK_6__MAX_VALUE                   0x000c
 
 #define PERM_SRC_ID_7                           0x9f0
-#define     PERM_SRC_ID_7__SRCID                                0x00ff
+#define     PERM_SRC_ID_7__SRCID                        0x00ff
 #define     PERM_SRC_ID_7__DIRECT_ACCESS_ACTIVE         0x0800
 #define     PERM_SRC_ID_7__WRITE_ACTIVE                 0x2000
 #define     PERM_SRC_ID_7__READ_ACTIVE                  0x4000
@@ -620,47 +620,6 @@
 #define     MIN_MAX_BANK_7__MIN_VALUE                   0x0003
 #define     MIN_MAX_BANK_7__MAX_VALUE                   0x000c
 
-/* flash.h */
-struct device_info_tag {
-        uint16_t wDeviceMaker;
-        uint16_t wDeviceID;
-        uint8_t  bDeviceParam0;
-        uint8_t  bDeviceParam1;
-        uint8_t  bDeviceParam2;
-        uint32_t wDeviceType;
-        uint32_t wSpectraStartBlock;
-        uint32_t wSpectraEndBlock;
-        uint32_t wTotalBlocks;
-        uint16_t wPagesPerBlock;
-        uint16_t wPageSize;
-        uint16_t wPageDataSize;
-        uint16_t wPageSpareSize;
-        uint16_t wNumPageSpareFlag;
-        uint16_t wECCBytesPerSector;
-        uint32_t wBlockSize;
-        uint32_t wBlockDataSize;
-        uint32_t wDataBlockNum;
-        uint8_t bPlaneNum;
-        uint16_t wDeviceMainAreaSize;
-        uint16_t wDeviceSpareAreaSize;
-        uint16_t wDevicesConnected;
-        uint16_t wDeviceWidth;
-        uint16_t wHWRevision;
-        uint16_t wHWFeatures;
-
-        uint16_t wONFIDevFeatures;
-        uint16_t wONFIOptCommands;
-        uint16_t wONFITimingMode;
-        uint16_t wONFIPgmCacheTimingMode;
-
-        uint16_t MLCDevice;
-        uint16_t wSpareSkipBytes;
-
-        uint8_t nBitsInPageNumber;
-        uint8_t nBitsInPageDataSize;
-        uint8_t nBitsInBlockDataSize;
-};
-
 /* ffsdefs.h */
 #define CLEAR 0                 /*use this to clear a field instead of "fail"*/
 #define SET   1                 /*use this to set a field instead of "pass"*/
@@ -684,11 +643,11 @@ struct device_info_tag {
 #define NAND_DBG_TRACE 3
 
 #ifdef VERBOSE
-#define nand_dbg_print(level, args...)                  \
-        do {                                            \
-                if (level <= nand_debug_level)          \
-                        printk(KERN_ALERT args);        \
-        } while (0)
+#define nand_dbg_print(level, args...)                          \
+        do {                                                    \
+                        if (level <= nand_debug_level)          \
+                                printk(KERN_ALERT args);        \
+        } while (0)
 #else
 #define nand_dbg_print(level, args...)
 #endif
@@ -772,10 +731,9 @@ struct device_info_tag {
 #define ECC_SECTOR_SIZE     512
 #define LLD_MAX_FLASH_BANKS     4
 
-#define DENALI_BUF_SIZE         NAND_MAX_PAGESIZE + NAND_MAX_OOBSIZE
+#define DENALI_BUF_SIZE         (NAND_MAX_PAGESIZE + NAND_MAX_OOBSIZE)
 
-struct nand_buf
-{
+struct nand_buf {
         int head;
         int tail;
         uint8_t buf[DENALI_BUF_SIZE];
@@ -788,7 +746,6 @@ struct nand_buf
 struct denali_nand_info {
         struct mtd_info mtd;
         struct nand_chip nand;
-        struct device_info_tag dev_info;
         int flash_bank; /* currently selected chip */
         int status;
         int platform;
@@ -806,11 +763,12 @@ struct denali_nand_info {
         uint32_t irq_status;
         int irq_debug_array[32];
         int idx;
-};
 
-static uint16_t  NAND_Flash_Reset(struct denali_nand_info *denali);
-static uint16_t  NAND_Read_Device_ID(struct denali_nand_info *denali);
-static void NAND_LLD_Enable_Disable_Interrupts(struct denali_nand_info *denali, uint16_t INT_ENABLE);
+        uint32_t devnum;        /* represent how many nands connected */
+        uint32_t fwblks; /* represent how many blocks FW used */
+        uint32_t totalblks;
+        uint32_t blksperchip;
+        uint32_t bbtskipbytes;
+};
 
 #endif /*_LLD_NAND_*/
-
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 47067bc98248..b7f8de7b2780 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -29,7 +29,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/doc2000.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/inftl.h>
 
@@ -146,6 +145,7 @@ static int doc_ecc_decode(struct rs_control *rs, uint8_t *data, uint8_t *ecc)
         uint8_t parity;
         uint16_t ds[4], s[5], tmp, errval[8], syn[4];
 
+        memset(syn, 0, sizeof(syn));
         /* Convert the ecc bytes into words */
         ds[0] = ((ecc[4] & 0xff) >> 0) | ((ecc[5] & 0x03) << 8);
         ds[1] = ((ecc[5] & 0xfc) >> 2) | ((ecc[2] & 0x0f) << 6);
@@ -169,9 +169,9 @@ static int doc_ecc_decode(struct rs_control *rs, uint8_t *data, uint8_t *ecc)
                         s[i] ^= rs->alpha_to[rs_modnn(rs, tmp + (FCR + i) * j)];
         }
 
-        /* Calc s[i] = s[i] / alpha^(v + i) */
+        /* Calc syn[i] = s[i] / alpha^(v + i) */
         for (i = 0; i < NROOTS; i++) {
-                if (syn[i])
+                if (s[i])
                         syn[i] = rs_modnn(rs, rs->index_of[s[i]] + (NN - FCR - i));
         }
         /* Call the decoder library */
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 0d76b169482f..fcf8ceb277d4 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -39,60 +39,96 @@
 
 #define nfc_is_v21()            (cpu_is_mx25() || cpu_is_mx35())
 #define nfc_is_v1()             (cpu_is_mx31() || cpu_is_mx27() || cpu_is_mx21())
+#define nfc_is_v3_2()           cpu_is_mx51()
+#define nfc_is_v3()             nfc_is_v3_2()
 
 /* Addresses for NFC registers */
-#define NFC_BUF_SIZE            0xE00
-#define NFC_BUF_ADDR            0xE04
-#define NFC_FLASH_ADDR          0xE06
-#define NFC_FLASH_CMD           0xE08
-#define NFC_CONFIG              0xE0A
-#define NFC_ECC_STATUS_RESULT   0xE0C
-#define NFC_RSLTMAIN_AREA       0xE0E
-#define NFC_RSLTSPARE_AREA      0xE10
-#define NFC_WRPROT              0xE12
-#define NFC_V1_UNLOCKSTART_BLKADDR      0xe14
-#define NFC_V1_UNLOCKEND_BLKADDR        0xe16
-#define NFC_V21_UNLOCKSTART_BLKADDR     0xe20
-#define NFC_V21_UNLOCKEND_BLKADDR       0xe22
-#define NFC_NF_WRPRST           0xE18
-#define NFC_CONFIG1             0xE1A
-#define NFC_CONFIG2             0xE1C
-
-/* Set INT to 0, FCMD to 1, rest to 0 in NFC_CONFIG2 Register
- * for Command operation */
-#define NFC_CMD            0x1
-
-/* Set INT to 0, FADD to 1, rest to 0 in NFC_CONFIG2 Register
- * for Address operation */
-#define NFC_ADDR           0x2
-
-/* Set INT to 0, FDI to 1, rest to 0 in NFC_CONFIG2 Register
- * for Input operation */
-#define NFC_INPUT          0x4
-
-/* Set INT to 0, FDO to 001, rest to 0 in NFC_CONFIG2 Register
- * for Data Output operation */
-#define NFC_OUTPUT         0x8
-
-/* Set INT to 0, FD0 to 010, rest to 0 in NFC_CONFIG2 Register
- * for Read ID operation */
-#define NFC_ID             0x10
-
-/* Set INT to 0, FDO to 100, rest to 0 in NFC_CONFIG2 Register
- * for Read Status operation */
-#define NFC_STATUS         0x20
-
-/* Set INT to 1, rest to 0 in NFC_CONFIG2 Register for Read
- * Status operation */
-#define NFC_INT            0x8000
-
-#define NFC_SP_EN           (1 << 2)
-#define NFC_ECC_EN          (1 << 3)
-#define NFC_INT_MSK         (1 << 4)
-#define NFC_BIG             (1 << 5)
-#define NFC_RST             (1 << 6)
-#define NFC_CE              (1 << 7)
-#define NFC_ONE_CYCLE       (1 << 8)
+#define NFC_V1_V2_BUF_SIZE              (host->regs + 0x00)
+#define NFC_V1_V2_BUF_ADDR              (host->regs + 0x04)
+#define NFC_V1_V2_FLASH_ADDR            (host->regs + 0x06)
+#define NFC_V1_V2_FLASH_CMD             (host->regs + 0x08)
+#define NFC_V1_V2_CONFIG                (host->regs + 0x0a)
+#define NFC_V1_V2_ECC_STATUS_RESULT     (host->regs + 0x0c)
+#define NFC_V1_V2_RSLTMAIN_AREA         (host->regs + 0x0e)
+#define NFC_V1_V2_RSLTSPARE_AREA        (host->regs + 0x10)
+#define NFC_V1_V2_WRPROT                (host->regs + 0x12)
+#define NFC_V1_UNLOCKSTART_BLKADDR      (host->regs + 0x14)
+#define NFC_V1_UNLOCKEND_BLKADDR        (host->regs + 0x16)
+#define NFC_V21_UNLOCKSTART_BLKADDR     (host->regs + 0x20)
+#define NFC_V21_UNLOCKEND_BLKADDR       (host->regs + 0x22)
+#define NFC_V1_V2_NF_WRPRST             (host->regs + 0x18)
+#define NFC_V1_V2_CONFIG1               (host->regs + 0x1a)
+#define NFC_V1_V2_CONFIG2               (host->regs + 0x1c)
+
+#define NFC_V2_CONFIG1_ECC_MODE_4       (1 << 0)
+#define NFC_V1_V2_CONFIG1_SP_EN         (1 << 2)
+#define NFC_V1_V2_CONFIG1_ECC_EN        (1 << 3)
+#define NFC_V1_V2_CONFIG1_INT_MSK       (1 << 4)
+#define NFC_V1_V2_CONFIG1_BIG           (1 << 5)
+#define NFC_V1_V2_CONFIG1_RST           (1 << 6)
+#define NFC_V1_V2_CONFIG1_CE            (1 << 7)
+#define NFC_V1_V2_CONFIG1_ONE_CYCLE     (1 << 8)
+
+#define NFC_V1_V2_CONFIG2_INT           (1 << 15)
+
+/*
+ * Operation modes for the NFC. Valid for v1, v2 and v3
+ * type controllers.
+ */
+#define NFC_CMD                         (1 << 0)
+#define NFC_ADDR                        (1 << 1)
+#define NFC_INPUT                       (1 << 2)
+#define NFC_OUTPUT                      (1 << 3)
+#define NFC_ID                          (1 << 4)
+#define NFC_STATUS                      (1 << 5)
+
+#define NFC_V3_FLASH_CMD                (host->regs_axi + 0x00)
+#define NFC_V3_FLASH_ADDR0              (host->regs_axi + 0x04)
+
+#define NFC_V3_CONFIG1                  (host->regs_axi + 0x34)
+#define NFC_V3_CONFIG1_SP_EN            (1 << 0)
+#define NFC_V3_CONFIG1_RBA(x)           (((x) & 0x7 ) << 4)
+
+#define NFC_V3_ECC_STATUS_RESULT        (host->regs_axi + 0x38)
+
+#define NFC_V3_LAUNCH                   (host->regs_axi + 0x40)
+
+#define NFC_V3_WRPROT                   (host->regs_ip + 0x0)
+#define NFC_V3_WRPROT_LOCK_TIGHT        (1 << 0)
+#define NFC_V3_WRPROT_LOCK              (1 << 1)
+#define NFC_V3_WRPROT_UNLOCK            (1 << 2)
+#define NFC_V3_WRPROT_BLS_UNLOCK        (2 << 6)
+
+#define NFC_V3_WRPROT_UNLOCK_BLK_ADD0   (host->regs_ip + 0x04)
+
+#define NFC_V3_CONFIG2                  (host->regs_ip + 0x24)
+#define NFC_V3_CONFIG2_PS_512                   (0 << 0)
+#define NFC_V3_CONFIG2_PS_2048                  (1 << 0)
+#define NFC_V3_CONFIG2_PS_4096                  (2 << 0)
+#define NFC_V3_CONFIG2_ONE_CYCLE                (1 << 2)
+#define NFC_V3_CONFIG2_ECC_EN                   (1 << 3)
+#define NFC_V3_CONFIG2_2CMD_PHASES              (1 << 4)
+#define NFC_V3_CONFIG2_NUM_ADDR_PHASE0          (1 << 5)
+#define NFC_V3_CONFIG2_ECC_MODE_8               (1 << 6)
+#define NFC_V3_CONFIG2_PPB(x)                   (((x) & 0x3) << 7)
+#define NFC_V3_CONFIG2_NUM_ADDR_PHASE1(x)       (((x) & 0x3) << 12)
+#define NFC_V3_CONFIG2_INT_MSK                  (1 << 15)
+#define NFC_V3_CONFIG2_ST_CMD(x)                (((x) & 0xff) << 24)
+#define NFC_V3_CONFIG2_SPAS(x)                  (((x) & 0xff) << 16)
+
+#define NFC_V3_CONFIG3                          (host->regs_ip + 0x28)
+#define NFC_V3_CONFIG3_ADD_OP(x)                (((x) & 0x3) << 0)
+#define NFC_V3_CONFIG3_FW8                      (1 << 3)
+#define NFC_V3_CONFIG3_SBB(x)                   (((x) & 0x7) << 8)
+#define NFC_V3_CONFIG3_NUM_OF_DEVICES(x)        (((x) & 0x7) << 12)
+#define NFC_V3_CONFIG3_RBB_MODE                 (1 << 15)
+#define NFC_V3_CONFIG3_NO_SDMA                  (1 << 20)
+
+#define NFC_V3_IPC                      (host->regs_ip + 0x2C)
+#define NFC_V3_IPC_CREQ                 (1 << 0)
+#define NFC_V3_IPC_INT                  (1 << 31)
+
+#define NFC_V3_DELAY_LINE               (host->regs_ip + 0x34)
 
 struct mxc_nand_host {
         struct mtd_info         mtd;
@@ -102,20 +138,30 @@ struct mxc_nand_host {
 
         void                    *spare0;
         void                    *main_area0;
-        void                    *main_area1;
 
         void __iomem            *base;
         void __iomem            *regs;
+        void __iomem            *regs_axi;
+        void __iomem            *regs_ip;
         int                     status_request;
         struct clk              *clk;
         int                     clk_act;
         int                     irq;
+        int                     eccsize;
 
         wait_queue_head_t       irq_waitq;
 
         uint8_t                 *data_buf;
         unsigned int            buf_start;
         int                     spare_len;
+
+        void                    (*preset)(struct mtd_info *);
+        void                    (*send_cmd)(struct mxc_nand_host *, uint16_t, int);
+        void                    (*send_addr)(struct mxc_nand_host *, uint16_t, int);
+        void                    (*send_page)(struct mtd_info *, unsigned int);
+        void                    (*send_read_id)(struct mxc_nand_host *);
+        uint16_t                (*get_dev_status)(struct mxc_nand_host *);
+        int                     (*check_int)(struct mxc_nand_host *);
 };
 
 /* OOB placement block for use with hardware ecc generation */
@@ -175,34 +221,52 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+static int check_int_v3(struct mxc_nand_host *host)
+{
+        uint32_t tmp;
+
+        tmp = readl(NFC_V3_IPC);
+        if (!(tmp & NFC_V3_IPC_INT))
+                return 0;
+
+        tmp &= ~NFC_V3_IPC_INT;
+        writel(tmp, NFC_V3_IPC);
+
+        return 1;
+}
+
+static int check_int_v1_v2(struct mxc_nand_host *host)
+{
+        uint32_t tmp;
+
+        tmp = readw(NFC_V1_V2_CONFIG2);
+        if (!(tmp & NFC_V1_V2_CONFIG2_INT))
+                return 0;
+
+        writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
+
+        return 1;
+}
+
 /* This function polls the NANDFC to wait for the basic operation to
  * complete by checking the INT bit of config2 register.
  */
 static void wait_op_done(struct mxc_nand_host *host, int useirq)
 {
-        uint16_t tmp;
         int max_retries = 8000;
 
         if (useirq) {
-                if ((readw(host->regs + NFC_CONFIG2) & NFC_INT) == 0) {
+                if (!host->check_int(host)) {
 
                         enable_irq(host->irq);
 
-                        wait_event(host->irq_waitq,
-                                readw(host->regs + NFC_CONFIG2) & NFC_INT);
-
-                        tmp = readw(host->regs + NFC_CONFIG2);
-                        tmp  &= ~NFC_INT;
-                        writew(tmp, host->regs + NFC_CONFIG2);
+                        wait_event(host->irq_waitq, host->check_int(host));
                 }
         } else {
                 while (max_retries-- > 0) {
-                        if (readw(host->regs + NFC_CONFIG2) & NFC_INT) {
-                                tmp = readw(host->regs + NFC_CONFIG2);
-                                tmp  &= ~NFC_INT;
-                                writew(tmp, host->regs + NFC_CONFIG2);
+                        if (host->check_int(host))
                                 break;
-                        }
+
                         udelay(1);
                 }
                 if (max_retries < 0)
@@ -211,21 +275,33 @@ static void wait_op_done(struct mxc_nand_host *host, int useirq)
         }
 }
 
+static void send_cmd_v3(struct mxc_nand_host *host, uint16_t cmd, int useirq)
+{
+        /* fill command */
+        writel(cmd, NFC_V3_FLASH_CMD);
+
+        /* send out command */
+        writel(NFC_CMD, NFC_V3_LAUNCH);
+
+        /* Wait for operation to complete */
+        wait_op_done(host, useirq);
+}
+
 /* This function issues the specified command to the NAND device and
  * waits for completion. */
-static void send_cmd(struct mxc_nand_host *host, uint16_t cmd, int useirq)
+static void send_cmd_v1_v2(struct mxc_nand_host *host, uint16_t cmd, int useirq)
 {
         DEBUG(MTD_DEBUG_LEVEL3, "send_cmd(host, 0x%x, %d)\n", cmd, useirq);
 
-        writew(cmd, host->regs + NFC_FLASH_CMD);
-        writew(NFC_CMD, host->regs + NFC_CONFIG2);
+        writew(cmd, NFC_V1_V2_FLASH_CMD);
+        writew(NFC_CMD, NFC_V1_V2_CONFIG2);
 
         if (cpu_is_mx21() && (cmd == NAND_CMD_RESET)) {
                 int max_retries = 100;
                 /* Reset completion is indicated by NFC_CONFIG2 */
                 /* being set to 0 */
                 while (max_retries-- > 0) {
-                        if (readw(host->regs + NFC_CONFIG2) == 0) {
+                        if (readw(NFC_V1_V2_CONFIG2) == 0) {
                                 break;
                         }
                         udelay(1);
@@ -239,21 +315,48 @@ static void send_cmd(struct mxc_nand_host *host, uint16_t cmd, int useirq)
         }
 }
 
+static void send_addr_v3(struct mxc_nand_host *host, uint16_t addr, int islast)
+{
+        /* fill address */
+        writel(addr, NFC_V3_FLASH_ADDR0);
+
+        /* send out address */
+        writel(NFC_ADDR, NFC_V3_LAUNCH);
+
+        wait_op_done(host, 0);
+}
+
 /* This function sends an address (or partial address) to the
  * NAND device. The address is used to select the source/destination for
  * a NAND command. */
-static void send_addr(struct mxc_nand_host *host, uint16_t addr, int islast)
+static void send_addr_v1_v2(struct mxc_nand_host *host, uint16_t addr, int islast)
 {
         DEBUG(MTD_DEBUG_LEVEL3, "send_addr(host, 0x%x %d)\n", addr, islast);
 
-        writew(addr, host->regs + NFC_FLASH_ADDR);
-        writew(NFC_ADDR, host->regs + NFC_CONFIG2);
+        writew(addr, NFC_V1_V2_FLASH_ADDR);
+        writew(NFC_ADDR, NFC_V1_V2_CONFIG2);
 
         /* Wait for operation to complete */
         wait_op_done(host, islast);
 }
 
-static void send_page(struct mtd_info *mtd, unsigned int ops)
+static void send_page_v3(struct mtd_info *mtd, unsigned int ops)
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
+        uint32_t tmp;
+
+        tmp = readl(NFC_V3_CONFIG1);
+        tmp &= ~(7 << 4);
+        writel(tmp, NFC_V3_CONFIG1);
+
+        /* transfer data from NFC ram to nand */
+        writel(ops, NFC_V3_LAUNCH);
+
+        wait_op_done(host, false);
+}
+
+static void send_page_v1_v2(struct mtd_info *mtd, unsigned int ops)
 {
         struct nand_chip *nand_chip = mtd->priv;
         struct mxc_nand_host *host = nand_chip->priv;
@@ -267,24 +370,34 @@ static void send_page(struct mtd_info *mtd, unsigned int ops)
         for (i = 0; i < bufs; i++) {
 
                 /* NANDFC buffer 0 is used for page read/write */
-                writew(i, host->regs + NFC_BUF_ADDR);
+                writew(i, NFC_V1_V2_BUF_ADDR);
 
-                writew(ops, host->regs + NFC_CONFIG2);
+                writew(ops, NFC_V1_V2_CONFIG2);
 
                 /* Wait for operation to complete */
                 wait_op_done(host, true);
         }
 }
 
+static void send_read_id_v3(struct mxc_nand_host *host)
+{
+        /* Read ID into main buffer */
+        writel(NFC_ID, NFC_V3_LAUNCH);
+
+        wait_op_done(host, true);
+
+        memcpy(host->data_buf, host->main_area0, 16);
+}
+
 /* Request the NANDFC to perform a read of the NAND device ID. */
-static void send_read_id(struct mxc_nand_host *host)
+static void send_read_id_v1_v2(struct mxc_nand_host *host)
 {
         struct nand_chip *this = &host->nand;
 
         /* NANDFC buffer 0 is used for device ID output */
-        writew(0x0, host->regs + NFC_BUF_ADDR);
+        writew(0x0, NFC_V1_V2_BUF_ADDR);
 
-        writew(NFC_ID, host->regs + NFC_CONFIG2);
+        writew(NFC_ID, NFC_V1_V2_CONFIG2);
 
         /* Wait for operation to complete */
         wait_op_done(host, true);
@@ -301,29 +414,36 @@ static void send_read_id(struct mxc_nand_host *host)
         memcpy(host->data_buf, host->main_area0, 16);
 }
 
+static uint16_t get_dev_status_v3(struct mxc_nand_host *host)
+{
+        writew(NFC_STATUS, NFC_V3_LAUNCH);
+        wait_op_done(host, true);
+
+        return readl(NFC_V3_CONFIG1) >> 16;
+}
+
 /* This function requests the NANDFC to perform a read of the
  * NAND device status and returns the current status. */
-static uint16_t get_dev_status(struct mxc_nand_host *host)
+static uint16_t get_dev_status_v1_v2(struct mxc_nand_host *host)
 {
-        void __iomem *main_buf = host->main_area1;
+        void __iomem *main_buf = host->main_area0;
         uint32_t store;
         uint16_t ret;
-        /* Issue status request to NAND device */
 
-        /* store the main area1 first word, later do recovery */
-        store = readl(main_buf);
-        /* NANDFC buffer 1 is used for device status to prevent
-         * corruption of read/write buffer on status requests. */
-        writew(1, host->regs + NFC_BUF_ADDR);
+        writew(0x0, NFC_V1_V2_BUF_ADDR);
 
-        writew(NFC_STATUS, host->regs + NFC_CONFIG2);
+        /*
+         * The device status is stored in main_area0. To
+         * prevent corruption of the buffer save the value
+         * and restore it afterwards.
+         */
+        store = readl(main_buf);
 
-        /* Wait for operation to complete */
+        writew(NFC_STATUS, NFC_V1_V2_CONFIG2);
         wait_op_done(host, true);
 
-        /* Status is placed in first word of main buffer */
-        /* get status, then recovery area 1 data */
         ret = readw(main_buf);
+
         writel(store, main_buf);
 
         return ret;
@@ -347,7 +467,7 @@ static void mxc_nand_enable_hwecc(struct mtd_info *mtd, int mode)
          */
 }
 
-static int mxc_nand_correct_data(struct mtd_info *mtd, u_char *dat,
+static int mxc_nand_correct_data_v1(struct mtd_info *mtd, u_char *dat,
                                  u_char *read_ecc, u_char *calc_ecc)
 {
         struct nand_chip *nand_chip = mtd->priv;
@@ -358,7 +478,7 @@ static int mxc_nand_correct_data(struct mtd_info *mtd, u_char *dat,
          * additional correction.  2-Bit errors cannot be corrected by
          * HW ECC, so we need to return failure
          */
-        uint16_t ecc_status = readw(host->regs + NFC_ECC_STATUS_RESULT);
+        uint16_t ecc_status = readw(NFC_V1_V2_ECC_STATUS_RESULT);
 
         if (((ecc_status & 0x3) == 2) || ((ecc_status >> 2) == 2)) {
                 DEBUG(MTD_DEBUG_LEVEL0,
@@ -369,6 +489,43 @@ static int mxc_nand_correct_data(struct mtd_info *mtd, u_char *dat,
         return 0;
 }
 
+static int mxc_nand_correct_data_v2_v3(struct mtd_info *mtd, u_char *dat,
+                                 u_char *read_ecc, u_char *calc_ecc)
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
+        u32 ecc_stat, err;
+        int no_subpages = 1;
+        int ret = 0;
+        u8 ecc_bit_mask, err_limit;
+
+        ecc_bit_mask = (host->eccsize == 4) ? 0x7 : 0xf;
+        err_limit = (host->eccsize == 4) ? 0x4 : 0x8;
+
+        no_subpages = mtd->writesize >> 9;
+
+        if (nfc_is_v21())
+                ecc_stat = readl(NFC_V1_V2_ECC_STATUS_RESULT);
+        else
+                ecc_stat = readl(NFC_V3_ECC_STATUS_RESULT);
+
+        do {
+                err = ecc_stat & ecc_bit_mask;
+                if (err > err_limit) {
+                        printk(KERN_WARNING "UnCorrectable RS-ECC Error\n");
+                        return -1;
+                } else {
+                        ret += err;
+                }
+                ecc_stat >>= 4;
+        } while (--no_subpages);
+
+        mtd->ecc_stats.corrected += ret;
+        pr_debug("%d Symbol Correctable RS-ECC Error\n", ret);
+
+        return ret;
+}
+
 static int mxc_nand_calculate_ecc(struct mtd_info *mtd, const u_char *dat,
                                   u_char *ecc_code)
 {
@@ -383,7 +540,7 @@ static u_char mxc_nand_read_byte(struct mtd_info *mtd)
 
         /* Check for status request */
         if (host->status_request)
-                return get_dev_status(host) & 0xFF;
+                return host->get_dev_status(host) & 0xFF;
 
         ret = *(uint8_t *)(host->data_buf + host->buf_start);
         host->buf_start++;
@@ -519,71 +676,163 @@ static void mxc_do_addr_cycle(struct mtd_info *mtd, int column, int page_addr)
                  * we will used the saved column address to index into
                  * the full page.
                  */
-                send_addr(host, 0, page_addr == -1);
+                host->send_addr(host, 0, page_addr == -1);
                 if (mtd->writesize > 512)
                         /* another col addr cycle for 2k page */
-                        send_addr(host, 0, false);
+                        host->send_addr(host, 0, false);
         }
 
         /* Write out page address, if necessary */
         if (page_addr != -1) {
                 /* paddr_0 - p_addr_7 */
-                send_addr(host, (page_addr & 0xff), false);
+                host->send_addr(host, (page_addr & 0xff), false);
 
                 if (mtd->writesize > 512) {
                         if (mtd->size >= 0x10000000) {
                                 /* paddr_8 - paddr_15 */
-                                send_addr(host, (page_addr >> 8) & 0xff, false);
-                                send_addr(host, (page_addr >> 16) & 0xff, true);
+                                host->send_addr(host, (page_addr >> 8) & 0xff, false);
+                                host->send_addr(host, (page_addr >> 16) & 0xff, true);
                         } else
                                 /* paddr_8 - paddr_15 */
-                                send_addr(host, (page_addr >> 8) & 0xff, true);
+                                host->send_addr(host, (page_addr >> 8) & 0xff, true);
                 } else {
                         /* One more address cycle for higher density devices */
                         if (mtd->size >= 0x4000000) {
                                 /* paddr_8 - paddr_15 */
-                                send_addr(host, (page_addr >> 8) & 0xff, false);
-                                send_addr(host, (page_addr >> 16) & 0xff, true);
+                                host->send_addr(host, (page_addr >> 8) & 0xff, false);
+                                host->send_addr(host, (page_addr >> 16) & 0xff, true);
                         } else
                                 /* paddr_8 - paddr_15 */
-                                send_addr(host, (page_addr >> 8) & 0xff, true);
+                                host->send_addr(host, (page_addr >> 8) & 0xff, true);
                 }
         }
 }
 
-static void preset(struct mtd_info *mtd)
+/*
+ * v2 and v3 type controllers can do 4bit or 8bit ecc depending
+ * on how much oob the nand chip has. For 8bit ecc we need at least
+ * 26 bytes of oob data per 512 byte block.
+ */
+static int get_eccsize(struct mtd_info *mtd)
+{
+        int oobbytes_per_512 = 0;
+
+        oobbytes_per_512 = mtd->oobsize * 512 / mtd->writesize;
+
+        if (oobbytes_per_512 < 26)
+                return 4;
+        else
+                return 8;
+}
+
+static void preset_v1_v2(struct mtd_info *mtd)
 {
         struct nand_chip *nand_chip = mtd->priv;
         struct mxc_nand_host *host = nand_chip->priv;
         uint16_t tmp;
 
         /* enable interrupt, disable spare enable */
-        tmp = readw(host->regs + NFC_CONFIG1);
-        tmp &= ~NFC_INT_MSK;
-        tmp &= ~NFC_SP_EN;
+        tmp = readw(NFC_V1_V2_CONFIG1);
+        tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
+        tmp &= ~NFC_V1_V2_CONFIG1_SP_EN;
         if (nand_chip->ecc.mode == NAND_ECC_HW) {
-                tmp |= NFC_ECC_EN;
+                tmp |= NFC_V1_V2_CONFIG1_ECC_EN;
+        } else {
+                tmp &= ~NFC_V1_V2_CONFIG1_ECC_EN;
+        }
+
+        if (nfc_is_v21() && mtd->writesize) {
+                host->eccsize = get_eccsize(mtd);
+                if (host->eccsize == 4)
+                        tmp |= NFC_V2_CONFIG1_ECC_MODE_4;
         } else {
-                tmp &= ~NFC_ECC_EN;
+                host->eccsize = 1;
         }
-        writew(tmp, host->regs + NFC_CONFIG1);
+
+        writew(tmp, NFC_V1_V2_CONFIG1);
         /* preset operation */
 
         /* Unlock the internal RAM Buffer */
-        writew(0x2, host->regs + NFC_CONFIG);
+        writew(0x2, NFC_V1_V2_CONFIG);
 
         /* Blocks to be unlocked */
         if (nfc_is_v21()) {
-                writew(0x0, host->regs + NFC_V21_UNLOCKSTART_BLKADDR);
-                writew(0xffff, host->regs + NFC_V21_UNLOCKEND_BLKADDR);
+                writew(0x0, NFC_V21_UNLOCKSTART_BLKADDR);
+                writew(0xffff, NFC_V21_UNLOCKEND_BLKADDR);
         } else if (nfc_is_v1()) {
-                writew(0x0, host->regs + NFC_V1_UNLOCKSTART_BLKADDR);
-                writew(0x4000, host->regs + NFC_V1_UNLOCKEND_BLKADDR);
+                writew(0x0, NFC_V1_UNLOCKSTART_BLKADDR);
+                writew(0x4000, NFC_V1_UNLOCKEND_BLKADDR);
         } else
                 BUG();
 
         /* Unlock Block Command for given address range */
-        writew(0x4, host->regs + NFC_WRPROT);
+        writew(0x4, NFC_V1_V2_WRPROT);
+}
+
+static void preset_v3(struct mtd_info *mtd)
+{
+        struct nand_chip *chip = mtd->priv;
+        struct mxc_nand_host *host = chip->priv;
+        uint32_t config2, config3;
+        int i, addr_phases;
+
+        writel(NFC_V3_CONFIG1_RBA(0), NFC_V3_CONFIG1);
+        writel(NFC_V3_IPC_CREQ, NFC_V3_IPC);
+
+        /* Unlock the internal RAM Buffer */
+        writel(NFC_V3_WRPROT_BLS_UNLOCK | NFC_V3_WRPROT_UNLOCK,
+                        NFC_V3_WRPROT);
+
+        /* Blocks to be unlocked */
+        for (i = 0; i < NAND_MAX_CHIPS; i++)
+                writel(0x0 |    (0xffff << 16),
+                                NFC_V3_WRPROT_UNLOCK_BLK_ADD0 + (i << 2));
+
+        writel(0, NFC_V3_IPC);
+
+        config2 = NFC_V3_CONFIG2_ONE_CYCLE |
+                NFC_V3_CONFIG2_2CMD_PHASES |
+                NFC_V3_CONFIG2_SPAS(mtd->oobsize >> 1) |
+                NFC_V3_CONFIG2_ST_CMD(0x70) |
+                NFC_V3_CONFIG2_NUM_ADDR_PHASE0;
+
+        if (chip->ecc.mode == NAND_ECC_HW)
+                config2 |= NFC_V3_CONFIG2_ECC_EN;
+
+        addr_phases = fls(chip->pagemask) >> 3;
+
+        if (mtd->writesize == 2048) {
+                config2 |= NFC_V3_CONFIG2_PS_2048;
+                config2 |= NFC_V3_CONFIG2_NUM_ADDR_PHASE1(addr_phases);
+        } else if (mtd->writesize == 4096) {
+                config2 |= NFC_V3_CONFIG2_PS_4096;
+                config2 |= NFC_V3_CONFIG2_NUM_ADDR_PHASE1(addr_phases);
+        } else {
+                config2 |= NFC_V3_CONFIG2_PS_512;
+                config2 |= NFC_V3_CONFIG2_NUM_ADDR_PHASE1(addr_phases - 1);
+        }
+
+        if (mtd->writesize) {
+                config2 |= NFC_V3_CONFIG2_PPB(ffs(mtd->erasesize / mtd->writesize) - 6);
+                host->eccsize = get_eccsize(mtd);
+                if (host->eccsize == 8)
+                        config2 |= NFC_V3_CONFIG2_ECC_MODE_8;
+        }
+
+        writel(config2, NFC_V3_CONFIG2);
+
+        config3 = NFC_V3_CONFIG3_NUM_OF_DEVICES(0) |
+                        NFC_V3_CONFIG3_NO_SDMA |
+                        NFC_V3_CONFIG3_RBB_MODE |
+                        NFC_V3_CONFIG3_SBB(6) | /* Reset default */
+                        NFC_V3_CONFIG3_ADD_OP(0);
+
+        if (!(chip->options & NAND_BUSWIDTH_16))
+                config3 |= NFC_V3_CONFIG3_FW8;
+
+        writel(config3, NFC_V3_CONFIG3);
+
+        writel(0, NFC_V3_DELAY_LINE);
 }
 
 /* Used by the upper layer to write command to NAND Flash for
@@ -604,15 +853,15 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
         /* Command pre-processing step */
         switch (command) {
         case NAND_CMD_RESET:
-                send_cmd(host, command, false);
-                preset(mtd);
+                host->preset(mtd);
+                host->send_cmd(host, command, false);
                 break;
 
         case NAND_CMD_STATUS:
                 host->buf_start = 0;
                 host->status_request = true;
 
-                send_cmd(host, command, true);
+                host->send_cmd(host, command, true);
                 mxc_do_addr_cycle(mtd, column, page_addr);
                 break;
 
@@ -625,13 +874,13 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
 
                 command = NAND_CMD_READ0; /* only READ0 is valid */
 
-                send_cmd(host, command, false);
+                host->send_cmd(host, command, false);
                 mxc_do_addr_cycle(mtd, column, page_addr);
 
                 if (mtd->writesize > 512)
-                        send_cmd(host, NAND_CMD_READSTART, true);
+                        host->send_cmd(host, NAND_CMD_READSTART, true);
 
-                send_page(mtd, NFC_OUTPUT);
+                host->send_page(mtd, NFC_OUTPUT);
 
                 memcpy(host->data_buf, host->main_area0, mtd->writesize);
                 copy_spare(mtd, true);
@@ -644,28 +893,28 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
 
                 host->buf_start = column;
 
-                send_cmd(host, command, false);
+                host->send_cmd(host, command, false);
                 mxc_do_addr_cycle(mtd, column, page_addr);
                 break;
 
         case NAND_CMD_PAGEPROG:
                 memcpy(host->main_area0, host->data_buf, mtd->writesize);
                 copy_spare(mtd, false);
-                send_page(mtd, NFC_INPUT);
-                send_cmd(host, command, true);
+                host->send_page(mtd, NFC_INPUT);
+                host->send_cmd(host, command, true);
                 mxc_do_addr_cycle(mtd, column, page_addr);
                 break;
 
         case NAND_CMD_READID:
-                send_cmd(host, command, true);
+                host->send_cmd(host, command, true);
                 mxc_do_addr_cycle(mtd, column, page_addr);
-                send_read_id(host);
+                host->send_read_id(host);
                 host->buf_start = column;
                 break;
 
         case NAND_CMD_ERASE1:
         case NAND_CMD_ERASE2:
-                send_cmd(host, command, false);
+                host->send_cmd(host, command, false);
                 mxc_do_addr_cycle(mtd, column, page_addr);
 
                 break;
@@ -761,22 +1010,55 @@ static int __init mxcnd_probe(struct platform_device *pdev)
         }
 
         host->main_area0 = host->base;
-        host->main_area1 = host->base + 0x200;
+
+        if (nfc_is_v1() || nfc_is_v21()) {
+                host->preset = preset_v1_v2;
+                host->send_cmd = send_cmd_v1_v2;
+                host->send_addr = send_addr_v1_v2;
+                host->send_page = send_page_v1_v2;
+                host->send_read_id = send_read_id_v1_v2;
+                host->get_dev_status = get_dev_status_v1_v2;
+                host->check_int = check_int_v1_v2;
+        }
 
         if (nfc_is_v21()) {
-                host->regs = host->base + 0x1000;
+                host->regs = host->base + 0x1e00;
                 host->spare0 = host->base + 0x1000;
                 host->spare_len = 64;
                 oob_smallpage = &nandv2_hw_eccoob_smallpage;
                 oob_largepage = &nandv2_hw_eccoob_largepage;
                 this->ecc.bytes = 9;
         } else if (nfc_is_v1()) {
-                host->regs = host->base;
+                host->regs = host->base + 0xe00;
                 host->spare0 = host->base + 0x800;
                 host->spare_len = 16;
                 oob_smallpage = &nandv1_hw_eccoob_smallpage;
                 oob_largepage = &nandv1_hw_eccoob_largepage;
                 this->ecc.bytes = 3;
+                host->eccsize = 1;
+        } else if (nfc_is_v3_2()) {
+                res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+                if (!res) {
+                        err = -ENODEV;
+                        goto eirq;
+                }
+                host->regs_ip = ioremap(res->start, resource_size(res));
+                if (!host->regs_ip) {
+                        err = -ENOMEM;
+                        goto eirq;
+                }
+                host->regs_axi = host->base + 0x1e00;
+                host->spare0 = host->base + 0x1000;
+                host->spare_len = 64;
+                host->preset = preset_v3;
+                host->send_cmd = send_cmd_v3;
+                host->send_addr = send_addr_v3;
+                host->send_page = send_page_v3;
+                host->send_read_id = send_read_id_v3;
+                host->check_int = check_int_v3;
+                host->get_dev_status = get_dev_status_v3;
+                oob_smallpage = &nandv2_hw_eccoob_smallpage;
+                oob_largepage = &nandv2_hw_eccoob_largepage;
         } else
                 BUG();
 
@@ -786,7 +1068,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
         if (pdata->hw_ecc) {
                 this->ecc.calculate = mxc_nand_calculate_ecc;
                 this->ecc.hwctl = mxc_nand_enable_hwecc;
-                this->ecc.correct = mxc_nand_correct_data;
+                if (nfc_is_v1())
+                        this->ecc.correct = mxc_nand_correct_data_v1;
+                else
+                        this->ecc.correct = mxc_nand_correct_data_v2_v3;
                 this->ecc.mode = NAND_ECC_HW;
         } else {
                 this->ecc.mode = NAND_ECC_SOFT;
@@ -817,6 +1102,9 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 goto escan;
         }
 
+        /* Call preset again, with correct writesize this time */
+        host->preset(mtd);
+
         if (mtd->writesize == 2048)
                 this->ecc.layout = oob_largepage;
 
@@ -848,6 +1136,8 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 escan:
         free_irq(host->irq, host);
 eirq:
+        if (host->regs_ip)
+                iounmap(host->regs_ip);
         iounmap(host->base);
 eres:
         clk_put(host->clk);
@@ -867,59 +1157,19 @@ static int __devexit mxcnd_remove(struct platform_device *pdev)
 
         nand_release(&host->mtd);
         free_irq(host->irq, host);
+        if (host->regs_ip)
+                iounmap(host->regs_ip);
         iounmap(host->base);
         kfree(host);
 
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int mxcnd_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        struct mtd_info *mtd = platform_get_drvdata(pdev);
-        struct nand_chip *nand_chip = mtd->priv;
-        struct mxc_nand_host *host = nand_chip->priv;
-        int ret = 0;
-
-        DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND suspend\n");
-
-        ret = mtd->suspend(mtd);
-
-        /*
-         * nand_suspend locks the device for exclusive access, so
-         * the clock must already be off.
-         */
-        BUG_ON(!ret && host->clk_act);
-
-        return ret;
-}
-
-static int mxcnd_resume(struct platform_device *pdev)
-{
-        struct mtd_info *mtd = platform_get_drvdata(pdev);
-        struct nand_chip *nand_chip = mtd->priv;
-        struct mxc_nand_host *host = nand_chip->priv;
-        int ret = 0;
-
-        DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND resume\n");
-
-        mtd->resume(mtd);
-
-        return ret;
-}
-
-#else
-# define mxcnd_suspend   NULL
-# define mxcnd_resume    NULL
-#endif                          /* CONFIG_PM */
-
 static struct platform_driver mxcnd_driver = {
         .driver = {
                    .name = DRIVER_NAME,
-                   },
+        },
         .remove = __devexit_p(mxcnd_remove),
-        .suspend = mxcnd_suspend,
-        .resume = mxcnd_resume,
 };
 
 static int __init mxc_nd_init(void)
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 4a7b86423ee9..16a1714df008 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -42,7 +42,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/nand_ecc.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/interrupt.h>
 #include <linux/bitops.h>
 #include <linux/leds.h>
@@ -347,7 +346,7 @@ static int nand_block_bad(struct mtd_info *mtd, loff_t ofs, int getchip)
         struct nand_chip *chip = mtd->priv;
         u16 bad;
 
-        if (chip->options & NAND_BB_LAST_PAGE)
+        if (chip->options & NAND_BBT_SCANLASTPAGE)
                 ofs += mtd->erasesize - mtd->writesize;
 
         page = (int)(ofs >> chip->page_shift) & chip->pagemask;
@@ -397,9 +396,9 @@ static int nand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
 {
         struct nand_chip *chip = mtd->priv;
         uint8_t buf[2] = { 0, 0 };
-        int block, ret;
+        int block, ret, i = 0;
 
-        if (chip->options & NAND_BB_LAST_PAGE)
+        if (chip->options & NAND_BBT_SCANLASTPAGE)
                 ofs += mtd->erasesize - mtd->writesize;
 
         /* Get block number */
@@ -411,17 +410,31 @@ static int nand_default_block_markbad(struct mtd_info *mtd, loff_t ofs)
         if (chip->options & NAND_USE_FLASH_BBT)
                 ret = nand_update_bbt(mtd, ofs);
         else {
-                /* We write two bytes, so we dont have to mess with 16 bit
-                 * access
-                 */
                 nand_get_device(chip, mtd, FL_WRITING);
-                ofs += mtd->oobsize;
-                chip->ops.len = chip->ops.ooblen = 2;
-                chip->ops.datbuf = NULL;
-                chip->ops.oobbuf = buf;
-                chip->ops.ooboffs = chip->badblockpos & ~0x01;
 
-                ret = nand_do_write_oob(mtd, ofs, &chip->ops);
+                /* Write to first two pages and to byte 1 and 6 if necessary.
+                 * If we write to more than one location, the first error
+                 * encountered quits the procedure. We write two bytes per
+                 * location, so we dont have to mess with 16 bit access.
+                 */
+                do {
+                        chip->ops.len = chip->ops.ooblen = 2;
+                        chip->ops.datbuf = NULL;
+                        chip->ops.oobbuf = buf;
+                        chip->ops.ooboffs = chip->badblockpos & ~0x01;
+
+                        ret = nand_do_write_oob(mtd, ofs, &chip->ops);
+
+                        if (!ret && (chip->options & NAND_BBT_SCANBYTE1AND6)) {
+                                chip->ops.ooboffs = NAND_SMALL_BADBLOCK_POS
+                                        & ~0x01;
+                                ret = nand_do_write_oob(mtd, ofs, &chip->ops);
+                        }
+                        i++;
+                        ofs += mtd->writesize;
+                } while (!ret && (chip->options & NAND_BBT_SCAN2NDPAGE) &&
+                                i < 2);
+
                 nand_release_device(mtd);
         }
         if (!ret)
@@ -2920,9 +2933,14 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
                 chip->chip_shift = ffs((unsigned)(chip->chipsize >> 32)) + 32 - 1;
 
         /* Set the bad block position */
-        chip->badblockpos = mtd->writesize > 512 ?
-                NAND_LARGE_BADBLOCK_POS : NAND_SMALL_BADBLOCK_POS;
-        chip->badblockbits = 8;
+        if (!(busw & NAND_BUSWIDTH_16) && (*maf_id == NAND_MFR_STMICRO ||
+                                (*maf_id == NAND_MFR_SAMSUNG &&
+                                 mtd->writesize == 512) ||
+                                *maf_id == NAND_MFR_AMD))
+                chip->badblockpos = NAND_SMALL_BADBLOCK_POS;
+        else
+                chip->badblockpos = NAND_LARGE_BADBLOCK_POS;
+
 
         /* Get chip options, preserve non chip based options */
         chip->options &= ~NAND_CHIPOPTIONS_MSK;
@@ -2941,12 +2959,32 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
 
         /*
          * Bad block marker is stored in the last page of each block
-         * on Samsung and Hynix MLC devices
+         * on Samsung and Hynix MLC devices; stored in first two pages
+         * of each block on Micron devices with 2KiB pages and on
+         * SLC Samsung, Hynix, and AMD/Spansion. All others scan only
+         * the first page.
          */
         if ((chip->cellinfo & NAND_CI_CELLTYPE_MSK) &&
                         (*maf_id == NAND_MFR_SAMSUNG ||
                          *maf_id == NAND_MFR_HYNIX))
-                chip->options |= NAND_BB_LAST_PAGE;
+                chip->options |= NAND_BBT_SCANLASTPAGE;
+        else if ((!(chip->cellinfo & NAND_CI_CELLTYPE_MSK) &&
+                                (*maf_id == NAND_MFR_SAMSUNG ||
+                                 *maf_id == NAND_MFR_HYNIX ||
+                                 *maf_id == NAND_MFR_AMD)) ||
+                        (mtd->writesize == 2048 &&
+                         *maf_id == NAND_MFR_MICRON))
+                chip->options |= NAND_BBT_SCAN2NDPAGE;
+
+        /*
+         * Numonyx/ST 2K pages, x8 bus use BOTH byte 1 and 6
+         */
+        if (!(busw & NAND_BUSWIDTH_16) &&
+                        *maf_id == NAND_MFR_STMICRO &&
+                        mtd->writesize == 2048) {
+                chip->options |= NAND_BBT_SCANBYTE1AND6;
+                chip->badblockpos = 0;
+        }
 
         /* Check for AND chips with 4 page planes */
         if (chip->options & NAND_4PAGE_ARRAY)
@@ -3306,6 +3344,11 @@ void nand_release(struct mtd_info *mtd)
         kfree(chip->bbt);
         if (!(chip->options & NAND_OWN_BUFFERS))
                 kfree(chip->buffers);
+
+        /* Free bad block descriptor memory */
+        if (chip->badblock_pattern && chip->badblock_pattern->options
+                        & NAND_BBT_DYNAMICSTRUCT)
+                kfree(chip->badblock_pattern);
 }
 
 EXPORT_SYMBOL_GPL(nand_lock);
diff --git a/drivers/mtd/nand/nand_bbt.c b/drivers/mtd/nand/nand_bbt.c
index ad97c0ce73b2..5fedf4a74f16 100644
--- a/drivers/mtd/nand/nand_bbt.c
+++ b/drivers/mtd/nand/nand_bbt.c
@@ -55,7 +55,6 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/nand_ecc.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/vmalloc.h>
@@ -93,6 +92,28 @@ static int check_pattern(uint8_t *buf, int len, int paglen, struct nand_bbt_desc
                         return -1;
         }
 
+        /* Check both positions 1 and 6 for pattern? */
+        if (td->options & NAND_BBT_SCANBYTE1AND6) {
+                if (td->options & NAND_BBT_SCANEMPTY) {
+                        p += td->len;
+                        end += NAND_SMALL_BADBLOCK_POS - td->offs;
+                        /* Check region between positions 1 and 6 */
+                        for (i = 0; i < NAND_SMALL_BADBLOCK_POS - td->offs - td->len;
+                                        i++) {
+                                if (*p++ != 0xff)
+                                        return -1;
+                        }
+                }
+                else {
+                        p += NAND_SMALL_BADBLOCK_POS - td->offs;
+                }
+                /* Compare the pattern */
+                for (i = 0; i < td->len; i++) {
+                        if (p[i] != td->pattern[i])
+                                return -1;
+                }
+        }
+
         if (td->options & NAND_BBT_SCANEMPTY) {
                 p += td->len;
                 end += td->len;
@@ -124,6 +145,13 @@ static int check_short_pattern(uint8_t *buf, struct nand_bbt_descr *td)
                 if (p[td->offs + i] != td->pattern[i])
                         return -1;
         }
+        /* Need to check location 1 AND 6? */
+        if (td->options & NAND_BBT_SCANBYTE1AND6) {
+                for (i = 0; i < td->len; i++) {
+                        if (p[NAND_SMALL_BADBLOCK_POS + i] != td->pattern[i])
+                                return -1;
+                }
+        }
         return 0;
 }
 
@@ -397,12 +425,10 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf,
 
         if (bd->options & NAND_BBT_SCANALLPAGES)
                 len = 1 << (this->bbt_erase_shift - this->page_shift);
-        else {
-                if (bd->options & NAND_BBT_SCAN2NDPAGE)
-                        len = 2;
-                else
-                        len = 1;
-        }
+        else if (bd->options & NAND_BBT_SCAN2NDPAGE)
+                len = 2;
+        else
+                len = 1;
 
         if (!(bd->options & NAND_BBT_SCANEMPTY)) {
                 /* We need only read few bytes from the OOB area */
@@ -432,7 +458,7 @@ static int create_bbt(struct mtd_info *mtd, uint8_t *buf,
                 from = (loff_t)startblock << (this->bbt_erase_shift - 1);
         }
 
-        if (this->options & NAND_BB_LAST_PAGE)
+        if (this->options & NAND_BBT_SCANLASTPAGE)
                 from += mtd->erasesize - (mtd->writesize * len);
 
         for (i = startblock; i < numblocks;) {
@@ -1092,30 +1118,16 @@ int nand_update_bbt(struct mtd_info *mtd, loff_t offs)
  * while scanning a device for factory marked good / bad blocks. */
 static uint8_t scan_ff_pattern[] = { 0xff, 0xff };
 
-static struct nand_bbt_descr smallpage_memorybased = {
-        .options = NAND_BBT_SCAN2NDPAGE,
-        .offs = 5,
-        .len = 1,
-        .pattern = scan_ff_pattern
-};
-
-static struct nand_bbt_descr largepage_memorybased = {
-        .options = 0,
-        .offs = 0,
-        .len = 2,
-        .pattern = scan_ff_pattern
-};
-
 static struct nand_bbt_descr smallpage_flashbased = {
         .options = NAND_BBT_SCAN2NDPAGE,
-        .offs = 5,
+        .offs = NAND_SMALL_BADBLOCK_POS,
         .len = 1,
         .pattern = scan_ff_pattern
 };
 
 static struct nand_bbt_descr largepage_flashbased = {
         .options = NAND_BBT_SCAN2NDPAGE,
-        .offs = 0,
+        .offs = NAND_LARGE_BADBLOCK_POS,
         .len = 2,
         .pattern = scan_ff_pattern
 };
@@ -1154,6 +1166,43 @@ static struct nand_bbt_descr bbt_mirror_descr = {
         .pattern = mirror_pattern
 };
 
+#define BBT_SCAN_OPTIONS (NAND_BBT_SCANLASTPAGE | NAND_BBT_SCAN2NDPAGE | \
+                NAND_BBT_SCANBYTE1AND6)
+/**
+ * nand_create_default_bbt_descr - [Internal] Creates a BBT descriptor structure
+ * @this:       NAND chip to create descriptor for
+ *
+ * This function allocates and initializes a nand_bbt_descr for BBM detection
+ * based on the properties of "this". The new descriptor is stored in
+ * this->badblock_pattern. Thus, this->badblock_pattern should be NULL when
+ * passed to this function.
+ *
+ * TODO: Handle other flags, replace other static structs
+ *        (e.g. handle NAND_BBT_FLASH for flash-based BBT,
+ *             replace smallpage_flashbased)
+ *
+ */
+static int nand_create_default_bbt_descr(struct nand_chip *this)
+{
+        struct nand_bbt_descr *bd;
+        if (this->badblock_pattern) {
+                printk(KERN_WARNING "BBT descr already allocated; not replacing.\n");
+                return -EINVAL;
+        }
+        bd = kzalloc(sizeof(*bd), GFP_KERNEL);
+        if (!bd) {
+                printk(KERN_ERR "nand_create_default_bbt_descr: Out of memory\n");
+                return -ENOMEM;
+        }
+        bd->options = this->options & BBT_SCAN_OPTIONS;
+        bd->offs = this->badblockpos;
+        bd->len = (this->options & NAND_BUSWIDTH_16) ? 2 : 1;
+        bd->pattern = scan_ff_pattern;
+        bd->options |= NAND_BBT_DYNAMICSTRUCT;
+        this->badblock_pattern = bd;
+        return 0;
+}
+
 /**
  * nand_default_bbt - [NAND Interface] Select a default bad block table for the device
  * @mtd:        MTD device structure
@@ -1196,10 +1245,8 @@ int nand_default_bbt(struct mtd_info *mtd)
         } else {
                 this->bbt_td = NULL;
                 this->bbt_md = NULL;
-                if (!this->badblock_pattern) {
-                        this->badblock_pattern = (mtd->writesize > 512) ?
-                            &largepage_memorybased : &smallpage_memorybased;
-                }
+                if (!this->badblock_pattern)
+                        nand_create_default_bbt_descr(this);
         }
         return nand_scan_bbt(mtd, this->badblock_pattern);
 }
diff --git a/drivers/mtd/nand/nand_ids.c b/drivers/mtd/nand/nand_ids.c
index 89907ed99009..a04b89105b65 100644
--- a/drivers/mtd/nand/nand_ids.c
+++ b/drivers/mtd/nand/nand_ids.c
@@ -85,6 +85,7 @@ struct nand_flash_dev nand_flash_ids[] = {
         {"NAND 128MiB 3,3V 8-bit",      0xD1, 0, 128, 0, LP_OPTIONS},
         {"NAND 128MiB 1,8V 16-bit",     0xB1, 0, 128, 0, LP_OPTIONS16},
         {"NAND 128MiB 3,3V 16-bit",     0xC1, 0, 128, 0, LP_OPTIONS16},
+        {"NAND 128MiB 1,8V 16-bit",     0xAD, 0, 128, 0, LP_OPTIONS16},
 
         /* 2 Gigabit */
         {"NAND 256MiB 1,8V 8-bit",      0xAA, 0, 256, 0, LP_OPTIONS},
@@ -110,6 +111,9 @@ struct nand_flash_dev nand_flash_ids[] = {
         {"NAND 2GiB 1,8V 16-bit",       0xB5, 0, 2048, 0, LP_OPTIONS16},
         {"NAND 2GiB 3,3V 16-bit",       0xC5, 0, 2048, 0, LP_OPTIONS16},
 
+        /* 32 Gigabit */
+        {"NAND 4GiB 3,3V 8-bit",        0xD7, 0, 4096, 0, LP_OPTIONS16},
+
         /*
          * Renesas AND 1 Gigabit. Those chips do not support extended id and
          * have a strange page/block layout !  The chosen minimum erasesize is
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 261337efe0ee..c25648bb5793 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -553,8 +553,8 @@ static uint64_t divide(uint64_t n, uint32_t d)
  */
 static int init_nandsim(struct mtd_info *mtd)
 {
-        struct nand_chip *chip = (struct nand_chip *)mtd->priv;
-        struct nandsim   *ns   = (struct nandsim *)(chip->priv);
+        struct nand_chip *chip = mtd->priv;
+        struct nandsim   *ns   = chip->priv;
         int i, ret = 0;
         uint64_t remains;
         uint64_t next_offset;
@@ -1877,7 +1877,7 @@ static void switch_state(struct nandsim *ns)
 
 static u_char ns_nand_read_byte(struct mtd_info *mtd)
 {
-        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
+        struct nandsim *ns = ((struct nand_chip *)mtd->priv)->priv;
         u_char outb = 0x00;
 
         /* Sanity and correctness checks */
@@ -1950,7 +1950,7 @@ static u_char ns_nand_read_byte(struct mtd_info *mtd)
 
 static void ns_nand_write_byte(struct mtd_info *mtd, u_char byte)
 {
-        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
+        struct nandsim *ns = ((struct nand_chip *)mtd->priv)->priv;
 
         /* Sanity and correctness checks */
         if (!ns->lines.ce) {
@@ -2132,7 +2132,7 @@ static uint16_t ns_nand_read_word(struct mtd_info *mtd)
 
 static void ns_nand_write_buf(struct mtd_info *mtd, const u_char *buf, int len)
 {
-        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
+        struct nandsim *ns = ((struct nand_chip *)mtd->priv)->priv;
 
         /* Check that chip is expecting data input */
         if (!(ns->state & STATE_DATAIN_MASK)) {
@@ -2159,7 +2159,7 @@ static void ns_nand_write_buf(struct mtd_info *mtd, const u_char *buf, int len)
 
 static void ns_nand_read_buf(struct mtd_info *mtd, u_char *buf, int len)
 {
-        struct nandsim *ns = (struct nandsim *)((struct nand_chip *)mtd->priv)->priv;
+        struct nandsim *ns = ((struct nand_chip *)mtd->priv)->priv;
 
         /* Sanity and correctness checks */
         if (!ns->lines.ce) {
@@ -2352,7 +2352,7 @@ module_init(ns_init_module);
  */
 static void __exit ns_cleanup_module(void)
 {
-        struct nandsim *ns = (struct nandsim *)(((struct nand_chip *)nsmtd->priv)->priv);
+        struct nandsim *ns = ((struct nand_chip *)nsmtd->priv)->priv;
         int i;
 
         free_nandsim(ns);    /* Free nandsim private resources */
diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index 8d467315f02b..90e143e5ad3e 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -91,7 +91,7 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
         }
 
         /* Scan to find existance of the device */
-        if (nand_scan(&data->mtd, 1)) {
+        if (nand_scan(&data->mtd, pdata->chip.nr_chips)) {
                 err = -ENXIO;
                 goto out;
         }
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index bcfc851fe550..5169ca6a66bc 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -64,8 +64,8 @@ static inline void r852_write_reg_dword(struct r852_device *dev,
 /* returns pointer to our private structure */
 static inline struct r852_device *r852_get_dev(struct mtd_info *mtd)
 {
-        struct nand_chip *chip = (struct nand_chip *)mtd->priv;
-        return (struct r852_device *)chip->priv;
+        struct nand_chip *chip = mtd->priv;
+        return chip->priv;
 }
 
 
@@ -380,7 +380,7 @@ void r852_cmdctl(struct mtd_info *mtd, int dat, unsigned int ctrl)
  */
 int r852_wait(struct mtd_info *mtd, struct nand_chip *chip)
 {
-        struct r852_device *dev = (struct r852_device *)chip->priv;
+        struct r852_device *dev = chip->priv;
 
         unsigned long timeout;
         int status;
diff --git a/drivers/mtd/nand/rtc_from4.c b/drivers/mtd/nand/rtc_from4.c
index a033c4cd8e16..67440b5beef8 100644
--- a/drivers/mtd/nand/rtc_from4.c
+++ b/drivers/mtd/nand/rtc_from4.c
@@ -24,7 +24,6 @@
 #include <linux/rslib.h>
 #include <linux/bitrev.h>
 #include <linux/module.h>
-#include <linux/mtd/compatmac.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 239aadfd01b0..33d832dddfdd 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -727,15 +727,12 @@ static int s3c2410_nand_add_partition(struct s3c2410_nand_info *info,
         if (set == NULL)
                 return add_mtd_device(&mtd->mtd);
 
-        if (set->nr_partitions == 0) {
-                mtd->mtd.name = set->name;
-                nr_part = parse_mtd_partitions(&mtd->mtd, part_probes,
-                                                &part_info, 0);
-        } else {
-                if (set->nr_partitions > 0 && set->partitions != NULL) {
-                        nr_part = set->nr_partitions;
-                        part_info = set->partitions;
-                }
+        mtd->mtd.name = set->name;
+        nr_part = parse_mtd_partitions(&mtd->mtd, part_probes, &part_info, 0);
+
+        if (nr_part <= 0 && set->nr_partitions > 0) {
+                nr_part = set->nr_partitions;
+                part_info = set->partitions;
         }
 
         if (nr_part > 0 && part_info)
diff --git a/drivers/mtd/nand/sm_common.c b/drivers/mtd/nand/sm_common.c
index ac80fb362e63..4a8f367c295c 100644
--- a/drivers/mtd/nand/sm_common.c
+++ b/drivers/mtd/nand/sm_common.c
@@ -109,7 +109,7 @@ static struct nand_flash_dev nand_xd_flash_ids[] = {
 
 int sm_register_device(struct mtd_info *mtd, int smartmedia)
 {
-        struct nand_chip *chip = (struct nand_chip *)mtd->priv;
+        struct nand_chip *chip = mtd->priv;
         int ret;
 
         chip->options |= NAND_SKIP_BBTSCAN;
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index a4578bf903aa..b155666acfbe 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -1,11 +1,22 @@
-/* Linux driver for NAND Flash Translation Layer      */
-/* (c) 1999 Machine Vision Holdings, Inc.             */
-/* Author: David Woodhouse <dwmw2@infradead.org>      */
-
 /*
-  The contents of this file are distributed under the GNU General
-  Public License version 2. The author places no additional
-  restrictions of any kind on it.
+ * Linux driver for NAND Flash Translation Layer
+ *
+ * Copyright © 1999 Machine Vision Holdings, Inc.
+ * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #define PRERELEASE
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index 8b22b1836e9f..e3cd1ffad2f6 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -2,7 +2,8 @@
  * NFTL mount code with extensive checks
  *
  * Author: Fabrice Bellard (fabrice.bellard@netgem.com)
- * Copyright (C) 2000 Netgem S.A.
+ * Copyright © 2000 Netgem S.A.
+ * Copyright © 1999-2010 David Woodhouse <dwmw2@infradead.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 4f0d635674f3..8bf7dc6d1ce6 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -1,11 +1,11 @@
 /*
  * Flash partitions described by the OF (or flattened) device tree
  *
- * Copyright (C) 2006 MontaVista Software Inc.
+ * Copyright © 2006 MontaVista Software Inc.
  * Author: Vitaly Wool <vwool@ru.mvista.com>
  *
  * Revised to handle newer style flash binding by:
- *   Copyright (C) 2007 David Gibson, IBM Corporation.
+ *   Copyright © 2007 David Gibson, IBM Corporation.
  *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
diff --git a/drivers/mtd/onenand/Kconfig b/drivers/mtd/onenand/Kconfig
index 9a49d68ba5f9..3f32289fdbb5 100644
--- a/drivers/mtd/onenand/Kconfig
+++ b/drivers/mtd/onenand/Kconfig
@@ -25,14 +25,14 @@ config MTD_ONENAND_GENERIC
 
 config MTD_ONENAND_OMAP2
         tristate "OneNAND on OMAP2/OMAP3 support"
-        depends on MTD_ONENAND && (ARCH_OMAP2 || ARCH_OMAP3)
+        depends on ARCH_OMAP2 || ARCH_OMAP3
         help
           Support for a OneNAND flash device connected to an OMAP2/OMAP3 CPU
           via the GPMC memory controller.
 
 config MTD_ONENAND_SAMSUNG
         tristate "OneNAND on Samsung SOC controller support"
-        depends on MTD_ONENAND && (ARCH_S3C64XX || ARCH_S5PC100 || ARCH_S5PV210)
+        depends on ARCH_S3C64XX || ARCH_S5PC100 || ARCH_S5PV210
         help
           Support for a OneNAND flash device connected to an Samsung SOC
           S3C64XX/S5PC1XX controller.
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 26caf2590dae..a2bb520286f8 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -377,8 +377,11 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
 
         default:
                 block = onenand_block(this, addr);
-                page = (int) (addr - onenand_addr(this, block)) >> this->page_shift;
-
+                if (FLEXONENAND(this))
+                        page = (int) (addr - onenand_addr(this, block))>>\
+                                this->page_shift;
+                else
+                        page = (int) (addr >> this->page_shift);
                 if (ONENAND_IS_2PLANE(this)) {
                         /* Make the even block number */
                         block &= ~1;
@@ -3730,17 +3733,16 @@ out:
 }
 
 /**
- * onenand_probe - [OneNAND Interface] Probe the OneNAND device
+ * onenand_chip_probe - [OneNAND Interface] The generic chip probe
  * @param mtd           MTD device structure
  *
  * OneNAND detection method:
  *   Compare the values from command with ones from register
  */
-static int onenand_probe(struct mtd_info *mtd)
+static int onenand_chip_probe(struct mtd_info *mtd)
 {
         struct onenand_chip *this = mtd->priv;
-        int bram_maf_id, bram_dev_id, maf_id, dev_id, ver_id;
-        int density;
+        int bram_maf_id, bram_dev_id, maf_id, dev_id;
         int syscfg;
 
         /* Save system configuration 1 */
@@ -3763,12 +3765,6 @@ static int onenand_probe(struct mtd_info *mtd)
         /* Restore system configuration 1 */
         this->write_word(syscfg, this->base + ONENAND_REG_SYS_CFG1);
 
-        /* Workaround */
-        if (syscfg & ONENAND_SYS_CFG1_SYNC_WRITE) {
-                bram_maf_id = this->read_word(this->base + ONENAND_REG_MANUFACTURER_ID);
-                bram_dev_id = this->read_word(this->base + ONENAND_REG_DEVICE_ID);
-        }
-
         /* Check manufacturer ID */
         if (onenand_check_maf(bram_maf_id))
                 return -ENXIO;
@@ -3776,13 +3772,35 @@ static int onenand_probe(struct mtd_info *mtd)
         /* Read manufacturer and device IDs from Register */
         maf_id = this->read_word(this->base + ONENAND_REG_MANUFACTURER_ID);
         dev_id = this->read_word(this->base + ONENAND_REG_DEVICE_ID);
-        ver_id = this->read_word(this->base + ONENAND_REG_VERSION_ID);
-        this->technology = this->read_word(this->base + ONENAND_REG_TECHNOLOGY);
 
         /* Check OneNAND device */
         if (maf_id != bram_maf_id || dev_id != bram_dev_id)
                 return -ENXIO;
 
+        return 0;
+}
+
+/**
+ * onenand_probe - [OneNAND Interface] Probe the OneNAND device
+ * @param mtd           MTD device structure
+ */
+static int onenand_probe(struct mtd_info *mtd)
+{
+        struct onenand_chip *this = mtd->priv;
+        int maf_id, dev_id, ver_id;
+        int density;
+        int ret;
+
+        ret = this->chip_probe(mtd);
+        if (ret)
+                return ret;
+
+        /* Read manufacturer and device IDs from Register */
+        maf_id = this->read_word(this->base + ONENAND_REG_MANUFACTURER_ID);
+        dev_id = this->read_word(this->base + ONENAND_REG_DEVICE_ID);
+        ver_id = this->read_word(this->base + ONENAND_REG_VERSION_ID);
+        this->technology = this->read_word(this->base + ONENAND_REG_TECHNOLOGY);
+
         /* Flash device information */
         onenand_print_device_info(dev_id, ver_id);
         this->device_id = dev_id;
@@ -3909,6 +3927,9 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
         if (!this->unlock_all)
                 this->unlock_all = onenand_unlock_all;
 
+        if (!this->chip_probe)
+                this->chip_probe = onenand_chip_probe;
+
         if (!this->read_bufferram)
                 this->read_bufferram = onenand_read_bufferram;
         if (!this->write_bufferram)
diff --git a/drivers/mtd/onenand/onenand_bbt.c b/drivers/mtd/onenand/onenand_bbt.c
index a91fcac1af01..01ab5b3c453b 100644
--- a/drivers/mtd/onenand/onenand_bbt.c
+++ b/drivers/mtd/onenand/onenand_bbt.c
@@ -15,7 +15,6 @@
 #include <linux/slab.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/onenand.h>
-#include <linux/mtd/compatmac.h>
 
 /**
  * check_short_pattern - [GENERIC] check if a pattern is in the buffer
diff --git a/drivers/mtd/onenand/samsung.c b/drivers/mtd/onenand/samsung.c
index 2750317cb58f..cb443af3d45f 100644
--- a/drivers/mtd/onenand/samsung.c
+++ b/drivers/mtd/onenand/samsung.c
@@ -630,6 +630,12 @@ normal:
         return 0;
 }
 
+static int s5pc110_chip_probe(struct mtd_info *mtd)
+{
+        /* Now just return 0 */
+        return 0;
+}
+
 static int s3c_onenand_bbt_wait(struct mtd_info *mtd, int state)
 {
         unsigned int flags = INT_ACT | LOAD_CMP;
@@ -757,6 +763,7 @@ static void s3c_onenand_setup(struct mtd_info *mtd)
                 /* Use generic onenand functions */
                 onenand->cmd_map = s5pc1xx_cmd_map;
                 this->read_bufferram = s5pc110_read_bufferram;
+                this->chip_probe = s5pc110_chip_probe;
                 return;
         } else {
                 BUG();
@@ -781,7 +788,6 @@ static int s3c_onenand_probe(struct platform_device *pdev)
         struct mtd_info *mtd;
         struct resource *r;
         int size, err;
-        unsigned long onenand_ctrl_cfg = 0;
 
         pdata = pdev->dev.platform_data;
         /* No need to check pdata. the platform data is optional */
@@ -900,14 +906,6 @@ static int s3c_onenand_probe(struct platform_device *pdev)
                 }
 
                 onenand->phys_base = onenand->base_res->start;
-
-                onenand_ctrl_cfg = readl(onenand->dma_addr + 0x100);
-                if ((onenand_ctrl_cfg & ONENAND_SYS_CFG1_SYNC_WRITE) &&
-                    onenand->dma_addr)
-                        writel(onenand_ctrl_cfg & ~ONENAND_SYS_CFG1_SYNC_WRITE,
-                                        onenand->dma_addr + 0x100);
-                else
-                        onenand_ctrl_cfg = 0;
         }
 
         if (onenand_scan(mtd, 1)) {
@@ -915,10 +913,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
                 goto scan_failed;
         }
 
-        if (onenand->type == TYPE_S5PC110) {
-                if (onenand_ctrl_cfg && onenand->dma_addr)
-                        writel(onenand_ctrl_cfg, onenand->dma_addr + 0x100);
-        } else {
+        if (onenand->type != TYPE_S5PC110) {
                 /* S3C doesn't handle subpage write */
                 mtd->subpage_sft = 0;
                 this->subpagesize = mtd->writesize;
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 2d600a1bf2aa..7a87d07cd79f 100644
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -1,6 +1,24 @@
 /*
  * Parse RedBoot-style Flash Image System (FIS) tables and
  * produce a Linux partition array to match.
+ *
+ * Copyright © 2001      Red Hat UK Limited
+ * Copyright © 2001-2010 David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index 63b83c0d9a13..cc4d1805b864 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -1,7 +1,7 @@
 /*
  * rfd_ftl.c -- resident flash disk (flash translation layer)
  *
- * Copyright (C) 2005  Sean Young <sean@mess.org>
+ * Copyright © 2005  Sean Young <sean@mess.org>
  *
  * This type of flash translation layer (FTL) is used by the Embedded BIOS
  * by General Software. It is known as the Resident Flash Disk (RFD), see:
diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index 81c4ecdc11f5..5cd189793332 100644
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -1,6 +1,6 @@
 /*
  * Linux driver for SSFDC Flash Translation Layer (Read only)
- * (c) 2005 Eptar srl
+ * © 2005 Eptar srl
  * Author: Claudio Lanconelli <lanconelli.claudio@eptar.com>
  *
  * Based on NTFL and MTDBLOCK_RO drivers
diff --git a/drivers/mtd/tests/mtd_pagetest.c b/drivers/mtd/tests/mtd_pagetest.c
index 6bc1b8276c62..00b937e38c1d 100644
--- a/drivers/mtd/tests/mtd_pagetest.c
+++ b/drivers/mtd/tests/mtd_pagetest.c
@@ -310,7 +310,7 @@ static int crosstest(void)
 static int erasecrosstest(void)
 {
         size_t read = 0, written = 0;
-        int err = 0, i, ebnum, ok = 1, ebnum2;
+        int err = 0, i, ebnum, ebnum2;
         loff_t addr0;
         char *readbuf = twopages;
 
@@ -357,8 +357,7 @@ static int erasecrosstest(void)
         if (memcmp(writebuf, readbuf, pgsize)) {
                 printk(PRINT_PREF "verify failed!\n");
                 errcnt += 1;
-                ok = 0;
-                return err;
+                return -1;
         }
 
         printk(PRINT_PREF "erasing block %d\n", ebnum);
@@ -396,10 +395,10 @@ static int erasecrosstest(void)
         if (memcmp(writebuf, readbuf, pgsize)) {
                 printk(PRINT_PREF "verify failed!\n");
                 errcnt += 1;
-                ok = 0;
+                return -1;
         }
 
-        if (ok && !err)
+        if (!err)
                 printk(PRINT_PREF "erasecrosstest ok\n");
         return err;
 }
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 066fd5b09fda..ad19585d960b 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -3198,17 +3198,17 @@ static int __devinit init_one(struct pci_dev *pdev,
                 }
         }
 
-        err = pci_request_regions(pdev, DRV_NAME);
+        err = pci_enable_device(pdev);
         if (err) {
-                /* Just info, some other driver may have claimed the device. */
-                dev_info(&pdev->dev, "cannot obtain PCI resources\n");
-                return err;
+                dev_err(&pdev->dev, "cannot enable PCI device\n");
+                goto out;
         }
 
-        err = pci_enable_device(pdev);
+        err = pci_request_regions(pdev, DRV_NAME);
         if (err) {
-                dev_err(&pdev->dev, "cannot enable PCI device\n");
-                goto out_release_regions;
+                /* Just info, some other driver may have claimed the device. */
+                dev_info(&pdev->dev, "cannot obtain PCI resources\n");
+                goto out_disable_device;
         }
 
         if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
@@ -3217,11 +3217,11 @@ static int __devinit init_one(struct pci_dev *pdev,
                 if (err) {
                         dev_err(&pdev->dev, "unable to obtain 64-bit DMA for "
                                "coherent allocations\n");
-                        goto out_disable_device;
+                        goto out_release_regions;
                 }
         } else if ((err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) != 0) {
                 dev_err(&pdev->dev, "no usable DMA configuration\n");
-                goto out_disable_device;
+                goto out_release_regions;
         }
 
         pci_set_master(pdev);
@@ -3234,7 +3234,7 @@ static int __devinit init_one(struct pci_dev *pdev,
         adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
         if (!adapter) {
                 err = -ENOMEM;
-                goto out_disable_device;
+                goto out_release_regions;
         }
 
         adapter->nofail_skb =
@@ -3370,11 +3370,12 @@ out_free_dev:
 out_free_adapter:
         kfree(adapter);
 
-out_disable_device:
-        pci_disable_device(pdev);
 out_release_regions:
         pci_release_regions(pdev);
+out_disable_device:
+        pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
+out:
         return err;
 }
 
diff --git a/drivers/net/cxgb4vf/cxgb4vf_main.c b/drivers/net/cxgb4vf/cxgb4vf_main.c
index a16563219ac9..7b6d07f50c71 100644
--- a/drivers/net/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/cxgb4vf/cxgb4vf_main.c
@@ -2462,23 +2462,24 @@ static int __devinit cxgb4vf_pci_probe(struct pci_dev *pdev,
                 version_printed = 1;
         }
 
+
         /*
-         * Reserve PCI resources for the device.  If we can't get them some
-         * other driver may have already claimed the device ...
+         * Initialize generic PCI device state.
          */
-        err = pci_request_regions(pdev, KBUILD_MODNAME);
+        err = pci_enable_device(pdev);
         if (err) {
-                dev_err(&pdev->dev, "cannot obtain PCI resources\n");
+                dev_err(&pdev->dev, "cannot enable PCI device\n");
                 return err;
         }
 
         /*
-         * Initialize generic PCI device state.
+         * Reserve PCI resources for the device.  If we can't get them some
+         * other driver may have already claimed the device ...
          */
-        err = pci_enable_device(pdev);
+        err = pci_request_regions(pdev, KBUILD_MODNAME);
         if (err) {
-                dev_err(&pdev->dev, "cannot enable PCI device\n");
-                goto err_release_regions;
+                dev_err(&pdev->dev, "cannot obtain PCI resources\n");
+                goto err_disable_device;
         }
 
         /*
@@ -2491,14 +2492,14 @@ static int __devinit cxgb4vf_pci_probe(struct pci_dev *pdev,
                 if (err) {
                         dev_err(&pdev->dev, "unable to obtain 64-bit DMA for"
                                 " coherent allocations\n");
-                        goto err_disable_device;
+                        goto err_release_regions;
                 }
                 pci_using_dac = 1;
         } else {
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (err != 0) {
                         dev_err(&pdev->dev, "no usable DMA configuration\n");
-                        goto err_disable_device;
+                        goto err_release_regions;
                 }
                 pci_using_dac = 0;
         }
@@ -2514,7 +2515,7 @@ static int __devinit cxgb4vf_pci_probe(struct pci_dev *pdev,
         adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
         if (!adapter) {
                 err = -ENOMEM;
-                goto err_disable_device;
+                goto err_release_regions;
         }
         pci_set_drvdata(pdev, adapter);
         adapter->pdev = pdev;
@@ -2750,13 +2751,13 @@ err_free_adapter:
         kfree(adapter);
         pci_set_drvdata(pdev, NULL);
 
-err_disable_device:
-        pci_disable_device(pdev);
-        pci_clear_master(pdev);
-
 err_release_regions:
         pci_release_regions(pdev);
         pci_set_drvdata(pdev, NULL);
+        pci_clear_master(pdev);
+
+err_disable_device:
+        pci_disable_device(pdev);
 
 err_out:
         return err;
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index d0824e322068..7fbd052ddb0a 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2944,8 +2944,8 @@ static int __devexit davinci_emac_remove(struct platform_device *pdev)
         release_mem_region(res->start, res->end - res->start + 1);
 
         unregister_netdev(ndev);
-        free_netdev(ndev);
         iounmap(priv->remap_addr);
+        free_netdev(ndev);
 
         clk_disable(emac_clk);
         clk_put(emac_clk);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index b194bad29ace..8e2eab4e7c75 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1779,6 +1779,7 @@ static int e100_tx_clean(struct nic *nic)
         for (cb = nic->cb_to_clean;
             cb->status & cpu_to_le16(cb_complete);
             cb = nic->cb_to_clean = cb->next) {
+                rmb(); /* read skb after status */
                 netif_printk(nic, tx_done, KERN_DEBUG, nic->netdev,
                              "cb[%d]->status = 0x%04X\n",
                              (int)(((void*)cb - (void*)nic->cbs)/sizeof(struct cb)),
@@ -1927,6 +1928,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
 
         netif_printk(nic, rx_status, KERN_DEBUG, nic->netdev,
                      "status=0x%04X\n", rfd_status);
+        rmb(); /* read size after status bit */
 
         /* If data isn't ready, nothing to indicate */
         if (unlikely(!(rfd_status & cb_complete))) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 02833af8a0b1..5cc39ed289c6 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3454,6 +3454,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
         while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
                (count < tx_ring->count)) {
                 bool cleaned = false;
+                rmb();  /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
                         tx_desc = E1000_TX_DESC(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
@@ -3643,6 +3644,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;
@@ -3849,6 +3851,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 521c6ee1f32a..2b8ef44bd2b1 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -781,6 +781,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb();  /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;
@@ -991,6 +992,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
         while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
                (count < tx_ring->count)) {
                 bool cleaned = false;
+                rmb(); /* read buffer_info after eop_desc */
                 for (; !cleaned; count++) {
                         tx_desc = E1000_TX_DESC(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
@@ -1087,6 +1089,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         break;
                 (*work_done)++;
                 skb = buffer_info->skb;
+                rmb();  /* read descriptor and rx_buffer_info after status DD */
 
                 /* in the packet split case this is header only */
                 prefetch(skb->data - NET_IP_ALIGN);
@@ -1286,6 +1289,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb();  /* read descriptor and rx_buffer_info after status DD */
 
                 status = rx_desc->status;
                 skb = buffer_info->skb;
diff --git a/drivers/net/enic/enic_main.c b/drivers/net/enic/enic_main.c
index 77a7f87d498e..9aab85366d21 100644
--- a/drivers/net/enic/enic_main.c
+++ b/drivers/net/enic/enic_main.c
@@ -1087,10 +1087,7 @@ static int enic_set_port_profile(struct enic *enic, u8 *mac)
 {
         struct vic_provinfo *vp;
         u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        u8 *uuid;
         char uuid_str[38];
-        static char *uuid_fmt = "%02X%02X%02X%02X-%02X%02X-%02X%02X-"
-                "%02X%02X-%02X%02X%02X%02X%0X%02X";
         int err;
 
         err = enic_vnic_dev_deinit(enic);
@@ -1121,24 +1118,14 @@ static int enic_set_port_profile(struct enic *enic, u8 *mac)
                         ETH_ALEN, mac);
 
                 if (enic->pp.set & ENIC_SET_INSTANCE) {
-                        uuid = enic->pp.instance_uuid;
-                        sprintf(uuid_str, uuid_fmt,
-                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                                uuid[8],  uuid[9],  uuid[10], uuid[11],
-                                uuid[12], uuid[13], uuid[14], uuid[15]);
+                        sprintf(uuid_str, "%pUB", enic->pp.instance_uuid);
                         vic_provinfo_add_tlv(vp,
                                 VIC_LINUX_PROV_TLV_CLIENT_UUID_STR,
                                 sizeof(uuid_str), uuid_str);
                 }
 
                 if (enic->pp.set & ENIC_SET_HOST) {
-                        uuid = enic->pp.host_uuid;
-                        sprintf(uuid_str, uuid_fmt,
-                                uuid[0],  uuid[1],  uuid[2],  uuid[3],
-                                uuid[4],  uuid[5],  uuid[6],  uuid[7],
-                                uuid[8],  uuid[9],  uuid[10], uuid[11],
-                                uuid[12], uuid[13], uuid[14], uuid[15]);
+                        sprintf(uuid_str, "%pUB", enic->pp.host_uuid);
                         vic_provinfo_add_tlv(vp,
                                 VIC_LINUX_PROV_TLV_HOST_UUID_STR,
                                 sizeof(uuid_str), uuid_str);
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index df5dcd23e4fc..9b4e5895f5f9 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -5353,6 +5353,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
 
         while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
                (count < tx_ring->count)) {
+                rmb();  /* read buffer_info after eop_desc status */
                 for (cleaned = false; !cleaned; count++) {
                         tx_desc = E1000_TX_DESC_ADV(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
@@ -5558,6 +5559,7 @@ static bool igb_clean_rx_irq_adv(struct igb_q_vector *q_vector,
                 if (*work_done >= budget)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 skb = buffer_info->skb;
                 prefetch(skb->data - NET_IP_ALIGN);
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index ec808fa8dc21..c539f7c9c3e0 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -248,6 +248,7 @@ static bool igbvf_clean_rx_irq(struct igbvf_adapter *adapter,
                 if (*work_done >= work_to_do)
                         break;
                 (*work_done)++;
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
 
                 buffer_info = &rx_ring->buffer_info[i];
 
@@ -780,6 +781,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
 
         while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
                (count < tx_ring->count)) {
+                rmb();  /* read buffer_info after eop_desc status */
                 for (cleaned = false; !cleaned; count++) {
                         tx_desc = IGBVF_TX_DESC_ADV(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index c6b75c83100c..45fc89b9ba64 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1816,6 +1816,7 @@ ixgb_clean_tx_irq(struct ixgb_adapter *adapter)
 
         while (eop_desc->status & IXGB_TX_DESC_STATUS_DD) {
 
+                rmb(); /* read buffer_info after eop_desc */
                 for (cleaned = false; !cleaned; ) {
                         tx_desc = IXGB_TX_DESC(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
@@ -1976,6 +1977,7 @@ ixgb_clean_rx_irq(struct ixgb_adapter *adapter, int *work_done, int work_to_do)
                         break;
 
                 (*work_done)++;
+                rmb();  /* read descriptor and rx_buffer_info after status DD */
                 status = rx_desc->status;
                 skb = buffer_info->skb;
                 buffer_info->skb = NULL;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7d6a415bcf88..e32af434cc9d 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -748,6 +748,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
         while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
                (count < tx_ring->work_limit)) {
                 bool cleaned = false;
+                rmb(); /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
                         struct sk_buff *skb;
                         tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
@@ -6155,9 +6156,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
                         txq &= (adapter->ring_feature[RING_F_FCOE].indices - 1);
                         txq += adapter->ring_feature[RING_F_FCOE].mask;
                         return txq;
+#ifdef CONFIG_IXGBE_DCB
                 } else if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
                         txq = adapter->fcoe.up;
                         return txq;
+#endif
                 }
         }
 #endif
@@ -6216,10 +6219,14 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
         if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED &&
             (skb->protocol == htons(ETH_P_FCOE) ||
              skb->protocol == htons(ETH_P_FIP))) {
-                tx_flags &= ~(IXGBE_TX_FLAGS_VLAN_PRIO_MASK
-                              << IXGBE_TX_FLAGS_VLAN_SHIFT);
-                tx_flags |= ((adapter->fcoe.up << 13)
-                              << IXGBE_TX_FLAGS_VLAN_SHIFT);
+#ifdef CONFIG_IXGBE_DCB
+                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+                        tx_flags &= ~(IXGBE_TX_FLAGS_VLAN_PRIO_MASK
+                                      << IXGBE_TX_FLAGS_VLAN_SHIFT);
+                        tx_flags |= ((adapter->fcoe.up << 13)
+                                      << IXGBE_TX_FLAGS_VLAN_SHIFT);
+                }
+#endif
                 /* flag for FCoE offloads */
                 if (skb->protocol == htons(ETH_P_FCOE))
                         tx_flags |= IXGBE_TX_FLAGS_FCOE;
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index 3e291ccc629d..918c00359b0a 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -231,6 +231,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
         while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
                (count < tx_ring->work_limit)) {
                 bool cleaned = false;
+                rmb(); /* read buffer_info after eop_desc */
                 for ( ; !cleaned; count++) {
                         struct sk_buff *skb;
                         tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
@@ -518,6 +519,7 @@ static bool ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector,
                         break;
                 (*work_done)++;
 
+                rmb(); /* read descriptor and rx_buffer_info after status DD */
                 if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                         hdr_info = le16_to_cpu(ixgbevf_get_hdr_info(rx_desc));
                         len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 6ce6ce1df6d2..fd86e18604e6 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -2001,27 +2001,26 @@ static void netxen_tx_timeout_task(struct work_struct *work)
         if (++adapter->tx_timeo_cnt >= NX_MAX_TX_TIMEOUTS)
                 goto request_reset;
 
+        rtnl_lock();
         if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
                 /* try to scrub interrupt */
                 netxen_napi_disable(adapter);
 
-                adapter->netdev->trans_start = jiffies;
-
                 netxen_napi_enable(adapter);
 
                 netif_wake_queue(adapter->netdev);
 
                 clear_bit(__NX_RESETTING, &adapter->state);
-                return;
         } else {
                 clear_bit(__NX_RESETTING, &adapter->state);
-                if (!netxen_nic_reset_context(adapter)) {
-                        adapter->netdev->trans_start = jiffies;
-                        return;
+                if (netxen_nic_reset_context(adapter)) {
+                        rtnl_unlock();
+                        goto request_reset;
                 }
-
-                /* context reset failed, fall through for fw reset */
         }
+        adapter->netdev->trans_start = jiffies;
+        rtnl_unlock();
+        return;
 
 request_reset:
         adapter->need_fw_reset = 1;
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 6c2e8fa0ca31..af50a530daee 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -108,9 +108,9 @@ static void ppp_async_process(unsigned long arg);
 static void async_lcp_peek(struct asyncppp *ap, unsigned char *data,
                            int len, int inbound);
 
-static struct ppp_channel_ops async_ops = {
-        ppp_async_send,
-        ppp_async_ioctl
+static const struct ppp_channel_ops async_ops = {
+        .start_xmit = ppp_async_send,
+        .ioctl      = ppp_async_ioctl,
 };
 
 /*
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index 52938da1e542..4c95ec3fb8d4 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -97,9 +97,9 @@ static void ppp_sync_flush_output(struct syncppp *ap);
 static void ppp_sync_input(struct syncppp *ap, const unsigned char *buf,
                            char *flags, int count);
 
-static struct ppp_channel_ops sync_ops = {
-        ppp_sync_send,
-        ppp_sync_ioctl
+static const struct ppp_channel_ops sync_ops = {
+        .start_xmit = ppp_sync_send,
+        .ioctl      = ppp_sync_ioctl,
 };
 
 /*
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 344ef330e123..c07de359dc07 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -92,7 +92,7 @@
 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
 
 static const struct proto_ops pppoe_ops;
-static struct ppp_channel_ops pppoe_chan_ops;
+static const struct ppp_channel_ops pppoe_chan_ops;
 
 /* per-net private data for this module */
 static int pppoe_net_id __read_mostly;
@@ -963,7 +963,7 @@ static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         return __pppoe_xmit(sk, skb);
 }
 
-static struct ppp_channel_ops pppoe_chan_ops = {
+static const struct ppp_channel_ops pppoe_chan_ops = {
         .start_xmit = pppoe_xmit,
 };
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3b03794ac3f5..7f62e2dea28f 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1457,7 +1457,6 @@ int usbnet_resume (struct usb_interface *intf)
                 spin_lock_irq(&dev->txq.lock);
                 while ((res = usb_get_from_anchor(&dev->deferred))) {
 
-                        printk(KERN_INFO"%s has delayed data\n", __func__);
                         skb = (struct sk_buff *)res->context;
                         retval = usb_submit_urb(res, GFP_ATOMIC);
                         if (retval < 0) {
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 42dffd3e5795..fd69095ef6e3 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -2763,12 +2763,12 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
 
         vptr->dev = dev;
 
-        dev->irq = pdev->irq;
-
         ret = pci_enable_device(pdev);
         if (ret < 0)
                 goto err_free_dev;
 
+        dev->irq = pdev->irq;
+
         ret = velocity_get_pci_info(vptr, pdev);
         if (ret < 0) {
                 /* error message already printed */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index bb6b67f6b0cc..4598e9d2608f 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -705,6 +705,19 @@ static int virtnet_close(struct net_device *dev)
         return 0;
 }
 
+static void virtnet_get_drvinfo(struct net_device *dev,
+                                struct ethtool_drvinfo *drvinfo)
+{
+        struct virtnet_info *vi = netdev_priv(dev);
+        struct virtio_device *vdev = vi->vdev;
+
+        strncpy(drvinfo->driver, KBUILD_MODNAME, ARRAY_SIZE(drvinfo->driver));
+        strncpy(drvinfo->version, "N/A", ARRAY_SIZE(drvinfo->version));
+        strncpy(drvinfo->fw_version, "N/A", ARRAY_SIZE(drvinfo->fw_version));
+        strncpy(drvinfo->bus_info, dev_name(&vdev->dev),
+                ARRAY_SIZE(drvinfo->bus_info));
+}
+
 static int virtnet_set_tx_csum(struct net_device *dev, u32 data)
 {
         struct virtnet_info *vi = netdev_priv(dev);
@@ -817,6 +830,7 @@ static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 }
 
 static const struct ethtool_ops virtnet_ethtool_ops = {
+        .get_drvinfo = virtnet_get_drvinfo,
         .set_tx_csum = virtnet_set_tx_csum,
         .set_sg = ethtool_op_set_sg,
         .set_tso = ethtool_op_set_tso,
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
index dabafb874c36..fe7418aefc4a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -63,6 +63,7 @@ static bool ar9002_hw_per_calibration(struct ath_hw *ah,
                                       u8 rxchainmask,
                                       struct ath9k_cal_list *currCal)
 {
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         bool iscaldone = false;
 
         if (currCal->calState == CAL_RUNNING) {
@@ -81,14 +82,14 @@ static bool ar9002_hw_per_calibration(struct ath_hw *ah,
                                 }
 
                                 currCal->calData->calPostProc(ah, numChains);
-                                ichan->CalValid |= currCal->calData->calType;
+                                caldata->CalValid |= currCal->calData->calType;
                                 currCal->calState = CAL_DONE;
                                 iscaldone = true;
                         } else {
                                 ar9002_hw_setup_calibration(ah, currCal);
                         }
                 }
-        } else if (!(ichan->CalValid & currCal->calData->calType)) {
+        } else if (!(caldata->CalValid & currCal->calData->calType)) {
                 ath9k_hw_reset_calibration(ah, currCal);
         }
 
@@ -686,8 +687,13 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
 {
         bool iscaldone = true;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
+        bool nfcal, nfcal_pending = false;
 
-        if (currCal &&
+        nfcal = !!(REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF);
+        if (ah->caldata)
+                nfcal_pending = ah->caldata->nfcal_pending;
+
+        if (currCal && !nfcal &&
             (currCal->calState == CAL_RUNNING ||
              currCal->calState == CAL_WAITING)) {
                 iscaldone = ar9002_hw_per_calibration(ah, chan,
@@ -703,7 +709,7 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
         }
 
         /* Do NF cal only at longer intervals */
-        if (longcal) {
+        if (longcal || nfcal_pending) {
                 /* Do periodic PAOffset Cal */
                 ar9002_hw_pa_cal(ah, false);
                 ar9002_hw_olc_temp_compensation(ah);
@@ -712,16 +718,18 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
                  * Get the value from the previous NF cal and update
                  * history buffer.
                  */
-                ath9k_hw_getnf(ah, chan);
-
-                /*
-                 * Load the NF from history buffer of the current channel.
-                 * NF is slow time-variant, so it is OK to use a historical
-                 * value.
-                 */
-                ath9k_hw_loadnf(ah, ah->curchan);
+                if (ath9k_hw_getnf(ah, chan)) {
+                        /*
+                         * Load the NF from history buffer of the current
+                         * channel.
+                         * NF is slow time-variant, so it is OK to use a
+                         * historical value.
+                         */
+                        ath9k_hw_loadnf(ah, ah->curchan);
+                }
 
-                ath9k_hw_start_nfcal(ah);
+                if (longcal)
+                        ath9k_hw_start_nfcal(ah, false);
         }
 
         return iscaldone;
@@ -869,8 +877,10 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         ar9002_hw_pa_cal(ah, true);
 
         /* Do NF Calibration after DC offset and other calibrations */
-        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
-                  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF);
+        ath9k_hw_start_nfcal(ah, true);
+
+        if (ah->caldata)
+                ah->caldata->nfcal_pending = true;
 
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
@@ -901,7 +911,8 @@ static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
                         ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
         }
 
-        chan->CalValid = 0;
+        if (ah->caldata)
+                ah->caldata->CalValid = 0;
 
         return true;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 5a0650399136..4674ea8c9c99 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -68,6 +68,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
                                       u8 rxchainmask,
                                       struct ath9k_cal_list *currCal)
 {
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         /* Cal is assumed not done until explicitly set below */
         bool iscaldone = false;
 
@@ -95,7 +96,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
                                 currCal->calData->calPostProc(ah, numChains);
 
                                 /* Calibration has finished. */
-                                ichan->CalValid |= currCal->calData->calType;
+                                caldata->CalValid |= currCal->calData->calType;
                                 currCal->calState = CAL_DONE;
                                 iscaldone = true;
                         } else {
@@ -106,7 +107,7 @@ static bool ar9003_hw_per_calibration(struct ath_hw *ah,
                         ar9003_hw_setup_calibration(ah, currCal);
                         }
                 }
-        } else if (!(ichan->CalValid & currCal->calData->calType)) {
+        } else if (!(caldata->CalValid & currCal->calData->calType)) {
                 /* If current cal is marked invalid in channel, kick it off */
                 ath9k_hw_reset_calibration(ah, currCal);
         }
@@ -149,6 +150,12 @@ static bool ar9003_hw_calibrate(struct ath_hw *ah,
         /* Do NF cal only at longer intervals */
         if (longcal) {
                 /*
+                 * Get the value from the previous NF cal and update
+                 * history buffer.
+                 */
+                ath9k_hw_getnf(ah, chan);
+
+                /*
                  * Load the NF from history buffer of the current channel.
                  * NF is slow time-variant, so it is OK to use a historical
                  * value.
@@ -156,7 +163,7 @@ static bool ar9003_hw_calibrate(struct ath_hw *ah,
                 ath9k_hw_loadnf(ah, ah->curchan);
 
                 /* start NF calibration, without updating BB NF register */
-                ath9k_hw_start_nfcal(ah);
+                ath9k_hw_start_nfcal(ah, false);
         }
 
         return iscaldone;
@@ -762,6 +769,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         /* Revert chainmasks to their original values before NF cal */
         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
 
+        ath9k_hw_start_nfcal(ah, true);
+
         /* Initialize list pointers */
         ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
 
@@ -785,7 +794,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         if (ah->cal_list_curr)
                 ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
 
-        chan->CalValid = 0;
+        if (ah->caldata)
+                ah->caldata->CalValid = 0;
 
         return true;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index ace8d2678b18..b883b174385b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -41,6 +41,20 @@
 #define LE16(x) __constant_cpu_to_le16(x)
 #define LE32(x) __constant_cpu_to_le32(x)
 
+/* Local defines to distinguish between extension and control CTL's */
+#define EXT_ADDITIVE (0x8000)
+#define CTL_11A_EXT (CTL_11A | EXT_ADDITIVE)
+#define CTL_11G_EXT (CTL_11G | EXT_ADDITIVE)
+#define CTL_11B_EXT (CTL_11B | EXT_ADDITIVE)
+#define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6  /* 10*log10(2)*2 */
+#define REDUCE_SCALED_POWER_BY_THREE_CHAIN   9  /* 10*log10(3)*2 */
+#define PWRINCR_3_TO_1_CHAIN      9             /* 10*log(3)*2 */
+#define PWRINCR_3_TO_2_CHAIN      3             /* floor(10*log(3/2)*2) */
+#define PWRINCR_2_TO_1_CHAIN      6             /* 10*log(2)*2 */
+
+#define SUB_NUM_CTL_MODES_AT_5G_40 2    /* excluding HT40, EXT-OFDM */
+#define SUB_NUM_CTL_MODES_AT_2G_40 3    /* excluding HT40, EXT-OFDM, EXT-CCK */
+
 static const struct ar9300_eeprom ar9300_default = {
         .eepromVersion = 2,
         .templateVersion = 2,
@@ -609,6 +623,14 @@ static const struct ar9300_eeprom ar9300_default = {
          }
 };
 
+static u16 ath9k_hw_fbin2freq(u8 fbin, bool is2GHz)
+{
+        if (fbin == AR9300_BCHAN_UNUSED)
+                return fbin;
+
+        return (u16) ((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
+}
+
 static int ath9k_hw_ar9300_check_eeprom(struct ath_hw *ah)
 {
         return 0;
@@ -1417,9 +1439,9 @@ static int ar9003_hw_tx_power_regwrite(struct ath_hw *ah, u8 * pPwrArray)
 #undef POW_SM
 }
 
-static void ar9003_hw_set_target_power_eeprom(struct ath_hw *ah, u16 freq)
+static void ar9003_hw_set_target_power_eeprom(struct ath_hw *ah, u16 freq,
+                                              u8 *targetPowerValT2)
 {
-        u8 targetPowerValT2[ar9300RateSize];
         /* XXX: hard code for now, need to get from eeprom struct */
         u8 ht40PowerIncForPdadc = 0;
         bool is2GHz = false;
@@ -1553,9 +1575,6 @@ static void ar9003_hw_set_target_power_eeprom(struct ath_hw *ah, u16 freq)
                           "TPC[%02d] 0x%08x\n", i, targetPowerValT2[i]);
                 i++;
         }
-
-        /* Write target power array to registers */
-        ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
 }
 
 static int ar9003_hw_cal_pier_get(struct ath_hw *ah,
@@ -1799,14 +1818,369 @@ static int ar9003_hw_calibration_apply(struct ath_hw *ah, int frequency)
         return 0;
 }
 
+static u16 ar9003_hw_get_direct_edge_power(struct ar9300_eeprom *eep,
+                                           int idx,
+                                           int edge,
+                                           bool is2GHz)
+{
+        struct cal_ctl_data_2g *ctl_2g = eep->ctlPowerData_2G;
+        struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
+
+        if (is2GHz)
+                return ctl_2g[idx].ctlEdges[edge].tPower;
+        else
+                return ctl_5g[idx].ctlEdges[edge].tPower;
+}
+
+static u16 ar9003_hw_get_indirect_edge_power(struct ar9300_eeprom *eep,
+                                             int idx,
+                                             unsigned int edge,
+                                             u16 freq,
+                                             bool is2GHz)
+{
+        struct cal_ctl_data_2g *ctl_2g = eep->ctlPowerData_2G;
+        struct cal_ctl_data_5g *ctl_5g = eep->ctlPowerData_5G;
+
+        u8 *ctl_freqbin = is2GHz ?
+                &eep->ctl_freqbin_2G[idx][0] :
+                &eep->ctl_freqbin_5G[idx][0];
+
+        if (is2GHz) {
+                if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 1) < freq &&
+                    ctl_2g[idx].ctlEdges[edge - 1].flag)
+                        return ctl_2g[idx].ctlEdges[edge - 1].tPower;
+        } else {
+                if (ath9k_hw_fbin2freq(ctl_freqbin[edge - 1], 0) < freq &&
+                    ctl_5g[idx].ctlEdges[edge - 1].flag)
+                        return ctl_5g[idx].ctlEdges[edge - 1].tPower;
+        }
+
+        return AR9300_MAX_RATE_POWER;
+}
+
+/*
+ * Find the maximum conformance test limit for the given channel and CTL info
+ */
+static u16 ar9003_hw_get_max_edge_power(struct ar9300_eeprom *eep,
+                                        u16 freq, int idx, bool is2GHz)
+{
+        u16 twiceMaxEdgePower = AR9300_MAX_RATE_POWER;
+        u8 *ctl_freqbin = is2GHz ?
+                &eep->ctl_freqbin_2G[idx][0] :
+                &eep->ctl_freqbin_5G[idx][0];
+        u16 num_edges = is2GHz ?
+                AR9300_NUM_BAND_EDGES_2G : AR9300_NUM_BAND_EDGES_5G;
+        unsigned int edge;
+
+        /* Get the edge power */
+        for (edge = 0;
+             (edge < num_edges) && (ctl_freqbin[edge] != AR9300_BCHAN_UNUSED);
+             edge++) {
+                /*
+                 * If there's an exact channel match or an inband flag set
+                 * on the lower channel use the given rdEdgePower
+                 */
+                if (freq == ath9k_hw_fbin2freq(ctl_freqbin[edge], is2GHz)) {
+                        twiceMaxEdgePower =
+                                ar9003_hw_get_direct_edge_power(eep, idx,
+                                                                edge, is2GHz);
+                        break;
+                } else if ((edge > 0) &&
+                           (freq < ath9k_hw_fbin2freq(ctl_freqbin[edge],
+                                                      is2GHz))) {
+                        twiceMaxEdgePower =
+                                ar9003_hw_get_indirect_edge_power(eep, idx,
+                                                                  edge, freq,
+                                                                  is2GHz);
+                        /*
+                         * Leave loop - no more affecting edges possible in
+                         * this monotonic increasing list
+                         */
+                        break;
+                }
+        }
+        return twiceMaxEdgePower;
+}
+
+static void ar9003_hw_set_power_per_rate_table(struct ath_hw *ah,
+                                               struct ath9k_channel *chan,
+                                               u8 *pPwrArray, u16 cfgCtl,
+                                               u8 twiceAntennaReduction,
+                                               u8 twiceMaxRegulatoryPower,
+                                               u16 powerLimit)
+{
+        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ar9300_eeprom *pEepData = &ah->eeprom.ar9300_eep;
+        u16 twiceMaxEdgePower = AR9300_MAX_RATE_POWER;
+        static const u16 tpScaleReductionTable[5] = {
+                0, 3, 6, 9, AR9300_MAX_RATE_POWER
+        };
+        int i;
+        int16_t  twiceLargestAntenna;
+        u16 scaledPower = 0, minCtlPower, maxRegAllowedPower;
+        u16 ctlModesFor11a[] = {
+                CTL_11A, CTL_5GHT20, CTL_11A_EXT, CTL_5GHT40
+        };
+        u16 ctlModesFor11g[] = {
+                CTL_11B, CTL_11G, CTL_2GHT20, CTL_11B_EXT,
+                CTL_11G_EXT, CTL_2GHT40
+        };
+        u16 numCtlModes, *pCtlMode, ctlMode, freq;
+        struct chan_centers centers;
+        u8 *ctlIndex;
+        u8 ctlNum;
+        u16 twiceMinEdgePower;
+        bool is2ghz = IS_CHAN_2GHZ(chan);
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+
+        /* Compute TxPower reduction due to Antenna Gain */
+        if (is2ghz)
+                twiceLargestAntenna = pEepData->modalHeader2G.antennaGain;
+        else
+                twiceLargestAntenna = pEepData->modalHeader5G.antennaGain;
+
+        twiceLargestAntenna = (int16_t)min((twiceAntennaReduction) -
+                                twiceLargestAntenna, 0);
+
+        /*
+         * scaledPower is the minimum of the user input power level
+         * and the regulatory allowed power level
+         */
+        maxRegAllowedPower = twiceMaxRegulatoryPower + twiceLargestAntenna;
+
+        if (regulatory->tp_scale != ATH9K_TP_SCALE_MAX) {
+                maxRegAllowedPower -=
+                        (tpScaleReductionTable[(regulatory->tp_scale)] * 2);
+        }
+
+        scaledPower = min(powerLimit, maxRegAllowedPower);
+
+        /*
+         * Reduce scaled Power by number of chains active to get
+         * to per chain tx power level
+         */
+        switch (ar5416_get_ntxchains(ah->txchainmask)) {
+        case 1:
+                break;
+        case 2:
+                scaledPower -= REDUCE_SCALED_POWER_BY_TWO_CHAIN;
+                break;
+        case 3:
+                scaledPower -= REDUCE_SCALED_POWER_BY_THREE_CHAIN;
+                break;
+        }
+
+        scaledPower = max((u16)0, scaledPower);
+
+        /*
+         * Get target powers from EEPROM - our baseline for TX Power
+         */
+        if (is2ghz) {
+                /* Setup for CTL modes */
+                /* CTL_11B, CTL_11G, CTL_2GHT20 */
+                numCtlModes =
+                        ARRAY_SIZE(ctlModesFor11g) -
+                                   SUB_NUM_CTL_MODES_AT_2G_40;
+                pCtlMode = ctlModesFor11g;
+                if (IS_CHAN_HT40(chan))
+                        /* All 2G CTL's */
+                        numCtlModes = ARRAY_SIZE(ctlModesFor11g);
+        } else {
+                /* Setup for CTL modes */
+                /* CTL_11A, CTL_5GHT20 */
+                numCtlModes = ARRAY_SIZE(ctlModesFor11a) -
+                                         SUB_NUM_CTL_MODES_AT_5G_40;
+                pCtlMode = ctlModesFor11a;
+                if (IS_CHAN_HT40(chan))
+                        /* All 5G CTL's */
+                        numCtlModes = ARRAY_SIZE(ctlModesFor11a);
+        }
+
+        /*
+         * For MIMO, need to apply regulatory caps individually across
+         * dynamically running modes: CCK, OFDM, HT20, HT40
+         *
+         * The outer loop walks through each possible applicable runtime mode.
+         * The inner loop walks through each ctlIndex entry in EEPROM.
+         * The ctl value is encoded as [7:4] == test group, [3:0] == test mode.
+         */
+        for (ctlMode = 0; ctlMode < numCtlModes; ctlMode++) {
+                bool isHt40CtlMode = (pCtlMode[ctlMode] == CTL_5GHT40) ||
+                        (pCtlMode[ctlMode] == CTL_2GHT40);
+                if (isHt40CtlMode)
+                        freq = centers.synth_center;
+                else if (pCtlMode[ctlMode] & EXT_ADDITIVE)
+                        freq = centers.ext_center;
+                else
+                        freq = centers.ctl_center;
+
+                ath_print(common, ATH_DBG_REGULATORY,
+                          "LOOP-Mode ctlMode %d < %d, isHt40CtlMode %d, "
+                          "EXT_ADDITIVE %d\n",
+                          ctlMode, numCtlModes, isHt40CtlMode,
+                          (pCtlMode[ctlMode] & EXT_ADDITIVE));
+
+                /* walk through each CTL index stored in EEPROM */
+                if (is2ghz) {
+                        ctlIndex = pEepData->ctlIndex_2G;
+                        ctlNum = AR9300_NUM_CTLS_2G;
+                } else {
+                        ctlIndex = pEepData->ctlIndex_5G;
+                        ctlNum = AR9300_NUM_CTLS_5G;
+                }
+
+                for (i = 0; (i < ctlNum) && ctlIndex[i]; i++) {
+                        ath_print(common, ATH_DBG_REGULATORY,
+                                  "LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
+                                  "pCtlMode 0x%2.2x ctlIndex 0x%2.2x "
+                                  "chan %dn",
+                                  i, cfgCtl, pCtlMode[ctlMode], ctlIndex[i],
+                                  chan->channel);
+
+                                /*
+                                 * compare test group from regulatory
+                                 * channel list with test mode from pCtlMode
+                                 * list
+                                 */
+                                if ((((cfgCtl & ~CTL_MODE_M) |
+                                       (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                                        ctlIndex[i]) ||
+                                    (((cfgCtl & ~CTL_MODE_M) |
+                                       (pCtlMode[ctlMode] & CTL_MODE_M)) ==
+                                     ((ctlIndex[i] & CTL_MODE_M) |
+                                       SD_NO_CTL))) {
+                                        twiceMinEdgePower =
+                                          ar9003_hw_get_max_edge_power(pEepData,
+                                                                       freq, i,
+                                                                       is2ghz);
+
+                                        if ((cfgCtl & ~CTL_MODE_M) == SD_NO_CTL)
+                                                /*
+                                                 * Find the minimum of all CTL
+                                                 * edge powers that apply to
+                                                 * this channel
+                                                 */
+                                                twiceMaxEdgePower =
+                                                        min(twiceMaxEdgePower,
+                                                            twiceMinEdgePower);
+                                                else {
+                                                        /* specific */
+                                                        twiceMaxEdgePower =
+                                                          twiceMinEdgePower;
+                                                        break;
+                                                }
+                                }
+                        }
+
+                        minCtlPower = (u8)min(twiceMaxEdgePower, scaledPower);
+
+                        ath_print(common, ATH_DBG_REGULATORY,
+                                  "SEL-Min ctlMode %d pCtlMode %d 2xMaxEdge %d "
+                                  "sP %d minCtlPwr %d\n",
+                                  ctlMode, pCtlMode[ctlMode], twiceMaxEdgePower,
+                                  scaledPower, minCtlPower);
+
+                        /* Apply ctl mode to correct target power set */
+                        switch (pCtlMode[ctlMode]) {
+                        case CTL_11B:
+                                for (i = ALL_TARGET_LEGACY_1L_5L;
+                                     i <= ALL_TARGET_LEGACY_11S; i++)
+                                        pPwrArray[i] =
+                                          (u8)min((u16)pPwrArray[i],
+                                                  minCtlPower);
+                                break;
+                        case CTL_11A:
+                        case CTL_11G:
+                                for (i = ALL_TARGET_LEGACY_6_24;
+                                     i <= ALL_TARGET_LEGACY_54; i++)
+                                        pPwrArray[i] =
+                                          (u8)min((u16)pPwrArray[i],
+                                                  minCtlPower);
+                                break;
+                        case CTL_5GHT20:
+                        case CTL_2GHT20:
+                                for (i = ALL_TARGET_HT20_0_8_16;
+                                     i <= ALL_TARGET_HT20_21; i++)
+                                        pPwrArray[i] =
+                                          (u8)min((u16)pPwrArray[i],
+                                                  minCtlPower);
+                                pPwrArray[ALL_TARGET_HT20_22] =
+                                  (u8)min((u16)pPwrArray[ALL_TARGET_HT20_22],
+                                          minCtlPower);
+                                pPwrArray[ALL_TARGET_HT20_23] =
+                                  (u8)min((u16)pPwrArray[ALL_TARGET_HT20_23],
+                                           minCtlPower);
+                                break;
+                        case CTL_5GHT40:
+                        case CTL_2GHT40:
+                                for (i = ALL_TARGET_HT40_0_8_16;
+                                     i <= ALL_TARGET_HT40_23; i++)
+                                        pPwrArray[i] =
+                                          (u8)min((u16)pPwrArray[i],
+                                                  minCtlPower);
+                                break;
+                        default:
+                            break;
+                        }
+        } /* end ctl mode checking */
+}
+
 static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
                                         struct ath9k_channel *chan, u16 cfgCtl,
                                         u8 twiceAntennaReduction,
                                         u8 twiceMaxRegulatoryPower,
                                         u8 powerLimit)
 {
-        ah->txpower_limit = powerLimit;
-        ar9003_hw_set_target_power_eeprom(ah, chan->channel);
+        struct ath_common *common = ath9k_hw_common(ah);
+        u8 targetPowerValT2[ar9300RateSize];
+        unsigned int i = 0;
+
+        ar9003_hw_set_target_power_eeprom(ah, chan->channel, targetPowerValT2);
+        ar9003_hw_set_power_per_rate_table(ah, chan,
+                                           targetPowerValT2, cfgCtl,
+                                           twiceAntennaReduction,
+                                           twiceMaxRegulatoryPower,
+                                           powerLimit);
+
+        while (i < ar9300RateSize) {
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x\n\n", i, targetPowerValT2[i]);
+                i++;
+        }
+
+        /* Write target power array to registers */
+        ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
+
+        /*
+         * This is the TX power we send back to driver core,
+         * and it can use to pass to userspace to display our
+         * currently configured TX power setting.
+         *
+         * Since power is rate dependent, use one of the indices
+         * from the AR9300_Rates enum to select an entry from
+         * targetPowerValT2[] to report. Currently returns the
+         * power for HT40 MCS 0, HT20 MCS 0, or OFDM 6 Mbps
+         * as CCK power is less interesting (?).
+         */
+        i = ALL_TARGET_LEGACY_6_24; /* legacy */
+        if (IS_CHAN_HT40(chan))
+                i = ALL_TARGET_HT40_0_8_16; /* ht40 */
+        else if (IS_CHAN_HT20(chan))
+                i = ALL_TARGET_HT20_0_8_16; /* ht20 */
+
+        ah->txpower_limit = targetPowerValT2[i];
+
         ar9003_hw_calibration_apply(ah, chan->channel);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 49e0c865ce5c..7c38229ba670 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -577,10 +577,11 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 }
 
 void ar9003_paprd_populate_single_table(struct ath_hw *ah,
-                                        struct ath9k_channel *chan, int chain)
+                                        struct ath9k_hw_cal_data *caldata,
+                                        int chain)
 {
-        u32 *paprd_table_val = chan->pa_table[chain];
-        u32 small_signal_gain = chan->small_signal_gain[chain];
+        u32 *paprd_table_val = caldata->pa_table[chain];
+        u32 small_signal_gain = caldata->small_signal_gain[chain];
         u32 training_power;
         u32 reg = 0;
         int i;
@@ -654,17 +655,17 @@ int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain)
 }
 EXPORT_SYMBOL(ar9003_paprd_setup_gain_table);
 
-int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
-                              int chain)
+int ar9003_paprd_create_curve(struct ath_hw *ah,
+                              struct ath9k_hw_cal_data *caldata, int chain)
 {
-        u16 *small_signal_gain = &chan->small_signal_gain[chain];
-        u32 *pa_table = chan->pa_table[chain];
+        u16 *small_signal_gain = &caldata->small_signal_gain[chain];
+        u32 *pa_table = caldata->pa_table[chain];
         u32 *data_L, *data_U;
         int i, status = 0;
         u32 *buf;
         u32 reg;
 
-        memset(chan->pa_table[chain], 0, sizeof(chan->pa_table[chain]));
+        memset(caldata->pa_table[chain], 0, sizeof(caldata->pa_table[chain]));
 
         buf = kmalloc(2 * 48 * sizeof(u32), GFP_ATOMIC);
         if (!buf)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index a753a431bb13..a491854fa38a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -542,7 +542,11 @@ static void ar9003_hw_prog_ini(struct ath_hw *ah,
                 u32 reg = INI_RA(iniArr, i, 0);
                 u32 val = INI_RA(iniArr, i, column);
 
-                REG_WRITE(ah, reg, val);
+                if (reg >= 0x16000 && reg < 0x17000)
+                        ath9k_hw_analog_shift_regwrite(ah, reg, val);
+                else
+                        REG_WRITE(ah, reg, val);
+
                 DO_DELAY(regWrites);
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 998ae2c49ed2..07f26ee7a723 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -510,7 +510,7 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_BEACONS                BIT(1)
 #define SC_OP_RXAGGR                 BIT(2)
 #define SC_OP_TXAGGR                 BIT(3)
-#define SC_OP_FULL_RESET             BIT(4)
+#define SC_OP_OFFCHANNEL             BIT(4)
 #define SC_OP_PREAMBLE_SHORT         BIT(5)
 #define SC_OP_PROTECT_ENABLE         BIT(6)
 #define SC_OP_RXFLUSH                BIT(7)
@@ -609,6 +609,7 @@ struct ath_softc {
 struct ath_wiphy {
         struct ath_softc *sc; /* shared for all virtual wiphys */
         struct ieee80211_hw *hw;
+        struct ath9k_hw_cal_data caldata;
         enum ath_wiphy_state {
                 ATH_WIPHY_INACTIVE,
                 ATH_WIPHY_ACTIVE,
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 139289e4e933..45208690c0ec 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -22,23 +22,6 @@
 /* We can tune this as we go by monitoring really low values */
 #define ATH9K_NF_TOO_LOW        -60
 
-/* AR5416 may return very high value (like -31 dBm), in those cases the nf
- * is incorrect and we should use the static NF value. Later we can try to
- * find out why they are reporting these values */
-
-static bool ath9k_hw_nf_in_range(struct ath_hw *ah, s16 nf)
-{
-        if (nf > ATH9K_NF_TOO_LOW) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
-                          "noise floor value detected (%d) is "
-                          "lower than what we think is a "
-                          "reasonable value (%d)\n",
-                          nf, ATH9K_NF_TOO_LOW);
-                return false;
-        }
-        return true;
-}
-
 static int16_t ath9k_hw_get_nf_hist_mid(int16_t *nfCalBuffer)
 {
         int16_t nfval;
@@ -121,6 +104,19 @@ void ath9k_hw_reset_calibration(struct ath_hw *ah,
         ah->cal_samples = 0;
 }
 
+static s16 ath9k_hw_get_default_nf(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+        struct ath_nf_limits *limit;
+
+        if (!chan || IS_CHAN_2GHZ(chan))
+                limit = &ah->nf_2g;
+        else
+                limit = &ah->nf_5g;
+
+        return limit->nominal;
+}
+
 /* This is done for the currently configured channel */
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
@@ -128,7 +124,7 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
         struct ieee80211_conf *conf = &common->hw->conf;
         struct ath9k_cal_list *currCal = ah->cal_list_curr;
 
-        if (!ah->curchan)
+        if (!ah->caldata)
                 return true;
 
         if (!AR_SREV_9100(ah) && !AR_SREV_9160_10_OR_LATER(ah))
@@ -151,37 +147,55 @@ bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
                   "Resetting Cal %d state for channel %u\n",
                   currCal->calData->calType, conf->channel->center_freq);
 
-        ah->curchan->CalValid &= ~currCal->calData->calType;
+        ah->caldata->CalValid &= ~currCal->calData->calType;
         currCal->calState = CAL_WAITING;
 
         return false;
 }
 EXPORT_SYMBOL(ath9k_hw_reset_calvalid);
 
-void ath9k_hw_start_nfcal(struct ath_hw *ah)
+void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update)
 {
+        if (ah->caldata)
+                ah->caldata->nfcal_pending = true;
+
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
                     AR_PHY_AGC_CONTROL_ENABLE_NF);
-        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+
+        if (update)
+                REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+        else
+                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
                     AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
 }
 
 void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        struct ath9k_nfcal_hist *h;
+        struct ath9k_nfcal_hist *h = NULL;
         unsigned i, j;
         int32_t val;
         u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
         struct ath_common *common = ath9k_hw_common(ah);
+        s16 default_nf = ath9k_hw_get_default_nf(ah, chan);
 
-        h = ah->nfCalHist;
+        if (ah->caldata)
+                h = ah->caldata->nfCalHist;
 
         for (i = 0; i < NUM_NF_READINGS; i++) {
                 if (chainmask & (1 << i)) {
+                        s16 nfval;
+
+                        if (h)
+                                nfval = h[i].privNF;
+                        else
+                                nfval = default_nf;
+
                         val = REG_READ(ah, ah->nf_regs[i]);
                         val &= 0xFFFFFE00;
-                        val |= (((u32) (h[i].privNF) << 1) & 0x1ff);
+                        val |= (((u32) nfval << 1) & 0x1ff);
                         REG_WRITE(ah, ah->nf_regs[i], val);
                 }
         }
@@ -277,22 +291,25 @@ static void ath9k_hw_nf_sanitize(struct ath_hw *ah, s16 *nf)
         }
 }
 
-int16_t ath9k_hw_getnf(struct ath_hw *ah,
-                       struct ath9k_channel *chan)
+bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         int16_t nf, nfThresh;
         int16_t nfarray[NUM_NF_READINGS] = { 0 };
         struct ath9k_nfcal_hist *h;
         struct ieee80211_channel *c = chan->chan;
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+
+        if (!caldata)
+                return false;
 
         chan->channelFlags &= (~CHANNEL_CW_INT);
         if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
                 ath_print(common, ATH_DBG_CALIBRATE,
                           "NF did not complete in calibration window\n");
                 nf = 0;
-                chan->rawNoiseFloor = nf;
-                return chan->rawNoiseFloor;
+                caldata->rawNoiseFloor = nf;
+                return false;
         } else {
                 ath9k_hw_do_getnf(ah, nfarray);
                 ath9k_hw_nf_sanitize(ah, nfarray);
@@ -307,47 +324,40 @@ int16_t ath9k_hw_getnf(struct ath_hw *ah,
                 }
         }
 
-        h = ah->nfCalHist;
-
+        h = caldata->nfCalHist;
+        caldata->nfcal_pending = false;
         ath9k_hw_update_nfcal_hist_buffer(h, nfarray);
-        chan->rawNoiseFloor = h[0].privNF;
-
-        return chan->rawNoiseFloor;
+        caldata->rawNoiseFloor = h[0].privNF;
+        return true;
 }
 
-void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah)
+void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
+                                  struct ath9k_channel *chan)
 {
-        struct ath_nf_limits *limit;
+        struct ath9k_nfcal_hist *h;
+        s16 default_nf;
         int i, j;
 
-        if (!ah->curchan || IS_CHAN_2GHZ(ah->curchan))
-                limit = &ah->nf_2g;
-        else
-                limit = &ah->nf_5g;
+        if (!ah->caldata)
+                return;
 
+        h = ah->caldata->nfCalHist;
+        default_nf = ath9k_hw_get_default_nf(ah, chan);
         for (i = 0; i < NUM_NF_READINGS; i++) {
-                ah->nfCalHist[i].currIndex = 0;
-                ah->nfCalHist[i].privNF = limit->nominal;
-                ah->nfCalHist[i].invalidNFcount =
-                        AR_PHY_CCA_FILTERWINDOW_LENGTH;
+                h[i].currIndex = 0;
+                h[i].privNF = default_nf;
+                h[i].invalidNFcount = AR_PHY_CCA_FILTERWINDOW_LENGTH;
                 for (j = 0; j < ATH9K_NF_CAL_HIST_MAX; j++) {
-                        ah->nfCalHist[i].nfCalBuffer[j] = limit->nominal;
+                        h[i].nfCalBuffer[j] = default_nf;
                 }
         }
 }
 
 s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
 {
-        s16 nf;
-
-        if (chan->rawNoiseFloor == 0)
-                nf = -96;
-        else
-                nf = chan->rawNoiseFloor;
-
-        if (!ath9k_hw_nf_in_range(ah, nf))
-                nf = ATH_DEFAULT_NOISE_FLOOR;
+        if (!ah->caldata || !ah->caldata->rawNoiseFloor)
+                return ath9k_hw_get_default_nf(ah, chan);
 
-        return nf;
+        return ah->caldata->rawNoiseFloor;
 }
 EXPORT_SYMBOL(ath9k_hw_getchan_noise);
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index cd60d09cdda7..0a304b3eeeb6 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -108,11 +108,11 @@ struct ath9k_pacal_info{
 };
 
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah);
-void ath9k_hw_start_nfcal(struct ath_hw *ah);
+void ath9k_hw_start_nfcal(struct ath_hw *ah, bool update);
 void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
-int16_t ath9k_hw_getnf(struct ath_hw *ah,
-                       struct ath9k_channel *chan);
-void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah);
+bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan);
+void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
+                                  struct ath9k_channel *chan);
 s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan);
 void ath9k_hw_reset_calibration(struct ath_hw *ah,
                                 struct ath9k_cal_list *currCal);
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 3756400e6bf9..43b9e21bc562 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -353,6 +353,8 @@ struct ath9k_htc_priv {
         u16 seq_no;
         u32 bmiss_cnt;
 
+        struct ath9k_hw_cal_data caldata[38];
+
         spinlock_t beacon_lock;
 
         bool tx_queues_stop;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index cf9bcc67ade2..ebed9d1691a5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -125,6 +125,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         struct ieee80211_conf *conf = &common->hw->conf;
         bool fastcc = true;
         struct ieee80211_channel *channel = hw->conf.channel;
+        struct ath9k_hw_cal_data *caldata;
         enum htc_phymode mode;
         __be16 htc_mode;
         u8 cmd_rsp;
@@ -149,7 +150,8 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
                   priv->ah->curchan->channel,
                   channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf));
 
-        ret = ath9k_hw_reset(ah, hchan, fastcc);
+        caldata = &priv->caldata[channel->hw_value];
+        ret = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (ret) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u Mhz) "
@@ -1028,7 +1030,7 @@ static void ath9k_htc_radio_enable(struct ieee80211_hw *hw)
                 ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
 
         /* Reset the HW */
-        ret = ath9k_hw_reset(ah, ah->curchan, false);
+        ret = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (ret) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
@@ -1091,7 +1093,7 @@ static void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
                 ah->curchan = ath9k_cmn_get_curchannel(hw, ah);
 
         /* Reset the HW */
-        ret = ath9k_hw_reset(ah, ah->curchan, false);
+        ret = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (ret) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
@@ -1179,7 +1181,7 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         ath9k_hw_configpcipowersave(ah, 0, 0);
 
         ath9k_hw_htc_resetinit(ah);
-        ret = ath9k_hw_reset(ah, init_channel, false);
+        ret = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (ret) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8d291ccf5c88..3384ca164562 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -610,7 +610,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         else
                 ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
 
-        ath9k_init_nfcal_hist_buffer(ah);
         ah->bb_watchdog_timeout_ms = 25;
 
         common->state = ATH_HW_INITIALIZED;
@@ -1183,9 +1182,6 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
 
         ath9k_hw_spur_mitigate_freq(ah, chan);
 
-        if (!chan->oneTimeCalsDone)
-                chan->oneTimeCalsDone = true;
-
         return true;
 }
 
@@ -1218,7 +1214,7 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
 EXPORT_SYMBOL(ath9k_hw_check_alive);
 
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
-                    bool bChannelChange)
+                   struct ath9k_hw_cal_data *caldata, bool bChannelChange)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         u32 saveLedState;
@@ -1243,9 +1239,19 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return -EIO;
 
-        if (curchan && !ah->chip_fullsleep)
+        if (curchan && !ah->chip_fullsleep && ah->caldata)
                 ath9k_hw_getnf(ah, curchan);
 
+        ah->caldata = caldata;
+        if (caldata &&
+            (chan->channel != caldata->channel ||
+             (chan->channelFlags & ~CHANNEL_CW_INT) !=
+             (caldata->channelFlags & ~CHANNEL_CW_INT))) {
+                /* Operating channel changed, reset channel calibration data */
+                memset(caldata, 0, sizeof(*caldata));
+                ath9k_init_nfcal_hist_buffer(ah, chan);
+        }
+
         if (bChannelChange &&
             (ah->chip_fullsleep != true) &&
             (ah->curchan != NULL) &&
@@ -1256,7 +1262,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
                 if (ath9k_hw_channel_change(ah, chan)) {
                         ath9k_hw_loadnf(ah, ah->curchan);
-                        ath9k_hw_start_nfcal(ah);
+                        ath9k_hw_start_nfcal(ah, true);
                         return 0;
                 }
         }
@@ -1461,11 +1467,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ah->btcoex_hw.enabled)
                 ath9k_hw_btcoex_enable(ah);
 
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
-                ath9k_hw_loadnf(ah, curchan);
-                ath9k_hw_start_nfcal(ah);
+        if (AR_SREV_9300_20_OR_LATER(ah))
                 ar9003_hw_bb_watchdog_config(ah);
-        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 2d30efc0b94f..399f7c1283cd 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -346,19 +346,25 @@ enum ath9k_int {
          CHANNEL_HT40PLUS |                     \
          CHANNEL_HT40MINUS)
 
-struct ath9k_channel {
-        struct ieee80211_channel *chan;
+struct ath9k_hw_cal_data {
         u16 channel;
         u32 channelFlags;
-        u32 chanmode;
         int32_t CalValid;
-        bool oneTimeCalsDone;
         int8_t iCoff;
         int8_t qCoff;
         int16_t rawNoiseFloor;
         bool paprd_done;
+        bool nfcal_pending;
         u16 small_signal_gain[AR9300_MAX_CHAINS];
         u32 pa_table[AR9300_MAX_CHAINS][PAPRD_TABLE_SZ];
+        struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
+};
+
+struct ath9k_channel {
+        struct ieee80211_channel *chan;
+        u16 channel;
+        u32 channelFlags;
+        u32 chanmode;
 };
 
 #define IS_CHAN_G(_c) ((((_c)->channelFlags & (CHANNEL_G)) == CHANNEL_G) || \
@@ -669,7 +675,7 @@ struct ath_hw {
         enum nl80211_iftype opmode;
         enum ath9k_power_mode power_mode;
 
-        struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
+        struct ath9k_hw_cal_data *caldata;
         struct ath9k_pacal_info pacal_info;
         struct ar5416Stats stats;
         struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES];
@@ -863,7 +869,7 @@ const char *ath9k_hw_probe(u16 vendorid, u16 devid);
 void ath9k_hw_deinit(struct ath_hw *ah);
 int ath9k_hw_init(struct ath_hw *ah);
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
-                   bool bChannelChange);
+                   struct ath9k_hw_cal_data *caldata, bool bChannelChange);
 int ath9k_hw_fill_cap_info(struct ath_hw *ah);
 u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
 
@@ -958,9 +964,10 @@ void ar9003_hw_bb_watchdog_read(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
 void ar9003_paprd_enable(struct ath_hw *ah, bool val);
 void ar9003_paprd_populate_single_table(struct ath_hw *ah,
-                                        struct ath9k_channel *chan, int chain);
-int ar9003_paprd_create_curve(struct ath_hw *ah, struct ath9k_channel *chan,
-                              int chain);
+                                        struct ath9k_hw_cal_data *caldata,
+                                        int chain);
+int ar9003_paprd_create_curve(struct ath_hw *ah,
+                              struct ath9k_hw_cal_data *caldata, int chain);
 int ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 0429dda0961f..3caa32316e7b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -154,6 +154,27 @@ void ath9k_ps_restore(struct ath_softc *sc)
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 }
 
+static void ath_start_ani(struct ath_common *common)
+{
+        struct ath_hw *ah = common->ah;
+        unsigned long timestamp = jiffies_to_msecs(jiffies);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        if (!(sc->sc_flags & SC_OP_ANI_RUN))
+                return;
+
+        if (sc->sc_flags & SC_OP_OFFCHANNEL)
+                return;
+
+        common->ani.longcal_timer = timestamp;
+        common->ani.shortcal_timer = timestamp;
+        common->ani.checkani_timer = timestamp;
+
+        mod_timer(&common->ani.timer,
+                  jiffies +
+                        msecs_to_jiffies((u32)ah->config.ani_poll_interval));
+}
+
 /*
  * Set/change channels.  If the channel is really being changed, it's done
  * by reseting the chip.  To accomplish this we must first cleanup any pending
@@ -162,16 +183,23 @@ void ath9k_ps_restore(struct ath_softc *sc)
 int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
                     struct ath9k_channel *hchan)
 {
+        struct ath_wiphy *aphy = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_conf *conf = &common->hw->conf;
         bool fastcc = true, stopped;
         struct ieee80211_channel *channel = hw->conf.channel;
+        struct ath9k_hw_cal_data *caldata = NULL;
         int r;
 
         if (sc->sc_flags & SC_OP_INVALID)
                 return -EIO;
 
+        del_timer_sync(&common->ani.timer);
+        cancel_work_sync(&sc->paprd_work);
+        cancel_work_sync(&sc->hw_check_work);
+        cancel_delayed_work_sync(&sc->tx_complete_work);
+
         ath9k_ps_wakeup(sc);
 
         /*
@@ -191,9 +219,12 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
          * to flush data frames already in queue because of
          * changing channel. */
 
-        if (!stopped || (sc->sc_flags & SC_OP_FULL_RESET))
+        if (!stopped || !(sc->sc_flags & SC_OP_OFFCHANNEL))
                 fastcc = false;
 
+        if (!(sc->sc_flags & SC_OP_OFFCHANNEL))
+                caldata = &aphy->caldata;
+
         ath_print(common, ATH_DBG_CONFIG,
                   "(%u MHz) -> (%u MHz), conf_is_ht40: %d\n",
                   sc->sc_ah->curchan->channel,
@@ -201,7 +232,7 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
 
         spin_lock_bh(&sc->sc_resetlock);
 
-        r = ath9k_hw_reset(ah, hchan, fastcc);
+        r = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
@@ -212,8 +243,6 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         }
         spin_unlock_bh(&sc->sc_resetlock);
 
-        sc->sc_flags &= ~SC_OP_FULL_RESET;
-
         if (ath_startrecv(sc) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to restart recv logic\n");
@@ -225,6 +254,12 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         ath_update_txpow(sc);
         ath9k_hw_set_interrupts(ah, ah->imask);
 
+        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL | SC_OP_SCANNING))) {
+                ath_start_ani(common);
+                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+                ath_beacon_config(sc, NULL);
+        }
+
  ps_restore:
         ath9k_ps_restore(sc);
         return r;
@@ -233,17 +268,19 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
 static void ath_paprd_activate(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         int chain;
 
-        if (!ah->curchan->paprd_done)
+        if (!caldata || !caldata->paprd_done)
                 return;
 
         ath9k_ps_wakeup(sc);
+        ar9003_paprd_enable(ah, false);
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
                 if (!(ah->caps.tx_chainmask & BIT(chain)))
                         continue;
 
-                ar9003_paprd_populate_single_table(ah, ah->curchan, chain);
+                ar9003_paprd_populate_single_table(ah, caldata, chain);
         }
 
         ar9003_paprd_enable(ah, true);
@@ -261,6 +298,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         int band = hw->conf.channel->band;
         struct ieee80211_supported_band *sband = &sc->sbands[band];
         struct ath_tx_control txctl;
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
         int qnum, ftype;
         int chain_ok = 0;
         int chain;
@@ -268,6 +306,9 @@ void ath_paprd_calibrate(struct work_struct *work)
         int time_left;
         int i;
 
+        if (!caldata)
+                return;
+
         skb = alloc_skb(len, GFP_KERNEL);
         if (!skb)
                 return;
@@ -322,7 +363,7 @@ void ath_paprd_calibrate(struct work_struct *work)
                 if (!ar9003_paprd_is_done(ah))
                         break;
 
-                if (ar9003_paprd_create_curve(ah, ah->curchan, chain) != 0)
+                if (ar9003_paprd_create_curve(ah, caldata, chain) != 0)
                         break;
 
                 chain_ok = 1;
@@ -330,7 +371,7 @@ void ath_paprd_calibrate(struct work_struct *work)
         kfree_skb(skb);
 
         if (chain_ok) {
-                ah->curchan->paprd_done = true;
+                caldata->paprd_done = true;
                 ath_paprd_activate(sc);
         }
 
@@ -439,33 +480,14 @@ set_timer:
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
         mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) &&
-            !(sc->sc_flags & SC_OP_SCANNING)) {
-                if (!sc->sc_ah->curchan->paprd_done)
+        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
+                if (!ah->caldata->paprd_done)
                         ieee80211_queue_work(sc->hw, &sc->paprd_work);
                 else
                         ath_paprd_activate(sc);
         }
 }
 
-static void ath_start_ani(struct ath_common *common)
-{
-        struct ath_hw *ah = common->ah;
-        unsigned long timestamp = jiffies_to_msecs(jiffies);
-        struct ath_softc *sc = (struct ath_softc *) common->priv;
-
-        if (!(sc->sc_flags & SC_OP_ANI_RUN))
-                return;
-
-        common->ani.longcal_timer = timestamp;
-        common->ani.shortcal_timer = timestamp;
-        common->ani.checkani_timer = timestamp;
-
-        mod_timer(&common->ani.timer,
-                  jiffies +
-                        msecs_to_jiffies((u32)ah->config.ani_poll_interval));
-}
-
 /*
  * Update tx/rx chainmask. For legacy association,
  * hard code chainmask to 1x1, for 11n association, use
@@ -477,7 +499,7 @@ void ath_update_chainmask(struct ath_softc *sc, int is_ht)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
 
-        if ((sc->sc_flags & SC_OP_SCANNING) || is_ht ||
+        if ((sc->sc_flags & SC_OP_OFFCHANNEL) || is_ht ||
             (ah->btcoex_hw.scheme != ATH_BTCOEX_CFG_NONE)) {
                 common->tx_chainmask = ah->caps.tx_chainmask;
                 common->rx_chainmask = ah->caps.rx_chainmask;
@@ -817,7 +839,7 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
                 ah->curchan = ath_get_curchannel(sc, sc->hw);
 
         spin_lock_bh(&sc->sc_resetlock);
-        r = ath9k_hw_reset(ah, ah->curchan, false);
+        r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
@@ -877,7 +899,7 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
                 ah->curchan = ath_get_curchannel(sc, hw);
 
         spin_lock_bh(&sc->sc_resetlock);
-        r = ath9k_hw_reset(ah, ah->curchan, false);
+        r = ath9k_hw_reset(ah, ah->curchan, ah->caldata, false);
         if (r) {
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_FATAL,
                           "Unable to reset channel (%u MHz), "
@@ -910,7 +932,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         ath_flushrecv(sc);
 
         spin_lock_bh(&sc->sc_resetlock);
-        r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
+        r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
         if (r)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d\n", r);
@@ -1085,7 +1107,7 @@ static int ath9k_start(struct ieee80211_hw *hw)
          * and then setup of the interrupt mask.
          */
         spin_lock_bh(&sc->sc_resetlock);
-        r = ath9k_hw_reset(ah, init_channel, false);
+        r = ath9k_hw_reset(ah, init_channel, ah->caldata, false);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
@@ -1579,6 +1601,10 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 
                 aphy->chan_idx = pos;
                 aphy->chan_is_ht = conf_is_ht(conf);
+                if (hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
+                        sc->sc_flags |= SC_OP_OFFCHANNEL;
+                else
+                        sc->sc_flags &= ~SC_OP_OFFCHANNEL;
 
                 if (aphy->state == ATH_WIPHY_SCAN ||
                     aphy->state == ATH_WIPHY_ACTIVE)
@@ -1990,7 +2016,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
         if (ath9k_wiphy_scanning(sc)) {
@@ -2008,10 +2033,6 @@ static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
         aphy->state = ATH_WIPHY_SCAN;
         ath9k_wiphy_pause_all_forced(sc, aphy);
         sc->sc_flags |= SC_OP_SCANNING;
-        del_timer_sync(&common->ani.timer);
-        cancel_work_sync(&sc->paprd_work);
-        cancel_work_sync(&sc->hw_check_work);
-        cancel_delayed_work_sync(&sc->tx_complete_work);
         mutex_unlock(&sc->mutex);
 }
 
@@ -2023,15 +2044,10 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
         aphy->state = ATH_WIPHY_ACTIVE;
         sc->sc_flags &= ~SC_OP_SCANNING;
-        sc->sc_flags |= SC_OP_FULL_RESET;
-        ath_start_ani(common);
-        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-        ath_beacon_config(sc, NULL);
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index da0cfe90c38a..a3fc987ebab0 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -1140,6 +1140,11 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 if (flush)
                         goto requeue;
 
+                retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
+                                                 rxs, &decrypt_error);
+                if (retval)
+                        goto requeue;
+
                 rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
                 if (rs.rs_tstamp > tsf_lower &&
                     unlikely(rs.rs_tstamp - tsf_lower > 0x10000000))
@@ -1149,11 +1154,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                     unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
                         rxs->mactime += 0x100000000ULL;
 
-                retval = ath9k_rx_skb_preprocess(common, hw, hdr, &rs,
-                                                 rxs, &decrypt_error);
-                if (retval)
-                        goto requeue;
-
                 /* Ensure we always have an skb to requeue once we are done
                  * processing the current buffer's skb */
                 requeue_skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_ATOMIC);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 501b72821b4d..4dda14e36227 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -120,26 +120,14 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
         list_add_tail(&ac->list, &txq->axq_acq);
 }
 
-static void ath_tx_pause_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
-{
-        struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
-
-        spin_lock_bh(&txq->axq_lock);
-        tid->paused++;
-        spin_unlock_bh(&txq->axq_lock);
-}
-
 static void ath_tx_resume_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
 {
         struct ath_txq *txq = &sc->tx.txq[tid->ac->qnum];
 
-        BUG_ON(tid->paused <= 0);
-        spin_lock_bh(&txq->axq_lock);
-
-        tid->paused--;
+        WARN_ON(!tid->paused);
 
-        if (tid->paused > 0)
-                goto unlock;
+        spin_lock_bh(&txq->axq_lock);
+        tid->paused = false;
 
         if (list_empty(&tid->buf_q))
                 goto unlock;
@@ -157,15 +145,10 @@ static void ath_tx_flush_tid(struct ath_softc *sc, struct ath_atx_tid *tid)
         struct list_head bf_head;
         INIT_LIST_HEAD(&bf_head);
 
-        BUG_ON(tid->paused <= 0);
-        spin_lock_bh(&txq->axq_lock);
+        WARN_ON(!tid->paused);
 
-        tid->paused--;
-
-        if (tid->paused > 0) {
-                spin_unlock_bh(&txq->axq_lock);
-                return;
-        }
+        spin_lock_bh(&txq->axq_lock);
+        tid->paused = false;
 
         while (!list_empty(&tid->buf_q)) {
                 bf = list_first_entry(&tid->buf_q, struct ath_buf, list);
@@ -811,7 +794,7 @@ void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
         an = (struct ath_node *)sta->drv_priv;
         txtid = ATH_AN_2_TID(an, tid);
         txtid->state |= AGGR_ADDBA_PROGRESS;
-        ath_tx_pause_tid(sc, txtid);
+        txtid->paused = true;
         *ssn = txtid->seq_start;
 }
 
@@ -835,10 +818,9 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 return;
         }
 
-        ath_tx_pause_tid(sc, txtid);
-
         /* drop all software retried frames and mark this TID */
         spin_lock_bh(&txq->axq_lock);
+        txtid->paused = true;
         while (!list_empty(&txtid->buf_q)) {
                 bf = list_first_entry(&txtid->buf_q, struct ath_buf, list);
                 if (!bf_isretried(bf)) {
@@ -1181,7 +1163,7 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
                           "Failed to stop TX DMA. Resetting hardware!\n");
 
                 spin_lock_bh(&sc->sc_resetlock);
-                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
+                r = ath9k_hw_reset(ah, sc->sc_ah->curchan, ah->caldata, false);
                 if (r)
                         ath_print(common, ATH_DBG_FATAL,
                                   "Unable to reset hardware; reset status %d\n",
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index c24c5efeae1f..16bbfa3189a5 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1924,6 +1924,10 @@ static int ipw2100_net_init(struct net_device *dev)
                 bg_band->channels =
                         kzalloc(geo->bg_channels *
                                 sizeof(struct ieee80211_channel), GFP_KERNEL);
+                if (!bg_band->channels) {
+                        ipw2100_down(priv);
+                        return -ENOMEM;
+                }
                 /* translate geo->bg to bg_band.channels */
                 for (i = 0; i < geo->bg_channels; i++) {
                         bg_band->channels[i].band = IEEE80211_BAND_2GHZ;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
index f052c6d09b37..d706b8afbe5a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -980,7 +980,7 @@ ssize_t iwl_ucode_bt_stats_read(struct file *file,
                          le32_to_cpu(bt->lo_priority_tx_req_cnt),
                          accum_bt->lo_priority_tx_req_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
-                         "lo_priority_rx_denied_cnt:\t%u\t\t\t%u\n",
+                         "lo_priority_tx_denied_cnt:\t%u\t\t\t%u\n",
                          le32_to_cpu(bt->lo_priority_tx_denied_cnt),
                          accum_bt->lo_priority_tx_denied_cnt);
         pos += scnprintf(buf + pos, bufsz - pos,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index a1b6d202d57c..9dd9e64c2b0b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1429,7 +1429,7 @@ int iwlagn_manage_ibss_station(struct iwl_priv *priv,
 void iwl_free_tfds_in_queue(struct iwl_priv *priv,
                             int sta_id, int tid, int freed)
 {
-        WARN_ON(!spin_is_locked(&priv->sta_lock));
+        lockdep_assert_held(&priv->sta_lock);
 
         if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
                 priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 35c86d22b14b..23e5c42e7d7e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -300,8 +300,9 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                                       struct ieee80211_sta *sta)
 {
         int ret = -EAGAIN;
+        u32 load = rs_tl_get_load(lq_data, tid);
 
-        if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
+        if (load > IWL_AGG_LOAD_THRESHOLD) {
                 IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
                                 sta->addr, tid);
                 ret = ieee80211_start_tx_ba_session(sta, tid);
@@ -311,12 +312,14 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                          * this might be cause by reloading firmware
                          * stop the tx ba session here
                          */
-                        IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
+                        IWL_ERR(priv, "Fail start Tx agg on tid: %d\n",
                                 tid);
                         ieee80211_stop_tx_ba_session(sta, tid);
                 }
-        } else
-                IWL_ERR(priv, "Fail finding valid aggregation tid: %d\n", tid);
+        } else {
+                IWL_ERR(priv, "Aggregation not enabled for tid %d "
+                        "because load = %u\n", tid, load);
+        }
         return ret;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 55a1b31fd09a..d04502d54df3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -1117,7 +1117,7 @@ int iwlagn_txq_check_empty(struct iwl_priv *priv,
         u8 *addr = priv->stations[sta_id].sta.sta.addr;
         struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
 
-        WARN_ON(!spin_is_locked(&priv->sta_lock));
+        lockdep_assert_held(&priv->sta_lock);
 
         switch (priv->stations[sta_id].tid[tid].agg.state) {
         case IWL_EMPTYING_HW_QUEUE_DELBA:
@@ -1331,7 +1331,14 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         tid = ba_resp->tid;
         agg = &priv->stations[sta_id].tid[tid].agg;
         if (unlikely(agg->txq_id != scd_flow)) {
-                IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n",
+                /*
+                 * FIXME: this is a uCode bug which need to be addressed,
+                 * log the information and return for now!
+                 * since it is possible happen very often and in order
+                 * not to fill the syslog, don't enable the logging by default
+                 */
+                IWL_DEBUG_TX_REPLY(priv,
+                        "BA scd_flow %d does not match txq_id %d\n",
                         scd_flow, agg->txq_id);
                 return;
         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 8024d44ce4bb..8ccb6d205b6d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2000,6 +2000,7 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
+        bool scan_completed = false;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
@@ -2013,7 +2014,7 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
         if (priv->vif == vif) {
                 priv->vif = NULL;
                 if (priv->scan_vif == vif) {
-                        ieee80211_scan_completed(priv->hw, true);
+                        scan_completed = true;
                         priv->scan_vif = NULL;
                         priv->scan_request = NULL;
                 }
@@ -2021,6 +2022,9 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
         }
         mutex_unlock(&priv->mutex);
 
+        if (scan_completed)
+                ieee80211_scan_completed(priv->hw, true);
+
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 5c2bcef5df0c..0b961a353ff6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -71,7 +71,7 @@ do {                                            			\
 #define IWL_DEBUG(__priv, level, fmt, args...)
 #define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
-                                      void *p, u32 len)
+                                      const void *p, u32 len)
 {}
 #endif                          /* CONFIG_IWLWIFI_DEBUG */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index ae7319bb3a99..4cf864c664ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -193,7 +193,7 @@ TRACE_EVENT(iwlwifi_dev_tx,
                 __entry->framelen = buf0_len + buf1_len;
                 memcpy(__get_dynamic_array(tfd), tfd, tfdlen);
                 memcpy(__get_dynamic_array(buf0), buf0, buf0_len);
-                memcpy(__get_dynamic_array(buf1), buf1, buf0_len);
+                memcpy(__get_dynamic_array(buf1), buf1, buf1_len);
         ),
         TP_printk("[%p] TX %.2x (%zu bytes)",
                   __entry->priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index b0c6b0473901..a4b3663a262f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -298,7 +298,7 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
-        WARN_ON(!mutex_is_locked(&priv->mutex));
+        lockdep_assert_held(&priv->mutex);
 
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 9511f03f07e0..7e0829be5e78 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -773,7 +773,7 @@ static int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
 
 int iwl_restore_default_wep_keys(struct iwl_priv *priv)
 {
-        WARN_ON(!mutex_is_locked(&priv->mutex));
+        lockdep_assert_held(&priv->mutex);
 
         return iwl_send_static_wepkey_cmd(priv, 0);
 }
@@ -784,7 +784,7 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
 {
         int ret;
 
-        WARN_ON(!mutex_is_locked(&priv->mutex));
+        lockdep_assert_held(&priv->mutex);
 
         IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
                       keyconf->keyidx);
@@ -808,7 +808,7 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
 {
         int ret;
 
-        WARN_ON(!mutex_is_locked(&priv->mutex));
+        lockdep_assert_held(&priv->mutex);
 
         if (keyconf->keylen != WEP_KEY_LEN_128 &&
             keyconf->keylen != WEP_KEY_LEN_64) {
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 25f902760980..8e9fbfd804b6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -257,6 +257,29 @@ static int lbs_add_supported_rates_tlv(u8 *tlv)
         return sizeof(rate_tlv->header) + i;
 }
 
+/* Add common rates from a TLV and return the new end of the TLV */
+static u8 *
+add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
+{
+        int hw, ap, ap_max = ie[1];
+        u8 hw_rate;
+
+        /* Advance past IE header */
+        ie += 2;
+
+        lbs_deb_hex(LBS_DEB_ASSOC, "AP IE Rates", (u8 *) ie, ap_max);
+
+        for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
+                hw_rate = lbs_rates[hw].bitrate / 5;
+                for (ap = 0; ap < ap_max; ap++) {
+                        if (hw_rate == (ie[ap] & 0x7f)) {
+                                *tlv++ = ie[ap];
+                                *nrates = *nrates + 1;
+                        }
+                }
+        }
+        return tlv;
+}
 
 /*
  * Adds a TLV with all rates the hardware *and* BSS supports.
@@ -264,8 +287,11 @@ static int lbs_add_supported_rates_tlv(u8 *tlv)
 static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
 {
         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
-        const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
-        int n;
+        const u8 *rates_eid, *ext_rates_eid;
+        int n = 0;
+
+        rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
+        ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
 
         /*
          * 01 00                   TLV_TYPE_RATES
@@ -275,26 +301,21 @@ static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
         tlv += sizeof(rate_tlv->header);
 
-        if (!rates_eid) {
+        /* Add basic rates */
+        if (rates_eid) {
+                tlv = add_ie_rates(tlv, rates_eid, &n);
+
+                /* Add extended rates, if any */
+                if (ext_rates_eid)
+                        tlv = add_ie_rates(tlv, ext_rates_eid, &n);
+        } else {
+                lbs_deb_assoc("assoc: bss had no basic rate IE\n");
                 /* Fallback: add basic 802.11b rates */
                 *tlv++ = 0x82;
                 *tlv++ = 0x84;
                 *tlv++ = 0x8b;
                 *tlv++ = 0x96;
                 n = 4;
-        } else {
-                int hw, ap;
-                u8 ap_max = rates_eid[1];
-                n = 0;
-                for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
-                        u8 hw_rate = lbs_rates[hw].bitrate / 5;
-                        for (ap = 0; ap < ap_max; ap++) {
-                                if (hw_rate == (rates_eid[ap+2] & 0x7f)) {
-                                        *tlv++ = rates_eid[ap+2];
-                                        n++;
-                                }
-                        }
-                }
         }
 
         rate_tlv->header.len = cpu_to_le16(n);
@@ -465,7 +486,15 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
         lbs_deb_enter(LBS_DEB_CFG80211);
 
         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
-        nr_sets = le16_to_cpu(resp->size);
+        nr_sets = le16_to_cpu(scanresp->nr_sets);
+
+        lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
+                        nr_sets, bsssize, le16_to_cpu(resp->size));
+
+        if (nr_sets == 0) {
+                ret = 0;
+                goto done;
+        }
 
         /*
          * The general layout of the scan response is described in chapter
@@ -670,8 +699,13 @@ static void lbs_scan_worker(struct work_struct *work)
 
         if (priv->scan_channel >= priv->scan_req->n_channels) {
                 /* Mark scan done */
-                cfg80211_scan_done(priv->scan_req, false);
+                if (priv->internal_scan)
+                        kfree(priv->scan_req);
+                else
+                        cfg80211_scan_done(priv->scan_req, false);
+
                 priv->scan_req = NULL;
+                priv->last_scan = jiffies;
         }
 
         /* Restart network */
@@ -682,10 +716,33 @@ static void lbs_scan_worker(struct work_struct *work)
 
         kfree(scan_cmd);
 
+        /* Wake up anything waiting on scan completion */
+        if (priv->scan_req == NULL) {
+                lbs_deb_scan("scan: waking up waiters\n");
+                wake_up_all(&priv->scan_q);
+        }
+
  out_no_scan_cmd:
         lbs_deb_leave(LBS_DEB_SCAN);
 }
 
+static void _internal_start_scan(struct lbs_private *priv, bool internal,
+        struct cfg80211_scan_request *request)
+{
+        lbs_deb_enter(LBS_DEB_CFG80211);
+
+        lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
+                request->n_ssids, request->n_channels, request->ie_len);
+
+        priv->scan_channel = 0;
+        queue_delayed_work(priv->work_thread, &priv->scan_work,
+                msecs_to_jiffies(50));
+
+        priv->scan_req = request;
+        priv->internal_scan = internal;
+
+        lbs_deb_leave(LBS_DEB_CFG80211);
+}
 
 static int lbs_cfg_scan(struct wiphy *wiphy,
         struct net_device *dev,
@@ -702,18 +759,11 @@ static int lbs_cfg_scan(struct wiphy *wiphy,
                 goto out;
         }
 
-        lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
-                request->n_ssids, request->n_channels, request->ie_len);
-
-        priv->scan_channel = 0;
-        queue_delayed_work(priv->work_thread, &priv->scan_work,
-                msecs_to_jiffies(50));
+        _internal_start_scan(priv, false, request);
 
         if (priv->surpriseremoved)
                 ret = -EIO;
 
-        priv->scan_req = request;
-
  out:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
@@ -1000,6 +1050,7 @@ static int lbs_associate(struct lbs_private *priv,
         int status;
         int ret;
         u8 *pos = &(cmd->iebuf[0]);
+        u8 *tmp;
 
         lbs_deb_enter(LBS_DEB_CFG80211);
 
@@ -1044,7 +1095,9 @@ static int lbs_associate(struct lbs_private *priv,
         pos += lbs_add_cf_param_tlv(pos);
 
         /* add rates TLV */
+        tmp = pos + 4; /* skip Marvell IE header */
         pos += lbs_add_common_rates_tlv(pos, bss);
+        lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
 
         /* add auth type TLV */
         if (priv->fwrelease >= 0x09000000)
@@ -1124,7 +1177,62 @@ done:
         return ret;
 }
 
+static struct cfg80211_scan_request *
+_new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
+{
+        struct cfg80211_scan_request *creq = NULL;
+        int i, n_channels = 0;
+        enum ieee80211_band band;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (wiphy->bands[band])
+                        n_channels += wiphy->bands[band]->n_channels;
+        }
+
+        creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
+                       n_channels * sizeof(void *),
+                       GFP_ATOMIC);
+        if (!creq)
+                return NULL;
+
+        /* SSIDs come after channels */
+        creq->ssids = (void *)&creq->channels[n_channels];
+        creq->n_channels = n_channels;
+        creq->n_ssids = 1;
+
+        /* Scan all available channels */
+        i = 0;
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                int j;
+
+                if (!wiphy->bands[band])
+                        continue;
+
+                for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                        /* ignore disabled channels */
+                        if (wiphy->bands[band]->channels[j].flags &
+                                                IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        creq->channels[i] = &wiphy->bands[band]->channels[j];
+                        i++;
+                }
+        }
+        if (i) {
+                /* Set real number of channels specified in creq->channels[] */
+                creq->n_channels = i;
+
+                /* Scan for the SSID we're going to connect to */
+                memcpy(creq->ssids[0].ssid, sme->ssid, sme->ssid_len);
+                creq->ssids[0].ssid_len = sme->ssid_len;
+        } else {
+                /* No channels found... */
+                kfree(creq);
+                creq = NULL;
+        }
 
+        return creq;
+}
 
 static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_connect_params *sme)
@@ -1136,37 +1244,43 @@ static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
 
         lbs_deb_enter(LBS_DEB_CFG80211);
 
-        if (sme->bssid) {
-                bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
-                        sme->ssid, sme->ssid_len,
-                        WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        } else {
-                /*
-                 * Here we have an impedance mismatch. The firmware command
-                 * CMD_802_11_ASSOCIATE always needs a BSSID, it cannot
-                 * connect otherwise. However, for the connect-API of
-                 * cfg80211 the bssid is purely optional. We don't get one,
-                 * except the user specifies one on the "iw" command line.
-                 *
-                 * If we don't got one, we could initiate a scan and look
-                 * for the best matching cfg80211_bss entry.
-                 *
-                 * Or, better yet, net/wireless/sme.c get's rewritten into
-                 * something more generally useful.
+        if (!sme->bssid) {
+                /* Run a scan if one isn't in-progress already and if the last
+                 * scan was done more than 2 seconds ago.
                  */
-                lbs_pr_err("TODO: no BSS specified\n");
-                ret = -ENOTSUPP;
-                goto done;
-        }
+                if (priv->scan_req == NULL &&
+                    time_after(jiffies, priv->last_scan + (2 * HZ))) {
+                        struct cfg80211_scan_request *creq;
 
+                        creq = _new_connect_scan_req(wiphy, sme);
+                        if (!creq) {
+                                ret = -EINVAL;
+                                goto done;
+                        }
+
+                        lbs_deb_assoc("assoc: scanning for compatible AP\n");
+                        _internal_start_scan(priv, true, creq);
+                }
+
+                /* Wait for any in-progress scan to complete */
+                lbs_deb_assoc("assoc: waiting for scan to complete\n");
+                wait_event_interruptible_timeout(priv->scan_q,
+                                                 (priv->scan_req == NULL),
+                                                 (15 * HZ));
+                lbs_deb_assoc("assoc: scanning competed\n");
+        }
 
+        /* Find the BSS we want using available scan results */
+        bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
+                sme->ssid, sme->ssid_len,
+                WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
         if (!bss) {
-                lbs_pr_err("assicate: bss %pM not in scan results\n",
+                lbs_pr_err("assoc: bss %pM not in scan results\n",
                            sme->bssid);
                 ret = -ENOENT;
                 goto done;
         }
-        lbs_deb_assoc("trying %pM", sme->bssid);
+        lbs_deb_assoc("trying %pM\n", bss->bssid);
         lbs_deb_assoc("cipher 0x%x, key index %d, key len %d\n",
                       sme->crypto.cipher_group,
                       sme->key_idx, sme->key_len);
@@ -1229,7 +1343,7 @@ static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
         lbs_set_radio(priv, preamble, 1);
 
         /* Do the actual association */
-        lbs_associate(priv, bss, sme);
+        ret = lbs_associate(priv, bss, sme);
 
  done:
         if (bss)
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 3c7e255e18c7..f062ed583901 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -161,6 +161,11 @@ struct lbs_private {
         /** Scanning */
         struct delayed_work scan_work;
         int scan_channel;
+        /* Queue of things waiting for scan completion */
+        wait_queue_head_t scan_q;
+        /* Whether the scan was initiated internally and not by cfg80211 */
+        bool internal_scan;
+        unsigned long last_scan;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 258967144b96..24958a86747b 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -719,6 +719,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
         priv->deep_sleep_required = 0;
         priv->wakeup_dev_required = 0;
         init_waitqueue_head(&priv->ds_awake_q);
+        init_waitqueue_head(&priv->scan_q);
         priv->authtype_auto = 1;
         priv->is_host_sleep_configured = 0;
         priv->is_host_sleep_activated = 0;
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 822f8dc26e9c..71a101fb2e4e 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -43,6 +43,8 @@ static DEFINE_PCI_DEVICE_TABLE(p54p_table) = {
         { PCI_DEVICE(0x1260, 0x3886) },
         /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */
         { PCI_DEVICE(0x1260, 0xffff) },
+        /* Standard Microsystems Corp SMC2802W Wireless PCI */
+        { PCI_DEVICE(0x10b8, 0x2802) },
         { },
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 19b262e1ddbe..63c2cc408e15 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -240,16 +240,16 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
         struct rt2x00_dev *rt2x00dev;
         int retval;
 
-        retval = pci_request_regions(pci_dev, pci_name(pci_dev));
+        retval = pci_enable_device(pci_dev);
         if (retval) {
-                ERROR_PROBE("PCI request regions failed.\n");
+                ERROR_PROBE("Enable device failed.\n");
                 return retval;
         }
 
-        retval = pci_enable_device(pci_dev);
+        retval = pci_request_regions(pci_dev, pci_name(pci_dev));
         if (retval) {
-                ERROR_PROBE("Enable device failed.\n");
-                goto exit_release_regions;
+                ERROR_PROBE("PCI request regions failed.\n");
+                goto exit_disable_device;
         }
 
         pci_set_master(pci_dev);
@@ -260,14 +260,14 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
         if (dma_set_mask(&pci_dev->dev, DMA_BIT_MASK(32))) {
                 ERROR_PROBE("PCI DMA not supported.\n");
                 retval = -EIO;
-                goto exit_disable_device;
+                goto exit_release_regions;
         }
 
         hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
         if (!hw) {
                 ERROR_PROBE("Failed to allocate hardware.\n");
                 retval = -ENOMEM;
-                goto exit_disable_device;
+                goto exit_release_regions;
         }
 
         pci_set_drvdata(pci_dev, hw);
@@ -300,13 +300,12 @@ exit_free_reg:
 exit_free_device:
         ieee80211_free_hw(hw);
 
-exit_disable_device:
-        if (retval != -EBUSY)
-                pci_disable_device(pci_dev);
-
 exit_release_regions:
         pci_release_regions(pci_dev);
 
+exit_disable_device:
+        pci_disable_device(pci_dev);
+
         pci_set_drvdata(pci_dev, NULL);
 
         return retval;
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 1d8178563d76..b50c39aaec05 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -695,6 +695,8 @@ static void rtl8180_beacon_work(struct work_struct *work)
 
         /* grab a fresh beacon */
         skb = ieee80211_beacon_get(dev, vif);
+        if (!skb)
+                goto resched;
 
         /*
          * update beacon timestamp w/ TSF value
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 96d25fb50495..4cb99c541e2a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -160,9 +160,8 @@ static void wl1271_spi_init(struct wl1271 *wl)
         spi_message_add_tail(&t, &m);
 
         spi_sync(wl_to_spi(wl), &m);
-        kfree(cmd);
-
         wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 
 #define WL1271_BUSY_WORD_TIMEOUT 1000
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 6a5af18faf68..b0de57947189 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3030,6 +3030,34 @@ static void __init iommu_exit_mempool(void)
 
 }
 
+static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev)
+{
+        struct dmar_drhd_unit *drhd;
+        u32 vtbar;
+        int rc;
+
+        /* We know that this device on this chipset has its own IOMMU.
+         * If we find it under a different IOMMU, then the BIOS is lying
+         * to us. Hope that the IOMMU for this device is actually
+         * disabled, and it needs no translation...
+         */
+        rc = pci_bus_read_config_dword(pdev->bus, PCI_DEVFN(0, 0), 0xb0, &vtbar);
+        if (rc) {
+                /* "can't" happen */
+                dev_info(&pdev->dev, "failed to run vt-d quirk\n");
+                return;
+        }
+        vtbar &= 0xffff0000;
+
+        /* we know that the this iommu should be at offset 0xa000 from vtbar */
+        drhd = dmar_find_matched_drhd_unit(pdev);
+        if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000,
+                            TAINT_FIRMWARE_WORKAROUND,
+                            "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"))
+                pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO;
+}
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu);
+
 static void __init init_no_remapping_devices(void)
 {
         struct dmar_drhd_unit *drhd;
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index bed7b4634ccd..8d41f3ed38d7 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -1083,6 +1083,49 @@ dasd_eer_store(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR(eer_enabled, 0644, dasd_eer_show, dasd_eer_store);
 
+/*
+ * expiration time for default requests
+ */
+static ssize_t
+dasd_expires_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_device *device;
+        int len;
+
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        if (IS_ERR(device))
+                return -ENODEV;
+        len = snprintf(buf, PAGE_SIZE, "%lu\n", device->default_expires);
+        dasd_put_device(device);
+        return len;
+}
+
+static ssize_t
+dasd_expires_store(struct device *dev, struct device_attribute *attr,
+               const char *buf, size_t count)
+{
+        struct dasd_device *device;
+        unsigned long val;
+
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        if (IS_ERR(device))
+                return -ENODEV;
+
+        if ((strict_strtoul(buf, 10, &val) != 0) ||
+            (val > DASD_EXPIRES_MAX) || val == 0) {
+                dasd_put_device(device);
+                return -EINVAL;
+        }
+
+        if (val)
+                device->default_expires = val;
+
+        dasd_put_device(device);
+        return count;
+}
+
+static DEVICE_ATTR(expires, 0644, dasd_expires_show, dasd_expires_store);
+
 static struct attribute * dasd_attrs[] = {
         &dev_attr_readonly.attr,
         &dev_attr_discipline.attr,
@@ -1094,6 +1137,7 @@ static struct attribute * dasd_attrs[] = {
         &dev_attr_eer_enabled.attr,
         &dev_attr_erplog.attr,
         &dev_attr_failfast.attr,
+        &dev_attr_expires.attr,
         NULL,
 };
 
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 687f323cdc38..2b3bc3ec0541 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -43,7 +43,7 @@ MODULE_LICENSE("GPL");
                            sizeof(struct dasd_diag_req)) / \
                            sizeof(struct dasd_diag_bio)) / 2)
 #define DIAG_MAX_RETRIES        32
-#define DIAG_TIMEOUT            50 * HZ
+#define DIAG_TIMEOUT            50
 
 static struct dasd_discipline dasd_diag_discipline;
 
@@ -360,6 +360,8 @@ dasd_diag_check_device(struct dasd_device *device)
                 goto out;
         }
 
+        device->default_expires = DIAG_TIMEOUT;
+
         /* Figure out position of label block */
         switch (private->rdc_data.vdev_class) {
         case DEV_CLASS_FBA:
@@ -563,7 +565,7 @@ static struct dasd_ccw_req *dasd_diag_build_cp(struct dasd_device *memdev,
         cqr->startdev = memdev;
         cqr->memdev = memdev;
         cqr->block = block;
-        cqr->expires = DIAG_TIMEOUT;
+        cqr->expires = memdev->default_expires * HZ;
         cqr->status = DASD_CQR_FILLED;
         return cqr;
 }
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index ab84da5592e8..66360c24bd48 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -82,6 +82,14 @@ static struct ccw_driver dasd_eckd_driver; /* see below */
 #define INIT_CQR_UNFORMATTED 1
 #define INIT_CQR_ERROR 2
 
+/* emergency request for reserve/release */
+static struct {
+        struct dasd_ccw_req cqr;
+        struct ccw1 ccw;
+        char data[32];
+} *dasd_reserve_req;
+static DEFINE_MUTEX(dasd_reserve_mutex);
+
 
 /* initial attempt at a probe function. this can be simplified once
  * the other detection code is gone */
@@ -1107,8 +1115,9 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         struct dasd_eckd_private *private;
         struct dasd_block *block;
         struct dasd_uid temp_uid;
-        int is_known, rc;
+        int is_known, rc, i;
         int readonly;
+        unsigned long value;
 
         if (!ccw_device_is_pathgroup(device->cdev)) {
                 dev_warn(&device->cdev->dev,
@@ -1143,6 +1152,18 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         if (rc)
                 goto out_err1;
 
+        /* set default timeout */
+        device->default_expires = DASD_EXPIRES;
+        if (private->gneq) {
+                value = 1;
+                for (i = 0; i < private->gneq->timeout.value; i++)
+                        value = 10 * value;
+                value = value * private->gneq->timeout.number;
+                /* do not accept useless values */
+                if (value != 0 && value <= DASD_EXPIRES_MAX)
+                        device->default_expires = value;
+        }
+
         /* Generate device unique id */
         rc = dasd_eckd_generate_uid(device);
         if (rc)
@@ -1973,7 +1994,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_single(
         cqr->startdev = startdev;
         cqr->memdev = startdev;
         cqr->block = block;
-        cqr->expires = 5 * 60 * HZ;     /* 5 minutes */
+        cqr->expires = startdev->default_expires * HZ;  /* default 5 minutes */
         cqr->lpm = private->path_data.ppm;
         cqr->retries = 256;
         cqr->buildclk = get_clock();
@@ -2150,7 +2171,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_cmd_track(
         cqr->startdev = startdev;
         cqr->memdev = startdev;
         cqr->block = block;
-        cqr->expires = 5 * 60 * HZ;     /* 5 minutes */
+        cqr->expires = startdev->default_expires * HZ;  /* default 5 minutes */
         cqr->lpm = private->path_data.ppm;
         cqr->retries = 256;
         cqr->buildclk = get_clock();
@@ -2398,7 +2419,7 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_tpm_track(
         cqr->startdev = startdev;
         cqr->memdev = startdev;
         cqr->block = block;
-        cqr->expires = 5 * 60 * HZ;     /* 5 minutes */
+        cqr->expires = startdev->default_expires * HZ;  /* default 5 minutes */
         cqr->lpm = private->path_data.ppm;
         cqr->retries = 256;
         cqr->buildclk = get_clock();
@@ -2645,15 +2666,23 @@ dasd_eckd_release(struct dasd_device *device)
         struct dasd_ccw_req *cqr;
         int rc;
         struct ccw1 *ccw;
+        int useglobal;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        useglobal = 0;
         cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
         if (IS_ERR(cqr)) {
-                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
-                            "Could not allocate initialization request");
-                return PTR_ERR(cqr);
+                mutex_lock(&dasd_reserve_mutex);
+                useglobal = 1;
+                cqr = &dasd_reserve_req->cqr;
+                memset(cqr, 0, sizeof(*cqr));
+                memset(&dasd_reserve_req->ccw, 0,
+                       sizeof(dasd_reserve_req->ccw));
+                cqr->cpaddr = &dasd_reserve_req->ccw;
+                cqr->data = &dasd_reserve_req->data;
+                cqr->magic = DASD_ECKD_MAGIC;
         }
         ccw = cqr->cpaddr;
         ccw->cmd_code = DASD_ECKD_CCW_RELEASE;
@@ -2671,7 +2700,10 @@ dasd_eckd_release(struct dasd_device *device)
 
         rc = dasd_sleep_on_immediatly(cqr);
 
-        dasd_sfree_request(cqr, cqr->memdev);
+        if (useglobal)
+                mutex_unlock(&dasd_reserve_mutex);
+        else
+                dasd_sfree_request(cqr, cqr->memdev);
         return rc;
 }
 
@@ -2687,15 +2719,23 @@ dasd_eckd_reserve(struct dasd_device *device)
         struct dasd_ccw_req *cqr;
         int rc;
         struct ccw1 *ccw;
+        int useglobal;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        useglobal = 0;
         cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
         if (IS_ERR(cqr)) {
-                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
-                            "Could not allocate initialization request");
-                return PTR_ERR(cqr);
+                mutex_lock(&dasd_reserve_mutex);
+                useglobal = 1;
+                cqr = &dasd_reserve_req->cqr;
+                memset(cqr, 0, sizeof(*cqr));
+                memset(&dasd_reserve_req->ccw, 0,
+                       sizeof(dasd_reserve_req->ccw));
+                cqr->cpaddr = &dasd_reserve_req->ccw;
+                cqr->data = &dasd_reserve_req->data;
+                cqr->magic = DASD_ECKD_MAGIC;
         }
         ccw = cqr->cpaddr;
         ccw->cmd_code = DASD_ECKD_CCW_RESERVE;
@@ -2713,7 +2753,10 @@ dasd_eckd_reserve(struct dasd_device *device)
 
         rc = dasd_sleep_on_immediatly(cqr);
 
-        dasd_sfree_request(cqr, cqr->memdev);
+        if (useglobal)
+                mutex_unlock(&dasd_reserve_mutex);
+        else
+                dasd_sfree_request(cqr, cqr->memdev);
         return rc;
 }
 
@@ -2728,15 +2771,23 @@ dasd_eckd_steal_lock(struct dasd_device *device)
         struct dasd_ccw_req *cqr;
         int rc;
         struct ccw1 *ccw;
+        int useglobal;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        useglobal = 0;
         cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1, 32, device);
         if (IS_ERR(cqr)) {
-                DBF_DEV_EVENT(DBF_WARNING, device, "%s",
-                            "Could not allocate initialization request");
-                return PTR_ERR(cqr);
+                mutex_lock(&dasd_reserve_mutex);
+                useglobal = 1;
+                cqr = &dasd_reserve_req->cqr;
+                memset(cqr, 0, sizeof(*cqr));
+                memset(&dasd_reserve_req->ccw, 0,
+                       sizeof(dasd_reserve_req->ccw));
+                cqr->cpaddr = &dasd_reserve_req->ccw;
+                cqr->data = &dasd_reserve_req->data;
+                cqr->magic = DASD_ECKD_MAGIC;
         }
         ccw = cqr->cpaddr;
         ccw->cmd_code = DASD_ECKD_CCW_SLCK;
@@ -2754,7 +2805,10 @@ dasd_eckd_steal_lock(struct dasd_device *device)
 
         rc = dasd_sleep_on_immediatly(cqr);
 
-        dasd_sfree_request(cqr, cqr->memdev);
+        if (useglobal)
+                mutex_unlock(&dasd_reserve_mutex);
+        else
+                dasd_sfree_request(cqr, cqr->memdev);
         return rc;
 }
 
@@ -3488,10 +3542,15 @@ dasd_eckd_init(void)
         int ret;
 
         ASCEBC(dasd_eckd_discipline.ebcname, 4);
+        dasd_reserve_req = kmalloc(sizeof(*dasd_reserve_req),
+                                   GFP_KERNEL | GFP_DMA);
+        if (!dasd_reserve_req)
+                return -ENOMEM;
         ret = ccw_driver_register(&dasd_eckd_driver);
         if (!ret)
                 wait_for_device_probe();
-
+        else
+                kfree(dasd_reserve_req);
         return ret;
 }
 
@@ -3499,6 +3558,7 @@ static void __exit
 dasd_eckd_cleanup(void)
 {
         ccw_driver_unregister(&dasd_eckd_driver);
+        kfree(dasd_reserve_req);
 }
 
 module_init(dasd_eckd_init);
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index dd6385a5af14..0eb49655a6cd 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -320,7 +320,12 @@ struct dasd_gneq {
                 __u8 identifier:2;
                 __u8 reserved:6;
         } __attribute__ ((packed)) flags;
-        __u8 reserved[7];
+        __u8 reserved[5];
+        struct {
+                __u8 value:2;
+                __u8 number:6;
+        } __attribute__ ((packed)) timeout;
+        __u8 reserved3;
         __u16 subsystemID;
         __u8 reserved2[22];
 } __attribute__ ((packed));
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index dd88803e4899..7158f9528ecc 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -701,7 +701,7 @@ int __init dasd_eer_init(void)
 void dasd_eer_exit(void)
 {
         if (dasd_eer_dev) {
-                WARN_ON(misc_deregister(dasd_eer_dev) != 0);
+                misc_deregister(dasd_eer_dev);
                 kfree(dasd_eer_dev);
                 dasd_eer_dev = NULL;
         }
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index 37282b90eecc..bec5486e0e6d 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -163,6 +163,8 @@ dasd_fba_check_characteristics(struct dasd_device *device)
                 return rc;
         }
 
+        device->default_expires = DASD_EXPIRES;
+
         readonly = dasd_device_is_ro(device);
         if (readonly)
                 set_bit(DASD_FLAG_DEVICE_RO, &device->flags);
@@ -370,7 +372,7 @@ static struct dasd_ccw_req *dasd_fba_build_cp(struct dasd_device * memdev,
         cqr->startdev = memdev;
         cqr->memdev = memdev;
         cqr->block = block;
-        cqr->expires = 5 * 60 * HZ;     /* 5 minutes */
+        cqr->expires = memdev->default_expires * HZ;    /* default 5 minutes */
         cqr->retries = 32;
         cqr->buildclk = get_clock();
         cqr->status = DASD_CQR_FILLED;
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 49b431d135e0..500678d7116c 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -186,7 +186,7 @@ struct dasd_ccw_req {
 
         /* ... and how */
         unsigned long starttime;        /* jiffies time of request start */
-        int expires;                    /* expiration period in jiffies */
+        unsigned long expires;          /* expiration period in jiffies */
         char lpm;                       /* logical path mask */
         void *data;                     /* pointer to data area */
 
@@ -224,6 +224,9 @@ struct dasd_ccw_req {
 #define DASD_CQR_CLEARED        0x84    /* request was cleared */
 #define DASD_CQR_SUCCESS        0x85    /* request was successful */
 
+/* default expiration time*/
+#define DASD_EXPIRES      300
+#define DASD_EXPIRES_MAX  40000000
 
 /* per dasd_ccw_req flags */
 #define DASD_CQR_FLAGS_USE_ERP   0      /* use ERP for this request */
@@ -404,6 +407,9 @@ struct dasd_device {
 
         /* hook for alias management */
         struct list_head alias_list;
+
+        /* default expiration time in s */
+        unsigned long default_expires;
 };
 
 struct dasd_block {
diff --git a/drivers/s390/char/monreader.c b/drivers/s390/char/monreader.c
index 2ed3f82e5c30..e021ec663ef9 100644
--- a/drivers/s390/char/monreader.c
+++ b/drivers/s390/char/monreader.c
@@ -627,7 +627,7 @@ out_iucv:
 static void __exit mon_exit(void)
 {
         segment_unload(mon_dcss_name);
-        WARN_ON(misc_deregister(&mon_dev) != 0);
+        misc_deregister(&mon_dev);
         device_unregister(monreader_device);
         driver_unregister(&monreader_driver);
         iucv_unregister(&monreader_iucv_handler, 1);
diff --git a/drivers/s390/char/monwriter.c b/drivers/s390/char/monwriter.c
index 98a49dfda1de..572a1e7fd099 100644
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -380,7 +380,7 @@ out_driver:
 
 static void __exit mon_exit(void)
 {
-        WARN_ON(misc_deregister(&mon_dev) != 0);
+        misc_deregister(&mon_dev);
         platform_device_unregister(monwriter_pdev);
         platform_driver_unregister(&monwriter_pdrv);
 }
diff --git a/drivers/s390/cio/ccwreq.c b/drivers/s390/cio/ccwreq.c
index 7f206ed44fdf..d15f8b4d78bd 100644
--- a/drivers/s390/cio/ccwreq.c
+++ b/drivers/s390/cio/ccwreq.c
@@ -38,9 +38,13 @@ static u16 ccwreq_next_path(struct ccw_device *cdev)
 {
         struct ccw_request *req = &cdev->private->req;
 
+        if (!req->singlepath) {
+                req->mask = 0;
+                goto out;
+        }
         req->retries    = req->maxretries;
         req->mask       = lpm_adjust(req->mask >>= 1, req->lpm);
-
+out:
         return req->mask;
 }
 
@@ -113,8 +117,12 @@ void ccw_request_start(struct ccw_device *cdev)
 {
         struct ccw_request *req = &cdev->private->req;
 
-        /* Try all paths twice to counter link flapping. */
-        req->mask       = 0x8080;
+        if (req->singlepath) {
+                /* Try all paths twice to counter link flapping. */
+                req->mask = 0x8080;
+        } else
+                req->mask = req->lpm;
+
         req->retries    = req->maxretries;
         req->mask       = lpm_adjust(req->mask, req->lpm);
         req->drc        = 0;
@@ -182,6 +190,8 @@ static enum io_status ccwreq_status(struct ccw_device *cdev, struct irb *lcirb)
                 /* Ask the driver what to do */
                 if (cdev->drv && cdev->drv->uc_handler) {
                         todo = cdev->drv->uc_handler(cdev, lcirb);
+                        CIO_TRACE_EVENT(2, "uc_response");
+                        CIO_HEX_EVENT(2, &todo, sizeof(todo));
                         switch (todo) {
                         case UC_TODO_RETRY:
                                 return IO_STATUS_ERROR;
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 407d0e9adfaf..4cbb1a6ca33c 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -29,6 +29,7 @@
 #include "chsc.h"
 
 static void *sei_page;
+static DEFINE_SPINLOCK(siosl_lock);
 static DEFINE_SPINLOCK(sda_lock);
 
 /**
@@ -48,6 +49,7 @@ int chsc_error_from_response(int response)
         case 0x0007:
         case 0x0008:
         case 0x000a:
+        case 0x0104:
                 return -EINVAL;
         case 0x0004:
                 return -EOPNOTSUPP;
@@ -974,3 +976,49 @@ int chsc_sstpi(void *page, void *result, size_t size)
         return (rr->response.code == 0x0001) ? 0 : -EIO;
 }
 
+static struct {
+        struct chsc_header request;
+        u32 word1;
+        struct subchannel_id sid;
+        u32 word3;
+        struct chsc_header response;
+        u32 word[11];
+} __attribute__ ((packed)) siosl_area __attribute__ ((__aligned__(PAGE_SIZE)));
+
+int chsc_siosl(struct subchannel_id schid)
+{
+        unsigned long flags;
+        int ccode;
+        int rc;
+
+        spin_lock_irqsave(&siosl_lock, flags);
+        memset(&siosl_area, 0, sizeof(siosl_area));
+        siosl_area.request.length = 0x0010;
+        siosl_area.request.code = 0x0046;
+        siosl_area.word1 = 0x80000000;
+        siosl_area.sid = schid;
+
+        ccode = chsc(&siosl_area);
+        if (ccode > 0) {
+                if (ccode == 3)
+                        rc = -ENODEV;
+                else
+                        rc = -EBUSY;
+                CIO_MSG_EVENT(2, "chsc: chsc failed for 0.%x.%04x (ccode=%d)\n",
+                              schid.ssid, schid.sch_no, ccode);
+                goto out;
+        }
+        rc = chsc_error_from_response(siosl_area.response.code);
+        if (rc)
+                CIO_MSG_EVENT(2, "chsc: siosl failed for 0.%x.%04x (rc=%04x)\n",
+                              schid.ssid, schid.sch_no,
+                              siosl_area.response.code);
+        else
+                CIO_MSG_EVENT(4, "chsc: siosl succeeded for 0.%x.%04x\n",
+                              schid.ssid, schid.sch_no);
+out:
+        spin_unlock_irqrestore(&siosl_lock, flags);
+
+        return rc;
+}
+EXPORT_SYMBOL_GPL(chsc_siosl);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 37aa611d4ac5..5453013f094b 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -80,4 +80,6 @@ int chsc_get_channel_measurement_chars(struct channel_path *chp);
 
 int chsc_error_from_response(int response);
 
+int chsc_siosl(struct subchannel_id schid);
+
 #endif
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 6d229f3523a0..51bd3687d163 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -36,6 +36,7 @@
 #include "ioasm.h"
 #include "io_sch.h"
 #include "blacklist.h"
+#include "chsc.h"
 
 static struct timer_list recovery_timer;
 static DEFINE_SPINLOCK(recovery_lock);
@@ -486,9 +487,11 @@ static int online_store_handle_offline(struct ccw_device *cdev)
                 spin_lock_irq(cdev->ccwlock);
                 ccw_device_sched_todo(cdev, CDEV_TODO_UNREG_EVAL);
                 spin_unlock_irq(cdev->ccwlock);
-        } else if (cdev->online && cdev->drv && cdev->drv->set_offline)
+                return 0;
+        }
+        if (cdev->drv && cdev->drv->set_offline)
                 return ccw_device_set_offline(cdev);
-        return 0;
+        return -EINVAL;
 }
 
 static int online_store_recog_and_online(struct ccw_device *cdev)
@@ -505,8 +508,8 @@ static int online_store_recog_and_online(struct ccw_device *cdev)
                         return -EAGAIN;
         }
         if (cdev->drv && cdev->drv->set_online)
-                ccw_device_set_online(cdev);
-        return 0;
+                return ccw_device_set_online(cdev);
+        return -EINVAL;
 }
 
 static int online_store_handle_online(struct ccw_device *cdev, int force)
@@ -598,6 +601,25 @@ available_show (struct device *dev, struct device_attribute *attr, char *buf)
         }
 }
 
+static ssize_t
+initiate_logging(struct device *dev, struct device_attribute *attr,
+                 const char *buf, size_t count)
+{
+        struct subchannel *sch = to_subchannel(dev);
+        int rc;
+
+        rc = chsc_siosl(sch->schid);
+        if (rc < 0) {
+                pr_warning("Logging for subchannel 0.%x.%04x failed with "
+                           "errno=%d\n",
+                           sch->schid.ssid, sch->schid.sch_no, rc);
+                return rc;
+        }
+        pr_notice("Logging for subchannel 0.%x.%04x was triggered\n",
+                  sch->schid.ssid, sch->schid.sch_no);
+        return count;
+}
+
 static DEVICE_ATTR(chpids, 0444, chpids_show, NULL);
 static DEVICE_ATTR(pimpampom, 0444, pimpampom_show, NULL);
 static DEVICE_ATTR(devtype, 0444, devtype_show, NULL);
@@ -605,10 +627,12 @@ static DEVICE_ATTR(cutype, 0444, cutype_show, NULL);
 static DEVICE_ATTR(modalias, 0444, modalias_show, NULL);
 static DEVICE_ATTR(online, 0644, online_show, online_store);
 static DEVICE_ATTR(availability, 0444, available_show, NULL);
+static DEVICE_ATTR(logging, 0200, NULL, initiate_logging);
 
 static struct attribute *io_subchannel_attrs[] = {
         &dev_attr_chpids.attr,
         &dev_attr_pimpampom.attr,
+        &dev_attr_logging.attr,
         NULL,
 };
 
@@ -2036,6 +2060,21 @@ void ccw_device_sched_todo(struct ccw_device *cdev, enum cdev_todo todo)
         }
 }
 
+/**
+ * ccw_device_siosl() - initiate logging
+ * @cdev: ccw device
+ *
+ * This function is used to invoke model-dependent logging within the channel
+ * subsystem.
+ */
+int ccw_device_siosl(struct ccw_device *cdev)
+{
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
+
+        return chsc_siosl(sch->schid);
+}
+EXPORT_SYMBOL_GPL(ccw_device_siosl);
+
 MODULE_LICENSE("GPL");
 EXPORT_SYMBOL(ccw_device_set_online);
 EXPORT_SYMBOL(ccw_device_set_offline);
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index 6facb5499a65..82a5ad0d63f6 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -208,6 +208,7 @@ static void spid_start(struct ccw_device *cdev)
         req->timeout    = PGID_TIMEOUT;
         req->maxretries = PGID_RETRIES;
         req->lpm        = 0x80;
+        req->singlepath = 1;
         req->callback   = spid_callback;
         spid_do(cdev);
 }
@@ -420,6 +421,7 @@ static void verify_start(struct ccw_device *cdev)
         req->timeout    = PGID_TIMEOUT;
         req->maxretries = PGID_RETRIES;
         req->lpm        = 0x80;
+        req->singlepath = 1;
         if (cdev->private->flags.pgroup) {
                 CIO_TRACE_EVENT(4, "snid");
                 CIO_HEX_EVENT(4, devid, sizeof(*devid));
@@ -507,6 +509,7 @@ void ccw_device_disband_start(struct ccw_device *cdev)
         req->timeout    = PGID_TIMEOUT;
         req->maxretries = PGID_RETRIES;
         req->lpm        = sch->schib.pmcw.pam & sch->opm;
+        req->singlepath = 1;
         req->callback   = disband_callback;
         fn = SPID_FUNC_DISBAND;
         if (cdev->private->flags.mpath)
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index b9ce712a7f25..469ef93f2302 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -92,11 +92,12 @@ enum io_status {
  * @filter: optional callback to adjust request status based on IRB data
  * @callback: final callback
  * @data: user-defined pointer passed to all callbacks
+ * @singlepath: if set, use only one path from @lpm per start I/O
+ * @cancel: non-zero if request was cancelled
+ * @done: non-zero if request was finished
  * @mask: current path mask
  * @retries: current number of retries
  * @drc: delayed return code
- * @cancel: non-zero if request was cancelled
- * @done: non-zero if request was finished
  */
 struct ccw_request {
         struct ccw1 *cp;
@@ -108,12 +109,13 @@ struct ccw_request {
                                  enum io_status);
         void (*callback)(struct ccw_device *, void *, int);
         void *data;
+        unsigned int singlepath:1;
         /* These fields are used internally. */
+        unsigned int cancel:1;
+        unsigned int done:1;
         u16 mask;
         u16 retries;
         int drc;
-        int cancel:1;
-        int done:1;
 } __attribute__((packed));
 
 /*
diff --git a/drivers/s390/net/smsgiucv_app.c b/drivers/s390/net/smsgiucv_app.c
index 137688790207..4d2ea4000422 100644
--- a/drivers/s390/net/smsgiucv_app.c
+++ b/drivers/s390/net/smsgiucv_app.c
@@ -180,6 +180,13 @@ static int __init smsgiucv_app_init(void)
                 goto fail_put_driver;
         }
 
+        /* convert sender to uppercase characters */
+        if (sender) {
+                int len = strlen(sender);
+                while (len--)
+                        sender[len] = toupper(sender[len]);
+        }
+
         /* register with the smsgiucv device driver */
         rc = smsg_register_callback(SMSG_PREFIX, smsg_app_callback);
         if (rc) {
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index 8681f1345056..d89aa38c5cf0 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -216,7 +216,7 @@ serial21285_set_termios(struct uart_port *port, struct ktermios *termios,
                         struct ktermios *old)
 {
         unsigned long flags;
-        unsigned int baud, quot, h_lcr;
+        unsigned int baud, quot, h_lcr, b;
 
         /*
          * We don't support modem control lines.
@@ -234,12 +234,8 @@ serial21285_set_termios(struct uart_port *port, struct ktermios *termios,
          */
         baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16); 
         quot = uart_get_divisor(port, baud);
-
-        if (port->state && port->state->port.tty) {
-                struct tty_struct *tty = port->state->port.tty;
-                unsigned int b = port->uartclk / (16 * quot);
-                tty_encode_baud_rate(tty, b, b);
-        }
+        b = port->uartclk / (16 * quot);
+        tty_termios_encode_baud_rate(termios, b, b);
 
         switch (termios->c_cflag & CSIZE) {
         case CS5:
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 30463862603b..7356a56ac458 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -78,10 +78,6 @@ struct m68k_serial *m68k_consinfo = 0;
 
 #define M68K_CLOCK (16667000) /* FIXME: 16MHz is likely wrong */
 
-#ifdef CONFIG_CONSOLE
-extern wait_queue_head_t keypress_wait; 
-#endif
-
 struct tty_driver *serial_driver;
 
 /* number of characters left in xmit buffer before we ask for more */
@@ -102,19 +98,13 @@ static void change_speed(struct m68k_serial *info);
  *      Setup for console. Argument comes from the boot command line.
  */
 
-#if defined(CONFIG_M68EZ328ADS) || defined(CONFIG_ALMA_ANS) || defined(CONFIG_DRAGONIXVZ)
-#define CONSOLE_BAUD_RATE       115200
-#define DEFAULT_CBAUD           B115200
-#else
-        /* (es) */
-        /* note: this is messy, but it works, again, perhaps defined somewhere else?*/
-        #ifdef CONFIG_M68VZ328
-        #define CONSOLE_BAUD_RATE       19200
-        #define DEFAULT_CBAUD           B19200
-        #endif
-        /* (/es) */
+/* note: this is messy, but it works, again, perhaps defined somewhere else?*/
+#ifdef CONFIG_M68VZ328
+#define CONSOLE_BAUD_RATE       19200
+#define DEFAULT_CBAUD           B19200
 #endif
 
+
 #ifndef CONSOLE_BAUD_RATE
 #define CONSOLE_BAUD_RATE       9600
 #define DEFAULT_CBAUD           B9600
@@ -300,10 +290,6 @@ static void receive_chars(struct m68k_serial *info, unsigned short rx)
                                 return;
 #endif /* CONFIG_MAGIC_SYSRQ */
                         }
-                        /* It is a 'keyboard interrupt' ;-) */
-#ifdef CONFIG_CONSOLE
-                        wake_up(&keypress_wait);
-#endif                  
                 }
 
                 if(!tty)
@@ -1243,7 +1229,9 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
                         retval = -ERESTARTSYS;
                         break;
                 }
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         current->state = TASK_RUNNING;
         remove_wait_queue(&info->open_wait, &wait);
diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
index 768612f8e41e..0dff3bbddc8b 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/serial/68360serial.c
@@ -1705,7 +1705,6 @@ static void rs_360_wait_until_sent(struct tty_struct *tty, int timeout)
         printk("jiff=%lu...", jiffies);
 #endif
 
-        lock_kernel();
         /* We go through the loop at least once because we can't tell
          * exactly when the last character exits the shifter.  There can
          * be at least two characters waiting to be sent after the buffers
@@ -1734,7 +1733,6 @@ static void rs_360_wait_until_sent(struct tty_struct *tty, int timeout)
                         bdp--;
         } while (bdp->status & BD_SC_READY);
         current->state = TASK_RUNNING;
-        unlock_kernel();
 #ifdef SERIAL_DEBUG_RS_WAIT_UNTIL_SENT
         printk("lsr = %d (jiff=%lu)...done\n", lsr, jiffies);
 #endif
@@ -1862,7 +1860,9 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
                 printk("block_til_ready blocking: ttys%d, count = %d\n",
                        info->line, state->count);
 #endif
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         current->state = TASK_RUNNING;
         remove_wait_queue(&info->open_wait, &wait);
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 09ef57034c9c..24110f6f61e0 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -241,7 +241,7 @@ static const struct serial8250_config uart_config[] = {
                 .fifo_size      = 128,
                 .tx_loadsz      = 128,
                 .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
-                .flags          = UART_CAP_FIFO,
+                .flags          = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
         },
         [PORT_16654] = {
                 .name           = "ST16654",
@@ -300,6 +300,13 @@ static const struct serial8250_config uart_config[] = {
                 .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_00,
                 .flags          = UART_CAP_FIFO | UART_CAP_AFE,
         },
+        [PORT_U6_16550A] = {
+                .name           = "U6_16550A",
+                .fifo_size      = 64,
+                .tx_loadsz      = 64,
+                .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+                .flags          = UART_CAP_FIFO | UART_CAP_AFE,
+        },
 };
 
 #if defined(CONFIG_MIPS_ALCHEMY)
@@ -1070,6 +1077,15 @@ static void autoconfig_16550a(struct uart_8250_port *up)
                 DEBUG_AUTOCONF("Couldn't force IER_UUE to 0 ");
         }
         serial_outp(up, UART_IER, iersave);
+
+        /*
+         * We distinguish between 16550A and U6 16550A by counting
+         * how many bytes are in the FIFO.
+         */
+        if (up->port.type == PORT_16550A && size_fifo(up) == 64) {
+                up->port.type = PORT_U6_16550A;
+                up->capabilities |= UART_CAP_AFE;
+        }
 }
 
 /*
@@ -2224,9 +2240,9 @@ static unsigned int serial8250_get_divisor(struct uart_port *port, unsigned int
         return quot;
 }
 
-static void
-serial8250_set_termios(struct uart_port *port, struct ktermios *termios,
-                       struct ktermios *old)
+void
+serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+                          struct ktermios *old)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
         unsigned char cval, fcr = 0;
@@ -2402,16 +2418,22 @@ serial8250_set_termios(struct uart_port *port, struct ktermios *termios,
         if (tty_termios_baud_rate(termios))
                 tty_termios_encode_baud_rate(termios, baud, baud);
 }
+EXPORT_SYMBOL(serial8250_do_set_termios);
 
 static void
-serial8250_set_ldisc(struct uart_port *port)
+serial8250_set_termios(struct uart_port *port, struct ktermios *termios,
+                       struct ktermios *old)
 {
-        int line = port->line;
-
-        if (line >= port->state->port.tty->driver->num)
-                return;
+        if (port->set_termios)
+                port->set_termios(port, termios, old);
+        else
+                serial8250_do_set_termios(port, termios, old);
+}
 
-        if (port->state->port.tty->ldisc->ops->num == N_PPS) {
+static void
+serial8250_set_ldisc(struct uart_port *port, int new)
+{
+        if (new == N_PPS) {
                 port->flags |= UPF_HARDPPS_CD;
                 serial8250_enable_ms(port);
         } else
@@ -2987,6 +3009,7 @@ static int __devinit serial8250_probe(struct platform_device *dev)
                 port.type               = p->type;
                 port.serial_in          = p->serial_in;
                 port.serial_out         = p->serial_out;
+                port.set_termios        = p->set_termios;
                 port.dev                = &dev->dev;
                 port.irqflags           |= irqflag;
                 ret = serial8250_register_port(&port);
@@ -3150,6 +3173,9 @@ int serial8250_register_port(struct uart_port *port)
                         uart->port.serial_in = port->serial_in;
                 if (port->serial_out)
                         uart->port.serial_out = port->serial_out;
+                /*  Possibly override set_termios call */
+                if (port->set_termios)
+                        uart->port.set_termios = port->set_termios;
 
                 ret = uart_add_one_port(&serial8250_reg, &uart->port);
                 if (ret == 0)
diff --git a/drivers/serial/8250_early.c b/drivers/serial/8250_early.c
index f279745e9fef..b745792ec25a 100644
--- a/drivers/serial/8250_early.c
+++ b/drivers/serial/8250_early.c
@@ -19,9 +19,11 @@
  * The user can specify the device directly, e.g.,
  *      earlycon=uart8250,io,0x3f8,9600n8
  *      earlycon=uart8250,mmio,0xff5e0000,115200n8
+ *      earlycon=uart8250,mmio32,0xff5e0000,115200n8
  * or
  *      console=uart8250,io,0x3f8,9600n8
  *      console=uart8250,mmio,0xff5e0000,115200n8
+ *      console=uart8250,mmio32,0xff5e0000,115200n8
  */
 
 #include <linux/tty.h>
@@ -48,18 +50,31 @@ static struct early_serial8250_device early_device;
 
 static unsigned int __init serial_in(struct uart_port *port, int offset)
 {
-        if (port->iotype == UPIO_MEM)
+        switch (port->iotype) {
+        case UPIO_MEM:
                 return readb(port->membase + offset);
-        else
+        case UPIO_MEM32:
+                return readl(port->membase + (offset << 2));
+        case UPIO_PORT:
                 return inb(port->iobase + offset);
+        default:
+                return 0;
+        }
 }
 
 static void __init serial_out(struct uart_port *port, int offset, int value)
 {
-        if (port->iotype == UPIO_MEM)
+        switch (port->iotype) {
+        case UPIO_MEM:
                 writeb(value, port->membase + offset);
-        else
+                break;
+        case UPIO_MEM32:
+                writel(value, port->membase + (offset << 2));
+                break;
+        case UPIO_PORT:
                 outb(value, port->iobase + offset);
+                break;
+        }
 }
 
 #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
@@ -137,15 +152,21 @@ static int __init parse_options(struct early_serial8250_device *device,
                                                                 char *options)
 {
         struct uart_port *port = &device->port;
-        int mmio, length;
+        int mmio, mmio32, length;
 
         if (!options)
                 return -ENODEV;
 
         port->uartclk = BASE_BAUD * 16;
-        if (!strncmp(options, "mmio,", 5)) {
-                port->iotype = UPIO_MEM;
-                port->mapbase = simple_strtoul(options + 5, &options, 0);
+
+        mmio = !strncmp(options, "mmio,", 5);
+        mmio32 = !strncmp(options, "mmio32,", 7);
+        if (mmio || mmio32) {
+                port->iotype = (mmio ? UPIO_MEM : UPIO_MEM32);
+                port->mapbase = simple_strtoul(options + (mmio ? 5 : 7),
+                                               &options, 0);
+                if (mmio32)
+                        port->regshift = 2;
 #ifdef CONFIG_FIX_EARLYCON_MEM
                 set_fixmap_nocache(FIX_EARLYCON_MEM_BASE,
                                         port->mapbase & PAGE_MASK);
@@ -157,11 +178,10 @@ static int __init parse_options(struct early_serial8250_device *device,
                 if (!port->membase) {
                         printk(KERN_ERR "%s: Couldn't ioremap 0x%llx\n",
                                 __func__,
-                               (unsigned long long)port->mapbase);
+                               (unsigned long long) port->mapbase);
                         return -ENOMEM;
                 }
 #endif
-                mmio = 1;
         } else if (!strncmp(options, "io,", 3)) {
                 port->iotype = UPIO_PORT;
                 port->iobase = simple_strtoul(options + 3, &options, 0);
@@ -181,11 +201,18 @@ static int __init parse_options(struct early_serial8250_device *device,
                         device->baud);
         }
 
-        printk(KERN_INFO "Early serial console at %s 0x%llx (options '%s')\n",
-                mmio ? "MMIO" : "I/O port",
-                mmio ? (unsigned long long) port->mapbase
-                     : (unsigned long long) port->iobase,
-                device->options);
+        if (mmio || mmio32)
+                printk(KERN_INFO
+                       "Early serial console at MMIO%s 0x%llu (options '%s')\n",
+                        mmio32 ? "32" : "",
+                        (unsigned long long)port->mapbase,
+                        device->options);
+        else
+                printk(KERN_INFO
+                      "Early serial console at I/O port 0x%lu (options '%s')\n",
+                        port->iobase,
+                        device->options);
+
         return 0;
 }
 
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 746a44621d91..53be4d35a0aa 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -994,6 +994,7 @@ static int skip_tx_en_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_TITAN_800E        0xA014
 #define PCI_DEVICE_ID_TITAN_200EI       0xA016
 #define PCI_DEVICE_ID_TITAN_200EISI     0xA017
+#define PCI_DEVICE_ID_OXSEMI_16PCI958   0x9538
 
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
@@ -1542,6 +1543,8 @@ enum pci_board_num_t {
         pbn_b2_4_921600,
         pbn_b2_8_921600,
 
+        pbn_b2_8_1152000,
+
         pbn_b2_bt_1_115200,
         pbn_b2_bt_2_115200,
         pbn_b2_bt_4_115200,
@@ -1960,6 +1963,13 @@ static struct pciserial_board pci_boards[] __devinitdata = {
                 .uart_offset    = 8,
         },
 
+        [pbn_b2_8_1152000] = {
+                .flags          = FL_BASE2,
+                .num_ports      = 8,
+                .base_baud      = 1152000,
+                .uart_offset    = 8,
+        },
+
         [pbn_b2_bt_1_115200] = {
                 .flags          = FL_BASE2|FL_BASE_BARS,
                 .num_ports      = 1,
@@ -2875,6 +2885,9 @@ static struct pci_device_id serial_pci_tbl[] = {
         {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI952,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
                 pbn_b0_bt_2_921600 },
+        {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI958,
+                PCI_ANY_ID , PCI_ANY_ID, 0, 0,
+                pbn_b2_8_1152000 },
 
         /*
          * Oxford Semiconductor Inc. Tornado PCI express device range.
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index e437ce8c1748..a22e60c06f48 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -542,6 +542,7 @@ config SERIAL_S5PV210
         help
           Serial port support for Samsung's S5P Family of SoC's
 
+
 config SERIAL_MAX3100
         tristate "MAX3100 support"
         depends on SPI
@@ -549,6 +550,22 @@ config SERIAL_MAX3100
         help
           MAX3100 chip support
 
+config SERIAL_MAX3107
+        tristate "MAX3107 support"
+        depends on SPI
+        select SERIAL_CORE
+        help
+          MAX3107 chip support
+
+config SERIAL_MAX3107_AAVA
+        tristate "MAX3107 AAVA platform support"
+        depends on X86_MRST && SERIAL_MAX3107 && GPIOLIB
+        select SERIAL_CORE
+        help
+          Support for the MAX3107 chip configuration found on the AAVA
+          platform. Includes the extra initialisation and GPIO support
+          neded for this device.
+
 config SERIAL_DZ
         bool "DECstation DZ serial driver"
         depends on MACH_DECSTATION && 32BIT
@@ -690,6 +707,33 @@ config SERIAL_SA1100_CONSOLE
           your boot loader (lilo or loadlin) about how to pass options to the
           kernel at boot time.)
 
+config SERIAL_MRST_MAX3110
+        tristate "SPI UART driver for Max3110"
+        depends on SPI_DW_PCI
+        select SERIAL_CORE
+        select SERIAL_CORE_CONSOLE
+        help
+          This is the UART protocol driver for the MAX3110 device on
+          the Intel Moorestown platform. On other systems use the max3100
+          driver.
+
+config MRST_MAX3110_IRQ
+        boolean "Enable GPIO IRQ for Max3110 over Moorestown"
+        default n
+        depends on SERIAL_MRST_MAX3110 && GPIO_LANGWELL
+        help
+          This has to be enabled after Moorestown GPIO driver is loaded
+
+config SERIAL_MFD_HSU
+        tristate "Medfield High Speed UART support"
+        depends on PCI
+        select SERIAL_CORE
+
+config SERIAL_MFD_HSU_CONSOLE
+        boolean "Medfile HSU serial console support"
+        depends on SERIAL_MFD_HSU=y
+        select SERIAL_CORE_CONSOLE
+
 config SERIAL_BFIN
         tristate "Blackfin serial port support"
         depends on BLACKFIN
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index 208a85572c32..1ca4fd599ffe 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -46,6 +46,8 @@ obj-$(CONFIG_SERIAL_S3C24A0) += s3c24a0.o
 obj-$(CONFIG_SERIAL_S3C6400) += s3c6400.o
 obj-$(CONFIG_SERIAL_S5PV210) += s5pv210.o
 obj-$(CONFIG_SERIAL_MAX3100) += max3100.o
+obj-$(CONFIG_SERIAL_MAX3107) += max3107.o
+obj-$(CONFIG_SERIAL_MAX3107_AAVA) += max3107-aava.o
 obj-$(CONFIG_SERIAL_IP22_ZILOG) += ip22zilog.o
 obj-$(CONFIG_SERIAL_MUX) += mux.o
 obj-$(CONFIG_SERIAL_68328) += 68328serial.o
@@ -84,3 +86,5 @@ obj-$(CONFIG_SERIAL_TIMBERDALE)	+= timbuart.o
 obj-$(CONFIG_SERIAL_GRLIB_GAISLER_APBUART) += apbuart.o
 obj-$(CONFIG_SERIAL_ALTERA_JTAGUART) += altera_jtaguart.o
 obj-$(CONFIG_SERIAL_ALTERA_UART) += altera_uart.o
+obj-$(CONFIG_SERIAL_MRST_MAX3110)       += mrst_max3110.o
+obj-$(CONFIG_SERIAL_MFD_HSU)    += mfd.o
diff --git a/drivers/serial/altera_uart.c b/drivers/serial/altera_uart.c
index 0f1189605d21..f8d8a00554da 100644
--- a/drivers/serial/altera_uart.c
+++ b/drivers/serial/altera_uart.c
@@ -394,7 +394,7 @@ int __init early_altera_uart_setup(struct altera_uart_platform_uart *platp)
 static void altera_uart_console_putc(struct uart_port *port, const char c)
 {
         while (!(readl(port->membase + ALTERA_UART_STATUS_REG) &
-                 ALTERA_UART_STATUS_TRDY_MSK))
+                 ALTERA_UART_STATUS_TRDY_MSK))
                 cpu_relax();
 
         writel(c, port->membase + ALTERA_UART_TXDATA_REG);
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index a182def7007d..3892666b5fbd 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -217,7 +217,8 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
         if (rs485conf->flags & SER_RS485_ENABLED) {
                 dev_dbg(port->dev, "Setting UART to RS485\n");
                 atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
-                UART_PUT_TTGR(port, rs485conf->delay_rts_before_send);
+                if (rs485conf->flags & SER_RS485_RTS_AFTER_SEND)
+                        UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
                 mode |= ATMEL_US_USMODE_RS485;
         } else {
                 dev_dbg(port->dev, "Setting UART to RS232\n");
@@ -292,7 +293,9 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
 
         if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
                 dev_dbg(port->dev, "Setting UART to RS485\n");
-                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                if (atmel_port->rs485.flags & SER_RS485_RTS_AFTER_SEND)
+                        UART_PUT_TTGR(port,
+                                        atmel_port->rs485.delay_rts_after_send);
                 mode |= ATMEL_US_USMODE_RS485;
         } else {
                 dev_dbg(port->dev, "Setting UART to RS232\n");
@@ -1211,7 +1214,9 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
 
         if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
                 dev_dbg(port->dev, "Setting UART to RS485\n");
-                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                if (atmel_port->rs485.flags & SER_RS485_RTS_AFTER_SEND)
+                        UART_PUT_TTGR(port,
+                                        atmel_port->rs485.delay_rts_after_send);
                 mode |= ATMEL_US_USMODE_RS485;
         } else {
                 dev_dbg(port->dev, "Setting UART to RS232\n");
diff --git a/drivers/serial/bfin_5xx.c b/drivers/serial/bfin_5xx.c
index 511cbf687877..a9eff2b18eab 100644
--- a/drivers/serial/bfin_5xx.c
+++ b/drivers/serial/bfin_5xx.c
@@ -957,15 +957,12 @@ bfin_serial_verify_port(struct uart_port *port, struct serial_struct *ser)
  * Enable the IrDA function if tty->ldisc.num is N_IRDA.
  * In other cases, disable IrDA function.
  */
-static void bfin_serial_set_ldisc(struct uart_port *port)
+static void bfin_serial_set_ldisc(struct uart_port *port, int ld)
 {
         int line = port->line;
         unsigned short val;
 
-        if (line >= port->state->port.tty->driver->num)
-                return;
-
-        switch (port->state->port.tty->termios->c_line) {
+        switch (ld) {
         case N_IRDA:
                 val = UART_GET_GCTL(&bfin_serial_ports[line]);
                 val |= (IREN | RPOLC);
diff --git a/drivers/serial/crisv10.c b/drivers/serial/crisv10.c
index 31f172397af3..c856905bb3bd 100644
--- a/drivers/serial/crisv10.c
+++ b/drivers/serial/crisv10.c
@@ -3724,6 +3724,17 @@ rs_ioctl(struct tty_struct *tty, struct file * file,
                 return e100_enable_rs485(tty, &rs485data);
         }
 
+        case TIOCGRS485:
+        {
+                struct serial_rs485 *rs485data =
+                        &(((struct e100_serial *)tty->driver_data)->rs485);
+                /* This is the ioctl to get RS485 data from user-space */
+                if (copy_to_user((struct serial_rs485 *) arg,
+                                        rs485data,
+                                        sizeof(serial_rs485)))
+                        return -EFAULT;
+                break;
+        }
 
         case TIOCSERWRRS485:
         {
@@ -3924,7 +3935,6 @@ static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
          * Check R_DMA_CHx_STATUS bit 0-6=number of available bytes in FIFO
          * R_DMA_CHx_HWSW bit 31-16=nbr of bytes left in DMA buffer (0=64k)
          */
-        lock_kernel();
         orig_jiffies = jiffies;
         while (info->xmit.head != info->xmit.tail || /* More in send queue */
                (*info->ostatusadr & 0x007f) ||  /* more in FIFO */
@@ -3941,7 +3951,6 @@ static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
                         curr_time_usec - info->last_tx_active_usec;
         }
         set_current_state(TASK_RUNNING);
-        unlock_kernel();
 }
 
 /*
@@ -3981,7 +3990,7 @@ block_til_ready(struct tty_struct *tty, struct file * filp,
          */
         if (tty_hung_up_p(filp) ||
             (info->flags & ASYNC_CLOSING)) {
-                wait_event_interruptible(info->close_wait,
+                wait_event_interruptible_tty(info->close_wait,
                         !(info->flags & ASYNC_CLOSING));
 #ifdef SERIAL_DO_RESTART
                 if (info->flags & ASYNC_HUP_NOTIFY)
@@ -4057,7 +4066,9 @@ block_til_ready(struct tty_struct *tty, struct file * filp,
                 printk("block_til_ready blocking: ttyS%d, count = %d\n",
                        info->line, info->count);
 #endif
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&info->open_wait, &wait);
@@ -4139,7 +4150,7 @@ rs_open(struct tty_struct *tty, struct file * filp)
          */
         if (tty_hung_up_p(filp) ||
             (info->flags & ASYNC_CLOSING)) {
-                wait_event_interruptible(info->close_wait,
+                wait_event_interruptible_tty(info->close_wait,
                         !(info->flags & ASYNC_CLOSING));
 #ifdef SERIAL_DO_RESTART
                 return ((info->flags & ASYNC_HUP_NOTIFY) ?
@@ -4522,8 +4533,8 @@ static int __init rs_init(void)
                 INIT_WORK(&info->work, do_softint);
 
                 if (info->enabled) {
-                        printk(KERN_INFO "%s%d at 0x%x is a builtin UART with DMA\n",
-                               serial_driver->name, info->line, (unsigned int)info->ioport);
+                        printk(KERN_INFO "%s%d at %p is a builtin UART with DMA\n",
+                               serial_driver->name, info->line, info->ioport);
                 }
         }
 #ifdef CONFIG_ETRAX_FAST_TIMER
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index eacb588a9345..66ecc7ab6dab 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -909,13 +909,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
         rational_best_approximation(16 * div * baud, sport->port.uartclk,
                 1 << 16, 1 << 16, &num, &denom);
 
-        if (port->state && port->state->port.tty) {
-                tdiv64 = sport->port.uartclk;
-                tdiv64 *= num;
-                do_div(tdiv64, denom * 16 * div);
-                tty_encode_baud_rate(sport->port.state->port.tty,
+        tdiv64 = sport->port.uartclk;
+        tdiv64 *= num;
+        do_div(tdiv64, denom * 16 * div);
+        tty_termios_encode_baud_rate(termios,
                                 (speed_t)tdiv64, (speed_t)tdiv64);
-        }
 
         num -= 1;
         denom -= 1;
diff --git a/drivers/serial/ioc3_serial.c b/drivers/serial/ioc3_serial.c
index f164ba4eba02..93de907b1208 100644
--- a/drivers/serial/ioc3_serial.c
+++ b/drivers/serial/ioc3_serial.c
@@ -954,12 +954,13 @@ ioc3_change_speed(struct uart_port *the_port,
                   struct ktermios *new_termios, struct ktermios *old_termios)
 {
         struct ioc3_port *port = get_ioc3_port(the_port);
-        unsigned int cflag;
+        unsigned int cflag, iflag;
         int baud;
         int new_parity = 0, new_parity_enable = 0, new_stop = 0, new_data = 8;
         struct uart_state *state = the_port->state;
 
         cflag = new_termios->c_cflag;
+        iflag = new_termios->c_iflag;
 
         switch (cflag & CSIZE) {
         case CS5:
@@ -1000,12 +1001,12 @@ ioc3_change_speed(struct uart_port *the_port,
 
         state->port.tty->low_latency = 1;
 
-        if (I_IGNPAR(state->port.tty))
+        if (iflag & IGNPAR)
                 the_port->ignore_status_mask &= ~(N_PARITY_ERROR
                                                   | N_FRAMING_ERROR);
-        if (I_IGNBRK(state->port.tty)) {
+        if (iflag & IGNBRK) {
                 the_port->ignore_status_mask &= ~N_BREAK;
-                if (I_IGNPAR(state->port.tty))
+                if (iflag & IGNPAR)
                         the_port->ignore_status_mask &= ~N_OVERRUN_ERROR;
         }
         if (!(cflag & CREAD)) {
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 8ad28fc64926..fcfe82653ac8 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -1685,11 +1685,12 @@ ioc4_change_speed(struct uart_port *the_port,
 {
         struct ioc4_port *port = get_ioc4_port(the_port, 0);
         int baud, bits;
-        unsigned cflag;
+        unsigned cflag, iflag;
         int new_parity = 0, new_parity_enable = 0, new_stop = 0, new_data = 8;
         struct uart_state *state = the_port->state;
 
         cflag = new_termios->c_cflag;
+        iflag = new_termios->c_iflag;
 
         switch (cflag & CSIZE) {
         case CS5:
@@ -1741,12 +1742,12 @@ ioc4_change_speed(struct uart_port *the_port,
 
         state->port.tty->low_latency = 1;
 
-        if (I_IGNPAR(state->port.tty))
+        if (iflag & IGNPAR)
                 the_port->ignore_status_mask &= ~(N_PARITY_ERROR
                                                 | N_FRAMING_ERROR);
-        if (I_IGNBRK(state->port.tty)) {
+        if (iflag & IGNBRK) {
                 the_port->ignore_status_mask &= ~N_BREAK;
-                if (I_IGNPAR(state->port.tty))
+                if (iflag & IGNPAR)
                         the_port->ignore_status_mask &= ~N_OVERRUN_ERROR;
         }
         if (!(cflag & CREAD)) {
diff --git a/drivers/serial/max3100.c b/drivers/serial/max3100.c
index 3351c3bd59e4..beb1afa27d8d 100644
--- a/drivers/serial/max3100.c
+++ b/drivers/serial/max3100.c
@@ -430,17 +430,14 @@ max3100_set_termios(struct uart_port *port, struct ktermios *termios,
         int baud = 0;
         unsigned cflag;
         u32 param_new, param_mask, parity = 0;
-        struct tty_struct *tty = s->port.state->port.tty;
 
         dev_dbg(&s->spi->dev, "%s\n", __func__);
-        if (!tty)
-                return;
 
         cflag = termios->c_cflag;
         param_new = 0;
         param_mask = 0;
 
-        baud = tty_get_baud_rate(tty);
+        baud = tty_termios_baud_rate(termios);
         param_new = s->conf & MAX3100_BAUD;
         switch (baud) {
         case 300:
@@ -485,7 +482,7 @@ max3100_set_termios(struct uart_port *port, struct ktermios *termios,
         default:
                 baud = s->baud;
         }
-        tty_encode_baud_rate(tty, baud, baud);
+        tty_termios_encode_baud_rate(termios, baud, baud);
         s->baud = baud;
         param_mask |= MAX3100_BAUD;
 
diff --git a/drivers/serial/max3107-aava.c b/drivers/serial/max3107-aava.c
new file mode 100644
index 000000000000..a1fe304f2f52
--- /dev/null
+++ b/drivers/serial/max3107-aava.c
@@ -0,0 +1,344 @@
+/*
+ *  max3107.c - spi uart protocol driver for Maxim 3107
+ *  Based on max3100.c
+ *      by Christian Pellegrin <chripell@evolware.org>
+ *  and max3110.c
+ *      by Feng Tang <feng.tang@intel.com>
+ *
+ *  Copyright (C) Aavamobile 2009
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ */
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/serial_core.h>
+#include <linux/serial.h>
+#include <linux/spi/spi.h>
+#include <linux/freezer.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/sfi.h>
+#include <asm/mrst.h>
+#include "max3107.h"
+
+/* GPIO direction to input function */
+static int max3107_gpio_direction_in(struct gpio_chip *chip, unsigned offset)
+{
+        struct max3107_port *s = container_of(chip, struct max3107_port, chip);
+        u16 buf[1];             /* Buffer for SPI transfer */
+
+        if (offset >= MAX3107_GPIO_COUNT) {
+                dev_err(&s->spi->dev, "Invalid GPIO\n");
+                return -EINVAL;
+        }
+
+        /* Read current GPIO configuration register */
+        buf[0] = MAX3107_GPIOCFG_REG;
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 2)) {
+                dev_err(&s->spi->dev, "SPI transfer GPIO read failed\n");
+                return -EIO;
+        }
+        buf[0] &= MAX3107_SPI_RX_DATA_MASK;
+
+        /* Set GPIO to input */
+        buf[0] &= ~(0x0001 << offset);
+
+        /* Write new GPIO configuration register value */
+        buf[0] |= (MAX3107_WRITE_BIT | MAX3107_GPIOCFG_REG);
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, NULL, 2)) {
+                dev_err(&s->spi->dev, "SPI transfer GPIO write failed\n");
+                return -EIO;
+        }
+        return 0;
+}
+
+/* GPIO direction to output function */
+static int max3107_gpio_direction_out(struct gpio_chip *chip, unsigned offset,
+                                        int value)
+{
+        struct max3107_port *s = container_of(chip, struct max3107_port, chip);
+        u16 buf[2];     /* Buffer for SPI transfers */
+
+        if (offset >= MAX3107_GPIO_COUNT) {
+                dev_err(&s->spi->dev, "Invalid GPIO\n");
+                return -EINVAL;
+        }
+
+        /* Read current GPIO configuration and data registers */
+        buf[0] = MAX3107_GPIOCFG_REG;
+        buf[1] = MAX3107_GPIODATA_REG;
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 4)) {
+                dev_err(&s->spi->dev, "SPI transfer gpio failed\n");
+                return -EIO;
+        }
+        buf[0] &= MAX3107_SPI_RX_DATA_MASK;
+        buf[1] &= MAX3107_SPI_RX_DATA_MASK;
+
+        /* Set GPIO to output */
+        buf[0] |= (0x0001 << offset);
+        /* Set value */
+        if (value)
+                buf[1] |= (0x0001 << offset);
+        else
+                buf[1] &= ~(0x0001 << offset);
+
+        /* Write new GPIO configuration and data register values */
+        buf[0] |= (MAX3107_WRITE_BIT | MAX3107_GPIOCFG_REG);
+        buf[1] |= (MAX3107_WRITE_BIT | MAX3107_GPIODATA_REG);
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, NULL, 4)) {
+                dev_err(&s->spi->dev,
+                        "SPI transfer for GPIO conf data w failed\n");
+                return -EIO;
+        }
+        return 0;
+}
+
+/* GPIO value query function */
+static int max3107_gpio_get(struct gpio_chip *chip, unsigned offset)
+{
+        struct max3107_port *s = container_of(chip, struct max3107_port, chip);
+        u16 buf[1];     /* Buffer for SPI transfer */
+
+        if (offset >= MAX3107_GPIO_COUNT) {
+                dev_err(&s->spi->dev, "Invalid GPIO\n");
+                return -EINVAL;
+        }
+
+        /* Read current GPIO data register */
+        buf[0] = MAX3107_GPIODATA_REG;
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 2)) {
+                dev_err(&s->spi->dev, "SPI transfer GPIO data r failed\n");
+                return -EIO;
+        }
+        buf[0] &= MAX3107_SPI_RX_DATA_MASK;
+
+        /* Return value */
+        return buf[0] & (0x0001 << offset);
+}
+
+/* GPIO value set function */
+static void max3107_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+{
+        struct max3107_port *s = container_of(chip, struct max3107_port, chip);
+        u16 buf[2];     /* Buffer for SPI transfers */
+
+        if (offset >= MAX3107_GPIO_COUNT) {
+                dev_err(&s->spi->dev, "Invalid GPIO\n");
+                return;
+        }
+
+        /* Read current GPIO configuration registers*/
+        buf[0] = MAX3107_GPIODATA_REG;
+        buf[1] = MAX3107_GPIOCFG_REG;
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 4)) {
+                dev_err(&s->spi->dev,
+                        "SPI transfer for GPIO data and config read failed\n");
+                return;
+        }
+        buf[0] &= MAX3107_SPI_RX_DATA_MASK;
+        buf[1] &= MAX3107_SPI_RX_DATA_MASK;
+
+        if (!(buf[1] & (0x0001 << offset))) {
+                /* Configured as input, can't set value */
+                dev_warn(&s->spi->dev,
+                                "Trying to set value for input GPIO\n");
+                return;
+        }
+
+        /* Set value */
+        if (value)
+                buf[0] |= (0x0001 << offset);
+        else
+                buf[0] &= ~(0x0001 << offset);
+
+        /* Write new GPIO data register value */
+        buf[0] |= (MAX3107_WRITE_BIT | MAX3107_GPIODATA_REG);
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, NULL, 2))
+                dev_err(&s->spi->dev, "SPI transfer GPIO data w failed\n");
+}
+
+/* GPIO chip data */
+static struct gpio_chip max3107_gpio_chip = {
+        .owner                  = THIS_MODULE,
+        .direction_input        = max3107_gpio_direction_in,
+        .direction_output       = max3107_gpio_direction_out,
+        .get                    = max3107_gpio_get,
+        .set                    = max3107_gpio_set,
+        .can_sleep              = 1,
+        .base                   = MAX3107_GPIO_BASE,
+        .ngpio                  = MAX3107_GPIO_COUNT,
+};
+
+/**
+ *      max3107_aava_reset      -       reset on AAVA systems
+ *      @spi: The SPI device we are probing
+ *
+ *      Reset the device ready for probing.
+ */
+
+static int max3107_aava_reset(struct spi_device *spi)
+{
+        /* Reset the chip */
+        if (gpio_request(MAX3107_RESET_GPIO, "max3107")) {
+                pr_err("Requesting RESET GPIO failed\n");
+                return -EIO;
+        }
+        if (gpio_direction_output(MAX3107_RESET_GPIO, 0)) {
+                pr_err("Setting RESET GPIO to 0 failed\n");
+                gpio_free(MAX3107_RESET_GPIO);
+                return -EIO;
+        }
+        msleep(MAX3107_RESET_DELAY);
+        if (gpio_direction_output(MAX3107_RESET_GPIO, 1)) {
+                pr_err("Setting RESET GPIO to 1 failed\n");
+                gpio_free(MAX3107_RESET_GPIO);
+                return -EIO;
+        }
+        gpio_free(MAX3107_RESET_GPIO);
+        msleep(MAX3107_WAKEUP_DELAY);
+        return 0;
+}
+
+static int max3107_aava_configure(struct max3107_port *s)
+{
+        int retval;
+
+        /* Initialize GPIO chip data */
+        s->chip = max3107_gpio_chip;
+        s->chip.label = s->spi->modalias;
+        s->chip.dev = &s->spi->dev;
+
+        /* Add GPIO chip */
+        retval = gpiochip_add(&s->chip);
+        if (retval) {
+                dev_err(&s->spi->dev, "Adding GPIO chip failed\n");
+                return retval;
+        }
+
+        /* Temporary fix for EV2 boot problems, set modem reset to 0 */
+        max3107_gpio_direction_out(&s->chip, 3, 0);
+        return 0;
+}
+
+#if 0
+/* This will get enabled once we have the board stuff merged for this
+   specific case */
+
+static const struct baud_table brg13_ext[] = {
+        { 300,    MAX3107_BRG13_B300 },
+        { 600,    MAX3107_BRG13_B600 },
+        { 1200,   MAX3107_BRG13_B1200 },
+        { 2400,   MAX3107_BRG13_B2400 },
+        { 4800,   MAX3107_BRG13_B4800 },
+        { 9600,   MAX3107_BRG13_B9600 },
+        { 19200,  MAX3107_BRG13_B19200 },
+        { 57600,  MAX3107_BRG13_B57600 },
+        { 115200, MAX3107_BRG13_B115200 },
+        { 230400, MAX3107_BRG13_B230400 },
+        { 460800, MAX3107_BRG13_B460800 },
+        { 921600, MAX3107_BRG13_B921600 },
+        { 0, 0 }
+};
+
+static void max3107_aava_init(struct max3107_port *s)
+{
+        /*override for AAVA SC specific*/
+        if (mrst_platform_id() == MRST_PLATFORM_AAVA_SC) {
+                if (get_koski_build_id() <= KOSKI_EV2)
+                        if (s->ext_clk) {
+                                s->brg_cfg = MAX3107_BRG13_B9600;
+                                s->baud_tbl = (struct baud_table *)brg13_ext;
+                        }
+        }
+}
+#endif
+
+static int __devexit max3107_aava_remove(struct spi_device *spi)
+{
+        struct max3107_port *s = dev_get_drvdata(&spi->dev);
+
+        /* Remove GPIO chip */
+        if (gpiochip_remove(&s->chip))
+                dev_warn(&spi->dev, "Removing GPIO chip failed\n");
+
+        /* Then do the default remove */
+        return max3107_remove(spi);
+}
+
+/* Platform data */
+static struct max3107_plat aava_plat_data = {
+        .loopback               = 0,
+        .ext_clk                = 1,
+/*      .init                   = max3107_aava_init, */
+        .configure              = max3107_aava_configure,
+        .hw_suspend             = max3107_hw_susp,
+        .polled_mode            = 0,
+        .poll_time              = 0,
+};
+
+
+static int __devinit max3107_probe_aava(struct spi_device *spi)
+{
+        int err = max3107_aava_reset(spi);
+        if (err < 0)
+                return err;
+        return max3107_probe(spi, &aava_plat_data);
+}
+
+/* Spi driver data */
+static struct spi_driver max3107_driver = {
+        .driver = {
+                .name           = "aava-max3107",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+        .probe          = max3107_probe_aava,
+        .remove         = __devexit_p(max3107_aava_remove),
+        .suspend        = max3107_suspend,
+        .resume         = max3107_resume,
+};
+
+/* Driver init function */
+static int __init max3107_init(void)
+{
+        return spi_register_driver(&max3107_driver);
+}
+
+/* Driver exit function */
+static void __exit max3107_exit(void)
+{
+        spi_unregister_driver(&max3107_driver);
+}
+
+module_init(max3107_init);
+module_exit(max3107_exit);
+
+MODULE_DESCRIPTION("MAX3107 driver");
+MODULE_AUTHOR("Aavamobile");
+MODULE_ALIAS("aava-max3107-spi");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/serial/max3107.c b/drivers/serial/max3107.c
new file mode 100644
index 000000000000..67283c1a57ff
--- /dev/null
+++ b/drivers/serial/max3107.c
@@ -0,0 +1,1197 @@
+/*
+ *  max3107.c - spi uart protocol driver for Maxim 3107
+ *  Based on max3100.c
+ *      by Christian Pellegrin <chripell@evolware.org>
+ *  and max3110.c
+ *      by Feng Tang <feng.tang@intel.com>
+ *
+ *  Copyright (C) Aavamobile 2009
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ */
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/serial_core.h>
+#include <linux/serial.h>
+#include <linux/gpio.h>
+#include <linux/spi/spi.h>
+#include <linux/freezer.h>
+#include "max3107.h"
+
+static const struct baud_table brg26_ext[] = {
+        { 300,    MAX3107_BRG26_B300 },
+        { 600,    MAX3107_BRG26_B600 },
+        { 1200,   MAX3107_BRG26_B1200 },
+        { 2400,   MAX3107_BRG26_B2400 },
+        { 4800,   MAX3107_BRG26_B4800 },
+        { 9600,   MAX3107_BRG26_B9600 },
+        { 19200,  MAX3107_BRG26_B19200 },
+        { 57600,  MAX3107_BRG26_B57600 },
+        { 115200, MAX3107_BRG26_B115200 },
+        { 230400, MAX3107_BRG26_B230400 },
+        { 460800, MAX3107_BRG26_B460800 },
+        { 921600, MAX3107_BRG26_B921600 },
+        { 0, 0 }
+};
+
+static const struct baud_table brg13_int[] = {
+        { 300,    MAX3107_BRG13_IB300 },
+        { 600,    MAX3107_BRG13_IB600 },
+        { 1200,   MAX3107_BRG13_IB1200 },
+        { 2400,   MAX3107_BRG13_IB2400 },
+        { 4800,   MAX3107_BRG13_IB4800 },
+        { 9600,   MAX3107_BRG13_IB9600 },
+        { 19200,  MAX3107_BRG13_IB19200 },
+        { 57600,  MAX3107_BRG13_IB57600 },
+        { 115200, MAX3107_BRG13_IB115200 },
+        { 230400, MAX3107_BRG13_IB230400 },
+        { 460800, MAX3107_BRG13_IB460800 },
+        { 921600, MAX3107_BRG13_IB921600 },
+        { 0, 0 }
+};
+
+static u32 get_new_brg(int baud, struct max3107_port *s)
+{
+        int i;
+        const struct baud_table *baud_tbl = s->baud_tbl;
+
+        for (i = 0; i < 13; i++) {
+                if (baud == baud_tbl[i].baud)
+                        return baud_tbl[i].new_brg;
+        }
+
+        return 0;
+}
+
+/* Perform SPI transfer for write/read of device register(s) */
+int max3107_rw(struct max3107_port *s, u8 *tx, u8 *rx, int len)
+{
+        struct spi_message spi_msg;
+        struct spi_transfer spi_xfer;
+
+        /* Initialize SPI ,message */
+        spi_message_init(&spi_msg);
+
+        /* Initialize SPI transfer */
+        memset(&spi_xfer, 0, sizeof spi_xfer);
+        spi_xfer.len = len;
+        spi_xfer.tx_buf = tx;
+        spi_xfer.rx_buf = rx;
+        spi_xfer.speed_hz = MAX3107_SPI_SPEED;
+
+        /* Add SPI transfer to SPI message */
+        spi_message_add_tail(&spi_xfer, &spi_msg);
+
+#ifdef DBG_TRACE_SPI_DATA
+        {
+                int i;
+                pr_info("tx len %d:\n", spi_xfer.len);
+                for (i = 0 ; i < spi_xfer.len && i < 32 ; i++)
+                        pr_info(" %x", ((u8 *)spi_xfer.tx_buf)[i]);
+                pr_info("\n");
+        }
+#endif
+
+        /* Perform synchronous SPI transfer */
+        if (spi_sync(s->spi, &spi_msg)) {
+                dev_err(&s->spi->dev, "spi_sync failure\n");
+                return -EIO;
+        }
+
+#ifdef DBG_TRACE_SPI_DATA
+        if (spi_xfer.rx_buf) {
+                int i;
+                pr_info("rx len %d:\n", spi_xfer.len);
+                for (i = 0 ; i < spi_xfer.len && i < 32 ; i++)
+                        pr_info(" %x", ((u8 *)spi_xfer.rx_buf)[i]);
+                pr_info("\n");
+        }
+#endif
+        return 0;
+}
+EXPORT_SYMBOL_GPL(max3107_rw);
+
+/* Puts received data to circular buffer */
+static void put_data_to_circ_buf(struct max3107_port *s, unsigned char *data,
+                                        int len)
+{
+        struct uart_port *port = &s->port;
+        struct tty_struct *tty;
+
+        if (!port->state)
+                return;
+
+        tty = port->state->port.tty;
+        if (!tty)
+                return;
+
+        /* Insert received data */
+        tty_insert_flip_string(tty, data, len);
+        /* Update RX counter */
+        port->icount.rx += len;
+}
+
+/* Handle data receiving */
+static void max3107_handlerx(struct max3107_port *s, u16 rxlvl)
+{
+        int i;
+        int j;
+        int len;                                /* SPI transfer buffer length */
+        u16 *buf;
+        u8 *valid_str;
+
+        if (!s->rx_enabled)
+                /* RX is disabled */
+                return;
+
+        if (rxlvl == 0) {
+                /* RX fifo is empty */
+                return;
+        } else if (rxlvl >= MAX3107_RX_FIFO_SIZE) {
+                dev_warn(&s->spi->dev, "Possible RX FIFO overrun %d\n", rxlvl);
+                /* Ensure sanity of RX level */
+                rxlvl = MAX3107_RX_FIFO_SIZE;
+        }
+        if ((s->rxbuf == 0) || (s->rxstr == 0)) {
+                dev_warn(&s->spi->dev, "Rx buffer/str isn't ready\n");
+                return;
+        }
+        buf = s->rxbuf;
+        valid_str = s->rxstr;
+        while (rxlvl) {
+                pr_debug("rxlvl %d\n", rxlvl);
+                /* Clear buffer */
+                memset(buf, 0, sizeof(u16) * (MAX3107_RX_FIFO_SIZE + 2));
+                len = 0;
+                if (s->irqen_reg & MAX3107_IRQ_RXFIFO_BIT) {
+                        /* First disable RX FIFO interrupt */
+                        pr_debug("Disabling RX INT\n");
+                        buf[0] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG);
+                        s->irqen_reg &= ~MAX3107_IRQ_RXFIFO_BIT;
+                        buf[0] |= s->irqen_reg;
+                        len++;
+                }
+                /* Just increase the length by amount of words in FIFO since
+                 * buffer was zeroed and SPI transfer of 0x0000 means reading
+                 * from RX FIFO
+                 */
+                len += rxlvl;
+                /* Append RX level query */
+                buf[len] = MAX3107_RXFIFOLVL_REG;
+                len++;
+
+                /* Perform the SPI transfer */
+                if (max3107_rw(s, (u8 *)buf, (u8 *)buf, len * 2)) {
+                        dev_err(&s->spi->dev, "SPI transfer for RX h failed\n");
+                        return;
+                }
+
+                /* Skip RX FIFO interrupt disabling word if it was added */
+                j = ((len - 1) - rxlvl);
+                /* Read received words */
+                for (i = 0; i < rxlvl; i++, j++)
+                        valid_str[i] = (u8)buf[j];
+                put_data_to_circ_buf(s, valid_str, rxlvl);
+                /* Get new RX level */
+                rxlvl = (buf[len - 1] & MAX3107_SPI_RX_DATA_MASK);
+        }
+
+        if (s->rx_enabled) {
+                /* RX still enabled, re-enable RX FIFO interrupt */
+                pr_debug("Enabling RX INT\n");
+                buf[0] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG);
+                s->irqen_reg |= MAX3107_IRQ_RXFIFO_BIT;
+                buf[0] |= s->irqen_reg;
+                if (max3107_rw(s, (u8 *)buf, NULL, 2))
+                        dev_err(&s->spi->dev, "RX FIFO INT enabling failed\n");
+        }
+
+        /* Push the received data to receivers */
+        if (s->port.state->port.tty)
+                tty_flip_buffer_push(s->port.state->port.tty);
+}
+
+
+/* Handle data sending */
+static void max3107_handletx(struct max3107_port *s)
+{
+        struct circ_buf *xmit = &s->port.state->xmit;
+        int i;
+        unsigned long flags;
+        int len;                                /* SPI transfer buffer length */
+        u16 *buf;
+
+        if (!s->tx_fifo_empty)
+                /* Don't send more data before previous data is sent */
+                return;
+
+        if (uart_circ_empty(xmit) || uart_tx_stopped(&s->port))
+                /* No data to send or TX is stopped */
+                return;
+
+        if (!s->txbuf) {
+                dev_warn(&s->spi->dev, "Txbuf isn't ready\n");
+                return;
+        }
+        buf = s->txbuf;
+        /* Get length of data pending in circular buffer */
+        len = uart_circ_chars_pending(xmit);
+        if (len) {
+                /* Limit to size of TX FIFO */
+                if (len > MAX3107_TX_FIFO_SIZE)
+                        len = MAX3107_TX_FIFO_SIZE;
+
+                pr_debug("txlen %d\n", len);
+
+                /* Update TX counter */
+                s->port.icount.tx += len;
+
+                /* TX FIFO will no longer be empty */
+                s->tx_fifo_empty = 0;
+
+                i = 0;
+                if (s->irqen_reg & MAX3107_IRQ_TXEMPTY_BIT) {
+                        /* First disable TX empty interrupt */
+                        pr_debug("Disabling TE INT\n");
+                        buf[i] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG);
+                        s->irqen_reg &= ~MAX3107_IRQ_TXEMPTY_BIT;
+                        buf[i] |= s->irqen_reg;
+                        i++;
+                        len++;
+                }
+                /* Add data to send */
+                spin_lock_irqsave(&s->port.lock, flags);
+                for ( ; i < len ; i++) {
+                        buf[i] = (MAX3107_WRITE_BIT | MAX3107_THR_REG);
+                        buf[i] |= ((u16)xmit->buf[xmit->tail] &
+                                                MAX3107_SPI_TX_DATA_MASK);
+                        xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                }
+                spin_unlock_irqrestore(&s->port.lock, flags);
+                if (!(s->irqen_reg & MAX3107_IRQ_TXEMPTY_BIT)) {
+                        /* Enable TX empty interrupt */
+                        pr_debug("Enabling TE INT\n");
+                        buf[i] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG);
+                        s->irqen_reg |= MAX3107_IRQ_TXEMPTY_BIT;
+                        buf[i] |= s->irqen_reg;
+                        i++;
+                        len++;
+                }
+                if (!s->tx_enabled) {
+                        /* Enable TX */
+                        pr_debug("Enable TX\n");
+                        buf[i] = (MAX3107_WRITE_BIT | MAX3107_MODE1_REG);
+                        spin_lock_irqsave(&s->data_lock, flags);
+                        s->mode1_reg &= ~MAX3107_MODE1_TXDIS_BIT;
+                        buf[i] |= s->mode1_reg;
+                        spin_unlock_irqrestore(&s->data_lock, flags);
+                        s->tx_enabled = 1;
+                        i++;
+                        len++;
+                }
+
+                /* Perform the SPI transfer */
+                if (max3107_rw(s, (u8 *)buf, NULL, len*2)) {
+                        dev_err(&s->spi->dev,
+                                "SPI transfer TX handling failed\n");
+                        return;
+                }
+        }
+
+        /* Indicate wake up if circular buffer is getting low on data */
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(&s->port);
+
+}
+
+/* Handle interrupts
+ * Also reads and returns current RX FIFO level
+ */
+static u16 handle_interrupt(struct max3107_port *s)
+{
+        u16 buf[4];     /* Buffer for SPI transfers */
+        u8 irq_status;
+        u16 rx_level;
+        unsigned long flags;
+
+        /* Read IRQ status register */
+        buf[0] = MAX3107_IRQSTS_REG;
+        /* Read status IRQ status register */
+        buf[1] = MAX3107_STS_IRQSTS_REG;
+        /* Read LSR IRQ status register */
+        buf[2] = MAX3107_LSR_IRQSTS_REG;
+        /* Query RX level */
+        buf[3] = MAX3107_RXFIFOLVL_REG;
+
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 8)) {
+                dev_err(&s->spi->dev,
+                        "SPI transfer for INTR handling failed\n");
+                return 0;
+        }
+
+        irq_status = (u8)buf[0];
+        pr_debug("IRQSTS %x\n", irq_status);
+        rx_level = (buf[3] & MAX3107_SPI_RX_DATA_MASK);
+
+        if (irq_status & MAX3107_IRQ_LSR_BIT) {
+                /* LSR interrupt */
+                if (buf[2] & MAX3107_LSR_RXTO_BIT)
+                        /* RX timeout interrupt,
+                         * handled by normal RX handling
+                         */
+                        pr_debug("RX TO INT\n");
+        }
+
+        if (irq_status & MAX3107_IRQ_TXEMPTY_BIT) {
+                /* Tx empty interrupt,
+                 * disable TX and set tx_fifo_empty flag
+                 */
+                pr_debug("TE INT, disabling TX\n");
+                buf[0] = (MAX3107_WRITE_BIT | MAX3107_MODE1_REG);
+                spin_lock_irqsave(&s->data_lock, flags);
+                s->mode1_reg |= MAX3107_MODE1_TXDIS_BIT;
+                buf[0] |= s->mode1_reg;
+                spin_unlock_irqrestore(&s->data_lock, flags);
+                if (max3107_rw(s, (u8 *)buf, NULL, 2))
+                        dev_err(&s->spi->dev, "SPI transfer TX dis failed\n");
+                s->tx_enabled = 0;
+                s->tx_fifo_empty = 1;
+        }
+
+        if (irq_status & MAX3107_IRQ_RXFIFO_BIT)
+                /* RX FIFO interrupt,
+                 * handled by normal RX handling
+                 */
+                pr_debug("RFIFO INT\n");
+
+        /* Return RX level */
+        return rx_level;
+}
+
+/* Trigger work thread*/
+static void max3107_dowork(struct max3107_port *s)
+{
+        if (!work_pending(&s->work) && !freezing(current) && !s->suspended)
+                queue_work(s->workqueue, &s->work);
+        else
+                dev_warn(&s->spi->dev, "interrup isn't serviced normally!\n");
+}
+
+/* Work thread */
+static void max3107_work(struct work_struct *w)
+{
+        struct max3107_port *s = container_of(w, struct max3107_port, work);
+        u16 rxlvl = 0;
+        int len;        /* SPI transfer buffer length */
+        u16 buf[5];     /* Buffer for SPI transfers */
+        unsigned long flags;
+
+        /* Start by reading current RX FIFO level */
+        buf[0] = MAX3107_RXFIFOLVL_REG;
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 2)) {
+                dev_err(&s->spi->dev, "SPI transfer RX lev failed\n");
+                rxlvl = 0;
+        } else {
+                rxlvl = (buf[0] & MAX3107_SPI_RX_DATA_MASK);
+        }
+
+        do {
+                pr_debug("rxlvl %d\n", rxlvl);
+
+                /* Handle RX */
+                max3107_handlerx(s, rxlvl);
+                rxlvl = 0;
+
+                if (s->handle_irq) {
+                        /* Handle pending interrupts
+                         * We also get new RX FIFO level since new data may
+                         * have been received while pushing received data to
+                         * receivers
+                         */
+                        s->handle_irq = 0;
+                        rxlvl = handle_interrupt(s);
+                }
+
+                /* Handle TX */
+                max3107_handletx(s);
+
+                /* Handle configuration changes */
+                len = 0;
+                spin_lock_irqsave(&s->data_lock, flags);
+                if (s->mode1_commit) {
+                        pr_debug("mode1_commit\n");
+                        buf[len] = (MAX3107_WRITE_BIT | MAX3107_MODE1_REG);
+                        buf[len++] |= s->mode1_reg;
+                        s->mode1_commit = 0;
+                }
+                if (s->lcr_commit) {
+                        pr_debug("lcr_commit\n");
+                        buf[len] = (MAX3107_WRITE_BIT | MAX3107_LCR_REG);
+                        buf[len++] |= s->lcr_reg;
+                        s->lcr_commit = 0;
+                }
+                if (s->brg_commit) {
+                        pr_debug("brg_commit\n");
+                        buf[len] = (MAX3107_WRITE_BIT | MAX3107_BRGDIVMSB_REG);
+                        buf[len++] |= ((s->brg_cfg >> 16) &
+                                                MAX3107_SPI_TX_DATA_MASK);
+                        buf[len] = (MAX3107_WRITE_BIT | MAX3107_BRGDIVLSB_REG);
+                        buf[len++] |= ((s->brg_cfg >> 8) &
+                                                MAX3107_SPI_TX_DATA_MASK);
+                        buf[len] = (MAX3107_WRITE_BIT | MAX3107_BRGCFG_REG);
+                        buf[len++] |= ((s->brg_cfg) & 0xff);
+                        s->brg_commit = 0;
+                }
+                spin_unlock_irqrestore(&s->data_lock, flags);
+
+                if (len > 0) {
+                        if (max3107_rw(s, (u8 *)buf, NULL, len * 2))
+                                dev_err(&s->spi->dev,
+                                        "SPI transfer config failed\n");
+                }
+
+                /* Reloop if interrupt handling indicated data in RX FIFO */
+        } while (rxlvl);
+
+}
+
+/* Set sleep mode */
+static void max3107_set_sleep(struct max3107_port *s, int mode)
+{
+        u16 buf[1];     /* Buffer for SPI transfer */
+        unsigned long flags;
+        pr_debug("enter, mode %d\n", mode);
+
+        buf[0] = (MAX3107_WRITE_BIT | MAX3107_MODE1_REG);
+        spin_lock_irqsave(&s->data_lock, flags);
+        switch (mode) {
+        case MAX3107_DISABLE_FORCED_SLEEP:
+                        s->mode1_reg &= ~MAX3107_MODE1_FORCESLEEP_BIT;
+                        break;
+        case MAX3107_ENABLE_FORCED_SLEEP:
+                        s->mode1_reg |= MAX3107_MODE1_FORCESLEEP_BIT;
+                        break;
+        case MAX3107_DISABLE_AUTOSLEEP:
+                        s->mode1_reg &= ~MAX3107_MODE1_AUTOSLEEP_BIT;
+                        break;
+        case MAX3107_ENABLE_AUTOSLEEP:
+                        s->mode1_reg |= MAX3107_MODE1_AUTOSLEEP_BIT;
+                        break;
+        default:
+                spin_unlock_irqrestore(&s->data_lock, flags);
+                dev_warn(&s->spi->dev, "invalid sleep mode\n");
+                return;
+        }
+        buf[0] |= s->mode1_reg;
+        spin_unlock_irqrestore(&s->data_lock, flags);
+
+        if (max3107_rw(s, (u8 *)buf, NULL, 2))
+                dev_err(&s->spi->dev, "SPI transfer sleep mode failed\n");
+
+        if (mode == MAX3107_DISABLE_AUTOSLEEP ||
+                        mode == MAX3107_DISABLE_FORCED_SLEEP)
+                msleep(MAX3107_WAKEUP_DELAY);
+}
+
+/* Perform full register initialization */
+static void max3107_register_init(struct max3107_port *s)
+{
+        u16 buf[11];    /* Buffer for SPI transfers */
+
+        /* 1. Configure baud rate, 9600 as default */
+        s->baud = 9600;
+        /* the below is default*/
+        if (s->ext_clk) {
+                s->brg_cfg = MAX3107_BRG26_B9600;
+                s->baud_tbl = (struct baud_table *)brg26_ext;
+        } else {
+                s->brg_cfg = MAX3107_BRG13_IB9600;
+                s->baud_tbl = (struct baud_table *)brg13_int;
+        }
+
+        if (s->pdata->init)
+                s->pdata->init(s);
+
+        buf[0] = (MAX3107_WRITE_BIT | MAX3107_BRGDIVMSB_REG)
+                | ((s->brg_cfg >> 16) & MAX3107_SPI_TX_DATA_MASK);
+        buf[1] = (MAX3107_WRITE_BIT | MAX3107_BRGDIVLSB_REG)
+                | ((s->brg_cfg >> 8) & MAX3107_SPI_TX_DATA_MASK);
+        buf[2] = (MAX3107_WRITE_BIT | MAX3107_BRGCFG_REG)
+                | ((s->brg_cfg) & 0xff);
+
+        /* 2. Configure LCR register, 8N1 mode by default */
+        s->lcr_reg = MAX3107_LCR_WORD_LEN_8;
+        buf[3] = (MAX3107_WRITE_BIT | MAX3107_LCR_REG)
+                | s->lcr_reg;
+
+        /* 3. Configure MODE 1 register */
+        s->mode1_reg = 0;
+        /* Enable IRQ pin */
+        s->mode1_reg |= MAX3107_MODE1_IRQSEL_BIT;
+        /* Disable TX */
+        s->mode1_reg |= MAX3107_MODE1_TXDIS_BIT;
+        s->tx_enabled = 0;
+        /* RX is enabled */
+        s->rx_enabled = 1;
+        buf[4] = (MAX3107_WRITE_BIT | MAX3107_MODE1_REG)
+                | s->mode1_reg;
+
+        /* 4. Configure MODE 2 register */
+        buf[5] = (MAX3107_WRITE_BIT | MAX3107_MODE2_REG);
+        if (s->loopback) {
+                /* Enable loopback */
+                buf[5] |= MAX3107_MODE2_LOOPBACK_BIT;
+        }
+        /* Reset FIFOs */
+        buf[5] |= MAX3107_MODE2_FIFORST_BIT;
+        s->tx_fifo_empty = 1;
+
+        /* 5. Configure FIFO trigger level register */
+        buf[6] = (MAX3107_WRITE_BIT | MAX3107_FIFOTRIGLVL_REG);
+        /* RX FIFO trigger for 16 words, TX FIFO trigger not used */
+        buf[6] |= (MAX3107_FIFOTRIGLVL_RX(16) | MAX3107_FIFOTRIGLVL_TX(0));
+
+        /* 6. Configure flow control levels */
+        buf[7] = (MAX3107_WRITE_BIT | MAX3107_FLOWLVL_REG);
+        /* Flow control halt level 96, resume level 48 */
+        buf[7] |= (MAX3107_FLOWLVL_RES(48) | MAX3107_FLOWLVL_HALT(96));
+
+        /* 7. Configure flow control */
+        buf[8] = (MAX3107_WRITE_BIT | MAX3107_FLOWCTRL_REG);
+        /* Enable auto CTS and auto RTS flow control */
+        buf[8] |= (MAX3107_FLOWCTRL_AUTOCTS_BIT | MAX3107_FLOWCTRL_AUTORTS_BIT);
+
+        /* 8. Configure RX timeout register */
+        buf[9] = (MAX3107_WRITE_BIT | MAX3107_RXTO_REG);
+        /* Timeout after 48 character intervals */
+        buf[9] |= 0x0030;
+
+        /* 9. Configure LSR interrupt enable register */
+        buf[10] = (MAX3107_WRITE_BIT | MAX3107_LSR_IRQEN_REG);
+        /* Enable RX timeout interrupt */
+        buf[10] |= MAX3107_LSR_RXTO_BIT;
+
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, NULL, 22))
+                dev_err(&s->spi->dev, "SPI transfer for init failed\n");
+
+        /* 10. Clear IRQ status register by reading it */
+        buf[0] = MAX3107_IRQSTS_REG;
+
+        /* 11. Configure interrupt enable register */
+        /* Enable LSR interrupt */
+        s->irqen_reg = MAX3107_IRQ_LSR_BIT;
+        /* Enable RX FIFO interrupt */
+        s->irqen_reg |= MAX3107_IRQ_RXFIFO_BIT;
+        buf[1] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG)
+                | s->irqen_reg;
+
+        /* 12. Clear FIFO reset that was set in step 6 */
+        buf[2] = (MAX3107_WRITE_BIT | MAX3107_MODE2_REG);
+        if (s->loopback) {
+                /* Keep loopback enabled */
+                buf[2] |= MAX3107_MODE2_LOOPBACK_BIT;
+        }
+
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 6))
+                dev_err(&s->spi->dev, "SPI transfer for init failed\n");
+
+}
+
+/* IRQ handler */
+static irqreturn_t max3107_irq(int irqno, void *dev_id)
+{
+        struct max3107_port *s = dev_id;
+
+        if (irqno != s->spi->irq) {
+                /* Unexpected IRQ */
+                return IRQ_NONE;
+        }
+
+        /* Indicate irq */
+        s->handle_irq = 1;
+
+        /* Trigger work thread */
+        max3107_dowork(s);
+
+        return IRQ_HANDLED;
+}
+
+/* HW suspension function
+ *
+ * Currently autosleep is used to decrease current consumption, alternative
+ * approach would be to set the chip to reset mode if UART is not being
+ * used but that would mess the GPIOs
+ *
+ */
+void max3107_hw_susp(struct max3107_port *s, int suspend)
+{
+        pr_debug("enter, suspend %d\n", suspend);
+
+        if (suspend) {
+                /* Suspend requested,
+                 * enable autosleep to decrease current consumption
+                 */
+                s->suspended = 1;
+                max3107_set_sleep(s, MAX3107_ENABLE_AUTOSLEEP);
+        } else {
+                /* Resume requested,
+                 * disable autosleep
+                 */
+                s->suspended = 0;
+                max3107_set_sleep(s, MAX3107_DISABLE_AUTOSLEEP);
+        }
+}
+EXPORT_SYMBOL_GPL(max3107_hw_susp);
+
+/* Modem status IRQ enabling */
+static void max3107_enable_ms(struct uart_port *port)
+{
+        /* Modem status not supported */
+}
+
+/* Data send function */
+static void max3107_start_tx(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+
+        /* Trigger work thread for sending data */
+        max3107_dowork(s);
+}
+
+/* Function for checking that there is no pending transfers */
+static unsigned int max3107_tx_empty(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+
+        pr_debug("returning %d\n",
+                  (s->tx_fifo_empty && uart_circ_empty(&s->port.state->xmit)));
+        return s->tx_fifo_empty && uart_circ_empty(&s->port.state->xmit);
+}
+
+/* Function for stopping RX */
+static void max3107_stop_rx(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+        unsigned long flags;
+
+        /* Set RX disabled in MODE 1 register */
+        spin_lock_irqsave(&s->data_lock, flags);
+        s->mode1_reg |= MAX3107_MODE1_RXDIS_BIT;
+        s->mode1_commit = 1;
+        spin_unlock_irqrestore(&s->data_lock, flags);
+        /* Set RX disabled */
+        s->rx_enabled = 0;
+        /* Trigger work thread for doing the actual configuration change */
+        max3107_dowork(s);
+}
+
+/* Function for returning control pin states */
+static unsigned int max3107_get_mctrl(struct uart_port *port)
+{
+        /* DCD and DSR are not wired and CTS/RTS is handled automatically
+         * so just indicate DSR and CAR asserted
+         */
+        return TIOCM_DSR | TIOCM_CAR;
+}
+
+/* Function for setting control pin states */
+static void max3107_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+        /* DCD and DSR are not wired and CTS/RTS is hadnled automatically
+         * so do nothing
+         */
+}
+
+/* Function for configuring UART parameters */
+static void max3107_set_termios(struct uart_port *port,
+                                struct ktermios *termios,
+                                struct ktermios *old)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+        struct tty_struct *tty;
+        int baud;
+        u16 new_lcr = 0;
+        u32 new_brg = 0;
+        unsigned long flags;
+
+        if (!port->state)
+                return;
+
+        tty = port->state->port.tty;
+        if (!tty)
+                return;
+
+        /* Get new LCR register values */
+        /* Word size */
+        if ((termios->c_cflag & CSIZE) == CS7)
+                new_lcr |= MAX3107_LCR_WORD_LEN_7;
+        else
+                new_lcr |= MAX3107_LCR_WORD_LEN_8;
+
+        /* Parity */
+        if (termios->c_cflag & PARENB) {
+                new_lcr |= MAX3107_LCR_PARITY_BIT;
+                if (!(termios->c_cflag & PARODD))
+                        new_lcr |= MAX3107_LCR_EVENPARITY_BIT;
+        }
+
+        /* Stop bits */
+        if (termios->c_cflag & CSTOPB) {
+                /* 2 stop bits */
+                new_lcr |= MAX3107_LCR_STOPLEN_BIT;
+        }
+
+        /* Mask termios capabilities we don't support */
+        termios->c_cflag &= ~CMSPAR;
+
+        /* Set status ignore mask */
+        s->port.ignore_status_mask = 0;
+        if (termios->c_iflag & IGNPAR)
+                s->port.ignore_status_mask |= MAX3107_ALL_ERRORS;
+
+        /* Set low latency to immediately handle pushed data */
+        s->port.state->port.tty->low_latency = 1;
+
+        /* Get new baud rate generator configuration */
+        baud = tty_get_baud_rate(tty);
+
+        spin_lock_irqsave(&s->data_lock, flags);
+        new_brg = get_new_brg(baud, s);
+        /* if can't find the corrent config, use previous */
+        if (!new_brg) {
+                baud = s->baud;
+                new_brg = s->brg_cfg;
+        }
+        spin_unlock_irqrestore(&s->data_lock, flags);
+        tty_termios_encode_baud_rate(termios, baud, baud);
+        s->baud = baud;
+
+        /* Update timeout according to new baud rate */
+        uart_update_timeout(port, termios->c_cflag, baud);
+
+        spin_lock_irqsave(&s->data_lock, flags);
+        if (s->lcr_reg != new_lcr) {
+                s->lcr_reg = new_lcr;
+                s->lcr_commit = 1;
+        }
+        if (s->brg_cfg != new_brg) {
+                s->brg_cfg = new_brg;
+                s->brg_commit = 1;
+        }
+        spin_unlock_irqrestore(&s->data_lock, flags);
+
+        /* Trigger work thread for doing the actual configuration change */
+        max3107_dowork(s);
+}
+
+/* Port shutdown function */
+static void max3107_shutdown(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+
+        if (s->suspended && s->pdata->hw_suspend)
+                s->pdata->hw_suspend(s, 0);
+
+        /* Free the interrupt */
+        free_irq(s->spi->irq, s);
+
+        if (s->workqueue) {
+                /* Flush and destroy work queue */
+                flush_workqueue(s->workqueue);
+                destroy_workqueue(s->workqueue);
+                s->workqueue = NULL;
+        }
+
+        /* Suspend HW */
+        if (s->pdata->hw_suspend)
+                s->pdata->hw_suspend(s, 1);
+}
+
+/* Port startup function */
+static int max3107_startup(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+
+        /* Initialize work queue */
+        s->workqueue = create_freezeable_workqueue("max3107");
+        if (!s->workqueue) {
+                dev_err(&s->spi->dev, "Workqueue creation failed\n");
+                return -EBUSY;
+        }
+        INIT_WORK(&s->work, max3107_work);
+
+        /* Setup IRQ */
+        if (request_irq(s->spi->irq, max3107_irq, IRQF_TRIGGER_FALLING,
+                        "max3107", s)) {
+                dev_err(&s->spi->dev, "IRQ reguest failed\n");
+                destroy_workqueue(s->workqueue);
+                s->workqueue = NULL;
+                return -EBUSY;
+        }
+
+        /* Resume HW */
+        if (s->pdata->hw_suspend)
+                s->pdata->hw_suspend(s, 0);
+
+        /* Init registers */
+        max3107_register_init(s);
+
+        return 0;
+}
+
+/* Port type function */
+static const char *max3107_type(struct uart_port *port)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+        return s->spi->modalias;
+}
+
+/* Port release function */
+static void max3107_release_port(struct uart_port *port)
+{
+        /* Do nothing */
+}
+
+/* Port request function */
+static int max3107_request_port(struct uart_port *port)
+{
+        /* Do nothing */
+        return 0;
+}
+
+/* Port config function */
+static void max3107_config_port(struct uart_port *port, int flags)
+{
+        struct max3107_port *s = container_of(port, struct max3107_port, port);
+        s->port.type = PORT_MAX3107;
+}
+
+/* Port verify function */
+static int max3107_verify_port(struct uart_port *port,
+                                struct serial_struct *ser)
+{
+        if (ser->type == PORT_UNKNOWN || ser->type == PORT_MAX3107)
+                return 0;
+
+        return -EINVAL;
+}
+
+/* Port stop TX function */
+static void max3107_stop_tx(struct uart_port *port)
+{
+        /* Do nothing */
+}
+
+/* Port break control function */
+static void max3107_break_ctl(struct uart_port *port, int break_state)
+{
+        /* We don't support break control, do nothing */
+}
+
+
+/* Port functions */
+static struct uart_ops max3107_ops = {
+        .tx_empty       = max3107_tx_empty,
+        .set_mctrl      = max3107_set_mctrl,
+        .get_mctrl      = max3107_get_mctrl,
+        .stop_tx        = max3107_stop_tx,
+        .start_tx       = max3107_start_tx,
+        .stop_rx        = max3107_stop_rx,
+        .enable_ms      = max3107_enable_ms,
+        .break_ctl      = max3107_break_ctl,
+        .startup        = max3107_startup,
+        .shutdown       = max3107_shutdown,
+        .set_termios    = max3107_set_termios,
+        .type           = max3107_type,
+        .release_port   = max3107_release_port,
+        .request_port   = max3107_request_port,
+        .config_port    = max3107_config_port,
+        .verify_port    = max3107_verify_port,
+};
+
+/* UART driver data */
+static struct uart_driver max3107_uart_driver = {
+        .owner          = THIS_MODULE,
+        .driver_name    = "ttyMAX",
+        .dev_name       = "ttyMAX",
+        .nr             = 1,
+};
+
+static int driver_registered = 0;
+
+
+
+/* 'Generic' platform data */
+static struct max3107_plat generic_plat_data = {
+        .loopback               = 0,
+        .ext_clk                = 1,
+        .hw_suspend             = max3107_hw_susp,
+        .polled_mode            = 0,
+        .poll_time              = 0,
+};
+
+
+/*******************************************************************/
+
+/**
+ *      max3107_probe           -       SPI bus probe entry point
+ *      @spi: the spi device
+ *
+ *      SPI wants us to probe this device and if appropriate claim it.
+ *      Perform any platform specific requirements and then initialise
+ *      the device.
+ */
+
+int max3107_probe(struct spi_device *spi, struct max3107_plat *pdata)
+{
+        struct max3107_port *s;
+        u16 buf[2];     /* Buffer for SPI transfers */
+        int retval;
+
+        pr_info("enter max3107 probe\n");
+
+        /* Allocate port structure */
+        s = kzalloc(sizeof(*s), GFP_KERNEL);
+        if (!s) {
+                pr_err("Allocating port structure failed\n");
+                return -ENOMEM;
+        }
+
+        s->pdata = pdata;
+
+        /* SPI Rx buffer
+         * +2 for RX FIFO interrupt
+         * disabling and RX level query
+         */
+        s->rxbuf = kzalloc(sizeof(u16) * (MAX3107_RX_FIFO_SIZE+2), GFP_KERNEL);
+        if (!s->rxbuf) {
+                pr_err("Allocating RX buffer failed\n");
+                return -ENOMEM;
+        }
+        s->rxstr = kzalloc(sizeof(u8) * MAX3107_RX_FIFO_SIZE, GFP_KERNEL);
+        if (!s->rxstr) {
+                pr_err("Allocating RX buffer failed\n");
+                return -ENOMEM;
+        }
+        /* SPI Tx buffer
+         * SPI transfer buffer
+         * +3 for TX FIFO empty
+         * interrupt disabling and
+         * enabling and TX enabling
+         */
+        s->txbuf = kzalloc(sizeof(u16) * MAX3107_TX_FIFO_SIZE + 3, GFP_KERNEL);
+        if (!s->txbuf) {
+                pr_err("Allocating TX buffer failed\n");
+                return -ENOMEM;
+        }
+        /* Initialize shared data lock */
+        spin_lock_init(&s->data_lock);
+
+        /* SPI intializations */
+        dev_set_drvdata(&spi->dev, s);
+        spi->mode = SPI_MODE_0;
+        spi->dev.platform_data = pdata;
+        spi->bits_per_word = 16;
+        s->ext_clk = pdata->ext_clk;
+        s->loopback = pdata->loopback;
+        spi_setup(spi);
+        s->spi = spi;
+
+        /* Check REV ID to ensure we are talking to what we expect */
+        buf[0] = MAX3107_REVID_REG;
+        if (max3107_rw(s, (u8 *)buf, (u8 *)buf, 2)) {
+                dev_err(&s->spi->dev, "SPI transfer for REVID read failed\n");
+                return -EIO;
+        }
+        if ((buf[0] & MAX3107_SPI_RX_DATA_MASK) != MAX3107_REVID1 &&
+                (buf[0] & MAX3107_SPI_RX_DATA_MASK) != MAX3107_REVID2) {
+                dev_err(&s->spi->dev, "REVID %x does not match\n",
+                                (buf[0] & MAX3107_SPI_RX_DATA_MASK));
+                return -ENODEV;
+        }
+
+        /* Disable all interrupts */
+        buf[0] = (MAX3107_WRITE_BIT | MAX3107_IRQEN_REG | 0x0000);
+        buf[0] |= 0x0000;
+
+        /* Configure clock source */
+        buf[1] = (MAX3107_WRITE_BIT | MAX3107_CLKSRC_REG);
+        if (s->ext_clk) {
+                /* External clock */
+                buf[1] |= MAX3107_CLKSRC_EXTCLK_BIT;
+        }
+
+        /* PLL bypass ON */
+        buf[1] |= MAX3107_CLKSRC_PLLBYP_BIT;
+
+        /* Perform SPI transfer */
+        if (max3107_rw(s, (u8 *)buf, NULL, 4)) {
+                dev_err(&s->spi->dev, "SPI transfer for init failed\n");
+                return -EIO;
+        }
+
+        /* Register UART driver */
+        if (!driver_registered) {
+                retval = uart_register_driver(&max3107_uart_driver);
+                if (retval) {
+                        dev_err(&s->spi->dev, "Registering UART driver failed\n");
+                        return retval;
+                }
+                driver_registered = 1;
+        }
+
+        /* Initialize UART port data */
+        s->port.fifosize = 128;
+        s->port.ops = &max3107_ops;
+        s->port.line = 0;
+        s->port.dev = &spi->dev;
+        s->port.uartclk = 9600;
+        s->port.flags = UPF_SKIP_TEST | UPF_BOOT_AUTOCONF;
+        s->port.irq = s->spi->irq;
+        s->port.type = PORT_MAX3107;
+
+        /* Add UART port */
+        retval = uart_add_one_port(&max3107_uart_driver, &s->port);
+        if (retval < 0) {
+                dev_err(&s->spi->dev, "Adding UART port failed\n");
+                return retval;
+        }
+
+        if (pdata->configure) {
+                retval = pdata->configure(s);
+                if (retval < 0)
+                        return retval;
+        }
+
+        /* Go to suspend mode */
+        if (pdata->hw_suspend)
+                pdata->hw_suspend(s, 1);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(max3107_probe);
+
+/* Driver remove function */
+int max3107_remove(struct spi_device *spi)
+{
+        struct max3107_port *s = dev_get_drvdata(&spi->dev);
+
+        pr_info("enter max3107 remove\n");
+
+        /* Remove port */
+        if (uart_remove_one_port(&max3107_uart_driver, &s->port))
+                dev_warn(&s->spi->dev, "Removing UART port failed\n");
+
+
+        /* Free TxRx buffer */
+        kfree(s->rxbuf);
+        kfree(s->rxstr);
+        kfree(s->txbuf);
+
+        /* Free port structure */
+        kfree(s);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(max3107_remove);
+
+/* Driver suspend function */
+int max3107_suspend(struct spi_device *spi, pm_message_t state)
+{
+#ifdef CONFIG_PM
+        struct max3107_port *s = dev_get_drvdata(&spi->dev);
+
+        pr_debug("enter suspend\n");
+
+        /* Suspend UART port */
+        uart_suspend_port(&max3107_uart_driver, &s->port);
+
+        /* Go to suspend mode */
+        if (s->pdata->hw_suspend)
+                s->pdata->hw_suspend(s, 1);
+#endif  /* CONFIG_PM */
+        return 0;
+}
+EXPORT_SYMBOL_GPL(max3107_suspend);
+
+/* Driver resume function */
+int max3107_resume(struct spi_device *spi)
+{
+#ifdef CONFIG_PM
+        struct max3107_port *s = dev_get_drvdata(&spi->dev);
+
+        pr_debug("enter resume\n");
+
+        /* Resume from suspend */
+        if (s->pdata->hw_suspend)
+                s->pdata->hw_suspend(s, 0);
+
+        /* Resume UART port */
+        uart_resume_port(&max3107_uart_driver, &s->port);
+#endif  /* CONFIG_PM */
+        return 0;
+}
+EXPORT_SYMBOL_GPL(max3107_resume);
+
+static int max3107_probe_generic(struct spi_device *spi)
+{
+        return max3107_probe(spi, &generic_plat_data);
+}
+
+/* Spi driver data */
+static struct spi_driver max3107_driver = {
+        .driver = {
+                .name           = "max3107",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+        .probe          = max3107_probe_generic,
+        .remove         = __devexit_p(max3107_remove),
+        .suspend        = max3107_suspend,
+        .resume         = max3107_resume,
+};
+
+/* Driver init function */
+static int __init max3107_init(void)
+{
+        pr_info("enter max3107 init\n");
+        return spi_register_driver(&max3107_driver);
+}
+
+/* Driver exit function */
+static void __exit max3107_exit(void)
+{
+        pr_info("enter max3107 exit\n");
+        /* Unregister UART driver */
+        if (driver_registered)
+                uart_unregister_driver(&max3107_uart_driver);
+        spi_unregister_driver(&max3107_driver);
+}
+
+module_init(max3107_init);
+module_exit(max3107_exit);
+
+MODULE_DESCRIPTION("MAX3107 driver");
+MODULE_AUTHOR("Aavamobile");
+MODULE_ALIAS("max3107-spi");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/serial/max3107.h b/drivers/serial/max3107.h
new file mode 100644
index 000000000000..7ab632392502
--- /dev/null
+++ b/drivers/serial/max3107.h
@@ -0,0 +1,441 @@
+/*
+ * max3107.h - spi uart protocol driver header for Maxim 3107
+ *
+ * Copyright (C) Aavamobile 2009
+ * Based on serial_max3100.h by Christian Pellegrin
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef _MAX3107_H
+#define _MAX3107_H
+
+/* Serial error status definitions */
+#define MAX3107_PARITY_ERROR    1
+#define MAX3107_FRAME_ERROR     2
+#define MAX3107_OVERRUN_ERROR   4
+#define MAX3107_ALL_ERRORS      (MAX3107_PARITY_ERROR | \
+                                 MAX3107_FRAME_ERROR | \
+                                 MAX3107_OVERRUN_ERROR)
+
+/* GPIO definitions */
+#define MAX3107_GPIO_BASE       88
+#define MAX3107_GPIO_COUNT      4
+
+
+/* GPIO connected to chip's reset pin */
+#define MAX3107_RESET_GPIO      87
+
+
+/* Chip reset delay */
+#define MAX3107_RESET_DELAY     10
+
+/* Chip wakeup delay */
+#define MAX3107_WAKEUP_DELAY    50
+
+
+/* Sleep mode definitions */
+#define MAX3107_DISABLE_FORCED_SLEEP    0
+#define MAX3107_ENABLE_FORCED_SLEEP     1
+#define MAX3107_DISABLE_AUTOSLEEP       2
+#define MAX3107_ENABLE_AUTOSLEEP        3
+
+
+/* Definitions for register access with SPI transfers
+ *
+ * SPI transfer format:
+ *
+ * Master to slave bits xzzzzzzzyyyyyyyy
+ * Slave to master bits aaaaaaaabbbbbbbb
+ *
+ * where:
+ * x = 0 for reads, 1 for writes
+ * z = register address
+ * y = new register value if write, 0 if read
+ * a = unspecified
+ * b = register value if read, unspecified if write
+ */
+
+/* SPI speed */
+#define MAX3107_SPI_SPEED       (3125000 * 2)
+
+/* Write bit */
+#define MAX3107_WRITE_BIT       (1 << 15)
+
+/* SPI TX data mask */
+#define MAX3107_SPI_RX_DATA_MASK        (0x00ff)
+
+/* SPI RX data mask */
+#define MAX3107_SPI_TX_DATA_MASK        (0x00ff)
+
+/* Register access masks */
+#define MAX3107_RHR_REG                 (0x0000) /* RX FIFO */
+#define MAX3107_THR_REG                 (0x0000) /* TX FIFO */
+#define MAX3107_IRQEN_REG               (0x0100) /* IRQ enable */
+#define MAX3107_IRQSTS_REG              (0x0200) /* IRQ status */
+#define MAX3107_LSR_IRQEN_REG           (0x0300) /* LSR IRQ enable */
+#define MAX3107_LSR_IRQSTS_REG          (0x0400) /* LSR IRQ status */
+#define MAX3107_SPCHR_IRQEN_REG         (0x0500) /* Special char IRQ enable */
+#define MAX3107_SPCHR_IRQSTS_REG        (0x0600) /* Special char IRQ status */
+#define MAX3107_STS_IRQEN_REG           (0x0700) /* Status IRQ enable */
+#define MAX3107_STS_IRQSTS_REG          (0x0800) /* Status IRQ status */
+#define MAX3107_MODE1_REG               (0x0900) /* MODE1 */
+#define MAX3107_MODE2_REG               (0x0a00) /* MODE2 */
+#define MAX3107_LCR_REG                 (0x0b00) /* LCR */
+#define MAX3107_RXTO_REG                (0x0c00) /* RX timeout */
+#define MAX3107_HDPIXDELAY_REG          (0x0d00) /* Auto transceiver delays */
+#define MAX3107_IRDA_REG                (0x0e00) /* IRDA settings */
+#define MAX3107_FLOWLVL_REG             (0x0f00) /* Flow control levels */
+#define MAX3107_FIFOTRIGLVL_REG         (0x1000) /* FIFO IRQ trigger levels */
+#define MAX3107_TXFIFOLVL_REG           (0x1100) /* TX FIFO level */
+#define MAX3107_RXFIFOLVL_REG           (0x1200) /* RX FIFO level */
+#define MAX3107_FLOWCTRL_REG            (0x1300) /* Flow control */
+#define MAX3107_XON1_REG                (0x1400) /* XON1 character */
+#define MAX3107_XON2_REG                (0x1500) /* XON2 character */
+#define MAX3107_XOFF1_REG               (0x1600) /* XOFF1 character */
+#define MAX3107_XOFF2_REG               (0x1700) /* XOFF2 character */
+#define MAX3107_GPIOCFG_REG             (0x1800) /* GPIO config */
+#define MAX3107_GPIODATA_REG            (0x1900) /* GPIO data */
+#define MAX3107_PLLCFG_REG              (0x1a00) /* PLL config */
+#define MAX3107_BRGCFG_REG              (0x1b00) /* Baud rate generator conf */
+#define MAX3107_BRGDIVLSB_REG           (0x1c00) /* Baud rate divisor LSB */
+#define MAX3107_BRGDIVMSB_REG           (0x1d00) /* Baud rate divisor MSB */
+#define MAX3107_CLKSRC_REG              (0x1e00) /* Clock source */
+#define MAX3107_REVID_REG               (0x1f00) /* Revision identification */
+
+/* IRQ register bits */
+#define MAX3107_IRQ_LSR_BIT     (1 << 0) /* LSR interrupt */
+#define MAX3107_IRQ_SPCHR_BIT   (1 << 1) /* Special char interrupt */
+#define MAX3107_IRQ_STS_BIT     (1 << 2) /* Status interrupt */
+#define MAX3107_IRQ_RXFIFO_BIT  (1 << 3) /* RX FIFO interrupt */
+#define MAX3107_IRQ_TXFIFO_BIT  (1 << 4) /* TX FIFO interrupt */
+#define MAX3107_IRQ_TXEMPTY_BIT (1 << 5) /* TX FIFO empty interrupt */
+#define MAX3107_IRQ_RXEMPTY_BIT (1 << 6) /* RX FIFO empty interrupt */
+#define MAX3107_IRQ_CTS_BIT     (1 << 7) /* CTS interrupt */
+
+/* LSR register bits */
+#define MAX3107_LSR_RXTO_BIT    (1 << 0) /* RX timeout */
+#define MAX3107_LSR_RXOVR_BIT   (1 << 1) /* RX overrun */
+#define MAX3107_LSR_RXPAR_BIT   (1 << 2) /* RX parity error */
+#define MAX3107_LSR_FRERR_BIT   (1 << 3) /* Frame error */
+#define MAX3107_LSR_RXBRK_BIT   (1 << 4) /* RX break */
+#define MAX3107_LSR_RXNOISE_BIT (1 << 5) /* RX noise */
+#define MAX3107_LSR_UNDEF6_BIT  (1 << 6) /* Undefined/not used */
+#define MAX3107_LSR_CTS_BIT     (1 << 7) /* CTS pin state */
+
+/* Special character register bits */
+#define MAX3107_SPCHR_XON1_BIT          (1 << 0) /* XON1 character */
+#define MAX3107_SPCHR_XON2_BIT          (1 << 1) /* XON2 character */
+#define MAX3107_SPCHR_XOFF1_BIT         (1 << 2) /* XOFF1 character */
+#define MAX3107_SPCHR_XOFF2_BIT         (1 << 3) /* XOFF2 character */
+#define MAX3107_SPCHR_BREAK_BIT         (1 << 4) /* RX break */
+#define MAX3107_SPCHR_MULTIDROP_BIT     (1 << 5) /* 9-bit multidrop addr char */
+#define MAX3107_SPCHR_UNDEF6_BIT        (1 << 6) /* Undefined/not used */
+#define MAX3107_SPCHR_UNDEF7_BIT        (1 << 7) /* Undefined/not used */
+
+/* Status register bits */
+#define MAX3107_STS_GPIO0_BIT           (1 << 0) /* GPIO 0 interrupt */
+#define MAX3107_STS_GPIO1_BIT           (1 << 1) /* GPIO 1 interrupt */
+#define MAX3107_STS_GPIO2_BIT           (1 << 2) /* GPIO 2 interrupt */
+#define MAX3107_STS_GPIO3_BIT           (1 << 3) /* GPIO 3 interrupt */
+#define MAX3107_STS_UNDEF4_BIT          (1 << 4) /* Undefined/not used */
+#define MAX3107_STS_CLKREADY_BIT        (1 << 5) /* Clock ready */
+#define MAX3107_STS_SLEEP_BIT           (1 << 6) /* Sleep interrupt */
+#define MAX3107_STS_UNDEF7_BIT          (1 << 7) /* Undefined/not used */
+
+/* MODE1 register bits */
+#define MAX3107_MODE1_RXDIS_BIT         (1 << 0) /* RX disable */
+#define MAX3107_MODE1_TXDIS_BIT         (1 << 1) /* TX disable */
+#define MAX3107_MODE1_TXHIZ_BIT         (1 << 2) /* TX pin three-state */
+#define MAX3107_MODE1_RTSHIZ_BIT        (1 << 3) /* RTS pin three-state */
+#define MAX3107_MODE1_TRNSCVCTRL_BIT    (1 << 4) /* Transceiver ctrl enable */
+#define MAX3107_MODE1_FORCESLEEP_BIT    (1 << 5) /* Force sleep mode */
+#define MAX3107_MODE1_AUTOSLEEP_BIT     (1 << 6) /* Auto sleep enable */
+#define MAX3107_MODE1_IRQSEL_BIT        (1 << 7) /* IRQ pin enable */
+
+/* MODE2 register bits */
+#define MAX3107_MODE2_RST_BIT           (1 << 0) /* Chip reset */
+#define MAX3107_MODE2_FIFORST_BIT       (1 << 1) /* FIFO reset */
+#define MAX3107_MODE2_RXTRIGINV_BIT     (1 << 2) /* RX FIFO INT invert */
+#define MAX3107_MODE2_RXEMPTINV_BIT     (1 << 3) /* RX FIFO empty INT invert */
+#define MAX3107_MODE2_SPCHR_BIT         (1 << 4) /* Special chr detect enable */
+#define MAX3107_MODE2_LOOPBACK_BIT      (1 << 5) /* Internal loopback enable */
+#define MAX3107_MODE2_MULTIDROP_BIT     (1 << 6) /* 9-bit multidrop enable */
+#define MAX3107_MODE2_ECHOSUPR_BIT      (1 << 7) /* ECHO suppression enable */
+
+/* LCR register bits */
+#define MAX3107_LCR_LENGTH0_BIT         (1 << 0) /* Word length bit 0 */
+#define MAX3107_LCR_LENGTH1_BIT         (1 << 1) /* Word length bit 1
+                                                  *
+                                                  * Word length bits table:
+                                                  * 00 -> 5 bit words
+                                                  * 01 -> 6 bit words
+                                                  * 10 -> 7 bit words
+                                                  * 11 -> 8 bit words
+                                                  */
+#define MAX3107_LCR_STOPLEN_BIT         (1 << 2) /* STOP length bit
+                                                  *
+                                                  * STOP length bit table:
+                                                  * 0 -> 1 stop bit
+                                                  * 1 -> 1-1.5 stop bits if
+                                                  *      word length is 5,
+                                                  *      2 stop bits otherwise
+                                                  */
+#define MAX3107_LCR_PARITY_BIT          (1 << 3) /* Parity bit enable */
+#define MAX3107_LCR_EVENPARITY_BIT      (1 << 4) /* Even parity bit enable */
+#define MAX3107_LCR_FORCEPARITY_BIT     (1 << 5) /* 9-bit multidrop parity */
+#define MAX3107_LCR_TXBREAK_BIT         (1 << 6) /* TX break enable */
+#define MAX3107_LCR_RTS_BIT             (1 << 7) /* RTS pin control */
+#define MAX3107_LCR_WORD_LEN_5          (0x0000)
+#define MAX3107_LCR_WORD_LEN_6          (0x0001)
+#define MAX3107_LCR_WORD_LEN_7          (0x0002)
+#define MAX3107_LCR_WORD_LEN_8          (0x0003)
+
+
+/* IRDA register bits */
+#define MAX3107_IRDA_IRDAEN_BIT         (1 << 0) /* IRDA mode enable */
+#define MAX3107_IRDA_SIR_BIT            (1 << 1) /* SIR mode enable */
+#define MAX3107_IRDA_SHORTIR_BIT        (1 << 2) /* Short SIR mode enable */
+#define MAX3107_IRDA_MIR_BIT            (1 << 3) /* MIR mode enable */
+#define MAX3107_IRDA_RXINV_BIT          (1 << 4) /* RX logic inversion enable */
+#define MAX3107_IRDA_TXINV_BIT          (1 << 5) /* TX logic inversion enable */
+#define MAX3107_IRDA_UNDEF6_BIT         (1 << 6) /* Undefined/not used */
+#define MAX3107_IRDA_UNDEF7_BIT         (1 << 7) /* Undefined/not used */
+
+/* Flow control trigger level register masks */
+#define MAX3107_FLOWLVL_HALT_MASK       (0x000f) /* Flow control halt level */
+#define MAX3107_FLOWLVL_RES_MASK        (0x00f0) /* Flow control resume level */
+#define MAX3107_FLOWLVL_HALT(words)     ((words/8) & 0x000f)
+#define MAX3107_FLOWLVL_RES(words)      (((words/8) & 0x000f) << 4)
+
+/* FIFO interrupt trigger level register masks */
+#define MAX3107_FIFOTRIGLVL_TX_MASK     (0x000f) /* TX FIFO trigger level */
+#define MAX3107_FIFOTRIGLVL_RX_MASK     (0x00f0) /* RX FIFO trigger level */
+#define MAX3107_FIFOTRIGLVL_TX(words)   ((words/8) & 0x000f)
+#define MAX3107_FIFOTRIGLVL_RX(words)   (((words/8) & 0x000f) << 4)
+
+/* Flow control register bits */
+#define MAX3107_FLOWCTRL_AUTORTS_BIT    (1 << 0) /* Auto RTS flow ctrl enable */
+#define MAX3107_FLOWCTRL_AUTOCTS_BIT    (1 << 1) /* Auto CTS flow ctrl enable */
+#define MAX3107_FLOWCTRL_GPIADDR_BIT    (1 << 2) /* Enables that GPIO inputs
+                                                  * are used in conjunction with
+                                                  * XOFF2 for definition of
+                                                  * special character */
+#define MAX3107_FLOWCTRL_SWFLOWEN_BIT   (1 << 3) /* Auto SW flow ctrl enable */
+#define MAX3107_FLOWCTRL_SWFLOW0_BIT    (1 << 4) /* SWFLOW bit 0 */
+#define MAX3107_FLOWCTRL_SWFLOW1_BIT    (1 << 5) /* SWFLOW bit 1
+                                                  *
+                                                  * SWFLOW bits 1 & 0 table:
+                                                  * 00 -> no transmitter flow
+                                                  *       control
+                                                  * 01 -> receiver compares
+                                                  *       XON2 and XOFF2
+                                                  *       and controls
+                                                  *       transmitter
+                                                  * 10 -> receiver compares
+                                                  *       XON1 and XOFF1
+                                                  *       and controls
+                                                  *       transmitter
+                                                  * 11 -> receiver compares
+                                                  *       XON1, XON2, XOFF1 and
+                                                  *       XOFF2 and controls
+                                                  *       transmitter
+                                                  */
+#define MAX3107_FLOWCTRL_SWFLOW2_BIT    (1 << 6) /* SWFLOW bit 2 */
+#define MAX3107_FLOWCTRL_SWFLOW3_BIT    (1 << 7) /* SWFLOW bit 3
+                                                  *
+                                                  * SWFLOW bits 3 & 2 table:
+                                                  * 00 -> no received flow
+                                                  *       control
+                                                  * 01 -> transmitter generates
+                                                  *       XON2 and XOFF2
+                                                  * 10 -> transmitter generates
+                                                  *       XON1 and XOFF1
+                                                  * 11 -> transmitter generates
+                                                  *       XON1, XON2, XOFF1 and
+                                                  *       XOFF2
+                                                  */
+
+/* GPIO configuration register bits */
+#define MAX3107_GPIOCFG_GP0OUT_BIT      (1 << 0) /* GPIO 0 output enable */
+#define MAX3107_GPIOCFG_GP1OUT_BIT      (1 << 1) /* GPIO 1 output enable */
+#define MAX3107_GPIOCFG_GP2OUT_BIT      (1 << 2) /* GPIO 2 output enable */
+#define MAX3107_GPIOCFG_GP3OUT_BIT      (1 << 3) /* GPIO 3 output enable */
+#define MAX3107_GPIOCFG_GP0OD_BIT       (1 << 4) /* GPIO 0 open-drain enable */
+#define MAX3107_GPIOCFG_GP1OD_BIT       (1 << 5) /* GPIO 1 open-drain enable */
+#define MAX3107_GPIOCFG_GP2OD_BIT       (1 << 6) /* GPIO 2 open-drain enable */
+#define MAX3107_GPIOCFG_GP3OD_BIT       (1 << 7) /* GPIO 3 open-drain enable */
+
+/* GPIO DATA register bits */
+#define MAX3107_GPIODATA_GP0OUT_BIT     (1 << 0) /* GPIO 0 output value */
+#define MAX3107_GPIODATA_GP1OUT_BIT     (1 << 1) /* GPIO 1 output value */
+#define MAX3107_GPIODATA_GP2OUT_BIT     (1 << 2) /* GPIO 2 output value */
+#define MAX3107_GPIODATA_GP3OUT_BIT     (1 << 3) /* GPIO 3 output value */
+#define MAX3107_GPIODATA_GP0IN_BIT      (1 << 4) /* GPIO 0 input value */
+#define MAX3107_GPIODATA_GP1IN_BIT      (1 << 5) /* GPIO 1 input value */
+#define MAX3107_GPIODATA_GP2IN_BIT      (1 << 6) /* GPIO 2 input value */
+#define MAX3107_GPIODATA_GP3IN_BIT      (1 << 7) /* GPIO 3 input value */
+
+/* PLL configuration register masks */
+#define MAX3107_PLLCFG_PREDIV_MASK      (0x003f) /* PLL predivision value */
+#define MAX3107_PLLCFG_PLLFACTOR_MASK   (0x00c0) /* PLL multiplication factor */
+
+/* Baud rate generator configuration register masks and bits */
+#define MAX3107_BRGCFG_FRACT_MASK       (0x000f) /* Fractional portion of
+                                                  * Baud rate generator divisor
+                                                  */
+#define MAX3107_BRGCFG_2XMODE_BIT       (1 << 4) /* Double baud rate */
+#define MAX3107_BRGCFG_4XMODE_BIT       (1 << 5) /* Quadruple baud rate */
+#define MAX3107_BRGCFG_UNDEF6_BIT       (1 << 6) /* Undefined/not used */
+#define MAX3107_BRGCFG_UNDEF7_BIT       (1 << 7) /* Undefined/not used */
+
+/* Clock source register bits */
+#define MAX3107_CLKSRC_INTOSC_BIT       (1 << 0) /* Internal osc enable */
+#define MAX3107_CLKSRC_CRYST_BIT        (1 << 1) /* Crystal osc enable */
+#define MAX3107_CLKSRC_PLL_BIT          (1 << 2) /* PLL enable */
+#define MAX3107_CLKSRC_PLLBYP_BIT       (1 << 3) /* PLL bypass */
+#define MAX3107_CLKSRC_EXTCLK_BIT       (1 << 4) /* External clock enable */
+#define MAX3107_CLKSRC_UNDEF5_BIT       (1 << 5) /* Undefined/not used */
+#define MAX3107_CLKSRC_UNDEF6_BIT       (1 << 6) /* Undefined/not used */
+#define MAX3107_CLKSRC_CLK2RTS_BIT      (1 << 7) /* Baud clk to RTS pin */
+
+
+/* HW definitions */
+#define MAX3107_RX_FIFO_SIZE    128
+#define MAX3107_TX_FIFO_SIZE    128
+#define MAX3107_REVID1          0x00a0
+#define MAX3107_REVID2          0x00a1
+
+
+/* Baud rate generator configuration values for external clock 13MHz */
+#define MAX3107_BRG13_B300      (0x0A9400 | 0x05)
+#define MAX3107_BRG13_B600      (0x054A00 | 0x03)
+#define MAX3107_BRG13_B1200     (0x02A500 | 0x01)
+#define MAX3107_BRG13_B2400     (0x015200 | 0x09)
+#define MAX3107_BRG13_B4800     (0x00A900 | 0x04)
+#define MAX3107_BRG13_B9600     (0x005400 | 0x0A)
+#define MAX3107_BRG13_B19200    (0x002A00 | 0x05)
+#define MAX3107_BRG13_B38400    (0x001500 | 0x03)
+#define MAX3107_BRG13_B57600    (0x000E00 | 0x02)
+#define MAX3107_BRG13_B115200   (0x000700 | 0x01)
+#define MAX3107_BRG13_B230400   (0x000300 | 0x08)
+#define MAX3107_BRG13_B460800   (0x000100 | 0x0c)
+#define MAX3107_BRG13_B921600   (0x000100 | 0x1c)
+
+/* Baud rate generator configuration values for external clock 26MHz */
+#define MAX3107_BRG26_B300      (0x152800 | 0x0A)
+#define MAX3107_BRG26_B600      (0x0A9400 | 0x05)
+#define MAX3107_BRG26_B1200     (0x054A00 | 0x03)
+#define MAX3107_BRG26_B2400     (0x02A500 | 0x01)
+#define MAX3107_BRG26_B4800     (0x015200 | 0x09)
+#define MAX3107_BRG26_B9600     (0x00A900 | 0x04)
+#define MAX3107_BRG26_B19200    (0x005400 | 0x0A)
+#define MAX3107_BRG26_B38400    (0x002A00 | 0x05)
+#define MAX3107_BRG26_B57600    (0x001C00 | 0x03)
+#define MAX3107_BRG26_B115200   (0x000E00 | 0x02)
+#define MAX3107_BRG26_B230400   (0x000700 | 0x01)
+#define MAX3107_BRG26_B460800   (0x000300 | 0x08)
+#define MAX3107_BRG26_B921600   (0x000100 | 0x0C)
+
+/* Baud rate generator configuration values for internal clock */
+#define MAX3107_BRG13_IB300     (0x008000 | 0x00)
+#define MAX3107_BRG13_IB600     (0x004000 | 0x00)
+#define MAX3107_BRG13_IB1200    (0x002000 | 0x00)
+#define MAX3107_BRG13_IB2400    (0x001000 | 0x00)
+#define MAX3107_BRG13_IB4800    (0x000800 | 0x00)
+#define MAX3107_BRG13_IB9600    (0x000400 | 0x00)
+#define MAX3107_BRG13_IB19200   (0x000200 | 0x00)
+#define MAX3107_BRG13_IB38400   (0x000100 | 0x00)
+#define MAX3107_BRG13_IB57600   (0x000000 | 0x0B)
+#define MAX3107_BRG13_IB115200  (0x000000 | 0x05)
+#define MAX3107_BRG13_IB230400  (0x000000 | 0x03)
+#define MAX3107_BRG13_IB460800  (0x000000 | 0x00)
+#define MAX3107_BRG13_IB921600  (0x000000 | 0x00)
+
+
+struct baud_table {
+        int baud;
+        u32 new_brg;
+};
+
+struct max3107_port {
+        /* UART port structure */
+        struct uart_port port;
+
+        /* SPI device structure */
+        struct spi_device *spi;
+
+#if defined(CONFIG_GPIOLIB)
+        /* GPIO chip stucture */
+        struct gpio_chip chip;
+#endif
+
+        /* Workqueue that does all the magic */
+        struct workqueue_struct *workqueue;
+        struct work_struct work;
+
+        /* Lock for shared data */
+        spinlock_t data_lock;
+
+        /* Device configuration */
+        int ext_clk;            /* 1 if external clock used */
+        int loopback;           /* Current loopback mode state */
+        int baud;                       /* Current baud rate */
+
+        /* State flags */
+        int suspended;          /* Indicates suspend mode */
+        int tx_fifo_empty;      /* Flag for TX FIFO state */
+        int rx_enabled;         /* Flag for receiver state */
+        int tx_enabled;         /* Flag for transmitter state */
+
+        u16 irqen_reg;          /* Current IRQ enable register value */
+        /* Shared data */
+        u16 mode1_reg;          /* Current mode1 register value*/
+        int mode1_commit;       /* Flag for setting new mode1 register value */
+        u16 lcr_reg;            /* Current LCR register value */
+        int lcr_commit;         /* Flag for setting new LCR register value */
+        u32 brg_cfg;            /* Current Baud rate generator config  */
+        int brg_commit;         /* Flag for setting new baud rate generator
+                                 * config
+                                 */
+        struct baud_table *baud_tbl;
+        int handle_irq;         /* Indicates that IRQ should be handled */
+
+        /* Rx buffer and str*/
+        u16 *rxbuf;
+        u8  *rxstr;
+        /* Tx buffer*/
+        u16 *txbuf;
+
+        struct max3107_plat *pdata;     /* Platform data */
+};
+
+/* Platform data structure */
+struct max3107_plat {
+        /* Loopback mode enable */
+        int loopback;
+        /* External clock enable */
+        int ext_clk;
+        /* Called during the register initialisation */
+        void (*init)(struct max3107_port *s);
+        /* Called when the port is found and configured */
+        int (*configure)(struct max3107_port *s);
+        /* HW suspend function */
+        void (*hw_suspend) (struct max3107_port *s, int suspend);
+        /* Polling mode enable */
+        int polled_mode;
+        /* Polling period if polling mode enabled */
+        int poll_time;
+};
+
+extern int max3107_rw(struct max3107_port *s, u8 *tx, u8 *rx, int len);
+extern void max3107_hw_susp(struct max3107_port *s, int suspend);
+extern int max3107_probe(struct spi_device *spi, struct max3107_plat *pdata);
+extern int max3107_remove(struct spi_device *spi);
+extern int max3107_suspend(struct spi_device *spi, pm_message_t state);
+extern int max3107_resume(struct spi_device *spi);
+
+#endif /* _LINUX_SERIAL_MAX3107_H */
diff --git a/drivers/serial/mcf.c b/drivers/serial/mcf.c
index b5aaef965f24..3394b7cc1722 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/serial/mcf.c
@@ -70,16 +70,14 @@ static unsigned int mcf_tx_empty(struct uart_port *port)
 static unsigned int mcf_get_mctrl(struct uart_port *port)
 {
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
-        unsigned long flags;
         unsigned int sigs;
 
-        spin_lock_irqsave(&port->lock, flags);
         sigs = (readb(port->membase + MCFUART_UIPR) & MCFUART_UIPR_CTS) ?
                 0 : TIOCM_CTS;
         sigs |= (pp->sigs & TIOCM_RTS);
         sigs |= (mcf_getppdcd(port->line) ? TIOCM_CD : 0);
         sigs |= (mcf_getppdtr(port->line) ? TIOCM_DTR : 0);
-        spin_unlock_irqrestore(&port->lock, flags);
+
         return sigs;
 }
 
@@ -88,16 +86,13 @@ static unsigned int mcf_get_mctrl(struct uart_port *port)
 static void mcf_set_mctrl(struct uart_port *port, unsigned int sigs)
 {
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
-        unsigned long flags;
 
-        spin_lock_irqsave(&port->lock, flags);
         pp->sigs = sigs;
         mcf_setppdtr(port->line, (sigs & TIOCM_DTR));
         if (sigs & TIOCM_RTS)
                 writeb(MCFUART_UOP_RTS, port->membase + MCFUART_UOP1);
         else
                 writeb(MCFUART_UOP_RTS, port->membase + MCFUART_UOP0);
-        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /****************************************************************************/
@@ -105,12 +100,9 @@ static void mcf_set_mctrl(struct uart_port *port, unsigned int sigs)
 static void mcf_start_tx(struct uart_port *port)
 {
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
-        unsigned long flags;
 
-        spin_lock_irqsave(&port->lock, flags);
         pp->imr |= MCFUART_UIR_TXREADY;
         writeb(pp->imr, port->membase + MCFUART_UIMR);
-        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /****************************************************************************/
@@ -118,12 +110,9 @@ static void mcf_start_tx(struct uart_port *port)
 static void mcf_stop_tx(struct uart_port *port)
 {
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
-        unsigned long flags;
 
-        spin_lock_irqsave(&port->lock, flags);
         pp->imr &= ~MCFUART_UIR_TXREADY;
         writeb(pp->imr, port->membase + MCFUART_UIMR);
-        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /****************************************************************************/
@@ -131,12 +120,9 @@ static void mcf_stop_tx(struct uart_port *port)
 static void mcf_stop_rx(struct uart_port *port)
 {
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
-        unsigned long flags;
 
-        spin_lock_irqsave(&port->lock, flags);
         pp->imr &= ~MCFUART_UIR_RXREADY;
         writeb(pp->imr, port->membase + MCFUART_UIMR);
-        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /****************************************************************************/
@@ -366,13 +352,22 @@ static irqreturn_t mcf_interrupt(int irq, void *data)
         struct uart_port *port = data;
         struct mcf_uart *pp = container_of(port, struct mcf_uart, port);
         unsigned int isr;
+        irqreturn_t ret = IRQ_NONE;
 
         isr = readb(port->membase + MCFUART_UISR) & pp->imr;
-        if (isr & MCFUART_UIR_RXREADY)
+
+        spin_lock(&port->lock);
+        if (isr & MCFUART_UIR_RXREADY) {
                 mcf_rx_chars(pp);
-        if (isr & MCFUART_UIR_TXREADY)
+                ret = IRQ_HANDLED;
+        }
+        if (isr & MCFUART_UIR_TXREADY) {
                 mcf_tx_chars(pp);
-        return IRQ_HANDLED;
+                ret = IRQ_HANDLED;
+        }
+        spin_unlock(&port->lock);
+
+        return ret;
 }
 
 /****************************************************************************/
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
new file mode 100644
index 000000000000..bc9af503907f
--- /dev/null
+++ b/drivers/serial/mfd.c
@@ -0,0 +1,1498 @@
+/*
+ * mfd.c: driver for High Speed UART device of Intel Medfield platform
+ *
+ * Refer pxa.c, 8250.c and some other drivers in drivers/serial/
+ *
+ * (C) Copyright 2010 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+
+/* Notes:
+ * 1. DMA channel allocation: 0/1 channel are assigned to port 0,
+ *    2/3 chan to port 1, 4/5 chan to port 3. Even number chans
+ *    are used for RX, odd chans for TX
+ *
+ * 2. In A0 stepping, UART will not support TX half empty flag
+ *
+ * 3. The RI/DSR/DCD/DTR are not pinned out, DCD & DSR are always
+ *    asserted, only when the HW is reset the DDCD and DDSR will
+ *    be triggered
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/console.h>
+#include <linux/sysrq.h>
+#include <linux/serial_reg.h>
+#include <linux/circ_buf.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <linux/serial_core.h>
+#include <linux/serial_mfd.h>
+#include <linux/dma-mapping.h>
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/debugfs.h>
+
+#define  MFD_HSU_A0_STEPPING    1
+
+#define HSU_DMA_BUF_SIZE        2048
+
+#define chan_readl(chan, offset)        readl(chan->reg + offset)
+#define chan_writel(chan, offset, val)  writel(val, chan->reg + offset)
+
+#define mfd_readl(obj, offset)          readl(obj->reg + offset)
+#define mfd_writel(obj, offset, val)    writel(val, obj->reg + offset)
+
+#define HSU_DMA_TIMEOUT_CHECK_FREQ      (HZ/10)
+
+struct hsu_dma_buffer {
+        u8              *buf;
+        dma_addr_t      dma_addr;
+        u32             dma_size;
+        u32             ofs;
+};
+
+struct hsu_dma_chan {
+        u32     id;
+        enum dma_data_direction dirt;
+        struct uart_hsu_port    *uport;
+        void __iomem            *reg;
+        struct timer_list       rx_timer; /* only needed by RX channel */
+};
+
+struct uart_hsu_port {
+        struct uart_port        port;
+        unsigned char           ier;
+        unsigned char           lcr;
+        unsigned char           mcr;
+        unsigned int            lsr_break_flag;
+        char                    name[12];
+        int                     index;
+        struct device           *dev;
+
+        struct hsu_dma_chan     *txc;
+        struct hsu_dma_chan     *rxc;
+        struct hsu_dma_buffer   txbuf;
+        struct hsu_dma_buffer   rxbuf;
+        int                     use_dma;        /* flag for DMA/PIO */
+        int                     running;
+        int                     dma_tx_on;
+};
+
+/* Top level data structure of HSU */
+struct hsu_port {
+        void __iomem    *reg;
+        unsigned long   paddr;
+        unsigned long   iolen;
+        u32             irq;
+
+        struct uart_hsu_port    port[3];
+        struct hsu_dma_chan     chans[10];
+
+        struct dentry *debugfs;
+};
+
+static inline unsigned int serial_in(struct uart_hsu_port *up, int offset)
+{
+        unsigned int val;
+
+        if (offset > UART_MSR) {
+                offset <<= 2;
+                val = readl(up->port.membase + offset);
+        } else
+                val = (unsigned int)readb(up->port.membase + offset);
+
+        return val;
+}
+
+static inline void serial_out(struct uart_hsu_port *up, int offset, int value)
+{
+        if (offset > UART_MSR) {
+                offset <<= 2;
+                writel(value, up->port.membase + offset);
+        } else {
+                unsigned char val = value & 0xff;
+                writeb(val, up->port.membase + offset);
+        }
+}
+
+#ifdef CONFIG_DEBUG_FS
+
+#define HSU_REGS_BUFSIZE        1024
+
+static int hsu_show_regs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static ssize_t port_show_regs(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct uart_hsu_port *up = file->private_data;
+        char *buf;
+        u32 len = 0;
+        ssize_t ret;
+
+        buf = kzalloc(HSU_REGS_BUFSIZE, GFP_KERNEL);
+        if (!buf)
+                return 0;
+
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MFD HSU port[%d] regs:\n", up->index);
+
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "=================================\n");
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "IER: \t\t0x%08x\n", serial_in(up, UART_IER));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "IIR: \t\t0x%08x\n", serial_in(up, UART_IIR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "LCR: \t\t0x%08x\n", serial_in(up, UART_LCR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MCR: \t\t0x%08x\n", serial_in(up, UART_MCR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "LSR: \t\t0x%08x\n", serial_in(up, UART_LSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MSR: \t\t0x%08x\n", serial_in(up, UART_MSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "FOR: \t\t0x%08x\n", serial_in(up, UART_FOR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "PS: \t\t0x%08x\n", serial_in(up, UART_PS));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MUL: \t\t0x%08x\n", serial_in(up, UART_MUL));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "DIV: \t\t0x%08x\n", serial_in(up, UART_DIV));
+
+        ret =  simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return ret;
+}
+
+static ssize_t dma_show_regs(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct hsu_dma_chan *chan = file->private_data;
+        char *buf;
+        u32 len = 0;
+        ssize_t ret;
+
+        buf = kzalloc(HSU_REGS_BUFSIZE, GFP_KERNEL);
+        if (!buf)
+                return 0;
+
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MFD HSU DMA channel [%d] regs:\n", chan->id);
+
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "=================================\n");
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "CR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_CR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "DCR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_DCR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "BSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_BSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "MOTSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_MOTSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0SAR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D0SAR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D0TSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0SAR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D1SAR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D1TSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0SAR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D2SAR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D2TSR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0SAR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D3SAR));
+        len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
+                        "D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D3TSR));
+
+        ret =  simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return ret;
+}
+
+static const struct file_operations port_regs_ops = {
+        .owner          = THIS_MODULE,
+        .open           = hsu_show_regs_open,
+        .read           = port_show_regs,
+};
+
+static const struct file_operations dma_regs_ops = {
+        .owner          = THIS_MODULE,
+        .open           = hsu_show_regs_open,
+        .read           = dma_show_regs,
+};
+
+static int hsu_debugfs_init(struct hsu_port *hsu)
+{
+        int i;
+        char name[32];
+
+        hsu->debugfs = debugfs_create_dir("hsu", NULL);
+        if (!hsu->debugfs)
+                return -ENOMEM;
+
+        for (i = 0; i < 3; i++) {
+                snprintf(name, sizeof(name), "port_%d_regs", i);
+                debugfs_create_file(name, S_IFREG | S_IRUGO,
+                        hsu->debugfs, (void *)(&hsu->port[i]), &port_regs_ops);
+        }
+
+        for (i = 0; i < 6; i++) {
+                snprintf(name, sizeof(name), "dma_chan_%d_regs", i);
+                debugfs_create_file(name, S_IFREG | S_IRUGO,
+                        hsu->debugfs, (void *)&hsu->chans[i], &dma_regs_ops);
+        }
+
+        return 0;
+}
+
+static void hsu_debugfs_remove(struct hsu_port *hsu)
+{
+        if (hsu->debugfs)
+                debugfs_remove_recursive(hsu->debugfs);
+}
+
+#else
+static inline int hsu_debugfs_init(struct hsu_port *hsu)
+{
+        return 0;
+}
+
+static inline void hsu_debugfs_remove(struct hsu_port *hsu)
+{
+}
+#endif /* CONFIG_DEBUG_FS */
+
+static void serial_hsu_enable_ms(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+
+        up->ier |= UART_IER_MSI;
+        serial_out(up, UART_IER, up->ier);
+}
+
+void hsu_dma_tx(struct uart_hsu_port *up)
+{
+        struct circ_buf *xmit = &up->port.state->xmit;
+        struct hsu_dma_buffer *dbuf = &up->txbuf;
+        int count;
+
+        /* test_and_set_bit may be better, but anyway it's in lock protected mode */
+        if (up->dma_tx_on)
+                return;
+
+        /* Update the circ buf info */
+        xmit->tail += dbuf->ofs;
+        xmit->tail &= UART_XMIT_SIZE - 1;
+
+        up->port.icount.tx += dbuf->ofs;
+        dbuf->ofs = 0;
+
+        /* Disable the channel */
+        chan_writel(up->txc, HSU_CH_CR, 0x0);
+
+        if (!uart_circ_empty(xmit) && !uart_tx_stopped(&up->port)) {
+                dma_sync_single_for_device(up->port.dev,
+                                           dbuf->dma_addr,
+                                           dbuf->dma_size,
+                                           DMA_TO_DEVICE);
+
+                count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
+                dbuf->ofs = count;
+
+                /* Reprogram the channel */
+                chan_writel(up->txc, HSU_CH_D0SAR, dbuf->dma_addr + xmit->tail);
+                chan_writel(up->txc, HSU_CH_D0TSR, count);
+
+                /* Reenable the channel */
+                chan_writel(up->txc, HSU_CH_DCR, 0x1
+                                                 | (0x1 << 8)
+                                                 | (0x1 << 16)
+                                                 | (0x1 << 24));
+                up->dma_tx_on = 1;
+                chan_writel(up->txc, HSU_CH_CR, 0x1);
+        }
+
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(&up->port);
+}
+
+/* The buffer is already cache coherent */
+void hsu_dma_start_rx_chan(struct hsu_dma_chan *rxc, struct hsu_dma_buffer *dbuf)
+{
+        dbuf->ofs = 0;
+
+        chan_writel(rxc, HSU_CH_BSR, 32);
+        chan_writel(rxc, HSU_CH_MOTSR, 4);
+
+        chan_writel(rxc, HSU_CH_D0SAR, dbuf->dma_addr);
+        chan_writel(rxc, HSU_CH_D0TSR, dbuf->dma_size);
+        chan_writel(rxc, HSU_CH_DCR, 0x1 | (0x1 << 8)
+                                         | (0x1 << 16)
+                                         | (0x1 << 24)  /* timeout bit, see HSU Errata 1 */
+                                         );
+        chan_writel(rxc, HSU_CH_CR, 0x3);
+
+        mod_timer(&rxc->rx_timer, jiffies + HSU_DMA_TIMEOUT_CHECK_FREQ);
+}
+
+/* Protected by spin_lock_irqsave(port->lock) */
+static void serial_hsu_start_tx(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+
+        if (up->use_dma) {
+                hsu_dma_tx(up);
+        } else if (!(up->ier & UART_IER_THRI)) {
+                up->ier |= UART_IER_THRI;
+                serial_out(up, UART_IER, up->ier);
+        }
+}
+
+static void serial_hsu_stop_tx(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        struct hsu_dma_chan *txc = up->txc;
+
+        if (up->use_dma)
+                chan_writel(txc, HSU_CH_CR, 0x0);
+        else if (up->ier & UART_IER_THRI) {
+                up->ier &= ~UART_IER_THRI;
+                serial_out(up, UART_IER, up->ier);
+        }
+}
+
+/* This is always called in spinlock protected mode, so
+ * modify timeout timer is safe here */
+void hsu_dma_rx(struct uart_hsu_port *up, u32 int_sts)
+{
+        struct hsu_dma_buffer *dbuf = &up->rxbuf;
+        struct hsu_dma_chan *chan = up->rxc;
+        struct uart_port *port = &up->port;
+        struct tty_struct *tty = port->state->port.tty;
+        int count;
+
+        if (!tty)
+                return;
+
+        /*
+         * First need to know how many is already transferred,
+         * then check if its a timeout DMA irq, and return
+         * the trail bytes out, push them up and reenable the
+         * channel
+         */
+
+        /* Timeout IRQ, need wait some time, see Errata 2 */
+        if (int_sts & 0xf00)
+                udelay(2);
+
+        /* Stop the channel */
+        chan_writel(chan, HSU_CH_CR, 0x0);
+
+        count = chan_readl(chan, HSU_CH_D0SAR) - dbuf->dma_addr;
+        if (!count) {
+                /* Restart the channel before we leave */
+                chan_writel(chan, HSU_CH_CR, 0x3);
+                return;
+        }
+        del_timer(&chan->rx_timer);
+
+        dma_sync_single_for_cpu(port->dev, dbuf->dma_addr,
+                        dbuf->dma_size, DMA_FROM_DEVICE);
+
+        /*
+         * Head will only wrap around when we recycle
+         * the DMA buffer, and when that happens, we
+         * explicitly set tail to 0. So head will
+         * always be greater than tail.
+         */
+        tty_insert_flip_string(tty, dbuf->buf, count);
+        port->icount.rx += count;
+
+        dma_sync_single_for_device(up->port.dev, dbuf->dma_addr,
+                        dbuf->dma_size, DMA_FROM_DEVICE);
+
+        /* Reprogram the channel */
+        chan_writel(chan, HSU_CH_D0SAR, dbuf->dma_addr);
+        chan_writel(chan, HSU_CH_D0TSR, dbuf->dma_size);
+        chan_writel(chan, HSU_CH_DCR, 0x1
+                                         | (0x1 << 8)
+                                         | (0x1 << 16)
+                                         | (0x1 << 24)  /* timeout bit, see HSU Errata 1 */
+                                         );
+        tty_flip_buffer_push(tty);
+
+        chan_writel(chan, HSU_CH_CR, 0x3);
+        chan->rx_timer.expires = jiffies + HSU_DMA_TIMEOUT_CHECK_FREQ;
+        add_timer(&chan->rx_timer);
+
+}
+
+static void serial_hsu_stop_rx(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        struct hsu_dma_chan *chan = up->rxc;
+
+        if (up->use_dma)
+                chan_writel(chan, HSU_CH_CR, 0x2);
+        else {
+                up->ier &= ~UART_IER_RLSI;
+                up->port.read_status_mask &= ~UART_LSR_DR;
+                serial_out(up, UART_IER, up->ier);
+        }
+}
+
+static inline void receive_chars(struct uart_hsu_port *up, int *status)
+{
+        struct tty_struct *tty = up->port.state->port.tty;
+        unsigned int ch, flag;
+        unsigned int max_count = 256;
+
+        if (!tty)
+                return;
+
+        do {
+                ch = serial_in(up, UART_RX);
+                flag = TTY_NORMAL;
+                up->port.icount.rx++;
+
+                if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
+                                       UART_LSR_FE | UART_LSR_OE))) {
+
+                        dev_warn(up->dev, "We really rush into ERR/BI case"
+                                "status = 0x%02x", *status);
+                        /* For statistics only */
+                        if (*status & UART_LSR_BI) {
+                                *status &= ~(UART_LSR_FE | UART_LSR_PE);
+                                up->port.icount.brk++;
+                                /*
+                                 * We do the SysRQ and SAK checking
+                                 * here because otherwise the break
+                                 * may get masked by ignore_status_mask
+                                 * or read_status_mask.
+                                 */
+                                if (uart_handle_break(&up->port))
+                                        goto ignore_char;
+                        } else if (*status & UART_LSR_PE)
+                                up->port.icount.parity++;
+                        else if (*status & UART_LSR_FE)
+                                up->port.icount.frame++;
+                        if (*status & UART_LSR_OE)
+                                up->port.icount.overrun++;
+
+                        /* Mask off conditions which should be ignored. */
+                        *status &= up->port.read_status_mask;
+
+#ifdef CONFIG_SERIAL_MFD_HSU_CONSOLE
+                        if (up->port.cons &&
+                                up->port.cons->index == up->port.line) {
+                                /* Recover the break flag from console xmit */
+                                *status |= up->lsr_break_flag;
+                                up->lsr_break_flag = 0;
+                        }
+#endif
+                        if (*status & UART_LSR_BI) {
+                                flag = TTY_BREAK;
+                        } else if (*status & UART_LSR_PE)
+                                flag = TTY_PARITY;
+                        else if (*status & UART_LSR_FE)
+                                flag = TTY_FRAME;
+                }
+
+                if (uart_handle_sysrq_char(&up->port, ch))
+                        goto ignore_char;
+
+                uart_insert_char(&up->port, *status, UART_LSR_OE, ch, flag);
+        ignore_char:
+                *status = serial_in(up, UART_LSR);
+        } while ((*status & UART_LSR_DR) && max_count--);
+        tty_flip_buffer_push(tty);
+}
+
+static void transmit_chars(struct uart_hsu_port *up)
+{
+        struct circ_buf *xmit = &up->port.state->xmit;
+        int count;
+
+        if (up->port.x_char) {
+                serial_out(up, UART_TX, up->port.x_char);
+                up->port.icount.tx++;
+                up->port.x_char = 0;
+                return;
+        }
+        if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
+                serial_hsu_stop_tx(&up->port);
+                return;
+        }
+
+#ifndef MFD_HSU_A0_STEPPING
+        count = up->port.fifosize / 2;
+#else
+        /*
+         * A0 only supports fully empty IRQ, and the first char written
+         * into it won't clear the EMPT bit, so we may need be cautious
+         * by useing a shorter buffer
+         */
+        count = up->port.fifosize - 4;
+#endif
+        do {
+                serial_out(up, UART_TX, xmit->buf[xmit->tail]);
+                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+
+                up->port.icount.tx++;
+                if (uart_circ_empty(xmit))
+                        break;
+        } while (--count > 0);
+
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(&up->port);
+
+        if (uart_circ_empty(xmit))
+                serial_hsu_stop_tx(&up->port);
+}
+
+static inline void check_modem_status(struct uart_hsu_port *up)
+{
+        int status;
+
+        status = serial_in(up, UART_MSR);
+
+        if ((status & UART_MSR_ANY_DELTA) == 0)
+                return;
+
+        if (status & UART_MSR_TERI)
+                up->port.icount.rng++;
+        if (status & UART_MSR_DDSR)
+                up->port.icount.dsr++;
+        /* We may only get DDCD when HW init and reset */
+        if (status & UART_MSR_DDCD)
+                uart_handle_dcd_change(&up->port, status & UART_MSR_DCD);
+        /* Will start/stop_tx accordingly */
+        if (status & UART_MSR_DCTS)
+                uart_handle_cts_change(&up->port, status & UART_MSR_CTS);
+
+        wake_up_interruptible(&up->port.state->port.delta_msr_wait);
+}
+
+/*
+ * This handles the interrupt from one port.
+ */
+static irqreturn_t port_irq(int irq, void *dev_id)
+{
+        struct uart_hsu_port *up = dev_id;
+        unsigned int iir, lsr;
+        unsigned long flags;
+
+        if (unlikely(!up->running))
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+        if (up->use_dma) {
+                lsr = serial_in(up, UART_LSR);
+                if (unlikely(lsr & (UART_LSR_BI | UART_LSR_PE |
+                                       UART_LSR_FE | UART_LSR_OE)))
+                        dev_warn(up->dev,
+                                "Got lsr irq while using DMA, lsr = 0x%2x\n",
+                                lsr);
+                check_modem_status(up);
+                spin_unlock_irqrestore(&up->port.lock, flags);
+                return IRQ_HANDLED;
+        }
+
+        iir = serial_in(up, UART_IIR);
+        if (iir & UART_IIR_NO_INT) {
+                spin_unlock_irqrestore(&up->port.lock, flags);
+                return IRQ_NONE;
+        }
+
+        lsr = serial_in(up, UART_LSR);
+        if (lsr & UART_LSR_DR)
+                receive_chars(up, &lsr);
+        check_modem_status(up);
+
+        /* lsr will be renewed during the receive_chars */
+        if (lsr & UART_LSR_THRE)
+                transmit_chars(up);
+
+        spin_unlock_irqrestore(&up->port.lock, flags);
+        return IRQ_HANDLED;
+}
+
+static inline void dma_chan_irq(struct hsu_dma_chan *chan)
+{
+        struct uart_hsu_port *up = chan->uport;
+        unsigned long flags;
+        u32 int_sts;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+
+        if (!up->use_dma || !up->running)
+                goto exit;
+
+        /*
+         * No matter what situation, need read clear the IRQ status
+         * There is a bug, see Errata 5, HSD 2900918
+         */
+        int_sts = chan_readl(chan, HSU_CH_SR);
+
+        /* Rx channel */
+        if (chan->dirt == DMA_FROM_DEVICE)
+                hsu_dma_rx(up, int_sts);
+
+        /* Tx channel */
+        if (chan->dirt == DMA_TO_DEVICE) {
+                chan_writel(chan, HSU_CH_CR, 0x0);
+                up->dma_tx_on = 0;
+                hsu_dma_tx(up);
+        }
+
+exit:
+        spin_unlock_irqrestore(&up->port.lock, flags);
+        return;
+}
+
+static irqreturn_t dma_irq(int irq, void *dev_id)
+{
+        struct hsu_port *hsu = dev_id;
+        u32 int_sts, i;
+
+        int_sts = mfd_readl(hsu, HSU_GBL_DMAISR);
+
+        /* Currently we only have 6 channels may be used */
+        for (i = 0; i < 6; i++) {
+                if (int_sts & 0x1)
+                        dma_chan_irq(&hsu->chans[i]);
+                int_sts >>= 1;
+        }
+
+        return IRQ_HANDLED;
+}
+
+static unsigned int serial_hsu_tx_empty(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned long flags;
+        unsigned int ret;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+        ret = serial_in(up, UART_LSR) & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
+        spin_unlock_irqrestore(&up->port.lock, flags);
+
+        return ret;
+}
+
+static unsigned int serial_hsu_get_mctrl(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned char status;
+        unsigned int ret;
+
+        status = serial_in(up, UART_MSR);
+
+        ret = 0;
+        if (status & UART_MSR_DCD)
+                ret |= TIOCM_CAR;
+        if (status & UART_MSR_RI)
+                ret |= TIOCM_RNG;
+        if (status & UART_MSR_DSR)
+                ret |= TIOCM_DSR;
+        if (status & UART_MSR_CTS)
+                ret |= TIOCM_CTS;
+        return ret;
+}
+
+static void serial_hsu_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned char mcr = 0;
+
+        if (mctrl & TIOCM_RTS)
+                mcr |= UART_MCR_RTS;
+        if (mctrl & TIOCM_DTR)
+                mcr |= UART_MCR_DTR;
+        if (mctrl & TIOCM_OUT1)
+                mcr |= UART_MCR_OUT1;
+        if (mctrl & TIOCM_OUT2)
+                mcr |= UART_MCR_OUT2;
+        if (mctrl & TIOCM_LOOP)
+                mcr |= UART_MCR_LOOP;
+
+        mcr |= up->mcr;
+
+        serial_out(up, UART_MCR, mcr);
+}
+
+static void serial_hsu_break_ctl(struct uart_port *port, int break_state)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned long flags;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+        if (break_state == -1)
+                up->lcr |= UART_LCR_SBC;
+        else
+                up->lcr &= ~UART_LCR_SBC;
+        serial_out(up, UART_LCR, up->lcr);
+        spin_unlock_irqrestore(&up->port.lock, flags);
+}
+
+/*
+ * What special to do:
+ * 1. chose the 64B fifo mode
+ * 2. make sure not to select half empty mode for A0 stepping
+ * 3. start dma or pio depends on configuration
+ * 4. we only allocate dma memory when needed
+ */
+static int serial_hsu_startup(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned long flags;
+
+        /*
+         * Clear the FIFO buffers and disable them.
+         * (they will be reenabled in set_termios())
+         */
+        serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO);
+        serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO |
+                        UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+        serial_out(up, UART_FCR, 0);
+
+        /* Clear the interrupt registers. */
+        (void) serial_in(up, UART_LSR);
+        (void) serial_in(up, UART_RX);
+        (void) serial_in(up, UART_IIR);
+        (void) serial_in(up, UART_MSR);
+
+        /* Now, initialize the UART, default is 8n1 */
+        serial_out(up, UART_LCR, UART_LCR_WLEN8);
+
+        spin_lock_irqsave(&up->port.lock, flags);
+
+        up->port.mctrl |= TIOCM_OUT2;
+        serial_hsu_set_mctrl(&up->port, up->port.mctrl);
+
+        /*
+         * Finally, enable interrupts.  Note: Modem status interrupts
+         * are set via set_termios(), which will be occurring imminently
+         * anyway, so we don't enable them here.
+         */
+        if (!up->use_dma)
+                up->ier = UART_IER_RLSI | UART_IER_RDI | UART_IER_RTOIE;
+        else
+                up->ier = 0;
+        serial_out(up, UART_IER, up->ier);
+
+        spin_unlock_irqrestore(&up->port.lock, flags);
+
+        /* DMA init */
+        if (up->use_dma) {
+                struct hsu_dma_buffer *dbuf;
+                struct circ_buf *xmit = &port->state->xmit;
+
+                up->dma_tx_on = 0;
+
+                /* First allocate the RX buffer */
+                dbuf = &up->rxbuf;
+                dbuf->buf = kzalloc(HSU_DMA_BUF_SIZE, GFP_KERNEL);
+                if (!dbuf->buf) {
+                        up->use_dma = 0;
+                        goto exit;
+                }
+                dbuf->dma_addr = dma_map_single(port->dev,
+                                                dbuf->buf,
+                                                HSU_DMA_BUF_SIZE,
+                                                DMA_FROM_DEVICE);
+                dbuf->dma_size = HSU_DMA_BUF_SIZE;
+
+                /* Start the RX channel right now */
+                hsu_dma_start_rx_chan(up->rxc, dbuf);
+
+                /* Next init the TX DMA */
+                dbuf = &up->txbuf;
+                dbuf->buf = xmit->buf;
+                dbuf->dma_addr = dma_map_single(port->dev,
+                                               dbuf->buf,
+                                               UART_XMIT_SIZE,
+                                               DMA_TO_DEVICE);
+                dbuf->dma_size = UART_XMIT_SIZE;
+
+                /* This should not be changed all around */
+                chan_writel(up->txc, HSU_CH_BSR, 32);
+                chan_writel(up->txc, HSU_CH_MOTSR, 4);
+                dbuf->ofs = 0;
+        }
+
+exit:
+         /* And clear the interrupt registers again for luck. */
+        (void) serial_in(up, UART_LSR);
+        (void) serial_in(up, UART_RX);
+        (void) serial_in(up, UART_IIR);
+        (void) serial_in(up, UART_MSR);
+
+        up->running = 1;
+        return 0;
+}
+
+static void serial_hsu_shutdown(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        unsigned long flags;
+
+        del_timer_sync(&up->rxc->rx_timer);
+
+        /* Disable interrupts from this port */
+        up->ier = 0;
+        serial_out(up, UART_IER, 0);
+        up->running = 0;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+        up->port.mctrl &= ~TIOCM_OUT2;
+        serial_hsu_set_mctrl(&up->port, up->port.mctrl);
+        spin_unlock_irqrestore(&up->port.lock, flags);
+
+        /* Disable break condition and FIFOs */
+        serial_out(up, UART_LCR, serial_in(up, UART_LCR) & ~UART_LCR_SBC);
+        serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO |
+                                  UART_FCR_CLEAR_RCVR |
+                                  UART_FCR_CLEAR_XMIT);
+        serial_out(up, UART_FCR, 0);
+}
+
+static void
+serial_hsu_set_termios(struct uart_port *port, struct ktermios *termios,
+                       struct ktermios *old)
+{
+        struct uart_hsu_port *up =
+                        container_of(port, struct uart_hsu_port, port);
+        struct tty_struct *tty = port->state->port.tty;
+        unsigned char cval, fcr = 0;
+        unsigned long flags;
+        unsigned int baud, quot;
+        u32 mul = 0x3600;
+        u32 ps = 0x10;
+
+        switch (termios->c_cflag & CSIZE) {
+        case CS5:
+                cval = UART_LCR_WLEN5;
+                break;
+        case CS6:
+                cval = UART_LCR_WLEN6;
+                break;
+        case CS7:
+                cval = UART_LCR_WLEN7;
+                break;
+        default:
+        case CS8:
+                cval = UART_LCR_WLEN8;
+                break;
+        }
+
+        /* CMSPAR isn't supported by this driver */
+        if (tty)
+                tty->termios->c_cflag &= ~CMSPAR;
+
+        if (termios->c_cflag & CSTOPB)
+                cval |= UART_LCR_STOP;
+        if (termios->c_cflag & PARENB)
+                cval |= UART_LCR_PARITY;
+        if (!(termios->c_cflag & PARODD))
+                cval |= UART_LCR_EPAR;
+
+        /*
+         * For those basic low baud rate we can get the direct
+         * scalar from 2746800, like 115200 = 2746800/24, for those
+         * higher baud rate, we have to handle them case by case,
+         * but DIV reg is never touched as its default value 0x3d09
+         */
+        baud = uart_get_baud_rate(port, termios, old, 0, 4000000);
+        quot = uart_get_divisor(port, baud);
+
+        switch (baud) {
+        case 3500000:
+                mul = 0x3345;
+                ps = 0xC;
+                quot = 1;
+                break;
+        case 2500000:
+                mul = 0x2710;
+                ps = 0x10;
+                quot = 1;
+                break;
+        case 18432000:
+                mul = 0x2400;
+                ps = 0x10;
+                quot = 1;
+                break;
+        case 1500000:
+                mul = 0x1D4C;
+                ps = 0xc;
+                quot = 1;
+                break;
+        default:
+                ;
+        }
+
+        if ((up->port.uartclk / quot) < (2400 * 16))
+                fcr = UART_FCR_ENABLE_FIFO | UART_FCR_HSU_64_1B;
+        else if ((up->port.uartclk / quot) < (230400 * 16))
+                fcr = UART_FCR_ENABLE_FIFO | UART_FCR_HSU_64_16B;
+        else
+                fcr = UART_FCR_ENABLE_FIFO | UART_FCR_HSU_64_32B;
+
+        fcr |= UART_FCR_HSU_64B_FIFO;
+#ifdef MFD_HSU_A0_STEPPING
+        /* A0 doesn't support half empty IRQ */
+        fcr |= UART_FCR_FULL_EMPT_TXI;
+#endif
+
+        /*
+         * Ok, we're now changing the port state.  Do it with
+         * interrupts disabled.
+         */
+        spin_lock_irqsave(&up->port.lock, flags);
+
+        /* Update the per-port timeout */
+        uart_update_timeout(port, termios->c_cflag, baud);
+
+        up->port.read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
+        if (termios->c_iflag & INPCK)
+                up->port.read_status_mask |= UART_LSR_FE | UART_LSR_PE;
+        if (termios->c_iflag & (BRKINT | PARMRK))
+                up->port.read_status_mask |= UART_LSR_BI;
+
+        /* Characters to ignore */
+        up->port.ignore_status_mask = 0;
+        if (termios->c_iflag & IGNPAR)
+                up->port.ignore_status_mask |= UART_LSR_PE | UART_LSR_FE;
+        if (termios->c_iflag & IGNBRK) {
+                up->port.ignore_status_mask |= UART_LSR_BI;
+                /*
+                 * If we're ignoring parity and break indicators,
+                 * ignore overruns too (for real raw support).
+                 */
+                if (termios->c_iflag & IGNPAR)
+                        up->port.ignore_status_mask |= UART_LSR_OE;
+        }
+
+        /* Ignore all characters if CREAD is not set */
+        if ((termios->c_cflag & CREAD) == 0)
+                up->port.ignore_status_mask |= UART_LSR_DR;
+
+        /*
+         * CTS flow control flag and modem status interrupts, disable
+         * MSI by default
+         */
+        up->ier &= ~UART_IER_MSI;
+        if (UART_ENABLE_MS(&up->port, termios->c_cflag))
+                up->ier |= UART_IER_MSI;
+
+        serial_out(up, UART_IER, up->ier);
+
+        if (termios->c_cflag & CRTSCTS)
+                up->mcr |= UART_MCR_AFE | UART_MCR_RTS;
+        else
+                up->mcr &= ~UART_MCR_AFE;
+
+        serial_out(up, UART_LCR, cval | UART_LCR_DLAB); /* set DLAB */
+        serial_out(up, UART_DLL, quot & 0xff);          /* LS of divisor */
+        serial_out(up, UART_DLM, quot >> 8);            /* MS of divisor */
+        serial_out(up, UART_LCR, cval);                 /* reset DLAB */
+        serial_out(up, UART_MUL, mul);                  /* set MUL */
+        serial_out(up, UART_PS, ps);                    /* set PS */
+        up->lcr = cval;                                 /* Save LCR */
+        serial_hsu_set_mctrl(&up->port, up->port.mctrl);
+        serial_out(up, UART_FCR, fcr);
+        spin_unlock_irqrestore(&up->port.lock, flags);
+}
+
+static void
+serial_hsu_pm(struct uart_port *port, unsigned int state,
+              unsigned int oldstate)
+{
+}
+
+static void serial_hsu_release_port(struct uart_port *port)
+{
+}
+
+static int serial_hsu_request_port(struct uart_port *port)
+{
+        return 0;
+}
+
+static void serial_hsu_config_port(struct uart_port *port, int flags)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        up->port.type = PORT_MFD;
+}
+
+static int
+serial_hsu_verify_port(struct uart_port *port, struct serial_struct *ser)
+{
+        /* We don't want the core code to modify any port params */
+        return -EINVAL;
+}
+
+static const char *
+serial_hsu_type(struct uart_port *port)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+        return up->name;
+}
+
+/* Mainly for uart console use */
+static struct uart_hsu_port *serial_hsu_ports[3];
+static struct uart_driver serial_hsu_reg;
+
+#ifdef CONFIG_SERIAL_MFD_HSU_CONSOLE
+
+#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
+
+/* Wait for transmitter & holding register to empty */
+static inline void wait_for_xmitr(struct uart_hsu_port *up)
+{
+        unsigned int status, tmout = 1000;
+
+        /* Wait up to 1ms for the character to be sent. */
+        do {
+                status = serial_in(up, UART_LSR);
+
+                if (status & UART_LSR_BI)
+                        up->lsr_break_flag = UART_LSR_BI;
+
+                if (--tmout == 0)
+                        break;
+                udelay(1);
+        } while (!(status & BOTH_EMPTY));
+
+        /* Wait up to 1s for flow control if necessary */
+        if (up->port.flags & UPF_CONS_FLOW) {
+                tmout = 1000000;
+                while (--tmout &&
+                       ((serial_in(up, UART_MSR) & UART_MSR_CTS) == 0))
+                        udelay(1);
+        }
+}
+
+static void serial_hsu_console_putchar(struct uart_port *port, int ch)
+{
+        struct uart_hsu_port *up =
+                container_of(port, struct uart_hsu_port, port);
+
+        wait_for_xmitr(up);
+        serial_out(up, UART_TX, ch);
+}
+
+/*
+ * Print a string to the serial port trying not to disturb
+ * any possible real use of the port...
+ *
+ *      The console_lock must be held when we get here.
+ */
+static void
+serial_hsu_console_write(struct console *co, const char *s, unsigned int count)
+{
+        struct uart_hsu_port *up = serial_hsu_ports[co->index];
+        unsigned long flags;
+        unsigned int ier;
+        int locked = 1;
+
+        local_irq_save(flags);
+        if (up->port.sysrq)
+                locked = 0;
+        else if (oops_in_progress) {
+                locked = spin_trylock(&up->port.lock);
+        } else
+                spin_lock(&up->port.lock);
+
+        /* First save the IER then disable the interrupts */
+        ier = serial_in(up, UART_IER);
+        serial_out(up, UART_IER, 0);
+
+        uart_console_write(&up->port, s, count, serial_hsu_console_putchar);
+
+        /*
+         * Finally, wait for transmitter to become empty
+         * and restore the IER
+         */
+        wait_for_xmitr(up);
+        serial_out(up, UART_IER, ier);
+
+        if (locked)
+                spin_unlock(&up->port.lock);
+        local_irq_restore(flags);
+}
+
+static struct console serial_hsu_console;
+
+static int __init
+serial_hsu_console_setup(struct console *co, char *options)
+{
+        struct uart_hsu_port *up;
+        int baud = 115200;
+        int bits = 8;
+        int parity = 'n';
+        int flow = 'n';
+        int ret;
+
+        if (co->index == -1 || co->index >= serial_hsu_reg.nr)
+                co->index = 0;
+        up = serial_hsu_ports[co->index];
+        if (!up)
+                return -ENODEV;
+
+        if (options)
+                uart_parse_options(options, &baud, &parity, &bits, &flow);
+
+        ret = uart_set_options(&up->port, co, baud, parity, bits, flow);
+
+        return ret;
+}
+
+static struct console serial_hsu_console = {
+        .name           = "ttyMFD",
+        .write          = serial_hsu_console_write,
+        .device         = uart_console_device,
+        .setup          = serial_hsu_console_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = 2,
+        .data           = &serial_hsu_reg,
+};
+#endif
+
+struct uart_ops serial_hsu_pops = {
+        .tx_empty       = serial_hsu_tx_empty,
+        .set_mctrl      = serial_hsu_set_mctrl,
+        .get_mctrl      = serial_hsu_get_mctrl,
+        .stop_tx        = serial_hsu_stop_tx,
+        .start_tx       = serial_hsu_start_tx,
+        .stop_rx        = serial_hsu_stop_rx,
+        .enable_ms      = serial_hsu_enable_ms,
+        .break_ctl      = serial_hsu_break_ctl,
+        .startup        = serial_hsu_startup,
+        .shutdown       = serial_hsu_shutdown,
+        .set_termios    = serial_hsu_set_termios,
+        .pm             = serial_hsu_pm,
+        .type           = serial_hsu_type,
+        .release_port   = serial_hsu_release_port,
+        .request_port   = serial_hsu_request_port,
+        .config_port    = serial_hsu_config_port,
+        .verify_port    = serial_hsu_verify_port,
+};
+
+static struct uart_driver serial_hsu_reg = {
+        .owner          = THIS_MODULE,
+        .driver_name    = "MFD serial",
+        .dev_name       = "ttyMFD",
+        .major          = TTY_MAJOR,
+        .minor          = 128,
+        .nr             = 3,
+};
+
+#ifdef CONFIG_PM
+static int serial_hsu_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        void *priv = pci_get_drvdata(pdev);
+        struct uart_hsu_port *up;
+
+        /* Make sure this is not the internal dma controller */
+        if (priv && (pdev->device != 0x081E)) {
+                up = priv;
+                uart_suspend_port(&serial_hsu_reg, &up->port);
+        }
+
+        pci_save_state(pdev);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        return 0;
+}
+
+static int serial_hsu_resume(struct pci_dev *pdev)
+{
+        void *priv = pci_get_drvdata(pdev);
+        struct uart_hsu_port *up;
+        int ret;
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                dev_warn(&pdev->dev,
+                        "HSU: can't re-enable device, try to continue\n");
+
+        if (priv && (pdev->device != 0x081E)) {
+                up = priv;
+                uart_resume_port(&serial_hsu_reg, &up->port);
+        }
+        return 0;
+}
+#else
+#define serial_hsu_suspend      NULL
+#define serial_hsu_resume       NULL
+#endif
+
+/* temp global pointer before we settle down on using one or four PCI dev */
+static struct hsu_port *phsu;
+
+static int serial_hsu_probe(struct pci_dev *pdev,
+                                const struct pci_device_id *ent)
+{
+        struct uart_hsu_port *uport;
+        int index, ret;
+
+        printk(KERN_INFO "HSU: found PCI Serial controller(ID: %04x:%04x)\n",
+                pdev->vendor, pdev->device);
+
+        switch (pdev->device) {
+        case 0x081B:
+                index = 0;
+                break;
+        case 0x081C:
+                index = 1;
+                break;
+        case 0x081D:
+                index = 2;
+                break;
+        case 0x081E:
+                /* internal DMA controller */
+                index = 3;
+                break;
+        default:
+                dev_err(&pdev->dev, "HSU: out of index!");
+                return -ENODEV;
+        }
+
+        ret = pci_enable_device(pdev);
+        if (ret)
+                return ret;
+
+        if (index == 3) {
+                /* DMA controller */
+                ret = request_irq(pdev->irq, dma_irq, 0, "hsu_dma", phsu);
+                if (ret) {
+                        dev_err(&pdev->dev, "can not get IRQ\n");
+                        goto err_disable;
+                }
+                pci_set_drvdata(pdev, phsu);
+        } else {
+                /* UART port 0~2 */
+                uport = &phsu->port[index];
+                uport->port.irq = pdev->irq;
+                uport->port.dev = &pdev->dev;
+                uport->dev = &pdev->dev;
+
+                ret = request_irq(pdev->irq, port_irq, 0, uport->name, uport);
+                if (ret) {
+                        dev_err(&pdev->dev, "can not get IRQ\n");
+                        goto err_disable;
+                }
+                uart_add_one_port(&serial_hsu_reg, &uport->port);
+
+#ifdef CONFIG_SERIAL_MFD_HSU_CONSOLE
+                if (index == 2) {
+                        register_console(&serial_hsu_console);
+                        uport->port.cons = &serial_hsu_console;
+                }
+#endif
+                pci_set_drvdata(pdev, uport);
+        }
+
+        return 0;
+
+err_disable:
+        pci_disable_device(pdev);
+        return ret;
+}
+
+static void hsu_dma_rx_timeout(unsigned long data)
+{
+        struct hsu_dma_chan *chan = (void *)data;
+        struct uart_hsu_port *up = chan->uport;
+        struct hsu_dma_buffer *dbuf = &up->rxbuf;
+        int count = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&up->port.lock, flags);
+
+        count = chan_readl(chan, HSU_CH_D0SAR) - dbuf->dma_addr;
+
+        if (!count) {
+                mod_timer(&chan->rx_timer, jiffies + HSU_DMA_TIMEOUT_CHECK_FREQ);
+                goto exit;
+        }
+
+        hsu_dma_rx(up, 0);
+exit:
+        spin_unlock_irqrestore(&up->port.lock, flags);
+}
+
+static void hsu_global_init(void)
+{
+        struct hsu_port *hsu;
+        struct uart_hsu_port *uport;
+        struct hsu_dma_chan *dchan;
+        int i, ret;
+
+        hsu = kzalloc(sizeof(struct hsu_port), GFP_KERNEL);
+        if (!hsu)
+                return;
+
+        /* Get basic io resource and map it */
+        hsu->paddr = 0xffa28000;
+        hsu->iolen = 0x1000;
+
+        if (!(request_mem_region(hsu->paddr, hsu->iolen, "HSU global")))
+                pr_warning("HSU: error in request mem region\n");
+
+        hsu->reg = ioremap_nocache((unsigned long)hsu->paddr, hsu->iolen);
+        if (!hsu->reg) {
+                pr_err("HSU: error in ioremap\n");
+                ret = -ENOMEM;
+                goto err_free_region;
+        }
+
+        /* Initialise the 3 UART ports */
+        uport = hsu->port;
+        for (i = 0; i < 3; i++) {
+                uport->port.type = PORT_MFD;
+                uport->port.iotype = UPIO_MEM;
+                uport->port.mapbase = (resource_size_t)hsu->paddr
+                                        + HSU_PORT_REG_OFFSET
+                                        + i * HSU_PORT_REG_LENGTH;
+                uport->port.membase = hsu->reg + HSU_PORT_REG_OFFSET
+                                        + i * HSU_PORT_REG_LENGTH;
+
+                sprintf(uport->name, "hsu_port%d", i);
+                uport->port.fifosize = 64;
+                uport->port.ops = &serial_hsu_pops;
+                uport->port.line = i;
+                uport->port.flags = UPF_IOREMAP;
+                /* set the scalable maxim support rate to 2746800 bps */
+                uport->port.uartclk = 115200 * 24 * 16;
+
+                uport->running = 0;
+                uport->txc = &hsu->chans[i * 2];
+                uport->rxc = &hsu->chans[i * 2 + 1];
+
+                serial_hsu_ports[i] = uport;
+                uport->index = i;
+                uport++;
+        }
+
+        /* Initialise 6 dma channels */
+        dchan = hsu->chans;
+        for (i = 0; i < 6; i++) {
+                dchan->id = i;
+                dchan->dirt = (i & 0x1) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+                dchan->uport = &hsu->port[i/2];
+                dchan->reg = hsu->reg + HSU_DMA_CHANS_REG_OFFSET +
+                                i * HSU_DMA_CHANS_REG_LENGTH;
+
+                /* Work around for RX */
+                if (dchan->dirt == DMA_FROM_DEVICE) {
+                        init_timer(&dchan->rx_timer);
+                        dchan->rx_timer.function = hsu_dma_rx_timeout;
+                        dchan->rx_timer.data = (unsigned long)dchan;
+                }
+                dchan++;
+        }
+
+        phsu = hsu;
+
+        hsu_debugfs_init(hsu);
+        return;
+
+err_free_region:
+        release_mem_region(hsu->paddr, hsu->iolen);
+        kfree(hsu);
+        return;
+}
+
+static void serial_hsu_remove(struct pci_dev *pdev)
+{
+        struct hsu_port *hsu;
+        int i;
+
+        hsu = pci_get_drvdata(pdev);
+        if (!hsu)
+                return;
+
+        for (i = 0; i < 3; i++)
+                uart_remove_one_port(&serial_hsu_reg, &hsu->port[i].port);
+
+        pci_set_drvdata(pdev, NULL);
+        free_irq(hsu->irq, hsu);
+        pci_disable_device(pdev);
+}
+
+/* First 3 are UART ports, and the 4th is the DMA */
+static const struct pci_device_id pci_ids[] __devinitdata = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081E) },
+        {},
+};
+
+static struct pci_driver hsu_pci_driver = {
+        .name =         "HSU serial",
+        .id_table =     pci_ids,
+        .probe =        serial_hsu_probe,
+        .remove =       __devexit_p(serial_hsu_remove),
+        .suspend =      serial_hsu_suspend,
+        .resume =       serial_hsu_resume,
+};
+
+static int __init hsu_pci_init(void)
+{
+        int ret;
+
+        hsu_global_init();
+
+        ret = uart_register_driver(&serial_hsu_reg);
+        if (ret)
+                return ret;
+
+        return pci_register_driver(&hsu_pci_driver);
+}
+
+static void __exit hsu_pci_exit(void)
+{
+        pci_unregister_driver(&hsu_pci_driver);
+        uart_unregister_driver(&serial_hsu_reg);
+
+        hsu_debugfs_remove(phsu);
+
+        kfree(phsu);
+}
+
+module_init(hsu_pci_init);
+module_exit(hsu_pci_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:medfield-hsu");
diff --git a/drivers/serial/mrst_max3110.c b/drivers/serial/mrst_max3110.c
new file mode 100644
index 000000000000..f6ad1ecbff79
--- /dev/null
+++ b/drivers/serial/mrst_max3110.c
@@ -0,0 +1,844 @@
+/*
+ *  max3110.c - spi uart protocol driver for Maxim 3110 on Moorestown
+ *
+ *  Copyright (C) Intel 2008 Feng Tang <feng.tang@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/*
+ * Note:
+ * 1. From Max3110 spec, the Rx FIFO has 8 words, while the Tx FIFO only has
+ *    1 word. If SPI master controller doesn't support sclk frequency change,
+ *    then the char need be sent out one by one with some delay
+ *
+ * 2. Currently only RX availabe interrrupt is used, no need for waiting TXE
+ *    interrupt for a low speed UART device
+ */
+
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/init.h>
+#include <linux/console.h>
+#include <linux/sysrq.h>
+#include <linux/platform_device.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <linux/serial_core.h>
+#include <linux/serial_reg.h>
+
+#include <linux/kthread.h>
+#include <linux/delay.h>
+#include <asm/atomic.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/dw_spi.h>
+
+#include "mrst_max3110.h"
+
+#define PR_FMT  "mrst_max3110: "
+
+#define UART_TX_NEEDED 1
+#define CON_TX_NEEDED  2
+#define BIT_IRQ_PENDING    3
+
+struct uart_max3110 {
+        struct uart_port port;
+        struct spi_device *spi;
+        char *name;
+
+        wait_queue_head_t wq;
+        struct task_struct *main_thread;
+        struct task_struct *read_thread;
+        struct mutex thread_mutex;;
+
+        u32 baud;
+        u16 cur_conf;
+        u8 clock;
+        u8 parity, word_7bits;
+
+        unsigned long uart_flags;
+
+        /* console related */
+        struct circ_buf con_xmit;
+
+        /* irq related */
+        u16 irq;
+};
+
+/* global data structure, may need be removed */
+struct uart_max3110 *pmax;
+static inline void receive_char(struct uart_max3110 *max, u8 ch);
+static void receive_chars(struct uart_max3110 *max,
+                                unsigned char *str, int len);
+static int max3110_read_multi(struct uart_max3110 *max, int len, u8 *buf);
+static void max3110_console_receive(struct uart_max3110 *max);
+
+int max3110_write_then_read(struct uart_max3110 *max,
+                const u8 *txbuf, u8 *rxbuf, unsigned len, int always_fast)
+{
+        struct spi_device *spi = max->spi;
+        struct spi_message      message;
+        struct spi_transfer     x;
+        int ret;
+
+        if (!txbuf || !rxbuf)
+                return -EINVAL;
+
+        spi_message_init(&message);
+        memset(&x, 0, sizeof x);
+        x.len = len;
+        x.tx_buf = txbuf;
+        x.rx_buf = rxbuf;
+        spi_message_add_tail(&x, &message);
+
+        if (always_fast)
+                x.speed_hz = 3125000;
+        else if (max->baud)
+                x.speed_hz = max->baud;
+
+        /* Do the i/o */
+        ret = spi_sync(spi, &message);
+        return ret;
+}
+
+/* Write a u16 to the device, and return one u16 read back */
+int max3110_out(struct uart_max3110 *max, const u16 out)
+{
+        u16 tmp;
+        int ret;
+
+        ret = max3110_write_then_read(max, (u8 *)&out, (u8 *)&tmp, 2, 1);
+        if (ret)
+                return ret;
+
+        /* If some valid data is read back */
+        if (tmp & MAX3110_READ_DATA_AVAILABLE)
+                receive_char(max, (tmp & 0xff));
+
+        return ret;
+}
+
+#define MAX_READ_LEN    20
+/*
+ * This is usually used to read data from SPIC RX FIFO, which doesn't
+ * need any delay like flushing character out. It returns how many
+ * valide bytes are read back
+ */
+static int max3110_read_multi(struct uart_max3110 *max, int len, u8 *buf)
+{
+        u16 out[MAX_READ_LEN], in[MAX_READ_LEN];
+        u8 *pbuf, valid_str[MAX_READ_LEN];
+        int i, j, bytelen;
+
+        if (len > MAX_READ_LEN) {
+                pr_err(PR_FMT "read len %d is too large\n", len);
+                return 0;
+        }
+
+        bytelen = len * 2;
+        memset(out, 0, bytelen);
+        memset(in, 0, bytelen);
+
+        if (max3110_write_then_read(max, (u8 *)out, (u8 *)in, bytelen, 1))
+                return 0;
+
+        /* If caller don't provide a buffer, then handle received char */
+        pbuf = buf ? buf : valid_str;
+
+        for (i = 0, j = 0; i < len; i++) {
+                if (in[i] & MAX3110_READ_DATA_AVAILABLE)
+                        pbuf[j++] = (u8)(in[i] & 0xff);
+        }
+
+        if (j && (pbuf == valid_str))
+                receive_chars(max, valid_str, j);
+
+        return j;
+}
+
+static void serial_m3110_con_putchar(struct uart_port *port, int ch)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+        struct circ_buf *xmit = &max->con_xmit;
+
+        if (uart_circ_chars_free(xmit)) {
+                xmit->buf[xmit->head] = (char)ch;
+                xmit->head = (xmit->head + 1) & (PAGE_SIZE - 1);
+        }
+
+
+        if (!test_and_set_bit(CON_TX_NEEDED, &max->uart_flags))
+                wake_up_process(max->main_thread);
+}
+
+/*
+ * Print a string to the serial port trying not to disturb
+ * any possible real use of the port...
+ *
+ *      The console_lock must be held when we get here.
+ */
+static void serial_m3110_con_write(struct console *co,
+                                const char *s, unsigned int count)
+{
+        if (!pmax)
+                return;
+
+        uart_console_write(&pmax->port, s, count, serial_m3110_con_putchar);
+}
+
+static int __init
+serial_m3110_con_setup(struct console *co, char *options)
+{
+        struct uart_max3110 *max = pmax;
+        int baud = 115200;
+        int bits = 8;
+        int parity = 'n';
+        int flow = 'n';
+
+        pr_info(PR_FMT "setting up console\n");
+
+        if (!max) {
+                pr_err(PR_FMT "pmax is NULL, return");
+                return -ENODEV;
+        }
+
+        if (options)
+                uart_parse_options(options, &baud, &parity, &bits, &flow);
+
+        return uart_set_options(&max->port, co, baud, parity, bits, flow);
+}
+
+static struct tty_driver *serial_m3110_con_device(struct console *co,
+                                                        int *index)
+{
+        struct uart_driver *p = co->data;
+        *index = co->index;
+        return p->tty_driver;
+}
+
+static struct uart_driver serial_m3110_reg;
+static struct console serial_m3110_console = {
+        .name           = "ttyS",
+        .write          = serial_m3110_con_write,
+        .device         = serial_m3110_con_device,
+        .setup          = serial_m3110_con_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
+        .data           = &serial_m3110_reg,
+};
+
+#define MRST_CONSOLE    (&serial_m3110_console)
+
+static unsigned int serial_m3110_tx_empty(struct uart_port *port)
+{
+        return 1;
+}
+
+static void serial_m3110_stop_tx(struct uart_port *port)
+{
+        return;
+}
+
+/* stop_rx will be called in spin_lock env */
+static void serial_m3110_stop_rx(struct uart_port *port)
+{
+        return;
+}
+
+#define WORDS_PER_XFER  128
+static inline void send_circ_buf(struct uart_max3110 *max,
+                                struct circ_buf *xmit)
+{
+        int len, left = 0;
+        u16 obuf[WORDS_PER_XFER], ibuf[WORDS_PER_XFER];
+        u8 valid_str[WORDS_PER_XFER];
+        int i, j;
+
+        while (!uart_circ_empty(xmit)) {
+                left = uart_circ_chars_pending(xmit);
+                while (left) {
+                        len = (left >= WORDS_PER_XFER) ? WORDS_PER_XFER : left;
+
+                        memset(obuf, 0, len * 2);
+                        memset(ibuf, 0, len * 2);
+                        for (i = 0; i < len; i++) {
+                                obuf[i] = (u8)xmit->buf[xmit->tail] | WD_TAG;
+                                xmit->tail = (xmit->tail + 1) &
+                                                (UART_XMIT_SIZE - 1);
+                        }
+                        max3110_write_then_read(max, (u8 *)obuf,
+                                                (u8 *)ibuf, len * 2, 0);
+
+                        for (i = 0, j = 0; i < len; i++) {
+                                if (ibuf[i] & MAX3110_READ_DATA_AVAILABLE)
+                                        valid_str[j++] = (u8)(ibuf[i] & 0xff);
+                        }
+
+                        if (j)
+                                receive_chars(max, valid_str, j);
+
+                        max->port.icount.tx += len;
+                        left -= len;
+                }
+        }
+}
+
+static void transmit_char(struct uart_max3110 *max)
+{
+        struct uart_port *port = &max->port;
+        struct circ_buf *xmit = &port->state->xmit;
+
+        if (uart_circ_empty(xmit) || uart_tx_stopped(port))
+                return;
+
+        send_circ_buf(max, xmit);
+
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(port);
+
+        if (uart_circ_empty(xmit))
+                serial_m3110_stop_tx(port);
+}
+
+/* This will be called by uart_write() and tty_write, can't
+ * go to sleep */
+static void serial_m3110_start_tx(struct uart_port *port)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+
+        if (!test_and_set_bit(UART_TX_NEEDED, &max->uart_flags))
+                wake_up_process(max->main_thread);
+}
+
+static void receive_chars(struct uart_max3110 *max, unsigned char *str, int len)
+{
+        struct uart_port *port = &max->port;
+        struct tty_struct *tty;
+        int usable;
+
+        /* If uart is not opened, just return */
+        if (!port->state)
+                return;
+
+        tty = port->state->port.tty;
+        if (!tty)
+                return; /* receive some char before the tty is opened */
+
+        while (len) {
+                usable = tty_buffer_request_room(tty, len);
+                if (usable) {
+                        tty_insert_flip_string(tty, str, usable);
+                        str += usable;
+                        port->icount.rx += usable;
+                        tty_flip_buffer_push(tty);
+                }
+                len -= usable;
+        }
+}
+
+static inline void receive_char(struct uart_max3110 *max, u8 ch)
+{
+        receive_chars(max, &ch, 1);
+}
+
+static void max3110_console_receive(struct uart_max3110 *max)
+{
+        int loop = 1, num, total = 0;
+        u8 recv_buf[512], *pbuf;
+
+        pbuf = recv_buf;
+        do {
+                num = max3110_read_multi(max, 8, pbuf);
+
+                if (num) {
+                        loop = 10;
+                        pbuf += num;
+                        total += num;
+
+                        if (total >= 500) {
+                                receive_chars(max, recv_buf, total);
+                                pbuf = recv_buf;
+                                total = 0;
+                        }
+                }
+        } while (--loop);
+
+        if (total)
+                receive_chars(max, recv_buf, total);
+}
+
+static int max3110_main_thread(void *_max)
+{
+        struct uart_max3110 *max = _max;
+        wait_queue_head_t *wq = &max->wq;
+        int ret = 0;
+        struct circ_buf *xmit = &max->con_xmit;
+
+        init_waitqueue_head(wq);
+        pr_info(PR_FMT "start main thread\n");
+
+        do {
+                wait_event_interruptible(*wq, max->uart_flags || kthread_should_stop());
+
+                mutex_lock(&max->thread_mutex);
+
+                if (test_and_clear_bit(BIT_IRQ_PENDING, &max->uart_flags))
+                        max3110_console_receive(max);
+
+                /* first handle console output */
+                if (test_and_clear_bit(CON_TX_NEEDED, &max->uart_flags))
+                        send_circ_buf(max, xmit);
+
+                /* handle uart output */
+                if (test_and_clear_bit(UART_TX_NEEDED, &max->uart_flags))
+                        transmit_char(max);
+
+                mutex_unlock(&max->thread_mutex);
+
+        } while (!kthread_should_stop());
+
+        return ret;
+}
+
+#ifdef CONFIG_MRST_MAX3110_IRQ
+static irqreturn_t serial_m3110_irq(int irq, void *dev_id)
+{
+        struct uart_max3110 *max = dev_id;
+
+        /* max3110's irq is a falling edge, not level triggered,
+         * so no need to disable the irq */
+        if (!test_and_set_bit(BIT_IRQ_PENDING, &max->uart_flags))
+                wake_up_process(max->main_thread);
+
+        return IRQ_HANDLED;
+}
+#else
+/* if don't use RX IRQ, then need a thread to polling read */
+static int max3110_read_thread(void *_max)
+{
+        struct uart_max3110 *max = _max;
+
+        pr_info(PR_FMT "start read thread\n");
+        do {
+                mutex_lock(&max->thread_mutex);
+                max3110_console_receive(max);
+                mutex_unlock(&max->thread_mutex);
+
+                set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(HZ / 20);
+        } while (!kthread_should_stop());
+
+        return 0;
+}
+#endif
+
+static int serial_m3110_startup(struct uart_port *port)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+        u16 config = 0;
+        int ret = 0;
+
+        if (port->line != 0)
+                pr_err(PR_FMT "uart port startup failed\n");
+
+        /* firstly disable all IRQ and config it to 115200, 8n1 */
+        config = WC_TAG | WC_FIFO_ENABLE
+                        | WC_1_STOPBITS
+                        | WC_8BIT_WORD
+                        | WC_BAUD_DR2;
+        ret = max3110_out(max, config);
+
+        /* as we use thread to handle tx/rx, need set low latency */
+        port->state->port.tty->low_latency = 1;
+
+#ifdef CONFIG_MRST_MAX3110_IRQ
+        ret = request_irq(max->irq, serial_m3110_irq,
+                                IRQ_TYPE_EDGE_FALLING, "max3110", max);
+        if (ret)
+                return ret;
+
+        /* enable RX IRQ only */
+        config |= WC_RXA_IRQ_ENABLE;
+        max3110_out(max, config);
+#else
+        /* if IRQ is disabled, start a read thread for input data */
+        max->read_thread =
+                kthread_run(max3110_read_thread, max, "max3110_read");
+#endif
+
+        max->cur_conf = config;
+        return 0;
+}
+
+static void serial_m3110_shutdown(struct uart_port *port)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+        u16 config;
+
+        if (max->read_thread) {
+                kthread_stop(max->read_thread);
+                max->read_thread = NULL;
+        }
+
+#ifdef CONFIG_MRST_MAX3110_IRQ
+        free_irq(max->irq, max);
+#endif
+
+        /* Disable interrupts from this port */
+        config = WC_TAG | WC_SW_SHDI;
+        max3110_out(max, config);
+}
+
+static void serial_m3110_release_port(struct uart_port *port)
+{
+}
+
+static int serial_m3110_request_port(struct uart_port *port)
+{
+        return 0;
+}
+
+static void serial_m3110_config_port(struct uart_port *port, int flags)
+{
+        /* give it fake type */
+        port->type = PORT_PXA;
+}
+
+static int
+serial_m3110_verify_port(struct uart_port *port, struct serial_struct *ser)
+{
+        /* we don't want the core code to modify any port params */
+        return -EINVAL;
+}
+
+
+static const char *serial_m3110_type(struct uart_port *port)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+        return max->name;
+}
+
+static void
+serial_m3110_set_termios(struct uart_port *port, struct ktermios *termios,
+                       struct ktermios *old)
+{
+        struct uart_max3110 *max =
+                container_of(port, struct uart_max3110, port);
+        unsigned char cval;
+        unsigned int baud, parity = 0;
+        int clk_div = -1;
+        u16 new_conf = max->cur_conf;
+
+        switch (termios->c_cflag & CSIZE) {
+        case CS7:
+                cval = UART_LCR_WLEN7;
+                new_conf |= WC_7BIT_WORD;
+                break;
+        default:
+        case CS8:
+                cval = UART_LCR_WLEN8;
+                new_conf |= WC_8BIT_WORD;
+                break;
+        }
+
+        baud = uart_get_baud_rate(port, termios, old, 0, 230400);
+
+        /* first calc the div for 1.8MHZ clock case */
+        switch (baud) {
+        case 300:
+                clk_div = WC_BAUD_DR384;
+                break;
+        case 600:
+                clk_div = WC_BAUD_DR192;
+                break;
+        case 1200:
+                clk_div = WC_BAUD_DR96;
+                break;
+        case 2400:
+                clk_div = WC_BAUD_DR48;
+                break;
+        case 4800:
+                clk_div = WC_BAUD_DR24;
+                break;
+        case 9600:
+                clk_div = WC_BAUD_DR12;
+                break;
+        case 19200:
+                clk_div = WC_BAUD_DR6;
+                break;
+        case 38400:
+                clk_div = WC_BAUD_DR3;
+                break;
+        case 57600:
+                clk_div = WC_BAUD_DR2;
+                break;
+        case 115200:
+                clk_div = WC_BAUD_DR1;
+                break;
+        case 230400:
+                if (max->clock & MAX3110_HIGH_CLK)
+                        break;
+        default:
+                /* pick the previous baud rate */
+                baud = max->baud;
+                clk_div = max->cur_conf & WC_BAUD_DIV_MASK;
+                tty_termios_encode_baud_rate(termios, baud, baud);
+        }
+
+        if (max->clock & MAX3110_HIGH_CLK) {
+                clk_div += 1;
+                /* high clk version max3110 doesn't support B300 */
+                if (baud == 300)
+                        baud = 600;
+                if (baud == 230400)
+                        clk_div = WC_BAUD_DR1;
+                tty_termios_encode_baud_rate(termios, baud, baud);
+        }
+
+        new_conf = (new_conf & ~WC_BAUD_DIV_MASK) | clk_div;
+        if (termios->c_cflag & CSTOPB)
+                new_conf |= WC_2_STOPBITS;
+        else
+                new_conf &= ~WC_2_STOPBITS;
+
+        if (termios->c_cflag & PARENB) {
+                new_conf |= WC_PARITY_ENABLE;
+                parity |= UART_LCR_PARITY;
+        } else
+                new_conf &= ~WC_PARITY_ENABLE;
+
+        if (!(termios->c_cflag & PARODD))
+                parity |= UART_LCR_EPAR;
+        max->parity = parity;
+
+        uart_update_timeout(port, termios->c_cflag, baud);
+
+        new_conf |= WC_TAG;
+        if (new_conf != max->cur_conf) {
+                max3110_out(max, new_conf);
+                max->cur_conf = new_conf;
+                max->baud = baud;
+        }
+}
+
+/* don't handle hw handshaking */
+static unsigned int serial_m3110_get_mctrl(struct uart_port *port)
+{
+        return TIOCM_DSR | TIOCM_CAR | TIOCM_DSR;
+}
+
+static void serial_m3110_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+}
+
+static void serial_m3110_break_ctl(struct uart_port *port, int break_state)
+{
+}
+
+static void serial_m3110_pm(struct uart_port *port, unsigned int state,
+                        unsigned int oldstate)
+{
+}
+
+static void serial_m3110_enable_ms(struct uart_port *port)
+{
+}
+
+struct uart_ops serial_m3110_ops = {
+        .tx_empty       = serial_m3110_tx_empty,
+        .set_mctrl      = serial_m3110_set_mctrl,
+        .get_mctrl      = serial_m3110_get_mctrl,
+        .stop_tx        = serial_m3110_stop_tx,
+        .start_tx       = serial_m3110_start_tx,
+        .stop_rx        = serial_m3110_stop_rx,
+        .enable_ms      = serial_m3110_enable_ms,
+        .break_ctl      = serial_m3110_break_ctl,
+        .startup        = serial_m3110_startup,
+        .shutdown       = serial_m3110_shutdown,
+        .set_termios    = serial_m3110_set_termios,     /* must have */
+        .pm             = serial_m3110_pm,
+        .type           = serial_m3110_type,
+        .release_port   = serial_m3110_release_port,
+        .request_port   = serial_m3110_request_port,
+        .config_port    = serial_m3110_config_port,
+        .verify_port    = serial_m3110_verify_port,
+};
+
+static struct uart_driver serial_m3110_reg = {
+        .owner          = THIS_MODULE,
+        .driver_name    = "MRST serial",
+        .dev_name       = "ttyS",
+        .major          = TTY_MAJOR,
+        .minor          = 64,
+        .nr             = 1,
+        .cons           = MRST_CONSOLE,
+};
+
+static int serial_m3110_suspend(struct spi_device *spi, pm_message_t state)
+{
+        return 0;
+}
+
+static int serial_m3110_resume(struct spi_device *spi)
+{
+        return 0;
+}
+
+static struct dw_spi_chip spi0_uart = {
+        .poll_mode = 1,
+        .enable_dma = 0,
+        .type = SPI_FRF_SPI,
+};
+
+static int serial_m3110_probe(struct spi_device *spi)
+{
+        struct uart_max3110 *max;
+        int ret;
+        unsigned char *buffer;
+        u16 res;
+        max = kzalloc(sizeof(*max), GFP_KERNEL);
+        if (!max)
+                return -ENOMEM;
+
+        /* set spi info */
+        spi->mode = SPI_MODE_0;
+        spi->bits_per_word = 16;
+        max->clock = MAX3110_HIGH_CLK;
+        spi->controller_data = &spi0_uart;
+
+        spi_setup(spi);
+
+        max->port.type = PORT_PXA;      /* need apply for a max3110 type */
+        max->port.fifosize = 2;         /* only have 16b buffer */
+        max->port.ops = &serial_m3110_ops;
+        max->port.line = 0;
+        max->port.dev = &spi->dev;
+        max->port.uartclk = 115200;
+
+        max->spi = spi;
+        max->name = spi->modalias;      /* use spi name as the name */
+        max->irq = (u16)spi->irq;
+
+        mutex_init(&max->thread_mutex);
+
+        max->word_7bits = 0;
+        max->parity = 0;
+        max->baud = 0;
+
+        max->cur_conf = 0;
+        max->uart_flags = 0;
+
+        /* Check if reading configuration register returns something sane */
+
+        res = RC_TAG;
+        ret = max3110_write_then_read(max, (u8 *)&res, (u8 *)&res, 2, 0);
+        if (ret < 0 || res == 0 || res == 0xffff) {
+                printk(KERN_ERR "MAX3111 deemed not present (conf reg %04x)",
+                                                                        res);
+                ret = -ENODEV;
+                goto err_get_page;
+        }
+        buffer = (unsigned char *)__get_free_page(GFP_KERNEL);
+        if (!buffer) {
+                ret = -ENOMEM;
+                goto err_get_page;
+        }
+        max->con_xmit.buf = (unsigned char *)buffer;
+        max->con_xmit.head = max->con_xmit.tail = 0;
+
+        max->main_thread = kthread_run(max3110_main_thread,
+                                        max, "max3110_main");
+        if (IS_ERR(max->main_thread)) {
+                ret = PTR_ERR(max->main_thread);
+                goto err_kthread;
+        }
+
+        pmax = max;
+        /* give membase a psudo value to pass serial_core's check */
+        max->port.membase = (void *)0xff110000;
+        uart_add_one_port(&serial_m3110_reg, &max->port);
+
+        return 0;
+
+err_kthread:
+        free_page((unsigned long)buffer);
+err_get_page:
+        pmax = NULL;
+        kfree(max);
+        return ret;
+}
+
+static int max3110_remove(struct spi_device *dev)
+{
+        struct uart_max3110 *max = pmax;
+
+        if (!pmax)
+                return 0;
+
+        pmax = NULL;
+        uart_remove_one_port(&serial_m3110_reg, &max->port);
+
+        free_page((unsigned long)max->con_xmit.buf);
+
+        if (max->main_thread)
+                kthread_stop(max->main_thread);
+
+        kfree(max);
+        return 0;
+}
+
+static struct spi_driver uart_max3110_driver = {
+        .driver = {
+                        .name   = "spi_max3111",
+                        .bus    = &spi_bus_type,
+                        .owner  = THIS_MODULE,
+        },
+        .probe          = serial_m3110_probe,
+        .remove         = __devexit_p(max3110_remove),
+        .suspend        = serial_m3110_suspend,
+        .resume         = serial_m3110_resume,
+};
+
+
+int __init serial_m3110_init(void)
+{
+        int ret = 0;
+
+        ret = uart_register_driver(&serial_m3110_reg);
+        if (ret)
+                return ret;
+
+        ret = spi_register_driver(&uart_max3110_driver);
+        if (ret)
+                uart_unregister_driver(&serial_m3110_reg);
+
+        return ret;
+}
+
+void __exit serial_m3110_exit(void)
+{
+        spi_unregister_driver(&uart_max3110_driver);
+        uart_unregister_driver(&serial_m3110_reg);
+}
+
+module_init(serial_m3110_init);
+module_exit(serial_m3110_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("max3110-uart");
diff --git a/drivers/serial/mrst_max3110.h b/drivers/serial/mrst_max3110.h
new file mode 100644
index 000000000000..363478acb2c3
--- /dev/null
+++ b/drivers/serial/mrst_max3110.h
@@ -0,0 +1,59 @@
+#ifndef _MRST_MAX3110_H
+#define _MRST_MAX3110_H
+
+#define MAX3110_HIGH_CLK        0x1     /* 3.6864 MHZ */
+#define MAX3110_LOW_CLK         0x0     /* 1.8432 MHZ */
+
+/* status bits for all 4 MAX3110 operate modes */
+#define MAX3110_READ_DATA_AVAILABLE     (1 << 15)
+#define MAX3110_WRITE_BUF_EMPTY         (1 << 14)
+
+#define WC_TAG                  (3 << 14)
+#define RC_TAG                  (1 << 14)
+#define WD_TAG                  (2 << 14)
+#define RD_TAG                  (0 << 14)
+
+/* bits def for write configuration */
+#define WC_FIFO_ENABLE_MASK     (1 << 13)
+#define WC_FIFO_ENABLE          (0 << 13)
+
+#define WC_SW_SHDI              (1 << 12)
+
+#define WC_IRQ_MASK             (0xF << 8)
+#define WC_TXE_IRQ_ENABLE       (1 << 11)       /* TX empty irq */
+#define WC_RXA_IRQ_ENABLE       (1 << 10)       /* RX availabe irq */
+#define WC_PAR_HIGH_IRQ_ENABLE  (1 << 9)
+#define WC_REC_ACT_IRQ_ENABLE   (1 << 8)
+
+#define WC_IRDA_ENABLE          (1 << 7)
+
+#define WC_STOPBITS_MASK        (1 << 6)
+#define WC_2_STOPBITS           (1 << 6)
+#define WC_1_STOPBITS           (0 << 6)
+
+#define WC_PARITY_ENABLE_MASK   (1 << 5)
+#define WC_PARITY_ENABLE        (1 << 5)
+
+#define WC_WORDLEN_MASK         (1 << 4)
+#define WC_7BIT_WORD            (1 << 4)
+#define WC_8BIT_WORD            (0 << 4)
+
+#define WC_BAUD_DIV_MASK        (0xF)
+#define WC_BAUD_DR1             (0x0)
+#define WC_BAUD_DR2             (0x1)
+#define WC_BAUD_DR4             (0x2)
+#define WC_BAUD_DR8             (0x3)
+#define WC_BAUD_DR16            (0x4)
+#define WC_BAUD_DR32            (0x5)
+#define WC_BAUD_DR64            (0x6)
+#define WC_BAUD_DR128           (0x7)
+#define WC_BAUD_DR3             (0x8)
+#define WC_BAUD_DR6             (0x9)
+#define WC_BAUD_DR12            (0xA)
+#define WC_BAUD_DR24            (0xB)
+#define WC_BAUD_DR48            (0xC)
+#define WC_BAUD_DR96            (0xD)
+#define WC_BAUD_DR192           (0xE)
+#define WC_BAUD_DR384           (0xF)
+
+#endif
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 7f2830709512..cd8511298bcb 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -58,9 +58,9 @@ static struct lock_class_key port_lock_key;
 #define uart_console(port)      (0)
 #endif
 
-static void uart_change_speed(struct uart_state *state,
+static void uart_change_speed(struct tty_struct *tty, struct uart_state *state,
                                         struct ktermios *old_termios);
-static void uart_wait_until_sent(struct tty_struct *tty, int timeout);
+static void __uart_wait_until_sent(struct uart_port *port, int timeout);
 static void uart_change_pm(struct uart_state *state, int pm_state);
 
 /*
@@ -137,7 +137,7 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
  * Startup the port.  This will be called once per open.  All calls
  * will be serialised by the per-port mutex.
  */
-static int uart_startup(struct uart_state *state, int init_hw)
+static int uart_startup(struct tty_struct *tty, struct uart_state *state, int init_hw)
 {
         struct uart_port *uport = state->uart_port;
         struct tty_port *port = &state->port;
@@ -152,7 +152,7 @@ static int uart_startup(struct uart_state *state, int init_hw)
          * once we have successfully opened the port.  Also set
          * up the tty->alt_speed kludge
          */
-        set_bit(TTY_IO_ERROR, &port->tty->flags);
+        set_bit(TTY_IO_ERROR, &tty->flags);
 
         if (uport->type == PORT_UNKNOWN)
                 return 0;
@@ -177,26 +177,26 @@ static int uart_startup(struct uart_state *state, int init_hw)
                         /*
                          * Initialise the hardware port settings.
                          */
-                        uart_change_speed(state, NULL);
+                        uart_change_speed(tty, state, NULL);
 
                         /*
                          * Setup the RTS and DTR signals once the
                          * port is open and ready to respond.
                          */
-                        if (port->tty->termios->c_cflag & CBAUD)
+                        if (tty->termios->c_cflag & CBAUD)
                                 uart_set_mctrl(uport, TIOCM_RTS | TIOCM_DTR);
                 }
 
                 if (port->flags & ASYNC_CTS_FLOW) {
                         spin_lock_irq(&uport->lock);
                         if (!(uport->ops->get_mctrl(uport) & TIOCM_CTS))
-                                port->tty->hw_stopped = 1;
+                                tty->hw_stopped = 1;
                         spin_unlock_irq(&uport->lock);
                 }
 
                 set_bit(ASYNCB_INITIALIZED, &port->flags);
 
-                clear_bit(TTY_IO_ERROR, &port->tty->flags);
+                clear_bit(TTY_IO_ERROR, &tty->flags);
         }
 
         if (retval && capable(CAP_SYS_ADMIN))
@@ -210,11 +210,10 @@ static int uart_startup(struct uart_state *state, int init_hw)
  * DTR is dropped if the hangup on close termio flag is on.  Calls to
  * uart_shutdown are serialised by the per-port semaphore.
  */
-static void uart_shutdown(struct uart_state *state)
+static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
 {
         struct uart_port *uport = state->uart_port;
         struct tty_port *port = &state->port;
-        struct tty_struct *tty = port->tty;
 
         /*
          * Set the TTY IO error marker
@@ -430,11 +429,10 @@ uart_get_divisor(struct uart_port *port, unsigned int baud)
 EXPORT_SYMBOL(uart_get_divisor);
 
 /* FIXME: Consistent locking policy */
-static void
-uart_change_speed(struct uart_state *state, struct ktermios *old_termios)
+static void uart_change_speed(struct tty_struct *tty, struct uart_state *state,
+                                        struct ktermios *old_termios)
 {
         struct tty_port *port = &state->port;
-        struct tty_struct *tty = port->tty;
         struct uart_port *uport = state->uart_port;
         struct ktermios *termios;
 
@@ -463,8 +461,8 @@ uart_change_speed(struct uart_state *state, struct ktermios *old_termios)
         uport->ops->set_termios(uport, termios, old_termios);
 }
 
-static inline int
-__uart_put_char(struct uart_port *port, struct circ_buf *circ, unsigned char c)
+static inline int __uart_put_char(struct uart_port *port,
+                                struct circ_buf *circ, unsigned char c)
 {
         unsigned long flags;
         int ret = 0;
@@ -494,8 +492,8 @@ static void uart_flush_chars(struct tty_struct *tty)
         uart_start(tty);
 }
 
-static int
-uart_write(struct tty_struct *tty, const unsigned char *buf, int count)
+static int uart_write(struct tty_struct *tty,
+                                        const unsigned char *buf, int count)
 {
         struct uart_state *state = tty->driver_data;
         struct uart_port *port;
@@ -675,7 +673,7 @@ static int uart_get_info(struct uart_state *state,
         return 0;
 }
 
-static int uart_set_info(struct uart_state *state,
+static int uart_set_info(struct tty_struct *tty, struct uart_state *state,
                          struct serial_struct __user *newinfo)
 {
         struct serial_struct new_serial;
@@ -770,7 +768,7 @@ static int uart_set_info(struct uart_state *state,
                  * We need to shutdown the serial port at the old
                  * port/type/irq combination.
                  */
-                uart_shutdown(state);
+                uart_shutdown(tty, state);
         }
 
         if (change_port) {
@@ -869,25 +867,27 @@ static int uart_set_info(struct uart_state *state,
                                        "is deprecated.\n", current->comm,
                                        tty_name(port->tty, buf));
                         }
-                        uart_change_speed(state, NULL);
+                        uart_change_speed(tty, state, NULL);
                 }
         } else
-                retval = uart_startup(state, 1);
+                retval = uart_startup(tty, state, 1);
  exit:
         mutex_unlock(&port->mutex);
         return retval;
 }
 
-
-/*
- * uart_get_lsr_info - get line status register info.
- * Note: uart_ioctl protects us against hangups.
+/**
+ *      uart_get_lsr_info       -       get line status register info
+ *      @tty: tty associated with the UART
+ *      @state: UART being queried
+ *      @value: returned modem value
+ *
+ *      Note: uart_ioctl protects us against hangups.
  */
-static int uart_get_lsr_info(struct uart_state *state,
-                             unsigned int __user *value)
+static int uart_get_lsr_info(struct tty_struct *tty,
+                        struct uart_state *state, unsigned int __user *value)
 {
         struct uart_port *uport = state->uart_port;
-        struct tty_port *port = &state->port;
         unsigned int result;
 
         result = uport->ops->tx_empty(uport);
@@ -900,7 +900,7 @@ static int uart_get_lsr_info(struct uart_state *state,
          */
         if (uport->x_char ||
             ((uart_circ_chars_pending(&state->xmit) > 0) &&
-             !port->tty->stopped && !port->tty->hw_stopped))
+             !tty->stopped && !tty->hw_stopped))
                 result &= ~TIOCSER_TEMT;
 
         return put_user(result, value);
@@ -961,7 +961,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state)
         return 0;
 }
 
-static int uart_do_autoconfig(struct uart_state *state)
+static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state)
 {
         struct uart_port *uport = state->uart_port;
         struct tty_port *port = &state->port;
@@ -980,7 +980,7 @@ static int uart_do_autoconfig(struct uart_state *state)
 
         ret = -EBUSY;
         if (tty_port_users(port) == 1) {
-                uart_shutdown(state);
+                uart_shutdown(tty, state);
 
                 /*
                  * If we already have a port type configured,
@@ -999,7 +999,7 @@ static int uart_do_autoconfig(struct uart_state *state)
                  */
                 uport->ops->config_port(uport, flags);
 
-                ret = uart_startup(state, 1);
+                ret = uart_startup(tty, state, 1);
         }
         mutex_unlock(&port->mutex);
         return ret;
@@ -1122,11 +1122,11 @@ uart_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd,
                 break;
 
         case TIOCSSERIAL:
-                ret = uart_set_info(state, uarg);
+                ret = uart_set_info(tty, state, uarg);
                 break;
 
         case TIOCSERCONFIG:
-                ret = uart_do_autoconfig(state);
+                ret = uart_do_autoconfig(tty, state);
                 break;
 
         case TIOCSERGWILD: /* obsolete */
@@ -1172,7 +1172,7 @@ uart_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd,
          */
         switch (cmd) {
         case TIOCSERGETLSR: /* Get line status register */
-                ret = uart_get_lsr_info(state, uarg);
+                ret = uart_get_lsr_info(tty, state, uarg);
                 break;
 
         default: {
@@ -1194,7 +1194,7 @@ static void uart_set_ldisc(struct tty_struct *tty)
         struct uart_port *uport = state->uart_port;
 
         if (uport->ops->set_ldisc)
-                uport->ops->set_ldisc(uport);
+                uport->ops->set_ldisc(uport, tty->termios->c_line);
 }
 
 static void uart_set_termios(struct tty_struct *tty,
@@ -1219,7 +1219,7 @@ static void uart_set_termios(struct tty_struct *tty,
                 return;
         }
 
-        uart_change_speed(state, old_termios);
+        uart_change_speed(tty, state, old_termios);
 
         /* Handle transition to B0 status */
         if ((old_termios->c_cflag & CBAUD) && !(cflag & CBAUD))
@@ -1272,8 +1272,9 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
         struct uart_state *state = tty->driver_data;
         struct tty_port *port;
         struct uart_port *uport;
+        unsigned long flags;
 
-        BUG_ON(!kernel_locked());
+        BUG_ON(!tty_locked());
 
         if (!state)
                 return;
@@ -1284,9 +1285,12 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
         pr_debug("uart_close(%d) called\n", uport->line);
 
         mutex_lock(&port->mutex);
+        spin_lock_irqsave(&port->lock, flags);
 
-        if (tty_hung_up_p(filp))
+        if (tty_hung_up_p(filp)) {
+                spin_unlock_irqrestore(&port->lock, flags);
                 goto done;
+        }
 
         if ((tty->count == 1) && (port->count != 1)) {
                 /*
@@ -1305,8 +1309,10 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
                        tty->name, port->count);
                 port->count = 0;
         }
-        if (port->count)
+        if (port->count) {
+                spin_unlock_irqrestore(&port->lock, flags);
                 goto done;
+        }
 
         /*
          * Now we wait for the transmit buffer to clear; and we notify
@@ -1314,9 +1320,18 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
          * setting tty->closing.
          */
         tty->closing = 1;
+        spin_unlock_irqrestore(&port->lock, flags);
 
-        if (port->closing_wait != ASYNC_CLOSING_WAIT_NONE)
-                tty_wait_until_sent(tty, msecs_to_jiffies(port->closing_wait));
+        if (port->closing_wait != ASYNC_CLOSING_WAIT_NONE) {
+                /*
+                 * hack: open-coded tty_wait_until_sent to avoid
+                 * recursive tty_lock
+                 */
+                long timeout = msecs_to_jiffies(port->closing_wait);
+                if (wait_event_interruptible_timeout(tty->write_wait,
+                                !tty_chars_in_buffer(tty), timeout) >= 0)
+                        __uart_wait_until_sent(uport, timeout);
+        }
 
         /*
          * At this point, we stop accepting input.  To do this, we
@@ -1332,45 +1347,47 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
                  * has completely drained; this is especially
                  * important if there is a transmit FIFO!
                  */
-                uart_wait_until_sent(tty, uport->timeout);
+                __uart_wait_until_sent(uport, uport->timeout);
         }
 
-        uart_shutdown(state);
+        uart_shutdown(tty, state);
         uart_flush_buffer(tty);
 
         tty_ldisc_flush(tty);
 
-        tty->closing = 0;
         tty_port_tty_set(port, NULL);
+        spin_lock_irqsave(&port->lock, flags);
+        tty->closing = 0;
 
         if (port->blocked_open) {
+                spin_unlock_irqrestore(&port->lock, flags);
                 if (port->close_delay)
                         msleep_interruptible(port->close_delay);
+                spin_lock_irqsave(&port->lock, flags);
         } else if (!uart_console(uport)) {
+                spin_unlock_irqrestore(&port->lock, flags);
                 uart_change_pm(state, 3);
+                spin_lock_irqsave(&port->lock, flags);
         }
 
         /*
          * Wake up anyone trying to open this port.
          */
         clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
+        spin_unlock_irqrestore(&port->lock, flags);
         wake_up_interruptible(&port->open_wait);
 
 done:
         mutex_unlock(&port->mutex);
 }
 
-static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+static void __uart_wait_until_sent(struct uart_port *port, int timeout)
 {
-        struct uart_state *state = tty->driver_data;
-        struct uart_port *port = state->uart_port;
         unsigned long char_time, expire;
 
         if (port->type == PORT_UNKNOWN || port->fifosize == 0)
                 return;
 
-        lock_kernel();
-
         /*
          * Set the check interval to be 1/5 of the estimated time to
          * send a single character, and make it at least 1.  The check
@@ -1416,7 +1433,16 @@ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
                         break;
         }
         set_current_state(TASK_RUNNING); /* might not be needed */
-        unlock_kernel();
+}
+
+static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+{
+        struct uart_state *state = tty->driver_data;
+        struct uart_port *port = state->uart_port;
+
+        tty_lock();
+        __uart_wait_until_sent(port, timeout);
+        tty_unlock();
 }
 
 /*
@@ -1429,16 +1455,19 @@ static void uart_hangup(struct tty_struct *tty)
 {
         struct uart_state *state = tty->driver_data;
         struct tty_port *port = &state->port;
+        unsigned long flags;
 
-        BUG_ON(!kernel_locked());
+        BUG_ON(!tty_locked());
         pr_debug("uart_hangup(%d)\n", state->uart_port->line);
 
         mutex_lock(&port->mutex);
         if (port->flags & ASYNC_NORMAL_ACTIVE) {
                 uart_flush_buffer(tty);
-                uart_shutdown(state);
+                uart_shutdown(tty, state);
+                spin_lock_irqsave(&port->lock, flags);
                 port->count = 0;
                 clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
+                spin_unlock_irqrestore(&port->lock, flags);
                 tty_port_tty_set(port, NULL);
                 wake_up_interruptible(&port->open_wait);
                 wake_up_interruptible(&port->delta_msr_wait);
@@ -1446,15 +1475,19 @@ static void uart_hangup(struct tty_struct *tty)
         mutex_unlock(&port->mutex);
 }
 
-/*
- * Copy across the serial console cflag setting into the termios settings
- * for the initial open of the port.  This allows continuity between the
- * kernel settings, and the settings init adopts when it opens the port
- * for the first time.
+/**
+ *      uart_update_termios     -       update the terminal hw settings
+ *      @tty: tty associated with UART
+ *      @state: UART to update
+ *
+ *      Copy across the serial console cflag setting into the termios settings
+ *      for the initial open of the port.  This allows continuity between the
+ *      kernel settings, and the settings init adopts when it opens the port
+ *      for the first time.
  */
-static void uart_update_termios(struct uart_state *state)
+static void uart_update_termios(struct tty_struct *tty,
+                                                struct uart_state *state)
 {
-        struct tty_struct *tty = state->port.tty;
         struct uart_port *port = state->uart_port;
 
         if (uart_console(port) && port->cons->cflag) {
@@ -1471,7 +1504,7 @@ static void uart_update_termios(struct uart_state *state)
                 /*
                  * Make termios settings take effect.
                  */
-                uart_change_speed(state, NULL);
+                uart_change_speed(tty, state, NULL);
 
                 /*
                  * And finally enable the RTS and DTR signals.
@@ -1481,90 +1514,37 @@ static void uart_update_termios(struct uart_state *state)
         }
 }
 
-/*
- * Block the open until the port is ready.  We must be called with
- * the per-port semaphore held.
- */
-static int
-uart_block_til_ready(struct file *filp, struct uart_state *state)
+static int uart_carrier_raised(struct tty_port *port)
 {
-        DECLARE_WAITQUEUE(wait, current);
+        struct uart_state *state = container_of(port, struct uart_state, port);
         struct uart_port *uport = state->uart_port;
-        struct tty_port *port = &state->port;
-        unsigned int mctrl;
-
-        port->blocked_open++;
-        port->count--;
-
-        add_wait_queue(&port->open_wait, &wait);
-        while (1) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                /*
-                 * If we have been hung up, tell userspace/restart open.
-                 */
-                if (tty_hung_up_p(filp) || port->tty == NULL)
-                        break;
-
-                /*
-                 * If the port has been closed, tell userspace/restart open.
-                 */
-                if (!(port->flags & ASYNC_INITIALIZED))
-                        break;
+        int mctrl;
+        spin_lock_irq(&uport->lock);
+        uport->ops->enable_ms(uport);
+        mctrl = uport->ops->get_mctrl(uport);
+        spin_unlock_irq(&uport->lock);
+        if (mctrl & TIOCM_CAR)
+                return 1;
+        return 0;
+}
 
-                /*
-                 * If non-blocking mode is set, or CLOCAL mode is set,
-                 * we don't want to wait for the modem status lines to
-                 * indicate that the port is ready.
-                 *
-                 * Also, if the port is not enabled/configured, we want
-                 * to allow the open to succeed here.  Note that we will
-                 * have set TTY_IO_ERROR for a non-existant port.
-                 */
-                if ((filp->f_flags & O_NONBLOCK) ||
-                    (port->tty->termios->c_cflag & CLOCAL) ||
-                    (port->tty->flags & (1 << TTY_IO_ERROR)))
-                        break;
+static void uart_dtr_rts(struct tty_port *port, int onoff)
+{
+        struct uart_state *state = container_of(port, struct uart_state, port);
+        struct uart_port *uport = state->uart_port;
 
-                /*
-                 * Set DTR to allow modem to know we're waiting.  Do
-                 * not set RTS here - we want to make sure we catch
-                 * the data from the modem.
-                 */
-                if (port->tty->termios->c_cflag & CBAUD)
-                        uart_set_mctrl(uport, TIOCM_DTR);
+        if (onoff) {
+                uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
 
                 /*
-                 * and wait for the carrier to indicate that the
-                 * modem is ready for us.
+                 * If this is the first open to succeed,
+                 * adjust things to suit.
                  */
-                spin_lock_irq(&uport->lock);
-                uport->ops->enable_ms(uport);
-                mctrl = uport->ops->get_mctrl(uport);
-                spin_unlock_irq(&uport->lock);
-                if (mctrl & TIOCM_CAR)
-                        break;
-
-                mutex_unlock(&port->mutex);
-                schedule();
-                mutex_lock(&port->mutex);
-
-                if (signal_pending(current))
-                        break;
+                if (!test_and_set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags))
+                        uart_update_termios(port->tty, state);
         }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&port->open_wait, &wait);
-
-        port->count++;
-        port->blocked_open--;
-
-        if (signal_pending(current))
-                return -ERESTARTSYS;
-
-        if (!port->tty || tty_hung_up_p(filp))
-                return -EAGAIN;
-
-        return 0;
+        else
+                uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
 }
 
 static struct uart_state *uart_get(struct uart_driver *drv, int line)
@@ -1611,7 +1591,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
         struct tty_port *port;
         int retval, line = tty->index;
 
-        BUG_ON(!kernel_locked());
+        BUG_ON(!tty_locked());
         pr_debug("uart_open(%d) called\n", line);
 
         /*
@@ -1668,23 +1648,14 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
         /*
          * Start up the serial port.
          */
-        retval = uart_startup(state, 0);
+        retval = uart_startup(tty, state, 0);
 
         /*
          * If we succeeded, wait until the port is ready.
          */
-        if (retval == 0)
-                retval = uart_block_til_ready(filp, state);
         mutex_unlock(&port->mutex);
-
-        /*
-         * If this is the first open to succeed, adjust things to suit.
-         */
-        if (retval == 0 && !(port->flags & ASYNC_NORMAL_ACTIVE)) {
-                set_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
-
-                uart_update_termios(state);
-        }
+        if (retval == 0)
+                retval = tty_port_block_til_ready(port, tty, filp);
 
 fail:
         return retval;
@@ -2010,9 +1981,13 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
         struct tty_port *port = &state->port;
         struct device *tty_dev;
         struct uart_match match = {uport, drv};
+        struct tty_struct *tty;
 
         mutex_lock(&port->mutex);
 
+        /* Must be inside the mutex lock until we convert to tty_port */
+        tty = port->tty;
+
         tty_dev = device_find_child(uport->dev, &match, serial_match_port);
         if (device_may_wakeup(tty_dev)) {
                 enable_irq_wake(uport->irq);
@@ -2105,9 +2080,12 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
                 ops->set_mctrl(uport, 0);
                 spin_unlock_irq(&uport->lock);
                 if (console_suspend_enabled || !uart_console(uport)) {
+                        /* Protected by port mutex for now */
+                        struct tty_struct *tty = port->tty;
                         ret = ops->startup(uport);
                         if (ret == 0) {
-                                uart_change_speed(state, NULL);
+                                if (tty)
+                                        uart_change_speed(tty, state, NULL);
                                 spin_lock_irq(&uport->lock);
                                 ops->set_mctrl(uport, uport->mctrl);
                                 ops->start_tx(uport);
@@ -2119,7 +2097,7 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
                                  * Clear the "initialized" flag so we won't try
                                  * to call the low level drivers shutdown method.
                                  */
-                                uart_shutdown(state);
+                                uart_shutdown(tty, state);
                         }
                 }
 
@@ -2312,6 +2290,11 @@ static const struct tty_operations uart_ops = {
 #endif
 };
 
+static const struct tty_port_operations uart_port_ops = {
+        .carrier_raised = uart_carrier_raised,
+        .dtr_rts        = uart_dtr_rts,
+};
+
 /**
  *      uart_register_driver - register a driver with the uart core layer
  *      @drv: low level driver structure
@@ -2368,6 +2351,7 @@ int uart_register_driver(struct uart_driver *drv)
                 struct tty_port *port = &state->port;
 
                 tty_port_init(port);
+                port->ops = &uart_port_ops;
                 port->close_delay     = 500;    /* .5 seconds */
                 port->closing_wait    = 30000;  /* 30 seconds */
                 tasklet_init(&state->tlet, uart_tasklet_action,
diff --git a/drivers/serial/timbuart.c b/drivers/serial/timbuart.c
index 67ca642713b8..1f36b7eb7351 100644
--- a/drivers/serial/timbuart.c
+++ b/drivers/serial/timbuart.c
@@ -423,7 +423,7 @@ static struct uart_driver timbuart_driver = {
         .nr = 1
 };
 
-static int timbuart_probe(struct platform_device *dev)
+static int __devinit timbuart_probe(struct platform_device *dev)
 {
         int err, irq;
         struct timbuart_port *uart;
@@ -489,7 +489,7 @@ err_mem:
         return err;
 }
 
-static int timbuart_remove(struct platform_device *dev)
+static int __devexit timbuart_remove(struct platform_device *dev)
 {
         struct timbuart_port *uart = platform_get_drvdata(dev);
 
@@ -507,7 +507,7 @@ static struct platform_driver timbuart_platform_driver = {
                 .owner  = THIS_MODULE,
         },
         .probe          = timbuart_probe,
-        .remove         = timbuart_remove,
+        .remove         = __devexit_p(timbuart_remove),
 };
 
 /*--------------------------------------------------------------------------*/
diff --git a/drivers/staging/easycap/easycap.h b/drivers/staging/easycap/easycap.h
index ad836d2d26fe..f3c827eb0abe 100644
--- a/drivers/staging/easycap/easycap.h
+++ b/drivers/staging/easycap/easycap.h
@@ -463,15 +463,12 @@ struct data_buffer audio_buffer[];
 void             easycap_complete(struct urb *);
 int              easycap_open(struct inode *, struct file *);
 int              easycap_release(struct inode *, struct file *);
-int              easycap_ioctl(struct inode *, struct file *, \
-                                                unsigned int,  unsigned long);
+long             easycap_ioctl(struct file *, unsigned int,  unsigned long);
 
 /*vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv*/
 #if defined(EASYCAP_IS_VIDEODEV_CLIENT)
 int              easycap_open_noinode(struct file *);
 int              easycap_release_noinode(struct file *);
-long             easycap_ioctl_noinode(struct file *, \
-                                                unsigned int,  unsigned long);
 int              videodev_release(struct video_device *);
 #endif /*EASYCAP_IS_VIDEODEV_CLIENT*/
 /*^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^*/
@@ -515,8 +512,7 @@ void             easysnd_complete(struct urb *);
 ssize_t          easysnd_read(struct file *, char __user *, size_t, loff_t *);
 int              easysnd_open(struct inode *, struct file *);
 int              easysnd_release(struct inode *, struct file *);
-int              easysnd_ioctl(struct inode *, struct file *, \
-                                                unsigned int,  unsigned long);
+long             easysnd_ioctl(struct file *, unsigned int,  unsigned long);
 unsigned int     easysnd_poll(struct file *, poll_table *);
 void             easysnd_delete(struct kref *);
 int              submit_audio_urbs(struct easycap *);
diff --git a/drivers/staging/easycap/easycap_ioctl.c b/drivers/staging/easycap/easycap_ioctl.c
index 276b63dfe27e..9a42ae02cd5d 100644
--- a/drivers/staging/easycap/easycap_ioctl.c
+++ b/drivers/staging/easycap/easycap_ioctl.c
@@ -25,6 +25,7 @@
 */
 /*****************************************************************************/
 
+#include <linux/smp_lock.h>
 #include "easycap.h"
 #include "easycap_debug.h"
 #include "easycap_standard.h"
@@ -773,19 +774,10 @@ while (0xFFFFFFFF != easycap_control[i1].id) {
 SAY("WARNING: failed to adjust mute: control not found\n");
 return -ENOENT;
 }
-/****************************************************************************/
-/*vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv*/
-#if defined(EASYCAP_IS_VIDEODEV_CLIENT)
-long
-easycap_ioctl_noinode(struct file *file, unsigned int cmd, unsigned long arg)\
-                                                                        {
-        return easycap_ioctl((struct inode *)NULL, file, cmd, arg);
-}
-#endif /*EASYCAP_IS_VIDEODEV_CLIENT*/
-/*^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^*/
+
 /*--------------------------------------------------------------------------*/
-int easycap_ioctl(struct inode *inode, struct file *file, \
-                                        unsigned int cmd, unsigned long arg)
+static int easycap_ioctl_bkl(struct inode *inode, struct file *file,
+                             unsigned int cmd, unsigned long arg)
 {
 static struct easycap *peasycap;
 static struct usb_device *p;
@@ -1956,19 +1948,22 @@ default: {
 }
 return 0;
 }
-/****************************************************************************/
-/*vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv*/
-#if defined(EASYCAP_IS_VIDEODEV_CLIENT)
-long
-easysnd_ioctl_noinode(struct file *file, unsigned int cmd, unsigned long arg)
+
+long easycap_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        return easysnd_ioctl((struct inode *)NULL, file, cmd, arg);
+        struct inode *inode = file->f_dentry->d_inode;
+        long ret;
+
+        lock_kernel();
+        ret = easycap_ioctl_bkl(inode, file, cmd, arg);
+        unlock_kernel();
+
+        return ret;
 }
-#endif /*EASYCAP_IS_VIDEODEV_CLIENT*/
-/*^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^*/
+
 /*--------------------------------------------------------------------------*/
-int easysnd_ioctl(struct inode *inode, struct file *file, \
-                                        unsigned int cmd, unsigned long arg)
+static int easysnd_ioctl_bkl(struct inode *inode, struct file *file,
+                             unsigned int cmd, unsigned long arg)
 {
 struct easycap *peasycap;
 struct usb_device *p;
@@ -2158,6 +2153,19 @@ default: {
 }
 return 0;
 }
+
+long easysnd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        long ret;
+
+        lock_kernel();
+        ret = easysnd_ioctl_bkl(inode, file, cmd, arg);
+        unlock_kernel();
+
+        return ret;
+}
+
 /*****************************************************************************/
 int explain_ioctl(__u32 wot)
 {
diff --git a/drivers/staging/easycap/easycap_main.c b/drivers/staging/easycap/easycap_main.c
index 09c194ce10a3..5a4bbd9b453f 100644
--- a/drivers/staging/easycap/easycap_main.c
+++ b/drivers/staging/easycap/easycap_main.c
@@ -60,13 +60,13 @@ struct usb_driver easycap_usb_driver = {
  */
 /*---------------------------------------------------------------------------*/
 const struct file_operations easycap_fops = {
-.owner =   THIS_MODULE,
-.open =    easycap_open,
-.release = easycap_release,
-.ioctl =   easycap_ioctl,
-.poll =    easycap_poll,
-.mmap =    easycap_mmap,
-.llseek =  no_llseek,
+        .owner          = THIS_MODULE,
+        .open           = easycap_open,
+        .release        = easycap_release,
+        .unlocked_ioctl = easycap_ioctl,
+        .poll           = easycap_poll,
+        .mmap           = easycap_mmap,
+        .llseek         = no_llseek,
 };
 struct vm_operations_struct easycap_vm_ops = {
 .open  = easycap_vma_open,
@@ -83,12 +83,12 @@ struct usb_class_driver easycap_class = {
 #if defined(EASYCAP_IS_VIDEODEV_CLIENT)
 #if defined(EASYCAP_NEEDS_V4L2_FOPS)
 const struct v4l2_file_operations v4l2_fops = {
-.owner =   THIS_MODULE,
-.open =    easycap_open_noinode,
-.release = easycap_release_noinode,
-.ioctl =   easycap_ioctl_noinode,
-.poll =    easycap_poll,
-.mmap =    easycap_mmap,
+        .owner          = THIS_MODULE,
+        .open           = easycap_open_noinode,
+        .release        = easycap_release_noinode,
+        .unlocked_ioctl = easycap_ioctl,
+        .poll           = easycap_poll,
+        .mmap           = easycap_mmap,
 };
 #endif /*EASYCAP_NEEDS_V4L2_FOPS*/
 int video_device_many /*=0*/;
@@ -102,12 +102,12 @@ struct video_device *pvideo_array[VIDEO_DEVICE_MANY], *pvideo_device;
  */
 /*--------------------------------------------------------------------------*/
 const struct file_operations easysnd_fops = {
-.owner =   THIS_MODULE,
-.open =    easysnd_open,
-.release = easysnd_release,
-.ioctl =   easysnd_ioctl,
-.read =    easysnd_read,
-.llseek =  no_llseek,
+        .owner          = THIS_MODULE,
+        .open           = easysnd_open,
+        .release        = easysnd_release,
+        .unlocked_ioctl = easysnd_ioctl,
+        .read           = easysnd_read,
+        .llseek         = no_llseek,
 };
 struct usb_class_driver easysnd_class = {
 .name = "usb/easysnd%d",
diff --git a/drivers/staging/pohmelfs/inode.c b/drivers/staging/pohmelfs/inode.c
index bc1c6051a6f6..97dae297ca3c 100644
--- a/drivers/staging/pohmelfs/inode.c
+++ b/drivers/staging/pohmelfs/inode.c
@@ -968,12 +968,18 @@ int pohmelfs_setattr_raw(struct inode *inode, struct iattr *attr)
                 goto err_out_exit;
         }
 
-        err = inode_setattr(inode, attr);
-        if (err) {
-                dprintk("%s: ino: %llu, failed to set the attributes.\n", __func__, POHMELFS_I(inode)->ino);
-                goto err_out_exit;
+        if ((attr->ia_valid & ATTR_SIZE) &&
+            attr->ia_size != i_size_read(inode)) {
+                err = vmtruncate(inode, attr->ia_size);
+                if (err) {
+                        dprintk("%s: ino: %llu, failed to set the attributes.\n", __func__, POHMELFS_I(inode)->ino);
+                        goto err_out_exit;
+                }
         }
 
+        setattr_copy(inode, attr);
+        mark_inode_dirty(inode);
+
         dprintk("%s: ino: %llu, mode: %o -> %o, uid: %u -> %u, gid: %u -> %u, size: %llu -> %llu.\n",
                         __func__, POHMELFS_I(inode)->ino, inode->i_mode, attr->ia_mode,
                         inode->i_uid, attr->ia_uid, inode->i_gid, attr->ia_gid, inode->i_size, attr->ia_size);
@@ -1217,7 +1223,7 @@ void pohmelfs_fill_inode(struct inode *inode, struct netfs_inode_info *info)
         }
 }
 
-static void pohmelfs_drop_inode(struct inode *inode)
+static int pohmelfs_drop_inode(struct inode *inode)
 {
         struct pohmelfs_sb *psb = POHMELFS_SB(inode->i_sb);
         struct pohmelfs_inode *pi = POHMELFS_I(inode);
@@ -1226,7 +1232,7 @@ static void pohmelfs_drop_inode(struct inode *inode)
         list_del_init(&pi->inode_entry);
         spin_unlock(&psb->ino_lock);
 
-        generic_drop_inode(inode);
+        return generic_drop_inode(inode);
 }
 
 static struct pohmelfs_inode *pohmelfs_get_inode_from_list(struct pohmelfs_sb *psb,
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index be5d8db98165..0574d848b900 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -215,7 +215,7 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf)
         vhci = hcd_to_vhci(hcd);
 
         spin_lock_irqsave(&vhci->lock, flags);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 usbip_dbg_vhci_rh("hw accessible flag in on?\n");
                 goto done;
         }
@@ -269,7 +269,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
         u32 prev_port_status[VHCI_NPORTS];
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 return -ETIMEDOUT;
 
         /*
@@ -1041,7 +1041,7 @@ static int vhci_bus_resume(struct usb_hcd *hcd)
         dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__);
 
         spin_lock_irq(&vhci->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 rc = -ESHUTDOWN;
         } else {
                 /* vhci->rh_state = DUMMY_RH_RUNNING;
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 80b4008c89ba..239f050efa35 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -41,7 +41,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 
 obj-$(CONFIG_USB)               += misc/
-obj-y                           += early/
+obj-$(CONFIG_EARLY_PRINTK_DBGP) += early/
 
 obj-$(CONFIG_USB_ATM)           += atm/
 obj-$(CONFIG_USB_SPEEDTOUCH)    += atm/
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 101ffc965ee0..593fc5e2d2e6 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -564,7 +564,7 @@ static void cxacru_timeout_kill(unsigned long data)
 }
 
 static int cxacru_start_wait_urb(struct urb *urb, struct completion *done,
-                                 int* actual_length)
+                                 int *actual_length)
 {
         struct timer_list timer;
 
@@ -952,7 +952,7 @@ static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw,
                 put_unaligned(cpu_to_le32(addr), (__le32 *)(buf + offb));
                 offb += 4;
                 addr += l;
-                if(l)
+                if (l)
                         memcpy(buf + offb, data + offd, l);
                 if (l < stride)
                         memset(buf + offb + l, 0, stride - l);
@@ -967,7 +967,7 @@ static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw,
                         }
                         offb = 0;
                 }
-        } while(offd < size);
+        } while (offd < size);
         dbg("sent fw %#x", fw);
 
         ret = 0;
@@ -1043,8 +1043,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance,
         if (instance->modem_type->boot_rom_patch) {
                 val = cpu_to_le32(BR_ADDR);
                 ret = cxacru_fw(usb_dev, FW_WRITE_MEM, 0x2, 0x0, BR_STACK_ADDR, (u8 *) &val, 4);
-        }
-        else {
+        } else {
                 ret = cxacru_fw(usb_dev, FW_GOTO_MEM, 0x0, 0x0, FW_ADDR, NULL, 0);
         }
         if (ret) {
@@ -1068,7 +1067,7 @@ static void cxacru_upload_firmware(struct cxacru_data *instance,
 }
 
 static int cxacru_find_firmware(struct cxacru_data *instance,
-                                char* phase, const struct firmware **fw_p)
+                                char *phase, const struct firmware **fw_p)
 {
         struct usbatm_data *usbatm = instance->usbatm;
         struct device *dev = &usbatm->usb_intf->dev;
diff --git a/drivers/usb/atm/speedtch.c b/drivers/usb/atm/speedtch.c
index 80f9617d3a15..4716e707de59 100644
--- a/drivers/usb/atm/speedtch.c
+++ b/drivers/usb/atm/speedtch.c
@@ -753,11 +753,13 @@ static struct usb_driver speedtch_usb_driver = {
         .id_table       = speedtch_usb_ids
 };
 
-static void speedtch_release_interfaces(struct usb_device *usb_dev, int num_interfaces) {
+static void speedtch_release_interfaces(struct usb_device *usb_dev,
+                                        int num_interfaces)
+{
         struct usb_interface *cur_intf;
         int i;
 
-        for(i = 0; i < num_interfaces; i++)
+        for (i = 0; i < num_interfaces; i++)
                 if ((cur_intf = usb_ifnum_to_if(usb_dev, i))) {
                         usb_set_intfdata(cur_intf, NULL);
                         usb_driver_release_interface(&speedtch_usb_driver, cur_intf);
@@ -792,7 +794,7 @@ static int speedtch_bind(struct usbatm_data *usbatm,
 
         /* claim all interfaces */
 
-        for (i=0; i < num_interfaces; i++) {
+        for (i = 0; i < num_interfaces; i++) {
                 cur_intf = usb_ifnum_to_if(usb_dev, i);
 
                 if ((i != ifnum) && cur_intf) {
@@ -842,7 +844,7 @@ static int speedtch_bind(struct usbatm_data *usbatm,
 
                 use_isoc = 0; /* fall back to bulk if endpoint not found */
 
-                for (i=0; i<desc->desc.bNumEndpoints; i++) {
+                for (i = 0; i < desc->desc.bNumEndpoints; i++) {
                         const struct usb_endpoint_descriptor *endpoint_desc = &desc->endpoint[i].desc;
 
                         if ((endpoint_desc->bEndpointAddress == target_address)) {
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index ebae94480140..5b3f555e01c9 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -67,6 +67,7 @@
 #include <linux/mutex.h>
 #include <linux/freezer.h>
 #include <linux/slab.h>
+#include <linux/kernel.h>
 
 #include <asm/unaligned.h>
 
@@ -2436,7 +2437,6 @@ UEA_ATTR(firmid, 0);
 
 /* Retrieve the device End System Identifier (MAC) */
 
-#define htoi(x) (isdigit(x) ? x-'0' : toupper(x)-'A'+10)
 static int uea_getesi(struct uea_softc *sc, u_char * esi)
 {
         unsigned char mac_str[2 * ETH_ALEN + 1];
@@ -2447,7 +2447,8 @@ static int uea_getesi(struct uea_softc *sc, u_char * esi)
                 return 1;
 
         for (i = 0; i < ETH_ALEN; i++)
-                esi[i] = htoi(mac_str[2 * i]) * 16 + htoi(mac_str[2 * i + 1]);
+                esi[i] = hex_to_bin(mac_str[2 * i]) * 16 +
+                         hex_to_bin(mac_str[2 * i + 1]);
 
         return 0;
 }
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 9b53e8df4648..05bf5a27b5b0 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -84,8 +84,8 @@
 
 #ifdef VERBOSE_DEBUG
 static int usbatm_print_packet(const unsigned char *data, int len);
-#define PACKETDEBUG(arg...)     usbatm_print_packet (arg)
-#define vdbg(arg...)            dbg (arg)
+#define PACKETDEBUG(arg...)     usbatm_print_packet(arg)
+#define vdbg(arg...)            dbg(arg)
 #else
 #define PACKETDEBUG(arg...)
 #define vdbg(arg...)
@@ -273,8 +273,7 @@ static void usbatm_complete(struct urb *urb)
 
         if (unlikely(status) &&
                         (!(channel->usbatm->flags & UDSL_IGNORE_EILSEQ) ||
-                         status != -EILSEQ ))
-        {
+                         status != -EILSEQ)) {
                 if (status == -ESHUTDOWN)
                         return;
 
@@ -494,7 +493,7 @@ static unsigned int usbatm_write_cells(struct usbatm_data *instance,
                 ptr += data_len;
                 __skb_pull(skb, data_len);
 
-                if(!left)
+                if (!left)
                         continue;
 
                 memset(ptr, 0, left);
@@ -506,7 +505,7 @@ static unsigned int usbatm_write_cells(struct usbatm_data *instance,
                         trailer[2] = ctrl->len >> 8;
                         trailer[3] = ctrl->len;
 
-                        ctrl->crc = ~ crc32_be(ctrl->crc, ptr, left - 4);
+                        ctrl->crc = ~crc32_be(ctrl->crc, ptr, left - 4);
 
                         trailer[4] = ctrl->crc >> 24;
                         trailer[5] = ctrl->crc >> 16;
@@ -516,8 +515,7 @@ static unsigned int usbatm_write_cells(struct usbatm_data *instance,
                         target[3] |= 0x2;       /* adjust PTI */
 
                         ctrl->len = 0;          /* tag this skb finished */
-                }
-                else
+                } else
                         ctrl->crc = crc32_be(ctrl->crc, ptr, left);
         }
 
@@ -1146,7 +1144,7 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
         instance->tx_channel.endpoint = usb_sndbulkpipe(usb_dev, driver->bulk_out);
 
         /* tx buffer size must be a positive multiple of the stride */
-        instance->tx_channel.buf_size = max (instance->tx_channel.stride,
+        instance->tx_channel.buf_size = max(instance->tx_channel.stride,
                         snd_buf_bytes - (snd_buf_bytes % instance->tx_channel.stride));
 
         /* rx buffer size must be a positive multiple of the endpoint maxpacket */
@@ -1159,7 +1157,7 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
                 goto fail_unbind;
         }
 
-        num_packets = max (1U, (rcv_buf_bytes + maxpacket / 2) / maxpacket); /* round */
+        num_packets = max(1U, (rcv_buf_bytes + maxpacket / 2) / maxpacket); /* round */
 
         if (num_packets * maxpacket > UDSL_MAX_BUF_SIZE)
                 num_packets--;
@@ -1262,7 +1260,7 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
                 usb_free_urb(instance->urbs[i]);
         }
 
-        kfree (instance);
+        kfree(instance);
 
         return error;
 }
@@ -1390,9 +1388,8 @@ static int usbatm_print_packet(const unsigned char *data, int len)
         for (i = 0; i < len;) {
                 buffer[0] = '\0';
                 sprintf(buffer, "%.3d :", i);
-                for (j = 0; (j < 16) && (i < len); j++, i++) {
+                for (j = 0; (j < 16) && (i < len); j++, i++)
                         sprintf(buffer, "%s %2.2x", buffer, data[i]);
-                }
                 dbg("%s", buffer);
         }
         return i;
diff --git a/drivers/usb/atm/usbatm.h b/drivers/usb/atm/usbatm.h
index 0863f85fcc26..5fc489405217 100644
--- a/drivers/usb/atm/usbatm.h
+++ b/drivers/usb/atm/usbatm.h
@@ -48,7 +48,7 @@
                         dev_warn(&(instance)->usb_intf->dev,            \
                                  "failed assertion '%s' at line %d",    \
                                  __stringify(x), __LINE__);             \
-        } while(0)
+        } while (0)
 #endif
 
 #define usb_err(instance, format, arg...)       \
@@ -59,7 +59,7 @@
         dev_warn(&(instance)->usb_intf->dev , format , ## arg)
 #ifdef DEBUG
 #define usb_dbg(instance, format, arg...)       \
-        dev_printk(KERN_DEBUG , &(instance)->usb_intf->dev , format , ## arg)
+        dev_printk(KERN_DEBUG , &(instance)->usb_intf->dev , format , ## arg)
 #else
 #define usb_dbg(instance, format, arg...)       \
         do {} while (0)
@@ -104,21 +104,21 @@ struct usbatm_data;
 /*
 *  Assuming all methods exist and succeed, they are called in this order:
 *
-*       bind, heavy_init, atm_start, ..., atm_stop, unbind
+*       bind, heavy_init, atm_start, ..., atm_stop, unbind
 */
 
 struct usbatm_driver {
         const char *driver_name;
 
         /* init device ... can sleep, or cause probe() failure */
-        int (*bind) (struct usbatm_data *, struct usb_interface *,
+        int (*bind) (struct usbatm_data *, struct usb_interface *,
                      const struct usb_device_id *id);
 
         /* additional device initialization that is too slow to be done in probe() */
-        int (*heavy_init) (struct usbatm_data *, struct usb_interface *);
+        int (*heavy_init) (struct usbatm_data *, struct usb_interface *);
 
         /* cleanup device ... can sleep, but can't fail */
-        void (*unbind) (struct usbatm_data *, struct usb_interface *);
+        void (*unbind) (struct usbatm_data *, struct usb_interface *);
 
         /* init ATM device ... can sleep, or cause ATM initialization failure */
         int (*atm_start) (struct usbatm_data *, struct atm_dev *);
@@ -126,9 +126,9 @@ struct usbatm_driver {
         /* cleanup ATM device ... can sleep, but can't fail */
         void (*atm_stop) (struct usbatm_data *, struct atm_dev *);
 
-        int bulk_in;    /* bulk rx endpoint */
-        int isoc_in;    /* isochronous rx endpoint */
-        int bulk_out;   /* bulk tx endpoint */
+        int bulk_in;    /* bulk rx endpoint */
+        int isoc_in;    /* isochronous rx endpoint */
+        int bulk_out;   /* bulk tx endpoint */
 
         unsigned rx_padding;
         unsigned tx_padding;
@@ -156,7 +156,7 @@ struct usbatm_channel {
 struct usbatm_data {
         /******************
         *  public fields  *
-        ******************/
+        ******************/
 
         /* mini driver */
         struct usbatm_driver *driver;
@@ -174,7 +174,7 @@ struct usbatm_data {
 
         /********************************
         *  private fields - do not use  *
-        ********************************/
+        ********************************/
 
         struct kref refcount;
         struct mutex serialize;
diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 17d167bbd2dc..48ee0c5ff282 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -49,13 +49,13 @@ static struct usbatm_driver xusbatm_drivers[XUSBATM_DRIVERS_MAX];
 static struct usb_device_id xusbatm_usb_ids[XUSBATM_DRIVERS_MAX + 1];
 static struct usb_driver xusbatm_usb_driver;
 
-static struct usb_interface *xusbatm_find_intf (struct usb_device *usb_dev, int altsetting, u8 ep)
+static struct usb_interface *xusbatm_find_intf(struct usb_device *usb_dev, int altsetting, u8 ep)
 {
         struct usb_host_interface *alt;
         struct usb_interface *intf;
         int i, j;
 
-        for(i = 0; i < usb_dev->actconfig->desc.bNumInterfaces; i++)
+        for (i = 0; i < usb_dev->actconfig->desc.bNumInterfaces; i++)
                 if ((intf = usb_dev->actconfig->interface[i]) && (alt = usb_altnum_to_altsetting(intf, altsetting)))
                         for (j = 0; j < alt->desc.bNumEndpoints; j++)
                                 if (alt->endpoint[j].desc.bEndpointAddress == ep)
@@ -63,7 +63,7 @@ static struct usb_interface *xusbatm_find_intf (struct usb_device *usb_dev, int
         return NULL;
 }
 
-static int xusbatm_capture_intf (struct usbatm_data *usbatm, struct usb_device *usb_dev,
+static int xusbatm_capture_intf(struct usbatm_data *usbatm, struct usb_device *usb_dev,
                 struct usb_interface *intf, int altsetting, int claim)
 {
         int ifnum = intf->altsetting->desc.bInterfaceNumber;
@@ -80,7 +80,7 @@ static int xusbatm_capture_intf (struct usbatm_data *usbatm, struct usb_device *
         return 0;
 }
 
-static void xusbatm_release_intf (struct usb_device *usb_dev, struct usb_interface *intf, int claimed)
+static void xusbatm_release_intf(struct usb_device *usb_dev, struct usb_interface *intf, int claimed)
 {
         if (claimed) {
                 usb_set_intfdata(intf, NULL);
@@ -147,7 +147,7 @@ static void xusbatm_unbind(struct usbatm_data *usbatm,
 
         usb_dbg(usbatm, "%s entered\n", __func__);
 
-        for(i = 0; i < usb_dev->actconfig->desc.bNumInterfaces; i++) {
+        for (i = 0; i < usb_dev->actconfig->desc.bNumInterfaces; i++) {
                 struct usb_interface *cur_intf = usb_dev->actconfig->interface[i];
 
                 if (cur_intf && (usb_get_intfdata(cur_intf) == usbatm)) {
diff --git a/drivers/usb/c67x00/c67x00-hcd.c b/drivers/usb/c67x00/c67x00-hcd.c
index a22b887f4e9e..d3e1356d091e 100644
--- a/drivers/usb/c67x00/c67x00-hcd.c
+++ b/drivers/usb/c67x00/c67x00-hcd.c
@@ -264,7 +264,7 @@ static void c67x00_hcd_irq(struct c67x00_sie *sie, u16 int_status, u16 msg)
         if (unlikely(hcd->state == HC_STATE_HALT))
                 return;
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 return;
 
         /* Handle Start of frame events */
@@ -282,7 +282,7 @@ static int c67x00_hcd_start(struct usb_hcd *hcd)
 {
         hcd->uses_new_polling = 1;
         hcd->state = HC_STATE_RUNNING;
-        hcd->poll_rh = 1;
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 
         return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 89d260d6b031..1833b3a71515 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -636,19 +636,13 @@ static void acm_tty_unregister(struct acm *acm)
 
 static int acm_tty_chars_in_buffer(struct tty_struct *tty);
 
-static void acm_port_down(struct acm *acm, int drain)
+static void acm_port_down(struct acm *acm)
 {
         int i, nr = acm->rx_buflimit;
         mutex_lock(&open_mutex);
         if (acm->dev) {
                 usb_autopm_get_interface(acm->control);
                 acm_set_control(acm, acm->ctrlout = 0);
-                /* try letting the last writes drain naturally */
-                if (drain) {
-                        wait_event_interruptible_timeout(acm->drain_wait,
-                                (ACM_NW == acm_wb_is_avail(acm)) || !acm->dev,
-                                        ACM_CLOSE_TIMEOUT * HZ);
-                }
                 usb_kill_urb(acm->ctrlurb);
                 for (i = 0; i < ACM_NW; i++)
                         usb_kill_urb(acm->wb[i].urb);
@@ -664,7 +658,7 @@ static void acm_tty_hangup(struct tty_struct *tty)
 {
         struct acm *acm = tty->driver_data;
         tty_port_hangup(&acm->port);
-        acm_port_down(acm, 0);
+        acm_port_down(acm);
 }
 
 static void acm_tty_close(struct tty_struct *tty, struct file *filp)
@@ -685,7 +679,7 @@ static void acm_tty_close(struct tty_struct *tty, struct file *filp)
                 mutex_unlock(&open_mutex);
                 return;
         }
-        acm_port_down(acm, 0);
+        acm_port_down(acm);
         tty_port_close_end(&acm->port, tty);
         tty_port_tty_set(&acm->port, NULL);
 }
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 84f9e52327f2..e325162859b0 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -135,7 +135,7 @@ MFG:HEWLETT-PACKARD;MDL:DESKJET 970C;CMD:MLC,PCL,PML;CLASS:PRINTER;DESCRIPTION:H
  * ->lock locks what interrupt accesses.
  */
 struct usblp {
-        struct usb_device       *dev;                   /* USB device */
+        struct usb_device       *dev;                   /* USB device */
         struct mutex            wmut;
         struct mutex            mut;
         spinlock_t              lock;           /* locks rcomplete, wcomplete */
@@ -169,7 +169,8 @@ struct usblp {
 };
 
 #ifdef DEBUG
-static void usblp_dump(struct usblp *usblp) {
+static void usblp_dump(struct usblp *usblp)
+{
         int p;
 
         dbg("usblp=0x%p", usblp);
@@ -216,8 +217,8 @@ static const struct quirk_printer_struct quirk_printers[] = {
         { 0x03f0, 0x0304, USBLP_QUIRK_BIDIR }, /* HP DeskJet 810C/812C */
         { 0x03f0, 0x0404, USBLP_QUIRK_BIDIR }, /* HP DeskJet 830C */
         { 0x03f0, 0x0504, USBLP_QUIRK_BIDIR }, /* HP DeskJet 885C */
-        { 0x03f0, 0x0604, USBLP_QUIRK_BIDIR }, /* HP DeskJet 840C */   
-        { 0x03f0, 0x0804, USBLP_QUIRK_BIDIR }, /* HP DeskJet 816C */   
+        { 0x03f0, 0x0604, USBLP_QUIRK_BIDIR }, /* HP DeskJet 840C */
+        { 0x03f0, 0x0804, USBLP_QUIRK_BIDIR }, /* HP DeskJet 816C */
         { 0x03f0, 0x1104, USBLP_QUIRK_BIDIR }, /* HP Deskjet 959C */
         { 0x0409, 0xefbe, USBLP_QUIRK_BIDIR }, /* NEC Picty900 (HP OEM) */
         { 0x0409, 0xbef4, USBLP_QUIRK_BIDIR }, /* NEC Picty760 (HP OEM) */
@@ -254,9 +255,8 @@ static int usblp_ctrl_msg(struct usblp *usblp, int request, int type, int dir, i
         /* High byte has the interface index.
            Low byte has the alternate setting.
          */
-        if ((request == USBLP_REQ_GET_ID) && (type == USB_TYPE_CLASS)) {
-          index = (usblp->ifnum<<8)|usblp->protocol[usblp->current_protocol].alt_setting;
-        }
+        if ((request == USBLP_REQ_GET_ID) && (type == USB_TYPE_CLASS))
+                index = (usblp->ifnum<<8)|usblp->protocol[usblp->current_protocol].alt_setting;
 
         retval = usb_control_msg(usblp->dev,
                 dir ? usb_rcvctrlpipe(usblp->dev, 0) : usb_sndctrlpipe(usblp->dev, 0),
@@ -372,7 +372,7 @@ static int usblp_check_status(struct usblp *usblp, int err)
         return newerr;
 }
 
-static int handle_bidir (struct usblp *usblp)
+static int handle_bidir(struct usblp *usblp)
 {
         if (usblp->bidir && usblp->used) {
                 if (usblp_submit_read(usblp) < 0)
@@ -395,14 +395,13 @@ static int usblp_open(struct inode *inode, struct file *file)
         if (minor < 0)
                 return -ENODEV;
 
-        mutex_lock (&usblp_mutex);
+        mutex_lock(&usblp_mutex);
 
         retval = -ENODEV;
         intf = usb_find_interface(&usblp_driver, minor);
-        if (!intf) {
+        if (!intf)
                 goto out;
-        }
-        usblp = usb_get_intfdata (intf);
+        usblp = usb_get_intfdata(intf);
         if (!usblp || !usblp->dev || !usblp->present)
                 goto out;
 
@@ -433,18 +432,18 @@ static int usblp_open(struct inode *inode, struct file *file)
                 retval = -EIO;
         }
 out:
-        mutex_unlock (&usblp_mutex);
+        mutex_unlock(&usblp_mutex);
         return retval;
 }
 
-static void usblp_cleanup (struct usblp *usblp)
+static void usblp_cleanup(struct usblp *usblp)
 {
         printk(KERN_INFO "usblp%d: removed\n", usblp->minor);
 
         kfree(usblp->readbuf);
-        kfree (usblp->device_id_string);
-        kfree (usblp->statusbuf);
-        kfree (usblp);
+        kfree(usblp->device_id_string);
+        kfree(usblp->statusbuf);
+        kfree(usblp);
 }
 
 static void usblp_unlink_urbs(struct usblp *usblp)
@@ -458,14 +457,14 @@ static int usblp_release(struct inode *inode, struct file *file)
 
         usblp->flags &= ~LP_ABORT;
 
-        mutex_lock (&usblp_mutex);
+        mutex_lock(&usblp_mutex);
         usblp->used = 0;
         if (usblp->present) {
                 usblp_unlink_urbs(usblp);
                 usb_autopm_put_interface(usblp->intf);
-        } else          /* finish cleanup from disconnect */
-                usblp_cleanup (usblp);
-        mutex_unlock (&usblp_mutex);
+        } else          /* finish cleanup from disconnect */
+                usblp_cleanup(usblp);
+        mutex_unlock(&usblp_mutex);
         return 0;
 }
 
@@ -495,190 +494,190 @@ static long usblp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         int twoints[2];
         int retval = 0;
 
-        mutex_lock (&usblp->mut);
+        mutex_lock(&usblp->mut);
         if (!usblp->present) {
                 retval = -ENODEV;
                 goto done;
         }
 
         dbg("usblp_ioctl: cmd=0x%x (%c nr=%d len=%d dir=%d)", cmd, _IOC_TYPE(cmd),
-                _IOC_NR(cmd), _IOC_SIZE(cmd), _IOC_DIR(cmd) );
+                _IOC_NR(cmd), _IOC_SIZE(cmd), _IOC_DIR(cmd));
 
         if (_IOC_TYPE(cmd) == 'P')      /* new-style ioctl number */
 
                 switch (_IOC_NR(cmd)) {
 
-                        case IOCNR_GET_DEVICE_ID: /* get the DEVICE_ID string */
-                                if (_IOC_DIR(cmd) != _IOC_READ) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_GET_DEVICE_ID: /* get the DEVICE_ID string */
+                        if (_IOC_DIR(cmd) != _IOC_READ) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
-                                length = usblp_cache_device_id_string(usblp);
-                                if (length < 0) {
-                                        retval = length;
-                                        goto done;
-                                }
-                                if (length > _IOC_SIZE(cmd))
-                                        length = _IOC_SIZE(cmd); /* truncate */
-
-                                if (copy_to_user((void __user *) arg,
-                                                usblp->device_id_string,
-                                                (unsigned long) length)) {
-                                        retval = -EFAULT;
-                                        goto done;
-                                }
+                        length = usblp_cache_device_id_string(usblp);
+                        if (length < 0) {
+                                retval = length;
+                                goto done;
+                        }
+                        if (length > _IOC_SIZE(cmd))
+                                length = _IOC_SIZE(cmd); /* truncate */
+
+                        if (copy_to_user((void __user *) arg,
+                                        usblp->device_id_string,
+                                        (unsigned long) length)) {
+                                retval = -EFAULT;
+                                goto done;
+                        }
 
-                                break;
+                        break;
 
-                        case IOCNR_GET_PROTOCOLS:
-                                if (_IOC_DIR(cmd) != _IOC_READ ||
-                                    _IOC_SIZE(cmd) < sizeof(twoints)) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_GET_PROTOCOLS:
+                        if (_IOC_DIR(cmd) != _IOC_READ ||
+                            _IOC_SIZE(cmd) < sizeof(twoints)) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
-                                twoints[0] = usblp->current_protocol;
-                                twoints[1] = 0;
-                                for (i = USBLP_FIRST_PROTOCOL;
-                                     i <= USBLP_LAST_PROTOCOL; i++) {
-                                        if (usblp->protocol[i].alt_setting >= 0)
-                                                twoints[1] |= (1<<i);
-                                }
+                        twoints[0] = usblp->current_protocol;
+                        twoints[1] = 0;
+                        for (i = USBLP_FIRST_PROTOCOL;
+                             i <= USBLP_LAST_PROTOCOL; i++) {
+                                if (usblp->protocol[i].alt_setting >= 0)
+                                        twoints[1] |= (1<<i);
+                        }
 
-                                if (copy_to_user((void __user *)arg,
-                                                (unsigned char *)twoints,
-                                                sizeof(twoints))) {
-                                        retval = -EFAULT;
-                                        goto done;
-                                }
+                        if (copy_to_user((void __user *)arg,
+                                        (unsigned char *)twoints,
+                                        sizeof(twoints))) {
+                                retval = -EFAULT;
+                                goto done;
+                        }
 
-                                break;
+                        break;
 
-                        case IOCNR_SET_PROTOCOL:
-                                if (_IOC_DIR(cmd) != _IOC_WRITE) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_SET_PROTOCOL:
+                        if (_IOC_DIR(cmd) != _IOC_WRITE) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
 #ifdef DEBUG
-                                if (arg == -10) {
-                                        usblp_dump(usblp);
-                                        break;
-                                }
+                        if (arg == -10) {
+                                usblp_dump(usblp);
+                                break;
+                        }
 #endif
 
-                                usblp_unlink_urbs(usblp);
-                                retval = usblp_set_protocol(usblp, arg);
-                                if (retval < 0) {
-                                        usblp_set_protocol(usblp,
-                                                usblp->current_protocol);
-                                }
-                                break;
+                        usblp_unlink_urbs(usblp);
+                        retval = usblp_set_protocol(usblp, arg);
+                        if (retval < 0) {
+                                usblp_set_protocol(usblp,
+                                        usblp->current_protocol);
+                        }
+                        break;
 
-                        case IOCNR_HP_SET_CHANNEL:
-                                if (_IOC_DIR(cmd) != _IOC_WRITE ||
-                                    le16_to_cpu(usblp->dev->descriptor.idVendor) != 0x03F0 ||
-                                    usblp->quirks & USBLP_QUIRK_BIDIR) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_HP_SET_CHANNEL:
+                        if (_IOC_DIR(cmd) != _IOC_WRITE ||
+                            le16_to_cpu(usblp->dev->descriptor.idVendor) != 0x03F0 ||
+                            usblp->quirks & USBLP_QUIRK_BIDIR) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
-                                err = usblp_hp_channel_change_request(usblp,
-                                        arg, &newChannel);
-                                if (err < 0) {
-                                        dev_err(&usblp->dev->dev,
-                                                "usblp%d: error = %d setting "
-                                                "HP channel\n",
-                                                usblp->minor, err);
-                                        retval = -EIO;
-                                        goto done;
-                                }
+                        err = usblp_hp_channel_change_request(usblp,
+                                arg, &newChannel);
+                        if (err < 0) {
+                                dev_err(&usblp->dev->dev,
+                                        "usblp%d: error = %d setting "
+                                        "HP channel\n",
+                                        usblp->minor, err);
+                                retval = -EIO;
+                                goto done;
+                        }
 
-                                dbg("usblp%d requested/got HP channel %ld/%d",
-                                        usblp->minor, arg, newChannel);
-                                break;
+                        dbg("usblp%d requested/got HP channel %ld/%d",
+                                usblp->minor, arg, newChannel);
+                        break;
 
-                        case IOCNR_GET_BUS_ADDRESS:
-                                if (_IOC_DIR(cmd) != _IOC_READ ||
-                                    _IOC_SIZE(cmd) < sizeof(twoints)) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_GET_BUS_ADDRESS:
+                        if (_IOC_DIR(cmd) != _IOC_READ ||
+                            _IOC_SIZE(cmd) < sizeof(twoints)) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
-                                twoints[0] = usblp->dev->bus->busnum;
-                                twoints[1] = usblp->dev->devnum;
-                                if (copy_to_user((void __user *)arg,
-                                                (unsigned char *)twoints,
-                                                sizeof(twoints))) {
-                                        retval = -EFAULT;
-                                        goto done;
-                                }
+                        twoints[0] = usblp->dev->bus->busnum;
+                        twoints[1] = usblp->dev->devnum;
+                        if (copy_to_user((void __user *)arg,
+                                        (unsigned char *)twoints,
+                                        sizeof(twoints))) {
+                                retval = -EFAULT;
+                                goto done;
+                        }
 
-                                dbg("usblp%d is bus=%d, device=%d",
-                                        usblp->minor, twoints[0], twoints[1]);
-                                break;
+                        dbg("usblp%d is bus=%d, device=%d",
+                                usblp->minor, twoints[0], twoints[1]);
+                        break;
 
-                        case IOCNR_GET_VID_PID:
-                                if (_IOC_DIR(cmd) != _IOC_READ ||
-                                    _IOC_SIZE(cmd) < sizeof(twoints)) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
+                case IOCNR_GET_VID_PID:
+                        if (_IOC_DIR(cmd) != _IOC_READ ||
+                            _IOC_SIZE(cmd) < sizeof(twoints)) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
 
-                                twoints[0] = le16_to_cpu(usblp->dev->descriptor.idVendor);
-                                twoints[1] = le16_to_cpu(usblp->dev->descriptor.idProduct);
-                                if (copy_to_user((void __user *)arg,
-                                                (unsigned char *)twoints,
-                                                sizeof(twoints))) {
-                                        retval = -EFAULT;
-                                        goto done;
-                                }
+                        twoints[0] = le16_to_cpu(usblp->dev->descriptor.idVendor);
+                        twoints[1] = le16_to_cpu(usblp->dev->descriptor.idProduct);
+                        if (copy_to_user((void __user *)arg,
+                                        (unsigned char *)twoints,
+                                        sizeof(twoints))) {
+                                retval = -EFAULT;
+                                goto done;
+                        }
 
-                                dbg("usblp%d is VID=0x%4.4X, PID=0x%4.4X",
-                                        usblp->minor, twoints[0], twoints[1]);
-                                break;
+                        dbg("usblp%d is VID=0x%4.4X, PID=0x%4.4X",
+                                usblp->minor, twoints[0], twoints[1]);
+                        break;
 
-                        case IOCNR_SOFT_RESET:
-                                if (_IOC_DIR(cmd) != _IOC_NONE) {
-                                        retval = -EINVAL;
-                                        goto done;
-                                }
-                                retval = usblp_reset(usblp);
-                                break;
-                        default:
-                                retval = -ENOTTY;
+                case IOCNR_SOFT_RESET:
+                        if (_IOC_DIR(cmd) != _IOC_NONE) {
+                                retval = -EINVAL;
+                                goto done;
+                        }
+                        retval = usblp_reset(usblp);
+                        break;
+                default:
+                        retval = -ENOTTY;
                 }
         else    /* old-style ioctl value */
                 switch (cmd) {
 
-                        case LPGETSTATUS:
-                                if ((retval = usblp_read_status(usblp, usblp->statusbuf))) {
-                                        if (printk_ratelimit())
-                                                printk(KERN_ERR "usblp%d:"
-                                                    "failed reading printer status (%d)\n",
-                                                    usblp->minor, retval);
-                                        retval = -EIO;
-                                        goto done;
-                                }
-                                status = *usblp->statusbuf;
-                                if (copy_to_user ((void __user *)arg, &status, sizeof(int)))
-                                        retval = -EFAULT;
-                                break;
+                case LPGETSTATUS:
+                        if ((retval = usblp_read_status(usblp, usblp->statusbuf))) {
+                                if (printk_ratelimit())
+                                        printk(KERN_ERR "usblp%d:"
+                                            "failed reading printer status (%d)\n",
+                                            usblp->minor, retval);
+                                retval = -EIO;
+                                goto done;
+                        }
+                        status = *usblp->statusbuf;
+                        if (copy_to_user((void __user *)arg, &status, sizeof(int)))
+                                retval = -EFAULT;
+                        break;
 
-                        case LPABORT:
-                                if (arg)
-                                        usblp->flags |= LP_ABORT;
-                                else
-                                        usblp->flags &= ~LP_ABORT;
-                                break;
+                case LPABORT:
+                        if (arg)
+                                usblp->flags |= LP_ABORT;
+                        else
+                                usblp->flags &= ~LP_ABORT;
+                        break;
 
-                        default:
-                                retval = -ENOTTY;
+                default:
+                        retval = -ENOTTY;
                 }
 
 done:
-        mutex_unlock (&usblp->mut);
+        mutex_unlock(&usblp->mut);
         return retval;
 }
 
@@ -840,7 +839,7 @@ static ssize_t usblp_read(struct file *file, char __user *buffer, size_t len, lo
         }
 
 done:
-        mutex_unlock (&usblp->mut);
+        mutex_unlock(&usblp->mut);
         return count;
 }
 
@@ -1023,7 +1022,7 @@ raise_urb:
  * while you are sending print data, and you don't try to query the
  * printer status every couple of milliseconds, you will probably be OK.
  */
-static unsigned int usblp_quirks (__u16 vendor, __u16 product)
+static unsigned int usblp_quirks(__u16 vendor, __u16 product)
 {
         int i;
 
@@ -1031,7 +1030,7 @@ static unsigned int usblp_quirks (__u16 vendor, __u16 product)
                 if (vendor == quirk_printers[i].vendorId &&
                     product == quirk_printers[i].productId)
                         return quirk_printers[i].quirks;
-        }
+        }
         return 0;
 }
 
@@ -1061,7 +1060,7 @@ static struct usb_class_driver usblp_class = {
 static ssize_t usblp_show_ieee1284_id(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct usb_interface *intf = to_usb_interface(dev);
-        struct usblp *usblp = usb_get_intfdata (intf);
+        struct usblp *usblp = usb_get_intfdata(intf);
 
         if (usblp->device_id_string[0] == 0 &&
             usblp->device_id_string[1] == 0)
@@ -1075,7 +1074,7 @@ static DEVICE_ATTR(ieee1284_id, S_IRUGO, usblp_show_ieee1284_id, NULL);
 static int usblp_probe(struct usb_interface *intf,
                        const struct usb_device_id *id)
 {
-        struct usb_device *dev = interface_to_usbdev (intf);
+        struct usb_device *dev = interface_to_usbdev(intf);
         struct usblp *usblp;
         int protocol;
         int retval;
@@ -1089,7 +1088,7 @@ static int usblp_probe(struct usb_interface *intf,
         }
         usblp->dev = dev;
         mutex_init(&usblp->wmut);
-        mutex_init (&usblp->mut);
+        mutex_init(&usblp->mut);
         spin_lock_init(&usblp->lock);
         init_waitqueue_head(&usblp->rwait);
         init_waitqueue_head(&usblp->wwait);
@@ -1153,7 +1152,7 @@ static int usblp_probe(struct usb_interface *intf,
         usblp_check_status(usblp, 0);
 #endif
 
-        usb_set_intfdata (intf, usblp);
+        usb_set_intfdata(intf, usblp);
 
         usblp->present = 1;
 
@@ -1177,7 +1176,7 @@ static int usblp_probe(struct usb_interface *intf,
         return 0;
 
 abort_intfdata:
-        usb_set_intfdata (intf, NULL);
+        usb_set_intfdata(intf, NULL);
         device_remove_file(&intf->dev, &dev_attr_ieee1284_id);
 abort:
         kfree(usblp->readbuf);
@@ -1340,35 +1339,35 @@ static int usblp_cache_device_id_string(struct usblp *usblp)
 
 static void usblp_disconnect(struct usb_interface *intf)
 {
-        struct usblp *usblp = usb_get_intfdata (intf);
+        struct usblp *usblp = usb_get_intfdata(intf);
 
         usb_deregister_dev(intf, &usblp_class);
 
         if (!usblp || !usblp->dev) {
                 dev_err(&intf->dev, "bogus disconnect\n");
-                BUG ();
+                BUG();
         }
 
         device_remove_file(&intf->dev, &dev_attr_ieee1284_id);
 
-        mutex_lock (&usblp_mutex);
-        mutex_lock (&usblp->mut);
+        mutex_lock(&usblp_mutex);
+        mutex_lock(&usblp->mut);
         usblp->present = 0;
         wake_up(&usblp->wwait);
         wake_up(&usblp->rwait);
-        usb_set_intfdata (intf, NULL);
+        usb_set_intfdata(intf, NULL);
 
         usblp_unlink_urbs(usblp);
-        mutex_unlock (&usblp->mut);
+        mutex_unlock(&usblp->mut);
 
         if (!usblp->used)
-                usblp_cleanup (usblp);
-        mutex_unlock (&usblp_mutex);
+                usblp_cleanup(usblp);
+        mutex_unlock(&usblp_mutex);
 }
 
 static int usblp_suspend(struct usb_interface *intf, pm_message_t message)
 {
-        struct usblp *usblp = usb_get_intfdata (intf);
+        struct usblp *usblp = usb_get_intfdata(intf);
 
         usblp_unlink_urbs(usblp);
 #if 0 /* XXX Do we want this? What if someone is reading, should we fail? */
@@ -1382,10 +1381,10 @@ static int usblp_suspend(struct usb_interface *intf, pm_message_t message)
 
 static int usblp_resume(struct usb_interface *intf)
 {
-        struct usblp *usblp = usb_get_intfdata (intf);
+        struct usblp *usblp = usb_get_intfdata(intf);
         int r;
 
-        r = handle_bidir (usblp);
+        r = handle_bidir(usblp);
 
         return r;
 }
@@ -1401,7 +1400,7 @@ static const struct usb_device_id usblp_ids[] = {
         { }                                             /* Terminating entry */
 };
 
-MODULE_DEVICE_TABLE (usb, usblp_ids);
+MODULE_DEVICE_TABLE(usb, usblp_ids);
 
 static struct usb_driver usblp_driver = {
         .name =         "usblp",
@@ -1426,8 +1425,8 @@ static void __exit usblp_exit(void)
 module_init(usblp_init);
 module_exit(usblp_exit);
 
-MODULE_AUTHOR( DRIVER_AUTHOR );
-MODULE_DESCRIPTION( DRIVER_DESC );
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
 module_param(proto_bias, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(proto_bias, "Favourite protocol number");
 MODULE_LICENSE("GPL");
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index c2f62a3993d2..f1aaff6202a5 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1668,13 +1668,10 @@ static int proc_ioctl(struct dev_state *ps, struct usbdevfs_ioctl *ctl)
         default:
                 if (intf->dev.driver)
                         driver = to_usb_driver(intf->dev.driver);
-                if (driver == NULL || driver->ioctl == NULL) {
+                if (driver == NULL || driver->unlocked_ioctl == NULL) {
                         retval = -ENOTTY;
                 } else {
-                        /* keep API that guarantees BKL */
-                        lock_kernel();
-                        retval = driver->ioctl(intf, ctl->ioctl_code, buf);
-                        unlock_kernel();
+                        retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
                         if (retval == -ENOIOCTLCMD)
                                 retval = -ENOTTY;
                 }
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index a6bd53ace035..d7a4401ef019 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1742,9 +1742,8 @@ static int usb_runtime_suspend(struct device *dev)
                 }
 
                 /* Prevent the parent from suspending immediately after */
-                else if (udev->parent) {
+                else if (udev->parent)
                         udev->parent->last_busy = jiffies;
-                }
         }
 
         /* Runtime suspend for a USB interface doesn't mean anything. */
@@ -1786,21 +1785,19 @@ static int usb_runtime_idle(struct device *dev)
         return 0;
 }
 
-static struct dev_pm_ops usb_bus_pm_ops = {
+static const struct dev_pm_ops usb_bus_pm_ops = {
         .runtime_suspend =      usb_runtime_suspend,
         .runtime_resume =       usb_runtime_resume,
         .runtime_idle =         usb_runtime_idle,
 };
 
-#else
-
-#define usb_bus_pm_ops  (*(struct dev_pm_ops *) NULL)
-
 #endif /* CONFIG_USB_SUSPEND */
 
 struct bus_type usb_bus_type = {
         .name =         "usb",
         .match =        usb_device_match,
         .uevent =       usb_uevent,
+#ifdef CONFIG_USB_SUSPEND
         .pm =           &usb_bus_pm_ops,
+#endif
 };
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
index 4f84a41ee7a8..3788e738e265 100644
--- a/drivers/usb/core/endpoint.c
+++ b/drivers/usb/core/endpoint.c
@@ -96,16 +96,21 @@ static ssize_t show_ep_interval(struct device *dev,
 
         switch (usb_endpoint_type(ep->desc)) {
         case USB_ENDPOINT_XFER_CONTROL:
-                if (ep->udev->speed == USB_SPEED_HIGH)  /* uframes per NAK */
+                if (ep->udev->speed == USB_SPEED_HIGH)
+                        /* uframes per NAK */
                         interval = ep->desc->bInterval;
                 break;
+
         case USB_ENDPOINT_XFER_ISOC:
                 interval = 1 << (ep->desc->bInterval - 1);
                 break;
+
         case USB_ENDPOINT_XFER_BULK:
-                if (ep->udev->speed == USB_SPEED_HIGH && !in) /* uframes per NAK */
+                if (ep->udev->speed == USB_SPEED_HIGH && !in)
+                        /* uframes per NAK */
                         interval = ep->desc->bInterval;
                 break;
+
         case USB_ENDPOINT_XFER_INT:
                 if (ep->udev->speed == USB_SPEED_HIGH)
                         interval = 1 << (ep->desc->bInterval - 1);
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 9a34ccb0a1c0..69ecd3c92311 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -105,8 +105,10 @@ int usb_choose_configuration(struct usb_device *udev)
                 /* When the first config's first interface is one of Microsoft's
                  * pet nonstandard Ethernet-over-USB protocols, ignore it unless
                  * this kernel has enabled the necessary host side driver.
+                 * But: Don't ignore it if it's the only config.
                  */
-                if (i == 0 && desc && (is_rndis(desc) || is_activesync(desc))) {
+                if (i == 0 && num_configs > 1 && desc &&
+                                (is_rndis(desc) || is_activesync(desc))) {
 #if !defined(CONFIG_USB_NET_RNDIS_HOST) && !defined(CONFIG_USB_NET_RNDIS_HOST_MODULE)
                         continue;
 #else
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 1cf2d1e79a5c..c3f98543caaf 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -66,10 +66,7 @@ static void companion_common(struct pci_dev *pdev, struct usb_hcd *hcd,
          * vice versa.
          */
         companion = NULL;
-        for (;;) {
-                companion = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, companion);
-                if (!companion)
-                        break;
+        for_each_pci_dev(companion) {
                 if (companion->bus != pdev->bus ||
                                 PCI_SLOT(companion->devfn) != slot)
                         continue;
@@ -250,6 +247,9 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         if (retval != 0)
                 goto err4;
         set_hs_companion(dev, hcd);
+
+        if (pci_dev_run_wake(dev))
+                pm_runtime_put_noidle(&dev->dev);
         return retval;
 
  err4:
@@ -292,6 +292,17 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
         if (!hcd)
                 return;
 
+        if (pci_dev_run_wake(dev))
+                pm_runtime_get_noresume(&dev->dev);
+
+        /* Fake an interrupt request in order to give the driver a chance
+         * to test whether the controller hardware has been removed (e.g.,
+         * cardbus physical eject).
+         */
+        local_irq_disable();
+        usb_hcd_irq(0, hcd);
+        local_irq_enable();
+
         usb_remove_hcd(hcd);
         if (hcd->driver->flags & HCD_MEMORY) {
                 iounmap(hcd->regs);
@@ -317,12 +328,34 @@ void usb_hcd_pci_shutdown(struct pci_dev *dev)
         if (!hcd)
                 return;
 
-        if (hcd->driver->shutdown)
+        if (test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) &&
+                        hcd->driver->shutdown)
                 hcd->driver->shutdown(hcd);
 }
 EXPORT_SYMBOL_GPL(usb_hcd_pci_shutdown);
 
-#ifdef  CONFIG_PM_SLEEP
+#ifdef  CONFIG_PM_OPS
+
+#ifdef  CONFIG_PPC_PMAC
+static void powermac_set_asic(struct pci_dev *pci_dev, int enable)
+{
+        /* Enanble or disable ASIC clocks for USB */
+        if (machine_is(powermac)) {
+                struct device_node      *of_node;
+
+                of_node = pci_device_to_OF_node(pci_dev);
+                if (of_node)
+                        pmac_call_feature(PMAC_FTR_USB_ENABLE,
+                                        of_node, 0, enable);
+        }
+}
+
+#else
+
+static inline void powermac_set_asic(struct pci_dev *pci_dev, int enable)
+{}
+
+#endif  /* CONFIG_PPC_PMAC */
 
 static int check_root_hub_suspended(struct device *dev)
 {
@@ -337,7 +370,7 @@ static int check_root_hub_suspended(struct device *dev)
         return 0;
 }
 
-static int hcd_pci_suspend(struct device *dev)
+static int suspend_common(struct device *dev, bool do_wakeup)
 {
         struct pci_dev          *pci_dev = to_pci_dev(dev);
         struct usb_hcd          *hcd = pci_get_drvdata(pci_dev);
@@ -352,13 +385,21 @@ static int hcd_pci_suspend(struct device *dev)
         if (retval)
                 return retval;
 
-        /* We might already be suspended (runtime PM -- not yet written) */
-        if (pci_dev->current_state != PCI_D0)
-                return retval;
-
         if (hcd->driver->pci_suspend) {
-                retval = hcd->driver->pci_suspend(hcd);
+                /* Optimization: Don't suspend if a root-hub wakeup is
+                 * pending and it would cause the HCD to wake up anyway.
+                 */
+                if (do_wakeup && HCD_WAKEUP_PENDING(hcd))
+                        return -EBUSY;
+                retval = hcd->driver->pci_suspend(hcd, do_wakeup);
                 suspend_report_result(hcd->driver->pci_suspend, retval);
+
+                /* Check again in case wakeup raced with pci_suspend */
+                if (retval == 0 && do_wakeup && HCD_WAKEUP_PENDING(hcd)) {
+                        if (hcd->driver->pci_resume)
+                                hcd->driver->pci_resume(hcd, false);
+                        retval = -EBUSY;
+                }
                 if (retval)
                         return retval;
         }
@@ -374,6 +415,48 @@ static int hcd_pci_suspend(struct device *dev)
         return retval;
 }
 
+static int resume_common(struct device *dev, int event)
+{
+        struct pci_dev          *pci_dev = to_pci_dev(dev);
+        struct usb_hcd          *hcd = pci_get_drvdata(pci_dev);
+        int                     retval;
+
+        if (hcd->state != HC_STATE_SUSPENDED) {
+                dev_dbg(dev, "can't resume, not suspended!\n");
+                return 0;
+        }
+
+        retval = pci_enable_device(pci_dev);
+        if (retval < 0) {
+                dev_err(dev, "can't re-enable after resume, %d!\n", retval);
+                return retval;
+        }
+
+        pci_set_master(pci_dev);
+
+        clear_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+
+        if (hcd->driver->pci_resume) {
+                if (event != PM_EVENT_AUTO_RESUME)
+                        wait_for_companions(pci_dev, hcd);
+
+                retval = hcd->driver->pci_resume(hcd,
+                                event == PM_EVENT_RESTORE);
+                if (retval) {
+                        dev_err(dev, "PCI post-resume error %d!\n", retval);
+                        usb_hc_died(hcd);
+                }
+        }
+        return retval;
+}
+
+#ifdef  CONFIG_PM_SLEEP
+
+static int hcd_pci_suspend(struct device *dev)
+{
+        return suspend_common(dev, device_may_wakeup(dev));
+}
+
 static int hcd_pci_suspend_noirq(struct device *dev)
 {
         struct pci_dev          *pci_dev = to_pci_dev(dev);
@@ -408,16 +491,7 @@ static int hcd_pci_suspend_noirq(struct device *dev)
                 return retval;
         }
 
-#ifdef CONFIG_PPC_PMAC
-        /* Disable ASIC clocks for USB */
-        if (machine_is(powermac)) {
-                struct device_node      *of_node;
-
-                of_node = pci_device_to_OF_node(pci_dev);
-                if (of_node)
-                        pmac_call_feature(PMAC_FTR_USB_ENABLE, of_node, 0, 0);
-        }
-#endif
+        powermac_set_asic(pci_dev, 0);
         return retval;
 }
 
@@ -425,69 +499,63 @@ static int hcd_pci_resume_noirq(struct device *dev)
 {
         struct pci_dev          *pci_dev = to_pci_dev(dev);
 
-#ifdef CONFIG_PPC_PMAC
-        /* Reenable ASIC clocks for USB */
-        if (machine_is(powermac)) {
-                struct device_node *of_node;
-
-                of_node = pci_device_to_OF_node(pci_dev);
-                if (of_node)
-                        pmac_call_feature(PMAC_FTR_USB_ENABLE,
-                                                of_node, 0, 1);
-        }
-#endif
+        powermac_set_asic(pci_dev, 1);
 
         /* Go back to D0 and disable remote wakeup */
         pci_back_from_sleep(pci_dev);
         return 0;
 }
 
-static int resume_common(struct device *dev, bool hibernated)
+static int hcd_pci_resume(struct device *dev)
 {
-        struct pci_dev          *pci_dev = to_pci_dev(dev);
-        struct usb_hcd          *hcd = pci_get_drvdata(pci_dev);
-        int                     retval;
+        return resume_common(dev, PM_EVENT_RESUME);
+}
 
-        if (hcd->state != HC_STATE_SUSPENDED) {
-                dev_dbg(dev, "can't resume, not suspended!\n");
-                return 0;
-        }
+static int hcd_pci_restore(struct device *dev)
+{
+        return resume_common(dev, PM_EVENT_RESTORE);
+}
 
-        retval = pci_enable_device(pci_dev);
-        if (retval < 0) {
-                dev_err(dev, "can't re-enable after resume, %d!\n", retval);
-                return retval;
-        }
+#else
 
-        pci_set_master(pci_dev);
+#define hcd_pci_suspend         NULL
+#define hcd_pci_suspend_noirq   NULL
+#define hcd_pci_resume_noirq    NULL
+#define hcd_pci_resume          NULL
+#define hcd_pci_restore         NULL
 
-        clear_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+#endif  /* CONFIG_PM_SLEEP */
 
-        if (hcd->driver->pci_resume) {
-                /* This call should be made only during system resume,
-                 * not during runtime resume.
-                 */
-                wait_for_companions(pci_dev, hcd);
+#ifdef  CONFIG_PM_RUNTIME
 
-                retval = hcd->driver->pci_resume(hcd, hibernated);
-                if (retval) {
-                        dev_err(dev, "PCI post-resume error %d!\n", retval);
-                        usb_hc_died(hcd);
-                }
-        }
+static int hcd_pci_runtime_suspend(struct device *dev)
+{
+        int     retval;
+
+        retval = suspend_common(dev, true);
+        if (retval == 0)
+                powermac_set_asic(to_pci_dev(dev), 0);
+        dev_dbg(dev, "hcd_pci_runtime_suspend: %d\n", retval);
         return retval;
 }
 
-static int hcd_pci_resume(struct device *dev)
+static int hcd_pci_runtime_resume(struct device *dev)
 {
-        return resume_common(dev, false);
-}
+        int     retval;
 
-static int hcd_pci_restore(struct device *dev)
-{
-        return resume_common(dev, true);
+        powermac_set_asic(to_pci_dev(dev), 1);
+        retval = resume_common(dev, PM_EVENT_AUTO_RESUME);
+        dev_dbg(dev, "hcd_pci_runtime_resume: %d\n", retval);
+        return retval;
 }
 
+#else
+
+#define hcd_pci_runtime_suspend NULL
+#define hcd_pci_runtime_resume  NULL
+
+#endif  /* CONFIG_PM_RUNTIME */
+
 const struct dev_pm_ops usb_hcd_pci_pm_ops = {
         .suspend        = hcd_pci_suspend,
         .suspend_noirq  = hcd_pci_suspend_noirq,
@@ -501,7 +569,9 @@ const struct dev_pm_ops usb_hcd_pci_pm_ops = {
         .poweroff_noirq = hcd_pci_suspend_noirq,
         .restore_noirq  = hcd_pci_resume_noirq,
         .restore        = hcd_pci_restore,
+        .runtime_suspend = hcd_pci_runtime_suspend,
+        .runtime_resume = hcd_pci_runtime_resume,
 };
 EXPORT_SYMBOL_GPL(usb_hcd_pci_pm_ops);
 
-#endif  /* CONFIG_PM_SLEEP */
+#endif  /* CONFIG_PM_OPS */
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 12742f152f43..5cca00a6d09d 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -667,7 +667,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
         unsigned long   flags;
         char            buffer[6];      /* Any root hubs with > 31 ports? */
 
-        if (unlikely(!hcd->rh_registered))
+        if (unlikely(!hcd->rh_pollable))
                 return;
         if (!hcd->uses_new_polling && !hcd->status_urb)
                 return;
@@ -679,7 +679,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
                 spin_lock_irqsave(&hcd_root_hub_lock, flags);
                 urb = hcd->status_urb;
                 if (urb) {
-                        hcd->poll_pending = 0;
+                        clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags);
                         hcd->status_urb = NULL;
                         urb->actual_length = length;
                         memcpy(urb->transfer_buffer, buffer, length);
@@ -690,7 +690,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
                         spin_lock(&hcd_root_hub_lock);
                 } else {
                         length = 0;
-                        hcd->poll_pending = 1;
+                        set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags);
                 }
                 spin_unlock_irqrestore(&hcd_root_hub_lock, flags);
         }
@@ -699,7 +699,7 @@ void usb_hcd_poll_rh_status(struct usb_hcd *hcd)
          * exceed that limit if HZ is 100. The math is more clunky than
          * maybe expected, this is to make sure that all timers for USB devices
          * fire at the same time to give the CPU a break inbetween */
-        if (hcd->uses_new_polling ? hcd->poll_rh :
+        if (hcd->uses_new_polling ? HCD_POLL_RH(hcd) :
                         (length == 0 && hcd->status_urb != NULL))
                 mod_timer (&hcd->rh_timer, (jiffies/(HZ/4) + 1) * (HZ/4));
 }
@@ -736,7 +736,7 @@ static int rh_queue_status (struct usb_hcd *hcd, struct urb *urb)
                 mod_timer(&hcd->rh_timer, (jiffies/(HZ/4) + 1) * (HZ/4));
 
         /* If a status change has already occurred, report it ASAP */
-        else if (hcd->poll_pending)
+        else if (HCD_POLL_PENDING(hcd))
                 mod_timer(&hcd->rh_timer, jiffies);
         retval = 0;
  done:
@@ -1150,8 +1150,7 @@ int usb_hcd_check_unlink_urb(struct usb_hcd *hcd, struct urb *urb,
          * finish unlinking the initial failed usb_set_address()
          * or device descriptor fetch.
          */
-        if (!test_bit(HCD_FLAG_SAW_IRQ, &hcd->flags) &&
-                        !is_root_hub(urb->dev)) {
+        if (!HCD_SAW_IRQ(hcd) && !is_root_hub(urb->dev)) {
                 dev_warn(hcd->self.controller, "Unlink after no-IRQ?  "
                         "Controller is probably using the wrong IRQ.\n");
                 set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
@@ -1219,6 +1218,11 @@ static int hcd_alloc_coherent(struct usb_bus *bus,
 {
         unsigned char *vaddr;
 
+        if (*vaddr_handle == NULL) {
+                WARN_ON_ONCE(1);
+                return -EFAULT;
+        }
+
         vaddr = hcd_buffer_alloc(bus, size + sizeof(vaddr),
                                  mem_flags, dma_handle);
         if (!vaddr)
@@ -1941,6 +1945,7 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
 
         dev_dbg(&rhdev->dev, "usb %s%s\n",
                         (msg.event & PM_EVENT_AUTO ? "auto-" : ""), "resume");
+        clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
         if (!hcd->driver->bus_resume)
                 return -ENOENT;
         if (hcd->state == HC_STATE_RUNNING)
@@ -1994,8 +1999,10 @@ void usb_hcd_resume_root_hub (struct usb_hcd *hcd)
         unsigned long flags;
 
         spin_lock_irqsave (&hcd_root_hub_lock, flags);
-        if (hcd->rh_registered)
+        if (hcd->rh_registered) {
+                set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
                 queue_work(pm_wq, &hcd->wakeup_work);
+        }
         spin_unlock_irqrestore (&hcd_root_hub_lock, flags);
 }
 EXPORT_SYMBOL_GPL(usb_hcd_resume_root_hub);
@@ -2063,8 +2070,7 @@ irqreturn_t usb_hcd_irq (int irq, void *__hcd)
          */
         local_irq_save(flags);
 
-        if (unlikely(hcd->state == HC_STATE_HALT ||
-                     !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {
+        if (unlikely(hcd->state == HC_STATE_HALT || !HCD_HW_ACCESSIBLE(hcd))) {
                 rc = IRQ_NONE;
         } else if (hcd->driver->irq(hcd) == IRQ_NONE) {
                 rc = IRQ_NONE;
@@ -2079,6 +2085,7 @@ irqreturn_t usb_hcd_irq (int irq, void *__hcd)
         local_irq_restore(flags);
         return rc;
 }
+EXPORT_SYMBOL_GPL(usb_hcd_irq);
 
 /*-------------------------------------------------------------------------*/
 
@@ -2098,7 +2105,7 @@ void usb_hc_died (struct usb_hcd *hcd)
 
         spin_lock_irqsave (&hcd_root_hub_lock, flags);
         if (hcd->rh_registered) {
-                hcd->poll_rh = 0;
+                clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 
                 /* make khubd clean up old urbs and devices */
                 usb_set_device_state (hcd->self.root_hub,
@@ -2217,6 +2224,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
                 retval = -ENOMEM;
                 goto err_allocate_root_hub;
         }
+        hcd->self.root_hub = rhdev;
 
         switch (hcd->driver->flags & HCD_MASK) {
         case HCD_USB11:
@@ -2229,9 +2237,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
                 rhdev->speed = USB_SPEED_SUPER;
                 break;
         default:
-                goto err_allocate_root_hub;
+                goto err_set_rh_speed;
         }
-        hcd->self.root_hub = rhdev;
 
         /* wakeup flag init defaults to "everything works" for root hubs,
          * but drivers can override it in reset() if needed, along with
@@ -2246,6 +2253,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
                 dev_err(hcd->self.controller, "can't setup\n");
                 goto err_hcd_driver_setup;
         }
+        hcd->rh_pollable = 1;
 
         /* NOTE: root hub and controller capabilities may not be the same */
         if (device_can_wakeup(hcd->self.controller)
@@ -2300,23 +2308,38 @@ int usb_add_hcd(struct usb_hcd *hcd,
                        retval);
                 goto error_create_attr_group;
         }
-        if (hcd->uses_new_polling && hcd->poll_rh)
+        if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
                 usb_hcd_poll_rh_status(hcd);
         return retval;
 
 error_create_attr_group:
+        if (HC_IS_RUNNING(hcd->state))
+                hcd->state = HC_STATE_QUIESCING;
+        spin_lock_irq(&hcd_root_hub_lock);
+        hcd->rh_registered = 0;
+        spin_unlock_irq(&hcd_root_hub_lock);
+
+#ifdef CONFIG_USB_SUSPEND
+        cancel_work_sync(&hcd->wakeup_work);
+#endif
         mutex_lock(&usb_bus_list_lock);
-        usb_disconnect(&hcd->self.root_hub);
+        usb_disconnect(&rhdev);         /* Sets rhdev to NULL */
         mutex_unlock(&usb_bus_list_lock);
 err_register_root_hub:
+        hcd->rh_pollable = 0;
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        del_timer_sync(&hcd->rh_timer);
         hcd->driver->stop(hcd);
+        hcd->state = HC_STATE_HALT;
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        del_timer_sync(&hcd->rh_timer);
 err_hcd_driver_start:
         if (hcd->irq >= 0)
                 free_irq(irqnum, hcd);
 err_request_irq:
 err_hcd_driver_setup:
-        hcd->self.root_hub = NULL;
-        usb_put_dev(rhdev);
+err_set_rh_speed:
+        usb_put_dev(hcd->self.root_hub);
 err_allocate_root_hub:
         usb_deregister_bus(&hcd->self);
 err_register_bus:
@@ -2335,8 +2358,13 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
  */
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
+        struct usb_device *rhdev = hcd->self.root_hub;
+
         dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 
+        usb_get_dev(rhdev);
+        sysfs_remove_group(&rhdev->dev.kobj, &usb_bus_attr_group);
+
         if (HC_IS_RUNNING (hcd->state))
                 hcd->state = HC_STATE_QUIESCING;
 
@@ -2349,19 +2377,30 @@ void usb_remove_hcd(struct usb_hcd *hcd)
         cancel_work_sync(&hcd->wakeup_work);
 #endif
 
-        sysfs_remove_group(&hcd->self.root_hub->dev.kobj, &usb_bus_attr_group);
         mutex_lock(&usb_bus_list_lock);
-        usb_disconnect(&hcd->self.root_hub);
+        usb_disconnect(&rhdev);         /* Sets rhdev to NULL */
         mutex_unlock(&usb_bus_list_lock);
 
+        /* Prevent any more root-hub status calls from the timer.
+         * The HCD might still restart the timer (if a port status change
+         * interrupt occurs), but usb_hcd_poll_rh_status() won't invoke
+         * the hub_status_data() callback.
+         */
+        hcd->rh_pollable = 0;
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        del_timer_sync(&hcd->rh_timer);
+
         hcd->driver->stop(hcd);
         hcd->state = HC_STATE_HALT;
 
-        hcd->poll_rh = 0;
+        /* In case the HCD restarted the timer, stop it again. */
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         del_timer_sync(&hcd->rh_timer);
 
         if (hcd->irq >= 0)
                 free_irq(hcd->irq, hcd);
+
+        usb_put_dev(hcd->self.root_hub);
         usb_deregister_bus(&hcd->self);
         hcd_buffer_destroy(hcd);
 }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 70cccc75a362..84c1897188d2 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -20,6 +20,7 @@
 #include <linux/usb.h>
 #include <linux/usbdevice_fs.h>
 #include <linux/usb/hcd.h>
+#include <linux/usb/quirks.h>
 #include <linux/kthread.h>
 #include <linux/mutex.h>
 #include <linux/freezer.h>
@@ -1294,6 +1295,7 @@ descriptor_error:
         return -ENODEV;
 }
 
+/* No BKL needed */
 static int
 hub_ioctl(struct usb_interface *intf, unsigned int code, void *user_data)
 {
@@ -1801,7 +1803,6 @@ int usb_new_device(struct usb_device *udev)
         pm_runtime_set_active(&udev->dev);
         pm_runtime_enable(&udev->dev);
 
-        usb_detect_quirks(udev);
         err = usb_enumerate_device(udev);       /* Read descriptors */
         if (err < 0)
                 goto fail;
@@ -2880,7 +2881,9 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         }
 
         retval = 0;
-
+        /* notify HCD that we have a device connected and addressed */
+        if (hcd->driver->update_device)
+                hcd->driver->update_device(hcd, udev);
 fail:
         if (retval) {
                 hub_port_disable(hub, port1, 0);
@@ -3111,6 +3114,10 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                 if (status < 0)
                         goto loop;
 
+                usb_detect_quirks(udev);
+                if (udev->quirks & USB_QUIRK_DELAY_INIT)
+                        msleep(1000);
+
                 /* consecutive bus-powered hubs aren't reliable; they can
                  * violate the voltage drop budget.  if the new child has
                  * a "powered" LED, users should notice we didn't enable it
@@ -3463,7 +3470,7 @@ static struct usb_driver hub_driver = {
         .reset_resume = hub_reset_resume,
         .pre_reset =    hub_pre_reset,
         .post_reset =   hub_post_reset,
-        .ioctl =        hub_ioctl,
+        .unlocked_ioctl = hub_ioctl,
         .id_table =     hub_id_table,
         .supports_autosuspend = 1,
 };
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 1a27618b67d6..095fa5366690 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -265,13 +265,9 @@ static int remount(struct super_block *sb, int *flags, char *data)
                 return -EINVAL;
         }
 
-        lock_kernel();
-
         if (usbfs_mount && usbfs_mount->mnt_sb)
                 update_sb(usbfs_mount->mnt_sb);
 
-        unlock_kernel();
-
         return 0;
 }
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index db99c084df92..25719da45e33 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -38,6 +38,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Logitech Harmony 700-series */
+        { USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT },
+
         /* Philips PSC805 audio device */
         { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 7c0555548ac8..419e6b34e2fe 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -137,6 +137,16 @@ void usb_anchor_urb(struct urb *urb, struct usb_anchor *anchor)
 }
 EXPORT_SYMBOL_GPL(usb_anchor_urb);
 
+/* Callers must hold anchor->lock */
+static void __usb_unanchor_urb(struct urb *urb, struct usb_anchor *anchor)
+{
+        urb->anchor = NULL;
+        list_del(&urb->anchor_list);
+        usb_put_urb(urb);
+        if (list_empty(&anchor->urb_list))
+                wake_up(&anchor->wait);
+}
+
 /**
  * usb_unanchor_urb - unanchors an URB
  * @urb: pointer to the urb to anchor
@@ -156,17 +166,14 @@ void usb_unanchor_urb(struct urb *urb)
                 return;
 
         spin_lock_irqsave(&anchor->lock, flags);
-        if (unlikely(anchor != urb->anchor)) {
-                /* we've lost the race to another thread */
-                spin_unlock_irqrestore(&anchor->lock, flags);
-                return;
-        }
-        urb->anchor = NULL;
-        list_del(&urb->anchor_list);
+        /*
+         * At this point, we could be competing with another thread which
+         * has the same intention. To protect the urb from being unanchored
+         * twice, only the winner of the race gets the job.
+         */
+        if (likely(anchor == urb->anchor))
+                __usb_unanchor_urb(urb, anchor);
         spin_unlock_irqrestore(&anchor->lock, flags);
-        usb_put_urb(urb);
-        if (list_empty(&anchor->urb_list))
-                wake_up(&anchor->wait);
 }
 EXPORT_SYMBOL_GPL(usb_unanchor_urb);
 
@@ -749,20 +756,11 @@ EXPORT_SYMBOL_GPL(usb_unpoison_anchored_urbs);
 void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
 {
         struct urb *victim;
-        unsigned long flags;
 
-        spin_lock_irqsave(&anchor->lock, flags);
-        while (!list_empty(&anchor->urb_list)) {
-                victim = list_entry(anchor->urb_list.prev, struct urb,
-                                    anchor_list);
-                usb_get_urb(victim);
-                spin_unlock_irqrestore(&anchor->lock, flags);
-                /* this will unanchor the URB */
+        while ((victim = usb_get_from_anchor(anchor)) != NULL) {
                 usb_unlink_urb(victim);
                 usb_put_urb(victim);
-                spin_lock_irqsave(&anchor->lock, flags);
         }
-        spin_unlock_irqrestore(&anchor->lock, flags);
 }
 EXPORT_SYMBOL_GPL(usb_unlink_anchored_urbs);
 
@@ -799,12 +797,11 @@ struct urb *usb_get_from_anchor(struct usb_anchor *anchor)
                 victim = list_entry(anchor->urb_list.next, struct urb,
                                     anchor_list);
                 usb_get_urb(victim);
-                spin_unlock_irqrestore(&anchor->lock, flags);
-                usb_unanchor_urb(victim);
+                __usb_unanchor_urb(victim, anchor);
         } else {
-                spin_unlock_irqrestore(&anchor->lock, flags);
                 victim = NULL;
         }
+        spin_unlock_irqrestore(&anchor->lock, flags);
 
         return victim;
 }
@@ -826,12 +823,7 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
         while (!list_empty(&anchor->urb_list)) {
                 victim = list_entry(anchor->urb_list.prev, struct urb,
                                     anchor_list);
-                usb_get_urb(victim);
-                spin_unlock_irqrestore(&anchor->lock, flags);
-                /* this may free the URB */
-                usb_unanchor_urb(victim);
-                usb_put_urb(victim);
-                spin_lock_irqsave(&anchor->lock, flags);
+                __usb_unanchor_urb(victim, anchor);
         }
         spin_unlock_irqrestore(&anchor->lock, flags);
 }
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 5ae14f6c1e7a..fdd4130fbb7d 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -317,10 +317,6 @@ static const struct dev_pm_ops usb_device_pm_ops = {
         .restore =      usb_dev_restore,
 };
 
-#else
-
-#define usb_device_pm_ops       (*(struct dev_pm_ops *) NULL)
-
 #endif  /* CONFIG_PM */
 
 
@@ -338,7 +334,9 @@ struct device_type usb_device_type = {
         .release =      usb_release_dev,
         .uevent =       usb_dev_uevent,
         .devnode =      usb_devnode,
+#ifdef CONFIG_PM
         .pm =           &usb_device_pm_ops,
+#endif
 };
 
 
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 591ae9fde199..cd27f9bde2c8 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -714,6 +714,7 @@ config USB_GADGETFS
 config USB_FUNCTIONFS
         tristate "Function Filesystem (EXPERIMENTAL)"
         depends on EXPERIMENTAL
+        select USB_FUNCTIONFS_GENERIC if !(USB_FUNCTIONFS_ETH || USB_FUNCTIONFS_RNDIS)
         help
           The Function Filesystem (FunctioFS) lets one create USB
           composite functions in user space in the same way as GadgetFS
@@ -722,31 +723,31 @@ config USB_FUNCTIONFS
           implemented in kernel space (for instance Ethernet, serial or
           mass storage) and other are implemented in user space.
 
+          If you say "y" or "m" here you will be able what kind of
+          configurations the gadget will provide.
+
           Say "y" to link the driver statically, or "m" to build
           a dynamically linked module called "g_ffs".
 
 config USB_FUNCTIONFS_ETH
-        bool "Include CDC ECM (Ethernet) function"
+        bool "Include configuration with CDC ECM (Ethernet)"
         depends on USB_FUNCTIONFS && NET
         help
-          Include an CDC ECM (Ethernet) funcion in the CDC ECM (Funcion)
-          Filesystem.  If you also say "y" to the RNDIS query below the
-          gadget will have two configurations.
+          Include a configuration with CDC ECM funcion (Ethernet) and the
+          Funcion Filesystem.
 
 config USB_FUNCTIONFS_RNDIS
-        bool "Include RNDIS (Ethernet) function"
+        bool "Include configuration with RNDIS (Ethernet)"
         depends on USB_FUNCTIONFS && NET
         help
-          Include an RNDIS (Ethernet) funcion in the Funcion Filesystem.
-          If you also say "y" to the CDC ECM query above the gadget will
-          have two configurations.
+          Include a configuration with RNDIS funcion (Ethernet) and the Filesystem.
 
 config USB_FUNCTIONFS_GENERIC
         bool "Include 'pure' configuration"
-        depends on USB_FUNCTIONFS && (USB_FUNCTIONFS_ETH || USB_FUNCTIONFS_RNDIS)
+        depends on USB_FUNCTIONFS
         help
-          Include a configuration with FunctionFS and no Ethernet
-          configuration.
+          Include a configuration with the Function Filesystem alone with
+          no Ethernet interface.
 
 config USB_FILE_STORAGE
         tristate "File-backed Storage Gadget"
@@ -863,6 +864,7 @@ config USB_G_NOKIA
 config USB_G_MULTI
         tristate "Multifunction Composite Gadget (EXPERIMENTAL)"
         depends on BLOCK && NET
+        select USB_G_MULTI_CDC if !USB_G_MULTI_RNDIS
         help
           The Multifunction Composite Gadget provides Ethernet (RNDIS
           and/or CDC Ethernet), mass storage and ACM serial link
@@ -913,6 +915,34 @@ config USB_G_HID
           Say "y" to link the driver statically, or "m" to build a
           dynamically linked module called "g_hid".
 
+config USB_G_DBGP
+        tristate "EHCI Debug Device Gadget"
+        help
+          This gadget emulates an EHCI Debug device. This is useful when you want
+          to interact with an EHCI Debug Port.
+
+          Say "y" to link the driver statically, or "m" to build a
+          dynamically linked module called "g_dbgp".
+
+if USB_G_DBGP
+choice
+        prompt "EHCI Debug Device mode"
+        default USB_G_DBGP_SERIAL
+
+config USB_G_DBGP_PRINTK
+        depends on USB_G_DBGP
+        bool "printk"
+        help
+          Directly printk() received data. No interaction.
+
+config USB_G_DBGP_SERIAL
+        depends on USB_G_DBGP
+        bool "serial"
+        help
+          Userland can interact using /dev/ttyGSxxx.
+endchoice
+endif
+
 # put drivers that need isochronous transfer support (for audio
 # or video class gadget drivers), or specific hardware, here.
 config USB_G_WEBCAM
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 9bcde110feb1..27283df37d09 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -44,6 +44,7 @@ g_printer-objs			:= printer.o
 g_cdc-objs                      := cdc2.o
 g_multi-objs                    := multi.o
 g_hid-objs                      := hid.o
+g_dbgp-objs                     := dbgp.o
 g_nokia-objs                    := nokia.o
 g_webcam-objs                   := webcam.o
 
@@ -52,7 +53,6 @@ obj-$(CONFIG_USB_AUDIO)		+= g_audio.o
 obj-$(CONFIG_USB_ETH)           += g_ether.o
 obj-$(CONFIG_USB_GADGETFS)      += gadgetfs.o
 obj-$(CONFIG_USB_FUNCTIONFS)    += g_ffs.o
-obj-$(CONFIG_USB_ETH_FUNCTIONFS)        += g_eth_ffs.o
 obj-$(CONFIG_USB_FILE_STORAGE)  += g_file_storage.o
 obj-$(CONFIG_USB_MASS_STORAGE)  += g_mass_storage.o
 obj-$(CONFIG_USB_G_SERIAL)      += g_serial.o
@@ -60,6 +60,7 @@ obj-$(CONFIG_USB_G_PRINTER)	+= g_printer.o
 obj-$(CONFIG_USB_MIDI_GADGET)   += g_midi.o
 obj-$(CONFIG_USB_CDC_COMPOSITE) += g_cdc.o
 obj-$(CONFIG_USB_G_HID)         += g_hid.o
+obj-$(CONFIG_USB_G_DBGP)        += g_dbgp.o
 obj-$(CONFIG_USB_G_MULTI)       += g_multi.o
 obj-$(CONFIG_USB_G_NOKIA)       += g_nokia.o
 obj-$(CONFIG_USB_G_WEBCAM)      += g_webcam.o
diff --git a/drivers/usb/gadget/audio.c b/drivers/usb/gadget/audio.c
index a62af7b59094..b744ccd0f34d 100644
--- a/drivers/usb/gadget/audio.c
+++ b/drivers/usb/gadget/audio.c
@@ -89,7 +89,7 @@ static const struct usb_descriptor_header *otg_desc[] = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __init audio_do_config(struct usb_configuration *c)
+static int __ref audio_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -113,7 +113,7 @@ static struct usb_configuration audio_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __init audio_bind(struct usb_composite_dev *cdev)
+static int __ref audio_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         int                     status;
diff --git a/drivers/usb/gadget/cdc2.c b/drivers/usb/gadget/cdc2.c
index 928137d3dbdc..1f5ba2fd4c1f 100644
--- a/drivers/usb/gadget/cdc2.c
+++ b/drivers/usb/gadget/cdc2.c
@@ -129,7 +129,7 @@ static u8 hostaddr[ETH_ALEN];
 /*
  * We _always_ have both CDC ECM and CDC ACM functions.
  */
-static int __init cdc_do_config(struct usb_configuration *c)
+static int __ref cdc_do_config(struct usb_configuration *c)
 {
         int     status;
 
@@ -159,7 +159,7 @@ static struct usb_configuration cdc_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __init cdc_bind(struct usb_composite_dev *cdev)
+static int __ref cdc_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 391d169f8d07..e483f80822d2 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -673,20 +673,83 @@ static int get_string(struct usb_composite_dev *cdev,
  * string IDs.  Drivers for functions, configurations, or gadgets will
  * then store that ID in the appropriate descriptors and string table.
  *
- * All string identifier should be allocated using this routine, to
- * ensure that for example different functions don't wrongly assign
- * different meanings to the same identifier.
+ * All string identifier should be allocated using this,
+ * @usb_string_ids_tab() or @usb_string_ids_n() routine, to ensure
+ * that for example different functions don't wrongly assign different
+ * meanings to the same identifier.
  */
 int usb_string_id(struct usb_composite_dev *cdev)
 {
         if (cdev->next_string_id < 254) {
-                /* string id 0 is reserved */
+                /* string id 0 is reserved by USB spec for list of
+                 * supported languages */
+                /* 255 reserved as well? -- mina86 */
                 cdev->next_string_id++;
                 return cdev->next_string_id;
         }
         return -ENODEV;
 }
 
+/**
+ * usb_string_ids() - allocate unused string IDs in batch
+ * @cdev: the device whose string descriptor IDs are being allocated
+ * @str: an array of usb_string objects to assign numbers to
+ * Context: single threaded during gadget setup
+ *
+ * @usb_string_ids() is called from bind() callbacks to allocate
+ * string IDs.  Drivers for functions, configurations, or gadgets will
+ * then copy IDs from the string table to the appropriate descriptors
+ * and string table for other languages.
+ *
+ * All string identifier should be allocated using this,
+ * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
+ * example different functions don't wrongly assign different meanings
+ * to the same identifier.
+ */
+int usb_string_ids_tab(struct usb_composite_dev *cdev, struct usb_string *str)
+{
+        int next = cdev->next_string_id;
+
+        for (; str->s; ++str) {
+                if (unlikely(next >= 254))
+                        return -ENODEV;
+                str->id = ++next;
+        }
+
+        cdev->next_string_id = next;
+
+        return 0;
+}
+
+/**
+ * usb_string_ids_n() - allocate unused string IDs in batch
+ * @cdev: the device whose string descriptor IDs are being allocated
+ * @n: number of string IDs to allocate
+ * Context: single threaded during gadget setup
+ *
+ * Returns the first requested ID.  This ID and next @n-1 IDs are now
+ * valid IDs.  At least providind that @n is non zore because if it
+ * is, returns last requested ID which is now very useful information.
+ *
+ * @usb_string_ids_n() is called from bind() callbacks to allocate
+ * string IDs.  Drivers for functions, configurations, or gadgets will
+ * then store that ID in the appropriate descriptors and string table.
+ *
+ * All string identifier should be allocated using this,
+ * @usb_string_id() or @usb_string_ids_n() routine, to ensure that for
+ * example different functions don't wrongly assign different meanings
+ * to the same identifier.
+ */
+int usb_string_ids_n(struct usb_composite_dev *c, unsigned n)
+{
+        unsigned next = c->next_string_id;
+        if (unlikely(n > 254 || (unsigned)next + n > 254))
+                return -ENODEV;
+        c->next_string_id += n;
+        return next + 1;
+}
+
+
 /*-------------------------------------------------------------------------*/
 
 static void composite_setup_complete(struct usb_ep *ep, struct usb_request *req)
@@ -893,6 +956,8 @@ static void composite_disconnect(struct usb_gadget *gadget)
         spin_lock_irqsave(&cdev->lock, flags);
         if (cdev->config)
                 reset_config(cdev);
+        if (composite->disconnect)
+                composite->disconnect(cdev);
         spin_unlock_irqrestore(&cdev->lock, flags);
 }
 
diff --git a/drivers/usb/gadget/dbgp.c b/drivers/usb/gadget/dbgp.c
new file mode 100644
index 000000000000..0ed50a2c0a36
--- /dev/null
+++ b/drivers/usb/gadget/dbgp.c
@@ -0,0 +1,434 @@
+/*
+ * dbgp.c -- EHCI Debug Port device gadget
+ *
+ * Copyright (C) 2010 Stephane Duverger
+ *
+ * Released under the GPLv2.
+ *
+ */
+
+/* verbose messages */
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+/* See comments in "zero.c" */
+#include "epautoconf.c"
+
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+#include "u_serial.c"
+#endif
+
+#define DRIVER_VENDOR_ID        0x0525 /* NetChip */
+#define DRIVER_PRODUCT_ID       0xc0de /* undefined */
+
+#define USB_DEBUG_MAX_PACKET_SIZE     8
+#define DBGP_REQ_EP0_LEN              128
+#define DBGP_REQ_LEN                  512
+
+static struct dbgp {
+        struct usb_gadget  *gadget;
+        struct usb_request *req;
+        struct usb_ep      *i_ep;
+        struct usb_ep      *o_ep;
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+        struct gserial     *serial;
+#endif
+} dbgp;
+
+static struct usb_device_descriptor device_desc = {
+        .bLength = sizeof device_desc,
+        .bDescriptorType = USB_DT_DEVICE,
+        .bcdUSB = __constant_cpu_to_le16(0x0200),
+        .bDeviceClass = USB_CLASS_VENDOR_SPEC,
+        .idVendor = __constant_cpu_to_le16(DRIVER_VENDOR_ID),
+        .idProduct = __constant_cpu_to_le16(DRIVER_PRODUCT_ID),
+        .bNumConfigurations = 1,
+};
+
+static struct usb_debug_descriptor dbg_desc = {
+        .bLength = sizeof dbg_desc,
+        .bDescriptorType = USB_DT_DEBUG,
+};
+
+static struct usb_endpoint_descriptor i_desc = {
+        .bLength = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+        .bmAttributes = USB_ENDPOINT_XFER_BULK,
+        .bEndpointAddress = USB_DIR_IN,
+};
+
+static struct usb_endpoint_descriptor o_desc = {
+        .bLength = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+        .bmAttributes = USB_ENDPOINT_XFER_BULK,
+        .bEndpointAddress = USB_DIR_OUT,
+};
+
+#ifdef CONFIG_USB_G_DBGP_PRINTK
+static int dbgp_consume(char *buf, unsigned len)
+{
+        char c;
+
+        if (!len)
+                return 0;
+
+        c = buf[len-1];
+        if (c != 0)
+                buf[len-1] = 0;
+
+        printk(KERN_NOTICE "%s%c", buf, c);
+        return 0;
+}
+
+static void __disable_ep(struct usb_ep *ep)
+{
+        if (ep && ep->driver_data == dbgp.gadget) {
+                usb_ep_disable(ep);
+                ep->driver_data = NULL;
+        }
+}
+
+static void dbgp_disable_ep(void)
+{
+        __disable_ep(dbgp.i_ep);
+        __disable_ep(dbgp.o_ep);
+}
+
+static void dbgp_complete(struct usb_ep *ep, struct usb_request *req)
+{
+        int stp;
+        int err = 0;
+        int status = req->status;
+
+        if (ep == dbgp.i_ep) {
+                stp = 1;
+                goto fail;
+        }
+
+        if (status != 0) {
+                stp = 2;
+                goto release_req;
+        }
+
+        dbgp_consume(req->buf, req->actual);
+
+        req->length = DBGP_REQ_LEN;
+        err = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (err < 0) {
+                stp = 3;
+                goto release_req;
+        }
+
+        return;
+
+release_req:
+        kfree(req->buf);
+        usb_ep_free_request(dbgp.o_ep, req);
+        dbgp_disable_ep();
+fail:
+        dev_dbg(&dbgp.gadget->dev,
+                "complete: failure (%d:%d) ==> %d\n", stp, err, status);
+}
+
+static int dbgp_enable_ep_req(struct usb_ep *ep)
+{
+        int err, stp;
+        struct usb_request *req;
+
+        req = usb_ep_alloc_request(ep, GFP_KERNEL);
+        if (!req) {
+                err = -ENOMEM;
+                stp = 1;
+                goto fail_1;
+        }
+
+        req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL);
+        if (!req->buf) {
+                err = -ENOMEM;
+                stp = 2;
+                goto fail_2;
+        }
+
+        req->complete = dbgp_complete;
+        req->length = DBGP_REQ_LEN;
+        err = usb_ep_queue(ep, req, GFP_ATOMIC);
+        if (err < 0) {
+                stp = 3;
+                goto fail_3;
+        }
+
+        return 0;
+
+fail_3:
+        kfree(req->buf);
+fail_2:
+        usb_ep_free_request(dbgp.o_ep, req);
+fail_1:
+        dev_dbg(&dbgp.gadget->dev,
+                "enable ep req: failure (%d:%d)\n", stp, err);
+        return err;
+}
+
+static int __enable_ep(struct usb_ep *ep, struct usb_endpoint_descriptor *desc)
+{
+        int err = usb_ep_enable(ep, desc);
+        ep->driver_data = dbgp.gadget;
+        return err;
+}
+
+static int dbgp_enable_ep(void)
+{
+        int err, stp;
+
+        err = __enable_ep(dbgp.i_ep, &i_desc);
+        if (err < 0) {
+                stp = 1;
+                goto fail_1;
+        }
+
+        err = __enable_ep(dbgp.o_ep, &o_desc);
+        if (err < 0) {
+                stp = 2;
+                goto fail_2;
+        }
+
+        err = dbgp_enable_ep_req(dbgp.o_ep);
+        if (err < 0) {
+                stp = 3;
+                goto fail_3;
+        }
+
+        return 0;
+
+fail_3:
+        __disable_ep(dbgp.o_ep);
+fail_2:
+        __disable_ep(dbgp.i_ep);
+fail_1:
+        dev_dbg(&dbgp.gadget->dev, "enable ep: failure (%d:%d)\n", stp, err);
+        return err;
+}
+#endif
+
+static void dbgp_disconnect(struct usb_gadget *gadget)
+{
+#ifdef CONFIG_USB_G_DBGP_PRINTK
+        dbgp_disable_ep();
+#else
+        gserial_disconnect(dbgp.serial);
+#endif
+}
+
+static void dbgp_unbind(struct usb_gadget *gadget)
+{
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+        kfree(dbgp.serial);
+#endif
+        if (dbgp.req) {
+                kfree(dbgp.req->buf);
+                usb_ep_free_request(gadget->ep0, dbgp.req);
+        }
+
+        gadget->ep0->driver_data = NULL;
+}
+
+static int __init dbgp_configure_endpoints(struct usb_gadget *gadget)
+{
+        int stp;
+
+        usb_ep_autoconfig_reset(gadget);
+
+        dbgp.i_ep = usb_ep_autoconfig(gadget, &i_desc);
+        if (!dbgp.i_ep) {
+                stp = 1;
+                goto fail_1;
+        }
+
+        dbgp.i_ep->driver_data = gadget;
+        i_desc.wMaxPacketSize =
+                __constant_cpu_to_le16(USB_DEBUG_MAX_PACKET_SIZE);
+
+        dbgp.o_ep = usb_ep_autoconfig(gadget, &o_desc);
+        if (!dbgp.o_ep) {
+                dbgp.i_ep->driver_data = NULL;
+                stp = 2;
+                goto fail_2;
+        }
+
+        dbgp.o_ep->driver_data = gadget;
+        o_desc.wMaxPacketSize =
+                __constant_cpu_to_le16(USB_DEBUG_MAX_PACKET_SIZE);
+
+        dbg_desc.bDebugInEndpoint = i_desc.bEndpointAddress & 0x7f;
+        dbg_desc.bDebugOutEndpoint = o_desc.bEndpointAddress & 0x7f;
+
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+        dbgp.serial->in = dbgp.i_ep;
+        dbgp.serial->out = dbgp.o_ep;
+
+        dbgp.serial->in_desc = &i_desc;
+        dbgp.serial->out_desc = &o_desc;
+
+        if (gserial_setup(gadget, 1) < 0) {
+                stp = 3;
+                goto fail_3;
+        }
+
+        return 0;
+
+fail_3:
+        dbgp.o_ep->driver_data = NULL;
+#else
+        return 0;
+#endif
+fail_2:
+        dbgp.i_ep->driver_data = NULL;
+fail_1:
+        dev_dbg(&dbgp.gadget->dev, "ep config: failure (%d)\n", stp);
+        return -ENODEV;
+}
+
+static int __init dbgp_bind(struct usb_gadget *gadget)
+{
+        int err, stp;
+
+        dbgp.gadget = gadget;
+
+        dbgp.req = usb_ep_alloc_request(gadget->ep0, GFP_KERNEL);
+        if (!dbgp.req) {
+                err = -ENOMEM;
+                stp = 1;
+                goto fail;
+        }
+
+        dbgp.req->buf = kmalloc(DBGP_REQ_EP0_LEN, GFP_KERNEL);
+        if (!dbgp.req->buf) {
+                err = -ENOMEM;
+                stp = 2;
+                goto fail;
+        }
+
+        dbgp.req->length = DBGP_REQ_EP0_LEN;
+        gadget->ep0->driver_data = gadget;
+
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+        dbgp.serial = kzalloc(sizeof(struct gserial), GFP_KERNEL);
+        if (!dbgp.serial) {
+                stp = 3;
+                err = -ENOMEM;
+                goto fail;
+        }
+#endif
+        err = dbgp_configure_endpoints(gadget);
+        if (err < 0) {
+                stp = 4;
+                goto fail;
+        }
+
+        dev_dbg(&dbgp.gadget->dev, "bind: success\n");
+        return 0;
+
+fail:
+        dev_dbg(&gadget->dev, "bind: failure (%d:%d)\n", stp, err);
+        dbgp_unbind(gadget);
+        return err;
+}
+
+static void dbgp_setup_complete(struct usb_ep *ep,
+                                struct usb_request *req)
+{
+        dev_dbg(&dbgp.gadget->dev, "setup complete: %d, %d/%d\n",
+                req->status, req->actual, req->length);
+}
+
+static int dbgp_setup(struct usb_gadget *gadget,
+                      const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_request *req = dbgp.req;
+        u8 request = ctrl->bRequest;
+        u16 value = le16_to_cpu(ctrl->wValue);
+        u16 length = le16_to_cpu(ctrl->wLength);
+        int err = 0;
+        void *data;
+        u16 len;
+
+        gadget->ep0->driver_data = gadget;
+
+        if (request == USB_REQ_GET_DESCRIPTOR) {
+                switch (value>>8) {
+                case USB_DT_DEVICE:
+                        dev_dbg(&dbgp.gadget->dev, "setup: desc device\n");
+                        len = sizeof device_desc;
+                        data = &device_desc;
+                        break;
+                case USB_DT_DEBUG:
+                        dev_dbg(&dbgp.gadget->dev, "setup: desc debug\n");
+                        len = sizeof dbg_desc;
+                        data = &dbg_desc;
+                        break;
+                default:
+                        goto fail;
+                }
+        } else if (request == USB_REQ_SET_FEATURE &&
+                   value == USB_DEVICE_DEBUG_MODE) {
+                len = 0;
+                data = NULL;
+                dev_dbg(&dbgp.gadget->dev, "setup: feat debug\n");
+#ifdef CONFIG_USB_G_DBGP_PRINTK
+                err = dbgp_enable_ep();
+#else
+                err = gserial_connect(dbgp.serial, 0);
+#endif
+                if (err < 0)
+                        goto fail;
+        } else
+                goto fail;
+
+        if (len >= 0) {
+                req->length = min(length, len);
+                req->zero = len < req->length;
+                if (data && req->length)
+                        memcpy(req->buf, data, req->length);
+
+                req->complete = dbgp_setup_complete;
+                return usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);
+        }
+
+fail:
+        dev_dbg(&dbgp.gadget->dev,
+                "setup: failure req %x v %x\n", request, value);
+        return err;
+}
+
+static struct usb_gadget_driver dbgp_driver = {
+        .function = "dbgp",
+        .speed = USB_SPEED_HIGH,
+        .bind = dbgp_bind,
+        .unbind = dbgp_unbind,
+        .setup = dbgp_setup,
+        .disconnect = dbgp_disconnect,
+        .driver = {
+                .owner = THIS_MODULE,
+                .name = "dbgp"
+        },
+};
+
+static int __init dbgp_init(void)
+{
+        return usb_gadget_register_driver(&dbgp_driver);
+}
+
+static void __exit dbgp_exit(void)
+{
+        usb_gadget_unregister_driver(&dbgp_driver);
+#ifdef CONFIG_USB_G_DBGP_SERIAL
+        gserial_cleanup();
+#endif
+}
+
+MODULE_AUTHOR("Stephane Duverger");
+MODULE_LICENSE("GPL");
+module_init(dbgp_init);
+module_exit(dbgp_exit);
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 4f9e578cde9d..dc6546248ed9 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1542,7 +1542,7 @@ static int dummy_hub_status (struct usb_hcd *hcd, char *buf)
         dum = hcd_to_dummy (hcd);
 
         spin_lock_irqsave (&dum->lock, flags);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 goto done;
 
         if (dum->resuming && time_after_eq (jiffies, dum->re_timeout)) {
@@ -1588,7 +1588,7 @@ static int dummy_hub_control (
         int             retval = 0;
         unsigned long   flags;
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 return -ETIMEDOUT;
 
         dum = hcd_to_dummy (hcd);
@@ -1739,7 +1739,7 @@ static int dummy_bus_resume (struct usb_hcd *hcd)
         dev_dbg (&hcd->self.root_hub->dev, "%s\n", __func__);
 
         spin_lock_irq (&dum->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 rc = -ESHUTDOWN;
         } else {
                 dum->rh_state = DUMMY_RH_RUNNING;
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 400f80372d93..114fa024c22c 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -237,7 +237,7 @@ static u8 hostaddr[ETH_ALEN];
  * the first one present.  That's to make Microsoft's drivers happy,
  * and to follow DOCSIS 1.0 (cable modem standard).
  */
-static int __init rndis_do_config(struct usb_configuration *c)
+static int __ref rndis_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -270,7 +270,7 @@ MODULE_PARM_DESC(use_eem, "use CDC EEM mode");
 /*
  * We _always_ have an ECM, CDC Subset, or EEM configuration.
  */
-static int __init eth_do_config(struct usb_configuration *c)
+static int __ref eth_do_config(struct usb_configuration *c)
 {
         /* FIXME alloc iConfiguration string, set it in c->strings */
 
@@ -297,7 +297,7 @@ static struct usb_configuration eth_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-static int __init eth_bind(struct usb_composite_dev *cdev)
+static int __ref eth_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2aaa0f75c6cf..e4f595055208 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -714,9 +714,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
                 struct ffs_function *func = ffs->func;
                 ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
         } else if (gadget->ops->ioctl) {
-                lock_kernel();
                 ret = gadget->ops->ioctl(gadget, code, value);
-                unlock_kernel();
         } else {
                 ret = -ENOTTY;
         }
@@ -1377,7 +1375,8 @@ static void ffs_data_reset(struct ffs_data *ffs)
 
 static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
 {
-        unsigned i, count;
+        struct usb_gadget_strings **lang;
+        int first_id;
 
         ENTER();
 
@@ -1385,7 +1384,9 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
                  || test_and_set_bit(FFS_FL_BOUND, &ffs->flags)))
                 return -EBADFD;
 
-        ffs_data_get(ffs);
+        first_id = usb_string_ids_n(cdev, ffs->strings_count);
+        if (unlikely(first_id < 0))
+                return first_id;
 
         ffs->ep0req = usb_ep_alloc_request(cdev->gadget->ep0, GFP_KERNEL);
         if (unlikely(!ffs->ep0req))
@@ -1393,25 +1394,16 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
         ffs->ep0req->complete = ffs_ep0_complete;
         ffs->ep0req->context = ffs;
 
-        /* Get strings identifiers */
-        for (count = ffs->strings_count, i = 0; i < count; ++i) {
-                struct usb_gadget_strings **lang;
-
-                int id = usb_string_id(cdev);
-                if (unlikely(id < 0)) {
-                        usb_ep_free_request(cdev->gadget->ep0, ffs->ep0req);
-                        ffs->ep0req = NULL;
-                        return id;
-                }
-
-                lang = ffs->stringtabs;
-                do {
-                        (*lang)->strings[i].id = id;
-                        ++lang;
-                } while (*lang);
+        lang = ffs->stringtabs;
+        for (lang = ffs->stringtabs; *lang; ++lang) {
+                struct usb_string *str = (*lang)->strings;
+                int id = first_id;
+                for (; str->s; ++id, ++str)
+                        str->id = id;
         }
 
         ffs->gadget = cdev->gadget;
+        ffs_data_get(ffs);
         return 0;
 }
 
@@ -1480,9 +1472,9 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
 }
 
 
-static int functionfs_add(struct usb_composite_dev *cdev,
-                          struct usb_configuration *c,
-                          struct ffs_data *ffs)
+static int functionfs_bind_config(struct usb_composite_dev *cdev,
+                                  struct usb_configuration *c,
+                                  struct ffs_data *ffs)
 {
         struct ffs_function *func;
         int ret;
diff --git a/drivers/usb/gadget/f_hid.c b/drivers/usb/gadget/f_hid.c
index 1e00ff9866af..53e120208e99 100644
--- a/drivers/usb/gadget/f_hid.c
+++ b/drivers/usb/gadget/f_hid.c
@@ -142,7 +142,7 @@ static struct usb_descriptor_header *hidg_fs_descriptors[] = {
 static ssize_t f_hidg_read(struct file *file, char __user *buffer,
                         size_t count, loff_t *ptr)
 {
-        struct f_hidg   *hidg     = (struct f_hidg *)file->private_data;
+        struct f_hidg   *hidg     = file->private_data;
         char            *tmp_buff = NULL;
         unsigned long   flags;
 
@@ -200,7 +200,7 @@ static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req)
 static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
                             size_t count, loff_t *offp)
 {
-        struct f_hidg *hidg  = (struct f_hidg *)file->private_data;
+        struct f_hidg *hidg  = file->private_data;
         ssize_t status = -ENOMEM;
 
         if (!access_ok(VERIFY_READ, buffer, count))
@@ -257,7 +257,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
 
 static unsigned int f_hidg_poll(struct file *file, poll_table *wait)
 {
-        struct f_hidg   *hidg  = (struct f_hidg *)file->private_data;
+        struct f_hidg   *hidg  = file->private_data;
         unsigned int    ret = 0;
 
         poll_wait(file, &hidg->read_queue, wait);
diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
index e91d1b16d9be..43225879c3cd 100644
--- a/drivers/usb/gadget/f_loopback.c
+++ b/drivers/usb/gadget/f_loopback.c
@@ -324,7 +324,7 @@ static void loopback_disable(struct usb_function *f)
 
 /*-------------------------------------------------------------------------*/
 
-static int __init loopback_bind_config(struct usb_configuration *c)
+static int __ref loopback_bind_config(struct usb_configuration *c)
 {
         struct f_loopback       *loop;
         int                     status;
@@ -346,7 +346,7 @@ static int __init loopback_bind_config(struct usb_configuration *c)
         return status;
 }
 
-static struct usb_configuration loopback_driver = {
+static  struct usb_configuration loopback_driver = {
         .label          = "loopback",
         .strings        = loopback_strings,
         .bind           = loopback_bind_config,
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 4ce899c9b165..32cce029f65c 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -316,6 +316,27 @@ static const char fsg_string_interface[] = "Mass Storage";
 /*-------------------------------------------------------------------------*/
 
 struct fsg_dev;
+struct fsg_common;
+
+/* FSF callback functions */
+struct fsg_operations {
+        /* Callback function to call when thread exits.  If no
+         * callback is set or it returns value lower then zero MSF
+         * will force eject all LUNs it operates on (including those
+         * marked as non-removable or with prevent_medium_removal flag
+         * set). */
+        int (*thread_exits)(struct fsg_common *common);
+
+        /* Called prior to ejection.  Negative return means error,
+         * zero means to continue with ejection, positive means not to
+         * eject. */
+        int (*pre_eject)(struct fsg_common *common,
+                         struct fsg_lun *lun, int num);
+        /* Called after ejection.  Negative return means error, zero
+         * or positive is just a success. */
+        int (*post_eject)(struct fsg_common *common,
+                          struct fsg_lun *lun, int num);
+};
 
 
 /* Data shared by all the FSG instances. */
@@ -333,7 +354,6 @@ struct fsg_common {
         struct usb_ep           *ep0;           /* Copy of gadget->ep0 */
         struct usb_request      *ep0req;        /* Copy of cdev->req */
         unsigned int            ep0_req_tag;
-        const char              *ep0req_name;
 
         struct fsg_buffhd       *next_buffhd_to_fill;
         struct fsg_buffhd       *next_buffhd_to_drain;
@@ -369,8 +389,8 @@ struct fsg_common {
         struct completion       thread_notifier;
         struct task_struct      *thread_task;
 
-        /* Callback function to call when thread exits. */
-        int                     (*thread_exits)(struct fsg_common *common);
+        /* Callback functions. */
+        const struct fsg_operations     *ops;
         /* Gadget's private data. */
         void                    *private_data;
 
@@ -394,12 +414,8 @@ struct fsg_config {
         const char              *lun_name_format;
         const char              *thread_name;
 
-        /* Callback function to call when thread exits.  If no
-         * callback is set or it returns value lower then zero MSF
-         * will force eject all LUNs it operates on (including those
-         * marked as non-removable or with prevent_medium_removal flag
-         * set). */
-        int                     (*thread_exits)(struct fsg_common *common);
+        /* Callback functions. */
+        const struct fsg_operations     *ops;
         /* Gadget's private data. */
         void                    *private_data;
 
@@ -435,6 +451,7 @@ static inline int __fsg_is_set(struct fsg_common *common,
         if (common->fsg)
                 return 1;
         ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
+        WARN_ON(1);
         return 0;
 }
 
@@ -623,8 +640,6 @@ static int fsg_setup(struct usb_function *f,
 
                 /* Respond with data/status */
                 req->length = min((u16)1, w_length);
-                fsg->common->ep0req_name =
-                        ctrl->bRequestType & USB_DIR_IN ? "ep0-in" : "ep0-out";
                 return ep0_queue(fsg->common);
         }
 
@@ -1395,43 +1410,55 @@ static int do_start_stop(struct fsg_common *common)
         } else if (!curlun->removable) {
                 curlun->sense_data = SS_INVALID_COMMAND;
                 return -EINVAL;
-        }
-
-        loej = common->cmnd[4] & 0x02;
-        start = common->cmnd[4] & 0x01;
-
-        /* eject code from file_storage.c:do_start_stop() */
-
-        if ((common->cmnd[1] & ~0x01) != 0 ||     /* Mask away Immed */
-                (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */
+        } else if ((common->cmnd[1] & ~0x01) != 0 || /* Mask away Immed */
+                   (common->cmnd[4] & ~0x03) != 0) { /* Mask LoEj, Start */
                 curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                 return -EINVAL;
         }
 
-        if (!start) {
-                /* Are we allowed to unload the media? */
-                if (curlun->prevent_medium_removal) {
-                        LDBG(curlun, "unload attempt prevented\n");
-                        curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
-                        return -EINVAL;
-                }
-                if (loej) {     /* Simulate an unload/eject */
-                        up_read(&common->filesem);
-                        down_write(&common->filesem);
-                        fsg_lun_close(curlun);
-                        up_write(&common->filesem);
-                        down_read(&common->filesem);
-                }
-        } else {
+        loej  = common->cmnd[4] & 0x02;
+        start = common->cmnd[4] & 0x01;
 
-                /* Our emulation doesn't support mounting; the medium is
-                 * available for use as soon as it is loaded. */
+        /* Our emulation doesn't support mounting; the medium is
+         * available for use as soon as it is loaded. */
+        if (start) {
                 if (!fsg_lun_is_open(curlun)) {
                         curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
                         return -EINVAL;
                 }
+                return 0;
         }
-        return 0;
+
+        /* Are we allowed to unload the media? */
+        if (curlun->prevent_medium_removal) {
+                LDBG(curlun, "unload attempt prevented\n");
+                curlun->sense_data = SS_MEDIUM_REMOVAL_PREVENTED;
+                return -EINVAL;
+        }
+
+        if (!loej)
+                return 0;
+
+        /* Simulate an unload/eject */
+        if (common->ops && common->ops->pre_eject) {
+                int r = common->ops->pre_eject(common, curlun,
+                                               curlun - common->luns);
+                if (unlikely(r < 0))
+                        return r;
+                else if (r)
+                        return 0;
+        }
+
+        up_read(&common->filesem);
+        down_write(&common->filesem);
+        fsg_lun_close(curlun);
+        up_write(&common->filesem);
+        down_read(&common->filesem);
+
+        return common->ops && common->ops->post_eject
+                ? min(0, common->ops->post_eject(common, curlun,
+                                                 curlun - common->luns))
+                : 0;
 }
 
 
@@ -2610,7 +2637,8 @@ static int fsg_main_thread(void *common_)
         common->thread_task = NULL;
         spin_unlock_irq(&common->lock);
 
-        if (!common->thread_exits || common->thread_exits(common) < 0) {
+        if (!common->ops || !common->ops->thread_exits
+         || common->ops->thread_exits(common) < 0) {
                 struct fsg_lun *curlun = common->luns;
                 unsigned i = common->nluns;
 
@@ -2686,6 +2714,7 @@ static struct fsg_common *fsg_common_init(struct fsg_common *common,
                 common->free_storage_on_release = 0;
         }
 
+        common->ops = cfg->ops;
         common->private_data = cfg->private_data;
 
         common->gadget = gadget;
@@ -2807,7 +2836,6 @@ buffhds_first_it:
 
 
         /* Tell the thread to start working */
-        common->thread_exits = cfg->thread_exits;
         common->thread_task =
                 kthread_create(fsg_main_thread, common,
                                OR(cfg->thread_name, "file-storage"));
@@ -2990,9 +3018,9 @@ static struct usb_gadget_strings *fsg_strings_array[] = {
         NULL,
 };
 
-static int fsg_add(struct usb_composite_dev *cdev,
-                   struct usb_configuration *c,
-                   struct fsg_common *common)
+static int fsg_bind_config(struct usb_composite_dev *cdev,
+                           struct usb_configuration *c,
+                           struct fsg_common *common)
 {
         struct fsg_dev *fsg;
         int rc;
@@ -3024,6 +3052,13 @@ static int fsg_add(struct usb_composite_dev *cdev,
         return rc;
 }
 
+static inline int __deprecated __maybe_unused
+fsg_add(struct usb_composite_dev *cdev,
+        struct usb_configuration *c,
+        struct fsg_common *common)
+{
+        return fsg_bind_config(cdev, c, common);
+}
 
 
 /************************* Module parameters *************************/
@@ -3096,8 +3131,8 @@ fsg_config_from_params(struct fsg_config *cfg,
         cfg->product_name = 0;
         cfg->release = 0xffff;
 
-        cfg->thread_exits = 0;
-        cfg->private_data = 0;
+        cfg->ops = NULL;
+        cfg->private_data = NULL;
 
         /* Finalise */
         cfg->can_stall = params->stall;
diff --git a/drivers/usb/gadget/f_sourcesink.c b/drivers/usb/gadget/f_sourcesink.c
index 6d3cc443d914..685d768f336e 100644
--- a/drivers/usb/gadget/f_sourcesink.c
+++ b/drivers/usb/gadget/f_sourcesink.c
@@ -404,7 +404,7 @@ static void sourcesink_disable(struct usb_function *f)
 
 /*-------------------------------------------------------------------------*/
 
-static int __init sourcesink_bind_config(struct usb_configuration *c)
+static int __ref sourcesink_bind_config(struct usb_configuration *c)
 {
         struct f_sourcesink     *ss;
         int                     status;
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index b49d86e3e45b..a857b7ac238c 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -56,7 +56,7 @@
  * following protocols: RBC (0x01), ATAPI or SFF-8020i (0x02), QIC-157 (0c03),
  * UFI (0x04), SFF-8070i (0x05), and transparent SCSI (0x06), selected by
  * the optional "protocol" module parameter.  In addition, the default
- * Vendor ID, Product ID, and release number can be overridden.
+ * Vendor ID, Product ID, release number and serial number can be overridden.
  *
  * There is support for multiple logical units (LUNs), each of which has
  * its own backing file.  The number of LUNs can be set using the optional
@@ -93,6 +93,8 @@
  *      removable               Default false, boolean for removable media
  *      luns=N                  Default N = number of filenames, number of
  *                                      LUNs to support
+ *      nofua=b[,b...]          Default false, booleans for ignore FUA flag
+ *                                      in SCSI WRITE(10,12) commands
  *      stall                   Default determined according to the type of
  *                                      USB device controller (usually true),
  *                                      boolean to permit the driver to halt
@@ -106,17 +108,18 @@
  *      vendor=0xVVVV           Default 0x0525 (NetChip), USB Vendor ID
  *      product=0xPPPP          Default 0xa4a5 (FSG), USB Product ID
  *      release=0xRRRR          Override the USB release number (bcdDevice)
+ *      serial=HHHH...          Override serial number (string of hex chars)
  *      buflen=N                Default N=16384, buffer size used (will be
  *                                      rounded down to a multiple of
  *                                      PAGE_CACHE_SIZE)
  *
  * If CONFIG_USB_FILE_STORAGE_TEST is not set, only the "file", "ro",
- * "removable", "luns", "stall", and "cdrom" options are available; default
- * values are used for everything else.
+ * "removable", "luns", "nofua", "stall", and "cdrom" options are available;
+ * default values are used for everything else.
  *
  * The pathnames of the backing files and the ro settings are available in
- * the attribute files "file" and "ro" in the lun<n> subdirectory of the
- * gadget's sysfs directory.  If the "removable" option is set, writing to
+ * the attribute files "file", "nofua", and "ro" in the lun<n> subdirectory of
+ * the gadget's sysfs directory.  If the "removable" option is set, writing to
  * these files will simulate ejecting/loading the medium (writing an empty
  * line means eject) and adjusting a write-enable tab.  Changes to the ro
  * setting are not allowed when the medium is loaded or if CD-ROM emulation
@@ -270,6 +273,8 @@
 
 #define DRIVER_DESC             "File-backed Storage Gadget"
 #define DRIVER_NAME             "g_file_storage"
+/* DRIVER_VERSION must be at least 6 characters long, as it is used
+ * to generate a fallback serial number. */
 #define DRIVER_VERSION          "20 November 2008"
 
 static       char fsg_string_manufacturer[64];
@@ -301,8 +306,10 @@ MODULE_LICENSE("Dual BSD/GPL");
 static struct {
         char            *file[FSG_MAX_LUNS];
         int             ro[FSG_MAX_LUNS];
+        int             nofua[FSG_MAX_LUNS];
         unsigned int    num_filenames;
         unsigned int    num_ros;
+        unsigned int    num_nofuas;
         unsigned int    nluns;
 
         int             removable;
@@ -314,6 +321,7 @@ static struct {
         unsigned short  vendor;
         unsigned short  product;
         unsigned short  release;
+        char            *serial;
         unsigned int    buflen;
 
         int             transport_type;
@@ -341,6 +349,10 @@ MODULE_PARM_DESC(file, "names of backing files or devices");
 module_param_array_named(ro, mod_data.ro, bool, &mod_data.num_ros, S_IRUGO);
 MODULE_PARM_DESC(ro, "true to force read-only");
 
+module_param_array_named(nofua, mod_data.nofua, bool, &mod_data.num_nofuas,
+                S_IRUGO);
+MODULE_PARM_DESC(nofua, "true to ignore SCSI WRITE(10,12) FUA bit");
+
 module_param_named(luns, mod_data.nluns, uint, S_IRUGO);
 MODULE_PARM_DESC(luns, "number of LUNs");
 
@@ -353,6 +365,8 @@ MODULE_PARM_DESC(stall, "false to prevent bulk stalls");
 module_param_named(cdrom, mod_data.cdrom, bool, S_IRUGO);
 MODULE_PARM_DESC(cdrom, "true to emulate cdrom instead of disk");
 
+module_param_named(serial, mod_data.serial, charp, S_IRUGO);
+MODULE_PARM_DESC(serial, "USB serial number");
 
 /* In the non-TEST version, only the module parameters listed above
  * are available. */
@@ -1272,7 +1286,8 @@ static int do_write(struct fsg_dev *fsg)
                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                         return -EINVAL;
                 }
-                if (fsg->cmnd[1] & 0x08) {      // FUA
+                /* FUA */
+                if (!curlun->nofua && (fsg->cmnd[1] & 0x08)) {
                         spin_lock(&curlun->filp->f_lock);
                         curlun->filp->f_flags |= O_DSYNC;
                         spin_unlock(&curlun->filp->f_lock);
@@ -3126,6 +3141,7 @@ static int fsg_main_thread(void *fsg_)
 
 /* The write permissions and store_xxx pointers are set in fsg_bind() */
 static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(nofua, 0644, fsg_show_nofua, NULL);
 static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
 
 
@@ -3197,6 +3213,7 @@ static int __init check_parameters(struct fsg_dev *fsg)
 {
         int     prot;
         int     gcnum;
+        int     i;
 
         /* Store the default values */
         mod_data.transport_type = USB_PR_BULK;
@@ -3272,13 +3289,65 @@ static int __init check_parameters(struct fsg_dev *fsg)
                 ERROR(fsg, "invalid buflen\n");
                 return -ETOOSMALL;
         }
+
 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 
+        /* Serial string handling.
+         * On a real device, the serial string would be loaded
+         * from permanent storage. */
+        if (mod_data.serial) {
+                const char *ch;
+                unsigned len = 0;
+
+                /* Sanity check :
+                 * The CB[I] specification limits the serial string to
+                 * 12 uppercase hexadecimal characters.
+                 * BBB need at least 12 uppercase hexadecimal characters,
+                 * with a maximum of 126. */
+                for (ch = mod_data.serial; *ch; ++ch) {
+                        ++len;
+                        if ((*ch < '0' || *ch > '9') &&
+                            (*ch < 'A' || *ch > 'F')) { /* not uppercase hex */
+                                WARNING(fsg,
+                                        "Invalid serial string character: %c; "
+                                        "Failing back to default\n",
+                                        *ch);
+                                goto fill_serial;
+                        }
+                }
+                if (len > 126 ||
+                    (mod_data.transport_type == USB_PR_BULK && len < 12) ||
+                    (mod_data.transport_type != USB_PR_BULK && len > 12)) {
+                        WARNING(fsg,
+                                "Invalid serial string length; "
+                                "Failing back to default\n");
+                        goto fill_serial;
+                }
+                fsg_strings[FSG_STRING_SERIAL - 1].s = mod_data.serial;
+        } else {
+                WARNING(fsg,
+                        "Userspace failed to provide serial number; "
+                        "Failing back to default\n");
+fill_serial:
+                /* Serial number not specified or invalid, make our own.
+                 * We just encode it from the driver version string,
+                 * 12 characters to comply with both CB[I] and BBB spec.
+                 * Warning : Two devices running the same kernel will have
+                 * the same fallback serial number. */
+                for (i = 0; i < 12; i += 2) {
+                        unsigned char   c = DRIVER_VERSION[i / 2];
+
+                        if (!c)
+                                break;
+                        sprintf(&fsg_string_serial[i], "%02X", c);
+                }
+        }
+
         return 0;
 }
 
 
-static int __init fsg_bind(struct usb_gadget *gadget)
+static int __ref fsg_bind(struct usb_gadget *gadget)
 {
         struct fsg_dev          *fsg = the_fsg;
         int                     rc;
@@ -3305,6 +3374,10 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                 }
         }
 
+        /* Only for removable media? */
+        dev_attr_nofua.attr.mode = 0644;
+        dev_attr_nofua.store = fsg_store_nofua;
+
         /* Find out how many LUNs there should be */
         i = mod_data.nluns;
         if (i == 0)
@@ -3330,6 +3403,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                 curlun->ro = mod_data.cdrom || mod_data.ro[i];
                 curlun->initially_ro = curlun->ro;
                 curlun->removable = mod_data.removable;
+                curlun->nofua = mod_data.nofua[i];
                 curlun->dev.release = lun_release;
                 curlun->dev.parent = &gadget->dev;
                 curlun->dev.driver = &fsg_driver.driver;
@@ -3344,6 +3418,8 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                 if ((rc = device_create_file(&curlun->dev,
                                         &dev_attr_ro)) != 0 ||
                                 (rc = device_create_file(&curlun->dev,
+                                        &dev_attr_nofua)) != 0 ||
+                                (rc = device_create_file(&curlun->dev,
                                         &dev_attr_file)) != 0) {
                         device_unregister(&curlun->dev);
                         goto out;
@@ -3447,16 +3523,6 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                         init_utsname()->sysname, init_utsname()->release,
                         gadget->name);
 
-        /* On a real device, serial[] would be loaded from permanent
-         * storage.  We just encode it from the driver version string. */
-        for (i = 0; i < sizeof fsg_string_serial - 2; i += 2) {
-                unsigned char           c = DRIVER_VERSION[i / 2];
-
-                if (!c)
-                        break;
-                sprintf(&fsg_string_serial[i], "%02X", c);
-        }
-
         fsg->thread_task = kthread_create(fsg_main_thread, fsg,
                         "file-storage-gadget");
         if (IS_ERR(fsg->thread_task)) {
@@ -3478,8 +3544,8 @@ static int __init fsg_bind(struct usb_gadget *gadget)
                                 if (IS_ERR(p))
                                         p = NULL;
                         }
-                        LINFO(curlun, "ro=%d, file: %s\n",
-                                        curlun->ro, (p ? p : "(error)"));
+                        LINFO(curlun, "ro=%d, nofua=%d, file: %s\n",
+                              curlun->ro, curlun->nofua, (p ? p : "(error)"));
                 }
         }
         kfree(pathbuf);
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index d1af253a9105..a9474f8d5325 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -32,12 +32,13 @@
 #  include "u_ether.c"
 
 static u8 gfs_hostaddr[ETH_ALEN];
-#else
-#  if !defined CONFIG_USB_FUNCTIONFS_GENERIC
-#    define CONFIG_USB_FUNCTIONFS_GENERIC
+#  ifdef CONFIG_USB_FUNCTIONFS_ETH
+static int eth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 #  endif
+#else
 #  define gether_cleanup() do { } while (0)
 #  define gether_setup(gadget, hostaddr)   ((int)0)
+#  define gfs_hostaddr NULL
 #endif
 
 #include "f_fs.c"
@@ -107,15 +108,7 @@ static const struct usb_descriptor_header *gfs_otg_desc[] = {
 enum {
         GFS_STRING_MANUFACTURER_IDX,
         GFS_STRING_PRODUCT_IDX,
-#ifdef CONFIG_USB_FUNCTIONFS_RNDIS
-        GFS_STRING_RNDIS_CONFIG_IDX,
-#endif
-#ifdef CONFIG_USB_FUNCTIONFS_ETH
-        GFS_STRING_ECM_CONFIG_IDX,
-#endif
-#ifdef CONFIG_USB_FUNCTIONFS_GENERIC
-        GFS_STRING_GENERIC_CONFIG_IDX,
-#endif
+        GFS_STRING_FIRST_CONFIG_IDX,
 };
 
 static       char gfs_manufacturer[50];
@@ -126,13 +119,13 @@ static struct usb_string gfs_strings[] = {
         [GFS_STRING_MANUFACTURER_IDX].s = gfs_manufacturer,
         [GFS_STRING_PRODUCT_IDX].s = gfs_driver_desc,
 #ifdef CONFIG_USB_FUNCTIONFS_RNDIS
-        [GFS_STRING_RNDIS_CONFIG_IDX].s = "FunctionFS + RNDIS",
+        { .s = "FunctionFS + RNDIS" },
 #endif
 #ifdef CONFIG_USB_FUNCTIONFS_ETH
-        [GFS_STRING_ECM_CONFIG_IDX].s = "FunctionFS + ECM",
+        { .s = "FunctionFS + ECM" },
 #endif
 #ifdef CONFIG_USB_FUNCTIONFS_GENERIC
-        [GFS_STRING_GENERIC_CONFIG_IDX].s = "FunctionFS",
+        { .s = "FunctionFS" },
 #endif
         {  } /* end of list */
 };
@@ -146,59 +139,33 @@ static struct usb_gadget_strings *gfs_dev_strings[] = {
 };
 
 
+
+struct gfs_configuration {
+        struct usb_configuration c;
+        int (*eth)(struct usb_configuration *c, u8 *ethaddr);
+} gfs_configurations[] = {
 #ifdef CONFIG_USB_FUNCTIONFS_RNDIS
-static int gfs_do_rndis_config(struct usb_configuration *c);
-
-static struct usb_configuration gfs_rndis_config_driver = {
-        .label                  = "FunctionFS + RNDIS",
-        .bind                   = gfs_do_rndis_config,
-        .bConfigurationValue    = 1,
-        /* .iConfiguration      = DYNAMIC */
-        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
-};
-#  define gfs_add_rndis_config(cdev) \
-        usb_add_config(cdev, &gfs_rndis_config_driver)
-#else
-#  define gfs_add_rndis_config(cdev) 0
+        {
+                .eth            = rndis_bind_config,
+        },
 #endif
 
-
 #ifdef CONFIG_USB_FUNCTIONFS_ETH
-static int gfs_do_ecm_config(struct usb_configuration *c);
-
-static struct usb_configuration gfs_ecm_config_driver = {
-        .label                  = "FunctionFS + ECM",
-        .bind                   = gfs_do_ecm_config,
-        .bConfigurationValue    = 1,
-        /* .iConfiguration      = DYNAMIC */
-        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
-};
-#  define gfs_add_ecm_config(cdev) \
-        usb_add_config(cdev, &gfs_ecm_config_driver)
-#else
-#  define gfs_add_ecm_config(cdev) 0
+        {
+                .eth            = eth_bind_config,
+        },
 #endif
 
-
 #ifdef CONFIG_USB_FUNCTIONFS_GENERIC
-static int gfs_do_generic_config(struct usb_configuration *c);
-
-static struct usb_configuration gfs_generic_config_driver = {
-        .label                  = "FunctionFS",
-        .bind                   = gfs_do_generic_config,
-        .bConfigurationValue    = 2,
-        /* .iConfiguration      = DYNAMIC */
-        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
-};
-#  define gfs_add_generic_config(cdev) \
-        usb_add_config(cdev, &gfs_generic_config_driver)
-#else
-#  define gfs_add_generic_config(cdev) 0
+        {
+        },
 #endif
+};
 
 
 static int gfs_bind(struct usb_composite_dev *cdev);
 static int gfs_unbind(struct usb_composite_dev *cdev);
+static int gfs_do_config(struct usb_configuration *c);
 
 static struct usb_composite_driver gfs_driver = {
         .name           = gfs_short_name,
@@ -267,7 +234,7 @@ static int functionfs_check_dev_callback(const char *dev_name)
 
 static int gfs_bind(struct usb_composite_dev *cdev)
 {
-        int ret;
+        int ret, i;
 
         ENTER();
 
@@ -284,57 +251,32 @@ static int gfs_bind(struct usb_composite_dev *cdev)
         snprintf(gfs_manufacturer, sizeof gfs_manufacturer, "%s %s with %s",
                  init_utsname()->sysname, init_utsname()->release,
                  cdev->gadget->name);
-        ret = usb_string_id(cdev);
-        if (unlikely(ret < 0))
-                goto error;
-        gfs_strings[GFS_STRING_MANUFACTURER_IDX].id = ret;
-        gfs_dev_desc.iManufacturer = ret;
-
-        ret = usb_string_id(cdev);
-        if (unlikely(ret < 0))
-                goto error;
-        gfs_strings[GFS_STRING_PRODUCT_IDX].id = ret;
-        gfs_dev_desc.iProduct = ret;
-
-#ifdef CONFIG_USB_FUNCTIONFS_RNDIS
-        ret = usb_string_id(cdev);
-        if (unlikely(ret < 0))
-                goto error;
-        gfs_strings[GFS_STRING_RNDIS_CONFIG_IDX].id = ret;
-        gfs_rndis_config_driver.iConfiguration = ret;
-#endif
 
-#ifdef CONFIG_USB_FUNCTIONFS_ETH
-        ret = usb_string_id(cdev);
+        ret = usb_string_ids_tab(cdev, gfs_strings);
         if (unlikely(ret < 0))
                 goto error;
-        gfs_strings[GFS_STRING_ECM_CONFIG_IDX].id = ret;
-        gfs_ecm_config_driver.iConfiguration = ret;
-#endif
 
-#ifdef CONFIG_USB_FUNCTIONFS_GENERIC
-        ret = usb_string_id(cdev);
-        if (unlikely(ret < 0))
-                goto error;
-        gfs_strings[GFS_STRING_GENERIC_CONFIG_IDX].id = ret;
-        gfs_generic_config_driver.iConfiguration = ret;
-#endif
+        gfs_dev_desc.iManufacturer = gfs_strings[GFS_STRING_MANUFACTURER_IDX].id;
+        gfs_dev_desc.iProduct      = gfs_strings[GFS_STRING_PRODUCT_IDX].id;
 
         ret = functionfs_bind(gfs_ffs_data, cdev);
         if (unlikely(ret < 0))
                 goto error;
 
-        ret = gfs_add_rndis_config(cdev);
-        if (unlikely(ret < 0))
-                goto error_unbind;
+        for (i = 0; i < ARRAY_SIZE(gfs_configurations); ++i) {
+                struct gfs_configuration *c = gfs_configurations + i;
 
-        ret = gfs_add_ecm_config(cdev);
-        if (unlikely(ret < 0))
-                goto error_unbind;
+                ret = GFS_STRING_FIRST_CONFIG_IDX + i;
+                c->c.label                      = gfs_strings[ret].s;
+                c->c.iConfiguration             = gfs_strings[ret].id;
+                c->c.bind                       = gfs_do_config;
+                c->c.bConfigurationValue        = 1 + i;
+                c->c.bmAttributes               = USB_CONFIG_ATT_SELFPOWER;
 
-        ret = gfs_add_generic_config(cdev);
-        if (unlikely(ret < 0))
-                goto error_unbind;
+                ret = usb_add_config(cdev, &c->c);
+                if (unlikely(ret < 0))
+                        goto error_unbind;
+        }
 
         return 0;
 
@@ -368,10 +310,10 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
 }
 
 
-static int __gfs_do_config(struct usb_configuration *c,
-                           int (*eth)(struct usb_configuration *c, u8 *ethaddr),
-                           u8 *ethaddr)
+static int gfs_do_config(struct usb_configuration *c)
 {
+        struct gfs_configuration *gc =
+                container_of(c, struct gfs_configuration, c);
         int ret;
 
         if (WARN_ON(!gfs_ffs_data))
@@ -382,13 +324,13 @@ static int __gfs_do_config(struct usb_configuration *c,
                 c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        if (eth) {
-                ret = eth(c, ethaddr);
+        if (gc->eth) {
+                ret = gc->eth(c, gfs_hostaddr);
                 if (unlikely(ret < 0))
                         return ret;
         }
 
-        ret = functionfs_add(c->cdev, c, gfs_ffs_data);
+        ret = functionfs_bind_config(c->cdev, c, gfs_ffs_data);
         if (unlikely(ret < 0))
                 return ret;
 
@@ -406,32 +348,12 @@ static int __gfs_do_config(struct usb_configuration *c,
         return 0;
 }
 
-#ifdef CONFIG_USB_FUNCTIONFS_RNDIS
-static int gfs_do_rndis_config(struct usb_configuration *c)
-{
-        ENTER();
-
-        return __gfs_do_config(c, rndis_bind_config, gfs_hostaddr);
-}
-#endif
 
 #ifdef CONFIG_USB_FUNCTIONFS_ETH
-static int gfs_do_ecm_config(struct usb_configuration *c)
-{
-        ENTER();
-
-        return __gfs_do_config(c,
-                               can_support_ecm(c->cdev->gadget)
-                             ? ecm_bind_config : geth_bind_config,
-                               gfs_hostaddr);
-}
-#endif
-
-#ifdef CONFIG_USB_FUNCTIONFS_GENERIC
-static int gfs_do_generic_config(struct usb_configuration *c)
+static int eth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
 {
-        ENTER();
-
-        return __gfs_do_config(c, NULL, NULL);
+        return can_support_ecm(c->cdev->gadget)
+                ? ecm_bind_config(c, ethaddr)
+                : geth_bind_config(c, ethaddr);
 }
 #endif
diff --git a/drivers/usb/gadget/gmidi.c b/drivers/usb/gadget/gmidi.c
index b7bf88019b06..1b413a5cc3f6 100644
--- a/drivers/usb/gadget/gmidi.c
+++ b/drivers/usb/gadget/gmidi.c
@@ -1157,7 +1157,7 @@ fail:
 /*
  * Creates an output endpoint, and initializes output ports.
  */
-static int __init gmidi_bind(struct usb_gadget *gadget)
+static int __ref gmidi_bind(struct usb_gadget *gadget)
 {
         struct gmidi_device *dev;
         struct usb_ep *in_ep, *out_ep;
diff --git a/drivers/usb/gadget/hid.c b/drivers/usb/gadget/hid.c
index 775722686ed8..735495bf8411 100644
--- a/drivers/usb/gadget/hid.c
+++ b/drivers/usb/gadget/hid.c
@@ -127,7 +127,7 @@ static struct usb_gadget_strings *dev_strings[] = {
 
 /****************************** Configurations ******************************/
 
-static int __init do_config(struct usb_configuration *c)
+static int __ref do_config(struct usb_configuration *c)
 {
         struct hidg_func_node *e;
         int func = 0, status = 0;
@@ -156,7 +156,7 @@ static struct usb_configuration config_driver = {
 
 /****************************** Gadget Bind ******************************/
 
-static int __init hid_bind(struct usb_composite_dev *cdev)
+static int __ref hid_bind(struct usb_composite_dev *cdev)
 {
         struct usb_gadget *gadget = cdev->gadget;
         struct list_head *tmp;
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index de8a83803505..fc35406fc80c 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1299,11 +1299,9 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value)
         struct usb_gadget       *gadget = dev->gadget;
         long ret = -ENOTTY;
 
-        if (gadget->ops->ioctl) {
-                lock_kernel();
+        if (gadget->ops->ioctl)
                 ret = gadget->ops->ioctl (gadget, code, value);
-                unlock_kernel();
-        }
+
         return ret;
 }
 
@@ -1867,13 +1865,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         buf += 4;
         length -= 4;
 
-        kbuf = kmalloc (length, GFP_KERNEL);
-        if (!kbuf)
-                return -ENOMEM;
-        if (copy_from_user (kbuf, buf, length)) {
-                kfree (kbuf);
-                return -EFAULT;
-        }
+        kbuf = memdup_user(buf, length);
+        if (IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         spin_lock_irq (&dev->lock);
         value = -EINVAL;
diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
index a3913519fd58..c2d2a201f84b 100644
--- a/drivers/usb/gadget/langwell_udc.c
+++ b/drivers/usb/gadget/langwell_udc.c
@@ -842,9 +842,9 @@ static int langwell_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
                 VDBG(dev, "req->mapped = 0\n");
         }
 
-        DBG(dev, "%s queue req %p, len %u, buf %p, dma 0x%08x\n",
-                        _ep->name,
-                        _req, _req->length, _req->buf, _req->dma);
+        DBG(dev, "%s queue req %p, len %u, buf %p, dma 0x%08llx\n",
+            _ep->name,
+            _req, _req->length, _req->buf, (unsigned long long)_req->dma);
 
         _req->status = -EINPROGRESS;
         _req->actual = 0;
diff --git a/drivers/usb/gadget/mass_storage.c b/drivers/usb/gadget/mass_storage.c
index 705cc1f76327..585f2559484d 100644
--- a/drivers/usb/gadget/mass_storage.c
+++ b/drivers/usb/gadget/mass_storage.c
@@ -141,9 +141,14 @@ static int msg_thread_exits(struct fsg_common *common)
         return 0;
 }
 
-static int __init msg_do_config(struct usb_configuration *c)
+static int __ref msg_do_config(struct usb_configuration *c)
 {
-        struct fsg_common *common;
+        static const struct fsg_operations ops = {
+                .thread_exits = msg_thread_exits,
+        };
+        static struct fsg_common common;
+
+        struct fsg_common *retp;
         struct fsg_config config;
         int ret;
 
@@ -153,13 +158,14 @@ static int __init msg_do_config(struct usb_configuration *c)
         }
 
         fsg_config_from_params(&config, &mod_data);
-        config.thread_exits = msg_thread_exits;
-        common = fsg_common_init(0, c->cdev, &config);
-        if (IS_ERR(common))
-                return PTR_ERR(common);
+        config.ops = &ops;
+
+        retp = fsg_common_init(&common, c->cdev, &config);
+        if (IS_ERR(retp))
+                return PTR_ERR(retp);
 
-        ret = fsg_add(c->cdev, c, common);
-        fsg_common_put(common);
+        ret = fsg_bind_config(c->cdev, c, &common);
+        fsg_common_put(&common);
         return ret;
 }
 
@@ -176,7 +182,7 @@ static struct usb_configuration msg_config_driver = {
 /****************************** Gadget Bind ******************************/
 
 
-static int __init msg_bind(struct usb_composite_dev *cdev)
+static int __ref msg_bind(struct usb_composite_dev *cdev)
 {
         struct usb_gadget *gadget = cdev->gadget;
         int status;
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index a930d7fd7e7a..795d76232167 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -24,6 +24,7 @@
 
 #include <linux/kernel.h>
 #include <linux/utsname.h>
+#include <linux/module.h>
 
 
 #if defined USB_ETH_RNDIS
@@ -35,14 +36,13 @@
 
 
 #define DRIVER_DESC             "Multifunction Composite Gadget"
-#define DRIVER_VERSION          "2009/07/21"
 
-/*-------------------------------------------------------------------------*/
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Michal Nazarewicz");
+MODULE_LICENSE("GPL");
 
-#define MULTI_VENDOR_NUM        0x0525  /* XXX NetChip */
-#define MULTI_PRODUCT_NUM       0xa4ab  /* XXX */
 
-/*-------------------------------------------------------------------------*/
+/***************************** All the files... *****************************/
 
 /*
  * kbuild is not very cooperative with respect to linking separately
@@ -57,6 +57,8 @@
 #include "config.c"
 #include "epautoconf.c"
 
+#include "f_mass_storage.c"
+
 #include "u_serial.c"
 #include "f_acm.c"
 
@@ -68,13 +70,24 @@
 #endif
 #include "u_ether.c"
 
-#undef DBG     /* u_ether.c has broken idea about macros */
-#undef VDBG    /* so clean up after it */
-#undef ERROR
-#undef INFO
-#include "f_mass_storage.c"
 
-/*-------------------------------------------------------------------------*/
+
+/***************************** Device Descriptor ****************************/
+
+#define MULTI_VENDOR_NUM        0x0525  /* XXX NetChip */
+#define MULTI_PRODUCT_NUM       0xa4ab  /* XXX */
+
+
+enum {
+        __MULTI_NO_CONFIG,
+#ifdef CONFIG_USB_G_MULTI_RNDIS
+        MULTI_RNDIS_CONFIG_NUM,
+#endif
+#ifdef CONFIG_USB_G_MULTI_CDC
+        MULTI_CDC_CONFIG_NUM,
+#endif
+};
+
 
 static struct usb_device_descriptor device_desc = {
         .bLength =              sizeof device_desc,
@@ -82,80 +95,82 @@ static struct usb_device_descriptor device_desc = {
 
         .bcdUSB =               cpu_to_le16(0x0200),
 
-        /* .bDeviceClass =              USB_CLASS_COMM, */
-        /* .bDeviceSubClass =   0, */
-        /* .bDeviceProtocol =   0, */
-        .bDeviceClass =         0xEF,
+        .bDeviceClass =         USB_CLASS_MISC /* 0xEF */,
         .bDeviceSubClass =      2,
         .bDeviceProtocol =      1,
-        /* .bMaxPacketSize0 = f(hardware) */
 
         /* Vendor and product id can be overridden by module parameters.  */
         .idVendor =             cpu_to_le16(MULTI_VENDOR_NUM),
         .idProduct =            cpu_to_le16(MULTI_PRODUCT_NUM),
-        /* .bcdDevice = f(hardware) */
-        /* .iManufacturer = DYNAMIC */
-        /* .iProduct = DYNAMIC */
-        /* NO SERIAL NUMBER */
-        .bNumConfigurations =   1,
 };
 
-static struct usb_otg_descriptor otg_descriptor = {
-        .bLength =              sizeof otg_descriptor,
-        .bDescriptorType =      USB_DT_OTG,
-
-        /* REVISIT SRP-only hardware is possible, although
-         * it would not be called "OTG" ...
-         */
-        .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
-};
 
 static const struct usb_descriptor_header *otg_desc[] = {
-        (struct usb_descriptor_header *) &otg_descriptor,
+        (struct usb_descriptor_header *) &(struct usb_otg_descriptor){
+                .bLength =              sizeof(struct usb_otg_descriptor),
+                .bDescriptorType =      USB_DT_OTG,
+
+                /*
+                 * REVISIT SRP-only hardware is possible, although
+                 * it would not be called "OTG" ...
+                 */
+                .bmAttributes =         USB_OTG_SRP | USB_OTG_HNP,
+        },
         NULL,
 };
 
 
-/* string IDs are assigned dynamically */
-
-#define STRING_MANUFACTURER_IDX         0
-#define STRING_PRODUCT_IDX              1
+enum {
+        MULTI_STRING_MANUFACTURER_IDX,
+        MULTI_STRING_PRODUCT_IDX,
+#ifdef CONFIG_USB_G_MULTI_RNDIS
+        MULTI_STRING_RNDIS_CONFIG_IDX,
+#endif
+#ifdef CONFIG_USB_G_MULTI_CDC
+        MULTI_STRING_CDC_CONFIG_IDX,
+#endif
+};
 
 static char manufacturer[50];
 
 static struct usb_string strings_dev[] = {
-        [STRING_MANUFACTURER_IDX].s = manufacturer,
-        [STRING_PRODUCT_IDX].s = DRIVER_DESC,
+        [MULTI_STRING_MANUFACTURER_IDX].s = manufacturer,
+        [MULTI_STRING_PRODUCT_IDX].s      = DRIVER_DESC,
+#ifdef CONFIG_USB_G_MULTI_RNDIS
+        [MULTI_STRING_RNDIS_CONFIG_IDX].s = "Multifunction with RNDIS",
+#endif
+#ifdef CONFIG_USB_G_MULTI_CDC
+        [MULTI_STRING_CDC_CONFIG_IDX].s   = "Multifunction with CDC ECM",
+#endif
         {  } /* end of list */
 };
 
-static struct usb_gadget_strings stringtab_dev = {
-        .language       = 0x0409,       /* en-us */
-        .strings        = strings_dev,
-};
-
 static struct usb_gadget_strings *dev_strings[] = {
-        &stringtab_dev,
+        &(struct usb_gadget_strings){
+                .language       = 0x0409,       /* en-us */
+                .strings        = strings_dev,
+        },
         NULL,
 };
 
-static u8 hostaddr[ETH_ALEN];
 
 
 
 /****************************** Configurations ******************************/
 
-static struct fsg_module_parameters mod_data = {
-        .stall = 1
-};
-FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
+static struct fsg_module_parameters fsg_mod_data = { .stall = 1 };
+FSG_MODULE_PARAMETERS(/* no prefix */, fsg_mod_data);
+
+static struct fsg_common fsg_common;
+
+static u8 hostaddr[ETH_ALEN];
 
-static struct fsg_common *fsg_common;
 
+/********** RNDIS **********/
 
 #ifdef USB_ETH_RNDIS
 
-static int __init rndis_do_config(struct usb_configuration *c)
+static __ref int rndis_do_config(struct usb_configuration *c)
 {
         int ret;
 
@@ -172,26 +187,42 @@ static int __init rndis_do_config(struct usb_configuration *c)
         if (ret < 0)
                 return ret;
 
-        ret = fsg_add(c->cdev, c, fsg_common);
+        ret = fsg_bind_config(c->cdev, c, &fsg_common);
         if (ret < 0)
                 return ret;
 
         return 0;
 }
 
-static struct usb_configuration rndis_config_driver = {
-        .label                  = "Multifunction Composite (RNDIS + MS + ACM)",
-        .bind                   = rndis_do_config,
-        .bConfigurationValue    = 2,
-        /* .iConfiguration = DYNAMIC */
-        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
-};
+static int rndis_config_register(struct usb_composite_dev *cdev)
+{
+        static struct usb_configuration config = {
+                .bind                   = rndis_do_config,
+                .bConfigurationValue    = MULTI_RNDIS_CONFIG_NUM,
+                .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+        };
+
+        config.label          = strings_dev[MULTI_STRING_RNDIS_CONFIG_IDX].s;
+        config.iConfiguration = strings_dev[MULTI_STRING_RNDIS_CONFIG_IDX].id;
+
+        return usb_add_config(cdev, &config);
+}
+
+#else
+
+static int rndis_config_register(struct usb_composite_dev *cdev)
+{
+        return 0;
+}
 
 #endif
 
+
+/********** CDC ECM **********/
+
 #ifdef CONFIG_USB_G_MULTI_CDC
 
-static int __init cdc_do_config(struct usb_configuration *c)
+static __ref int cdc_do_config(struct usb_configuration *c)
 {
         int ret;
 
@@ -208,20 +239,33 @@ static int __init cdc_do_config(struct usb_configuration *c)
         if (ret < 0)
                 return ret;
 
-        ret = fsg_add(c->cdev, c, fsg_common);
+        ret = fsg_bind_config(c->cdev, c, &fsg_common);
         if (ret < 0)
                 return ret;
 
         return 0;
 }
 
-static struct usb_configuration cdc_config_driver = {
-        .label                  = "Multifunction Composite (CDC + MS + ACM)",
-        .bind                   = cdc_do_config,
-        .bConfigurationValue    = 1,
-        /* .iConfiguration = DYNAMIC */
-        .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
-};
+static int cdc_config_register(struct usb_composite_dev *cdev)
+{
+        static struct usb_configuration config = {
+                .bind                   = cdc_do_config,
+                .bConfigurationValue    = MULTI_CDC_CONFIG_NUM,
+                .bmAttributes           = USB_CONFIG_ATT_SELFPOWER,
+        };
+
+        config.label          = strings_dev[MULTI_STRING_CDC_CONFIG_IDX].s;
+        config.iConfiguration = strings_dev[MULTI_STRING_CDC_CONFIG_IDX].id;
+
+        return usb_add_config(cdev, &config);
+}
+
+#else
+
+static int cdc_config_register(struct usb_composite_dev *cdev)
+{
+        return 0;
+}
 
 #endif
 
@@ -230,7 +274,7 @@ static struct usb_configuration cdc_config_driver = {
 /****************************** Gadget Bind ******************************/
 
 
-static int __init multi_bind(struct usb_composite_dev *cdev)
+static int __ref multi_bind(struct usb_composite_dev *cdev)
 {
         struct usb_gadget *gadget = cdev->gadget;
         int status, gcnum;
@@ -252,67 +296,56 @@ static int __init multi_bind(struct usb_composite_dev *cdev)
                 goto fail0;
 
         /* set up mass storage function */
-        fsg_common = fsg_common_from_params(0, cdev, &mod_data);
-        if (IS_ERR(fsg_common)) {
-                status = PTR_ERR(fsg_common);
-                goto fail1;
+        {
+                void *retp;
+                retp = fsg_common_from_params(&fsg_common, cdev, &fsg_mod_data);
+                if (IS_ERR(retp)) {
+                        status = PTR_ERR(retp);
+                        goto fail1;
+                }
         }
 
-
+        /* set bcdDevice */
         gcnum = usb_gadget_controller_number(gadget);
-        if (gcnum >= 0)
+        if (gcnum >= 0) {
                 device_desc.bcdDevice = cpu_to_le16(0x0300 | gcnum);
-        else {
-                /* We assume that can_support_ecm() tells the truth;
-                 * but if the controller isn't recognized at all then
-                 * that assumption is a bit more likely to be wrong.
-                 */
-                WARNING(cdev, "controller '%s' not recognized\n",
-                        gadget->name);
+        } else {
+                WARNING(cdev, "controller '%s' not recognized\n", gadget->name);
                 device_desc.bcdDevice = cpu_to_le16(0x0300 | 0x0099);
         }
 
-
-        /* Allocate string descriptor numbers ... note that string
-         * contents can be overridden by the composite_dev glue.
-         */
-
-        /* device descriptor strings: manufacturer, product */
+        /* allocate string descriptor numbers */
         snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
                  init_utsname()->sysname, init_utsname()->release,
                  gadget->name);
-        status = usb_string_id(cdev);
-        if (status < 0)
-                goto fail2;
-        strings_dev[STRING_MANUFACTURER_IDX].id = status;
-        device_desc.iManufacturer = status;
 
-        status = usb_string_id(cdev);
-        if (status < 0)
+        status = usb_string_ids_tab(cdev, strings_dev);
+        if (unlikely(status < 0))
                 goto fail2;
-        strings_dev[STRING_PRODUCT_IDX].id = status;
-        device_desc.iProduct = status;
 
-#ifdef USB_ETH_RNDIS
-        /* register our first configuration */
-        status = usb_add_config(cdev, &rndis_config_driver);
-        if (status < 0)
+        device_desc.iManufacturer =
+                strings_dev[MULTI_STRING_MANUFACTURER_IDX].id;
+        device_desc.iProduct      =
+                strings_dev[MULTI_STRING_PRODUCT_IDX].id;
+
+        /* register configurations */
+        status = rndis_config_register(cdev);
+        if (unlikely(status < 0))
                 goto fail2;
-#endif
 
-#ifdef CONFIG_USB_G_MULTI_CDC
-        /* register our second configuration */
-        status = usb_add_config(cdev, &cdc_config_driver);
-        if (status < 0)
+        status = cdc_config_register(cdev);
+        if (unlikely(status < 0))
                 goto fail2;
-#endif
 
-        dev_info(&gadget->dev, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
-        fsg_common_put(fsg_common);
+        /* we're done */
+        dev_info(&gadget->dev, DRIVER_DESC "\n");
+        fsg_common_put(&fsg_common);
         return 0;
 
+
+        /* error recovery */
 fail2:
-        fsg_common_put(fsg_common);
+        fsg_common_put(&fsg_common);
 fail1:
         gserial_cleanup();
 fail0:
@@ -339,18 +372,15 @@ static struct usb_composite_driver multi_driver = {
         .unbind         = __exit_p(multi_unbind),
 };
 
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_AUTHOR("Michal Nazarewicz");
-MODULE_LICENSE("GPL");
 
-static int __init g_multi_init(void)
+static int __init multi_init(void)
 {
         return usb_composite_register(&multi_driver);
 }
-module_init(g_multi_init);
+module_init(multi_init);
 
-static void __exit g_multi_cleanup(void)
+static void __exit multi_exit(void)
 {
         usb_composite_unregister(&multi_driver);
 }
-module_exit(g_multi_cleanup);
+module_exit(multi_exit);
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 4c3ac5c42237..cf241c371a71 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -25,7 +25,7 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
@@ -70,6 +70,7 @@
 #define DRIVER_DESC             "Printer Gadget"
 #define DRIVER_VERSION          "2007 OCT 06"
 
+static DEFINE_MUTEX(printer_mutex);
 static const char shortname [] = "printer";
 static const char driver_desc [] = DRIVER_DESC;
 
@@ -476,7 +477,7 @@ printer_open(struct inode *inode, struct file *fd)
         unsigned long           flags;
         int                     ret = -EBUSY;
 
-        lock_kernel();
+        mutex_lock(&printer_mutex);
         dev = container_of(inode->i_cdev, struct printer_dev, printer_cdev);
 
         spin_lock_irqsave(&dev->lock, flags);
@@ -492,7 +493,7 @@ printer_open(struct inode *inode, struct file *fd)
         spin_unlock_irqrestore(&dev->lock, flags);
 
         DBG(dev, "printer_open returned %x\n", ret);
-        unlock_kernel();
+        mutex_unlock(&printer_mutex);
         return ret;
 }
 
@@ -1346,7 +1347,7 @@ printer_unbind(struct usb_gadget *gadget)
         set_gadget_data(gadget, NULL);
 }
 
-static int __init
+static int __ref
 printer_bind(struct usb_gadget *gadget)
 {
         struct printer_dev      *dev;
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 26193eceb323..521ebed0118d 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -12,6 +12,8 @@
  * published by the Free Software Foundation.
 */
 
+#define DEBUG
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
@@ -23,6 +25,7 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/slab.h>
+#include <linux/clk.h>
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
@@ -33,6 +36,7 @@
 #include <plat/regs-usb-hsotg.h>
 #include <mach/regs-sys.h>
 #include <plat/udc-hs.h>
+#include <plat/cpu.h>
 
 #define DMA_ADDR_INVALID (~((dma_addr_t)0))
 
@@ -91,7 +95,9 @@ struct s3c_hsotg_req;
  * For periodic IN endpoints, we have fifo_size and fifo_load to try
  * and keep track of the amount of data in the periodic FIFO for each
  * of these as we don't have a status register that tells us how much
- * is in each of them.
+ * is in each of them. (note, this may actually be useless information
+ * as in shared-fifo mode periodic in acts like a single-frame packet
+ * buffer than a fifo)
  */
 struct s3c_hsotg_ep {
         struct usb_ep           ep;
@@ -128,6 +134,7 @@ struct s3c_hsotg_ep {
  * @regs: The memory area mapped for accessing registers.
  * @regs_res: The resource that was allocated when claiming register space.
  * @irq: The IRQ number we are using
+ * @dedicated_fifos: Set if the hardware has dedicated IN-EP fifos.
  * @debug_root: root directrory for debugfs.
  * @debug_file: main status file for debugfs.
  * @debug_fifo: FIFO status file for debugfs.
@@ -145,6 +152,9 @@ struct s3c_hsotg {
         void __iomem            *regs;
         struct resource         *regs_res;
         int                     irq;
+        struct clk              *clk;
+
+        unsigned int            dedicated_fifos:1;
 
         struct dentry           *debug_root;
         struct dentry           *debug_file;
@@ -310,11 +320,11 @@ static void s3c_hsotg_init_fifo(struct s3c_hsotg *hsotg)
                 hsotg->regs + S3C_GNPTXFSIZ);
         */
 
-        /* set FIFO sizes to 2048/0x1C0 */
+        /* set FIFO sizes to 2048/1024 */
 
         writel(2048, hsotg->regs + S3C_GRXFSIZ);
         writel(S3C_GNPTXFSIZ_NPTxFStAddr(2048) |
-               S3C_GNPTXFSIZ_NPTxFDep(0x1C0),
+               S3C_GNPTXFSIZ_NPTxFDep(1024),
                hsotg->regs + S3C_GNPTXFSIZ);
 
         /* arange all the rest of the TX FIFOs, as some versions of this
@@ -464,7 +474,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
         if (to_write == 0)
                 return 0;
 
-        if (periodic) {
+        if (periodic && !hsotg->dedicated_fifos) {
                 u32 epsize = readl(hsotg->regs + S3C_DIEPTSIZ(hs_ep->index));
                 int size_left;
                 int size_done;
@@ -474,6 +484,14 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
 
                 size_left = S3C_DxEPTSIZ_XferSize_GET(epsize);
 
+                /* if shared fifo, we cannot write anything until the
+                 * previous data has been completely sent.
+                 */
+                if (hs_ep->fifo_load != 0) {
+                        s3c_hsotg_en_gsint(hsotg, S3C_GINTSTS_PTxFEmp);
+                        return -ENOSPC;
+                }
+
                 dev_dbg(hsotg->dev, "%s: left=%d, load=%d, fifo=%d, size %d\n",
                         __func__, size_left,
                         hs_ep->size_loaded, hs_ep->fifo_load, hs_ep->fifo_size);
@@ -494,6 +512,11 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
                         s3c_hsotg_en_gsint(hsotg, S3C_GINTSTS_PTxFEmp);
                         return -ENOSPC;
                 }
+        } else if (hsotg->dedicated_fifos && hs_ep->index != 0) {
+                can_write = readl(hsotg->regs + S3C_DTXFSTS(hs_ep->index));
+
+                can_write &= 0xffff;
+                can_write *= 4;
         } else {
                 if (S3C_GNPTXSTS_NPTxQSpcAvail_GET(gnptxsts) == 0) {
                         dev_dbg(hsotg->dev,
@@ -505,6 +528,7 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
                 }
 
                 can_write = S3C_GNPTXSTS_NPTxFSpcAvail_GET(gnptxsts);
+                can_write *= 4; /* fifo size is in 32bit quantities. */
         }
 
         dev_dbg(hsotg->dev, "%s: GNPTXSTS=%08x, can=%d, to=%d, mps %d\n",
@@ -517,6 +541,17 @@ static int s3c_hsotg_write_fifo(struct s3c_hsotg *hsotg,
         if (can_write > 512)
                 can_write = 512;
 
+        /* limit the write to one max-packet size worth of data, but allow
+         * the transfer to return that it did not run out of fifo space
+         * doing it. */
+        if (to_write > hs_ep->ep.maxpacket) {
+                to_write = hs_ep->ep.maxpacket;
+
+                s3c_hsotg_en_gsint(hsotg,
+                                   periodic ? S3C_GINTSTS_PTxFEmp :
+                                   S3C_GINTSTS_NPTxFEmp);
+        }
+
         /* see if we can write data */
 
         if (to_write > can_write) {
@@ -579,12 +614,10 @@ static unsigned get_ep_limit(struct s3c_hsotg_ep *hs_ep)
                 maxsize = S3C_DxEPTSIZ_XferSize_LIMIT + 1;
                 maxpkt = S3C_DxEPTSIZ_PktCnt_LIMIT + 1;
         } else {
+                maxsize = 64+64;
                 if (hs_ep->dir_in) {
-                        /* maxsize = S3C_DIEPTSIZ0_XferSize_LIMIT + 1; */
-                        maxsize = 64+64+1;
                         maxpkt = S3C_DIEPTSIZ0_PktCnt_LIMIT + 1;
                 } else {
-                        maxsize = 0x3f;
                         maxpkt = 2;
                 }
         }
@@ -1353,6 +1386,9 @@ static void s3c_hsotg_rx_data(struct s3c_hsotg *hsotg, int ep_idx, int size)
         read_ptr = hs_req->req.actual;
         max_req = hs_req->req.length - read_ptr;
 
+        dev_dbg(hsotg->dev, "%s: read %d/%d, done %d/%d\n",
+                __func__, to_read, max_req, read_ptr, hs_req->req.length);
+
         if (to_read > max_req) {
                 /* more data appeared than we where willing
                  * to deal with in this request.
@@ -1362,9 +1398,6 @@ static void s3c_hsotg_rx_data(struct s3c_hsotg *hsotg, int ep_idx, int size)
                 WARN_ON_ONCE(1);
         }
 
-        dev_dbg(hsotg->dev, "%s: read %d/%d, done %d/%d\n",
-                __func__, to_read, max_req, read_ptr, hs_req->req.length);
-
         hs_ep->total_data += to_read;
         hs_req->req.actual += to_read;
         to_read = DIV_ROUND_UP(to_read, 4);
@@ -1433,9 +1466,11 @@ static void s3c_hsotg_send_zlp(struct s3c_hsotg *hsotg,
 static void s3c_hsotg_handle_outdone(struct s3c_hsotg *hsotg,
                                      int epnum, bool was_setup)
 {
+        u32 epsize = readl(hsotg->regs + S3C_DOEPTSIZ(epnum));
         struct s3c_hsotg_ep *hs_ep = &hsotg->eps[epnum];
         struct s3c_hsotg_req *hs_req = hs_ep->req;
         struct usb_request *req = &hs_req->req;
+        unsigned size_left = S3C_DxEPTSIZ_XferSize_GET(epsize);
         int result = 0;
 
         if (!hs_req) {
@@ -1444,9 +1479,7 @@ static void s3c_hsotg_handle_outdone(struct s3c_hsotg *hsotg,
         }
 
         if (using_dma(hsotg)) {
-                u32 epsize = readl(hsotg->regs + S3C_DOEPTSIZ(epnum));
                 unsigned size_done;
-                unsigned size_left;
 
                 /* Calculate the size of the transfer by checking how much
                  * is left in the endpoint size register and then working it
@@ -1456,14 +1489,18 @@ static void s3c_hsotg_handle_outdone(struct s3c_hsotg *hsotg,
                  * so may overshoot/undershoot the transfer.
                  */
 
-                size_left = S3C_DxEPTSIZ_XferSize_GET(epsize);
-
                 size_done = hs_ep->size_loaded - size_left;
                 size_done += hs_ep->last_load;
 
                 req->actual = size_done;
         }
 
+        /* if there is more request to do, schedule new transfer */
+        if (req->actual < req->length && size_left == 0) {
+                s3c_hsotg_start_req(hsotg, hs_ep, hs_req, true);
+                return;
+        }
+
         if (req->actual < req->length && req->short_not_ok) {
                 dev_dbg(hsotg->dev, "%s: got %d/%d (short not ok) => error\n",
                         __func__, req->actual, req->length);
@@ -1758,7 +1795,7 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                 if (dir_in) {
                         s3c_hsotg_complete_in(hsotg, hs_ep);
 
-                        if (idx == 0)
+                        if (idx == 0 && !hs_ep->req)
                                 s3c_hsotg_enqueue_setup(hsotg);
                 } else if (using_dma(hsotg)) {
                         /* We're using DMA, we need to fire an OutDone here
@@ -1818,6 +1855,15 @@ static void s3c_hsotg_epint(struct s3c_hsotg *hsotg, unsigned int idx,
                                  __func__, idx);
                         clear |= S3C_DIEPMSK_INTknEPMisMsk;
                 }
+
+                /* FIFO has space or is empty (see GAHBCFG) */
+                if (hsotg->dedicated_fifos &&
+                    ints & S3C_DIEPMSK_TxFIFOEmpty) {
+                        dev_dbg(hsotg->dev, "%s: ep%d: TxFIFOEmpty\n",
+                                __func__, idx);
+                        s3c_hsotg_trytx(hsotg, hs_ep);
+                        clear |= S3C_DIEPMSK_TxFIFOEmpty;
+                }
         }
 
         writel(clear, hsotg->regs + epint_reg);
@@ -2071,17 +2117,12 @@ irq_retry:
                 kill_all_requests(hsotg, &hsotg->eps[0], -ECONNRESET, true);
 
                 /* it seems after a reset we can end up with a situation
-                 * where the TXFIFO still has data in it... try flushing
-                 * it to remove anything that may still be in it.
+                 * where the TXFIFO still has data in it... the docs
+                 * suggest resetting all the fifos, so use the init_fifo
+                 * code to relayout and flush the fifos.
                  */
 
-                if (1) {
-                        writel(S3C_GRSTCTL_TxFNum(0) | S3C_GRSTCTL_TxFFlsh,
-                               hsotg->regs + S3C_GRSTCTL);
-
-                        dev_info(hsotg->dev, "GNPTXSTS=%08x\n",
-                                 readl(hsotg->regs + S3C_GNPTXSTS));
-                }
+                s3c_hsotg_init_fifo(hsotg);
 
                 s3c_hsotg_enqueue_setup(hsotg);
 
@@ -2274,6 +2315,12 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
                 break;
         }
 
+        /* if the hardware has dedicated fifos, we must give each IN EP
+         * a unique tx-fifo even if it is non-periodic.
+         */
+        if (dir_in && hsotg->dedicated_fifos)
+                epctrl |= S3C_DxEPCTL_TxFNum(index);
+
         /* for non control endpoints, set PID to D0 */
         if (index)
                 epctrl |= S3C_DxEPCTL_SetD0PID;
@@ -2563,7 +2610,8 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 
         writel(S3C_DIEPMSK_TimeOUTMsk | S3C_DIEPMSK_AHBErrMsk |
                S3C_DIEPMSK_INTknEPMisMsk |
-               S3C_DIEPMSK_EPDisbldMsk | S3C_DIEPMSK_XferComplMsk,
+               S3C_DIEPMSK_EPDisbldMsk | S3C_DIEPMSK_XferComplMsk |
+               ((hsotg->dedicated_fifos) ? S3C_DIEPMSK_TxFIFOEmpty : 0),
                hsotg->regs + S3C_DIEPMSK);
 
         /* don't need XferCompl, we get that from RXFIFO in slave mode. In
@@ -2732,7 +2780,7 @@ static void __devinit s3c_hsotg_initep(struct s3c_hsotg *hsotg,
          */
 
         ptxfifo = readl(hsotg->regs + S3C_DPTXFSIZn(epnum));
-        hs_ep->fifo_size = S3C_DPTXFSIZn_DPTxFSize_GET(ptxfifo);
+        hs_ep->fifo_size = S3C_DPTXFSIZn_DPTxFSize_GET(ptxfifo) * 4;
 
         /* if we're using dma, we need to set the next-endpoint pointer
          * to be something valid.
@@ -2753,13 +2801,33 @@ static void __devinit s3c_hsotg_initep(struct s3c_hsotg *hsotg,
  */
 static void s3c_hsotg_otgreset(struct s3c_hsotg *hsotg)
 {
-        u32 osc;
+        struct clk *xusbxti;
+        u32 pwr, osc;
 
-        writel(0, S3C_PHYPWR);
+        pwr = readl(S3C_PHYPWR);
+        pwr &= ~0x19;
+        writel(pwr, S3C_PHYPWR);
         mdelay(1);
 
         osc = hsotg->plat->is_osc ? S3C_PHYCLK_EXT_OSC : 0;
 
+        xusbxti = clk_get(hsotg->dev, "xusbxti");
+        if (xusbxti && !IS_ERR(xusbxti)) {
+                switch (clk_get_rate(xusbxti)) {
+                case 12*MHZ:
+                        osc |= S3C_PHYCLK_CLKSEL_12M;
+                        break;
+                case 24*MHZ:
+                        osc |= S3C_PHYCLK_CLKSEL_24M;
+                        break;
+                default:
+                case 48*MHZ:
+                        /* default reference clock */
+                        break;
+                }
+                clk_put(xusbxti);
+        }
+
         writel(osc | 0x10, S3C_PHYCLK);
 
         /* issue a full set of resets to the otg and core */
@@ -2772,6 +2840,8 @@ static void s3c_hsotg_otgreset(struct s3c_hsotg *hsotg)
 
 static void s3c_hsotg_init(struct s3c_hsotg *hsotg)
 {
+        u32 cfg4;
+
         /* unmask subset of endpoint interrupts */
 
         writel(S3C_DIEPMSK_TimeOUTMsk | S3C_DIEPMSK_AHBErrMsk |
@@ -2807,6 +2877,14 @@ static void s3c_hsotg_init(struct s3c_hsotg *hsotg)
 
         writel(using_dma(hsotg) ? S3C_GAHBCFG_DMAEn : 0x0,
                hsotg->regs + S3C_GAHBCFG);
+
+        /* check hardware configuration */
+
+        cfg4 = readl(hsotg->regs + 0x50);
+        hsotg->dedicated_fifos = (cfg4 >> 25) & 1;
+
+        dev_info(hsotg->dev, "%s fifos\n",
+                 hsotg->dedicated_fifos ? "dedicated" : "shared");
 }
 
 static void s3c_hsotg_dump(struct s3c_hsotg *hsotg)
@@ -3181,13 +3259,20 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
         hsotg->dev = dev;
         hsotg->plat = plat;
 
+        hsotg->clk = clk_get(&pdev->dev, "otg");
+        if (IS_ERR(hsotg->clk)) {
+                dev_err(dev, "cannot get otg clock\n");
+                ret = -EINVAL;
+                goto err_mem;
+        }
+
         platform_set_drvdata(pdev, hsotg);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(dev, "cannot find register resource 0\n");
                 ret = -EINVAL;
-                goto err_mem;
+                goto err_clk;
         }
 
         hsotg->regs_res = request_mem_region(res->start, resource_size(res),
@@ -3195,7 +3280,7 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
         if (!hsotg->regs_res) {
                 dev_err(dev, "cannot reserve registers\n");
                 ret = -ENOENT;
-                goto err_mem;
+                goto err_clk;
         }
 
         hsotg->regs = ioremap(res->start, resource_size(res));
@@ -3248,6 +3333,8 @@ static int __devinit s3c_hsotg_probe(struct platform_device *pdev)
 
         /* reset the system */
 
+        clk_enable(hsotg->clk);
+
         s3c_hsotg_gate(pdev, true);
 
         s3c_hsotg_otgreset(hsotg);
@@ -3271,7 +3358,8 @@ err_regs:
 err_regs_res:
         release_resource(hsotg->regs_res);
         kfree(hsotg->regs_res);
-
+err_clk:
+        clk_put(hsotg->clk);
 err_mem:
         kfree(hsotg);
         return ret;
@@ -3293,6 +3381,9 @@ static int __devexit s3c_hsotg_remove(struct platform_device *pdev)
 
         s3c_hsotg_gate(pdev, false);
 
+        clk_disable(hsotg->clk);
+        clk_put(hsotg->clk);
+
         kfree(hsotg);
         return 0;
 }
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index f46a60962dab..b22eedbc7dc5 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -137,7 +137,7 @@ MODULE_PARM_DESC(n_ports, "number of ports to create, default=1");
 
 /*-------------------------------------------------------------------------*/
 
-static int __init serial_bind_config(struct usb_configuration *c)
+static int __ref serial_bind_config(struct usb_configuration *c)
 {
         unsigned i;
         int status = 0;
@@ -161,7 +161,7 @@ static struct usb_configuration serial_config_driver = {
         .bmAttributes   = USB_CONFIG_ATT_SELFPOWER,
 };
 
-static int __init gs_bind(struct usb_composite_dev *cdev)
+static int __ref gs_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
index 04c462ff0ea6..484acfb1a7c5 100644
--- a/drivers/usb/gadget/storage_common.c
+++ b/drivers/usb/gadget/storage_common.c
@@ -57,10 +57,12 @@
 #include <asm/unaligned.h>
 
 
-/* Thanks to NetChip Technologies for donating this product ID.
+/*
+ * Thanks to NetChip Technologies for donating this product ID.
  *
  * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
- * Instead:  allocate your own, using normal USB-IF procedures. */
+ * Instead:  allocate your own, using normal USB-IF procedures.
+ */
 #define FSG_VENDOR_ID   0x0525  /* NetChip */
 #define FSG_PRODUCT_ID  0xa4a5  /* Linux-USB File-backed Storage Gadget */
 
@@ -84,14 +86,27 @@
 #define LWARN(lun, fmt, args...)  dev_warn(&(lun)->dev, fmt, ## args)
 #define LINFO(lun, fmt, args...)  dev_info(&(lun)->dev, fmt, ## args)
 
-/* Keep those macros in sync with thos in
- * include/linux/ubs/composite.h or else GCC will complain.  If they
+/*
+ * Keep those macros in sync with those in
+ * include/linux/usb/composite.h or else GCC will complain.  If they
  * are identical (the same names of arguments, white spaces in the
  * same places) GCC will allow redefinition otherwise (even if some
- * white space is removed or added) warning will be issued.  No
- * checking if those symbols is defined is performed because warning
- * is desired when those macros were defined by someone else to mean
- * something else. */
+ * white space is removed or added) warning will be issued.
+ *
+ * Those macros are needed here because File Storage Gadget does not
+ * include the composite.h header.  For composite gadgets those macros
+ * are redundant since composite.h is included any way.
+ *
+ * One could check whether those macros are already defined (which
+ * would indicate composite.h had been included) or not (which would
+ * indicate we were in FSG) but this is not done because a warning is
+ * desired if definitions here differ from the ones in composite.h.
+ *
+ * We want the definitions to match and be the same in File Storage
+ * Gadget as well as Mass Storage Function (and so composite gadgets
+ * using MSF).  If someone changes them in composite.h it will produce
+ * a warning in this file when building MSF.
+ */
 #define DBG(d, fmt, args...)     dev_dbg(&(d)->gadget->dev , fmt , ## args)
 #define VDBG(d, fmt, args...)    dev_vdbg(&(d)->gadget->dev , fmt , ## args)
 #define ERROR(d, fmt, args...)   dev_err(&(d)->gadget->dev , fmt , ## args)
@@ -269,6 +284,7 @@ struct fsg_lun {
         unsigned int    prevent_medium_removal:1;
         unsigned int    registered:1;
         unsigned int    info_valid:1;
+        unsigned int    nofua:1;
 
         u32             sense_data;
         u32             sense_data_info;
@@ -313,9 +329,11 @@ struct fsg_buffhd {
         enum fsg_buffer_state           state;
         struct fsg_buffhd               *next;
 
-        /* The NetChip 2280 is faster, and handles some protocol faults
+        /*
+         * The NetChip 2280 is faster, and handles some protocol faults
          * better, if we don't submit any short bulk-out read requests.
-         * So we will record the intended request length here. */
+         * So we will record the intended request length here.
+         */
         unsigned int                    bulk_out_intended_length;
 
         struct usb_request              *inreq;
@@ -395,8 +413,10 @@ fsg_intf_desc = {
         .iInterface =           FSG_STRING_INTERFACE,
 };
 
-/* Three full-speed endpoint descriptors: bulk-in, bulk-out,
- * and interrupt-in. */
+/*
+ * Three full-speed endpoint descriptors: bulk-in, bulk-out, and
+ * interrupt-in.
+ */
 
 static struct usb_endpoint_descriptor
 fsg_fs_bulk_in_desc = {
@@ -459,7 +479,7 @@ static struct usb_descriptor_header *fsg_fs_function[] = {
  *
  * That means alternate endpoint descriptors (bigger packets)
  * and a "device qualifier" ... plus more construction options
- * for the config descriptor.
+ * for the configuration descriptor.
  */
 static struct usb_endpoint_descriptor
 fsg_hs_bulk_in_desc = {
@@ -547,8 +567,10 @@ static struct usb_gadget_strings	fsg_stringtab = {
 
  /*-------------------------------------------------------------------------*/
 
-/* If the next two routines are called while the gadget is registered,
- * the caller must own fsg->filesem for writing. */
+/*
+ * If the next two routines are called while the gadget is registered,
+ * the caller must own fsg->filesem for writing.
+ */
 
 static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
 {
@@ -587,8 +609,10 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
                 goto out;
         }
 
-        /* If we can't read the file, it's no good.
-         * If we can't write the file, use it read-only. */
+        /*
+         * If we can't read the file, it's no good.
+         * If we can't write the file, use it read-only.
+         */
         if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
                 LINFO(curlun, "file not readable: %s\n", filename);
                 goto out;
@@ -646,8 +670,10 @@ static void fsg_lun_close(struct fsg_lun *curlun)
 
 /*-------------------------------------------------------------------------*/
 
-/* Sync the file data, don't bother with the metadata.
- * This code was copied from fs/buffer.c:sys_fdatasync(). */
+/*
+ * Sync the file data, don't bother with the metadata.
+ * This code was copied from fs/buffer.c:sys_fdatasync().
+ */
 static int fsg_lun_fsync_sub(struct fsg_lun *curlun)
 {
         struct file     *filp = curlun->filp;
@@ -689,6 +715,14 @@ static ssize_t fsg_show_ro(struct device *dev, struct device_attribute *attr,
                                   : curlun->initially_ro);
 }
 
+static ssize_t fsg_show_nofua(struct device *dev, struct device_attribute *attr,
+                              char *buf)
+{
+        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
+
+        return sprintf(buf, "%u\n", curlun->nofua);
+}
+
 static ssize_t fsg_show_file(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
@@ -723,26 +757,47 @@ static ssize_t fsg_store_ro(struct device *dev, struct device_attribute *attr,
         ssize_t         rc = count;
         struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
         struct rw_semaphore     *filesem = dev_get_drvdata(dev);
-        int             i;
+        unsigned long   ro;
 
-        if (sscanf(buf, "%d", &i) != 1)
+        if (strict_strtoul(buf, 2, &ro))
                 return -EINVAL;
 
-        /* Allow the write-enable status to change only while the backing file
-         * is closed. */
+        /*
+         * Allow the write-enable status to change only while the
+         * backing file is closed.
+         */
         down_read(filesem);
         if (fsg_lun_is_open(curlun)) {
                 LDBG(curlun, "read-only status change prevented\n");
                 rc = -EBUSY;
         } else {
-                curlun->ro = !!i;
-                curlun->initially_ro = !!i;
+                curlun->ro = ro;
+                curlun->initially_ro = ro;
                 LDBG(curlun, "read-only status set to %d\n", curlun->ro);
         }
         up_read(filesem);
         return rc;
 }
 
+static ssize_t fsg_store_nofua(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t count)
+{
+        struct fsg_lun  *curlun = fsg_lun_from_dev(dev);
+        unsigned long   nofua;
+
+        if (strict_strtoul(buf, 2, &nofua))
+                return -EINVAL;
+
+        /* Sync data when switching from async mode to sync */
+        if (!nofua && curlun->nofua)
+                fsg_lun_fsync_sub(curlun);
+
+        curlun->nofua = nofua;
+
+        return count;
+}
+
 static ssize_t fsg_store_file(struct device *dev, struct device_attribute *attr,
                               const char *buf, size_t count)
 {
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 1da755a1c855..6bb876d65252 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -704,17 +704,6 @@ static char *host_addr;
 module_param(host_addr, charp, S_IRUGO);
 MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 
-
-static u8 __init nibble(unsigned char c)
-{
-        if (isdigit(c))
-                return c - '0';
-        c = toupper(c);
-        if (isxdigit(c))
-                return 10 + c - 'A';
-        return 0;
-}
-
 static int get_ether_addr(const char *str, u8 *dev_addr)
 {
         if (str) {
@@ -725,8 +714,8 @@ static int get_ether_addr(const char *str, u8 *dev_addr)
 
                         if ((*str == '.') || (*str == ':'))
                                 str++;
-                        num = nibble(*str++) << 4;
-                        num |= (nibble(*str++));
+                        num = hex_to_bin(*str++) << 4;
+                        num |= hex_to_bin(*str++);
                         dev_addr [i] = num;
                 }
                 if (is_valid_ether_addr(dev_addr))
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 3e8dcb5455e3..01e5354a4c20 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -18,6 +18,7 @@
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>
 #include <linux/delay.h>
diff --git a/drivers/usb/gadget/webcam.c b/drivers/usb/gadget/webcam.c
index 288d21155abe..de1deb7a3c63 100644
--- a/drivers/usb/gadget/webcam.c
+++ b/drivers/usb/gadget/webcam.c
@@ -308,7 +308,7 @@ static const struct uvc_descriptor_header * const uvc_hs_streaming_cls[] = {
  * USB configuration
  */
 
-static int __init
+static int __ref
 webcam_config_bind(struct usb_configuration *c)
 {
         return uvc_bind_config(c, uvc_control_cls, uvc_fs_streaming_cls,
@@ -330,7 +330,7 @@ webcam_unbind(struct usb_composite_dev *cdev)
         return 0;
 }
 
-static int __init
+static int __ref
 webcam_bind(struct usb_composite_dev *cdev)
 {
         int ret;
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index 807280d069f9..cf353920bb1c 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -264,7 +264,7 @@ static void zero_resume(struct usb_composite_dev *cdev)
 
 /*-------------------------------------------------------------------------*/
 
-static int __init zero_bind(struct usb_composite_dev *cdev)
+static int __ref zero_bind(struct usb_composite_dev *cdev)
 {
         int                     gcnum;
         struct usb_gadget       *gadget = cdev->gadget;
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index f865be2276d4..2d926cec0725 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -72,8 +72,9 @@ config USB_EHCI_ROOT_HUB_TT
           from ARC, and has since changed hands a few times.
 
 config USB_EHCI_TT_NEWSCHED
-        bool "Improved Transaction Translator scheduling (EXPERIMENTAL)"
-        depends on USB_EHCI_HCD && EXPERIMENTAL
+        bool "Improved Transaction Translator scheduling"
+        depends on USB_EHCI_HCD
+        default y
         ---help---
           This changes the periodic scheduling code to fill more of the low
           and full speed bandwidth available from the Transaction Translator
@@ -84,9 +85,11 @@ config USB_EHCI_TT_NEWSCHED
           If you have multiple periodic low/fullspeed devices connected to a
           highspeed USB hub which is connected to a highspeed USB Host
           Controller, and some of those devices will not work correctly
-          (possibly due to "ENOSPC" or "-28" errors), say Y.
+          (possibly due to "ENOSPC" or "-28" errors), say Y.  Conversely, if
+          you have only one such device and it doesn't work, you could try
+          saying N.
 
-          If unsure, say N.
+          If unsure, say Y.
 
 config USB_EHCI_BIG_ENDIAN_MMIO
         bool
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index faa61748db70..2baf8a849086 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -228,7 +228,7 @@ static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
          * the root hub is either suspended or stopped.
          */
         spin_lock_irqsave(&ehci->lock, flags);
-        ehci_prepare_ports_for_controller_suspend(ehci);
+        ehci_prepare_ports_for_controller_suspend(ehci, device_may_wakeup(dev));
         ehci_writel(ehci, 0, &ehci->regs->intr_enable);
         (void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 874d2000bf92..76b7fd2d838a 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -98,13 +98,18 @@ static void dbg_hcc_params (struct ehci_hcd *ehci, char *label)
                         HCC_64BIT_ADDR(params) ? " 64 bit addr" : "");
         } else {
                 ehci_dbg (ehci,
-                        "%s hcc_params %04x thresh %d uframes %s%s%s\n",
+                        "%s hcc_params %04x thresh %d uframes %s%s%s%s%s%s%s\n",
                         label,
                         params,
                         HCC_ISOC_THRES(params),
                         HCC_PGM_FRAMELISTLEN(params) ? "256/512/1024" : "1024",
                         HCC_CANPARK(params) ? " park" : "",
-                        HCC_64BIT_ADDR(params) ? " 64 bit addr" : "");
+                        HCC_64BIT_ADDR(params) ? " 64 bit addr" : "",
+                        HCC_LPM(params) ? " LPM" : "",
+                        HCC_PER_PORT_CHANGE_EVENT(params) ? " ppce" : "",
+                        HCC_HW_PREFETCH(params) ? " hw prefetch" : "",
+                        HCC_32FRAME_PERIODIC_LIST(params) ?
+                                " 32 peridic list" : "");
         }
 }
 #else
@@ -191,8 +196,9 @@ static int __maybe_unused
 dbg_status_buf (char *buf, unsigned len, const char *label, u32 status)
 {
         return scnprintf (buf, len,
-                "%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s",
+                "%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s%s",
                 label, label [0] ? " " : "", status,
+                (status & STS_PPCE_MASK) ? " PPCE" : "",
                 (status & STS_ASS) ? " Async" : "",
                 (status & STS_PSS) ? " Periodic" : "",
                 (status & STS_RECL) ? " Recl" : "",
@@ -210,8 +216,9 @@ static int __maybe_unused
 dbg_intr_buf (char *buf, unsigned len, const char *label, u32 enable)
 {
         return scnprintf (buf, len,
-                "%s%sintrenable %02x%s%s%s%s%s%s",
+                "%s%sintrenable %02x%s%s%s%s%s%s%s",
                 label, label [0] ? " " : "", enable,
+                (enable & STS_PPCE_MASK) ? " PPCE" : "",
                 (enable & STS_IAA) ? " IAA" : "",
                 (enable & STS_FATAL) ? " FATAL" : "",
                 (enable & STS_FLR) ? " FLR" : "",
@@ -228,9 +235,15 @@ static int
 dbg_command_buf (char *buf, unsigned len, const char *label, u32 command)
 {
         return scnprintf (buf, len,
-                "%s%scommand %06x %s=%d ithresh=%d%s%s%s%s period=%s%s %s",
+                "%s%scommand %07x %s%s%s%s%s%s=%d ithresh=%d%s%s%s%s "
+                "period=%s%s %s",
                 label, label [0] ? " " : "", command,
-                (command & CMD_PARK) ? "park" : "(park)",
+                (command & CMD_HIRD) ? " HIRD" : "",
+                (command & CMD_PPCEE) ? " PPCEE" : "",
+                (command & CMD_FSP) ? " FSP" : "",
+                (command & CMD_ASPE) ? " ASPE" : "",
+                (command & CMD_PSPE) ? " PSPE" : "",
+                (command & CMD_PARK) ? " park" : "(park)",
                 CMD_PARK_CNT (command),
                 (command >> 16) & 0x3f,
                 (command & CMD_LRESET) ? " LReset" : "",
@@ -257,11 +270,22 @@ dbg_port_buf (char *buf, unsigned len, const char *label, int port, u32 status)
         }
 
         return scnprintf (buf, len,
-                "%s%sport %d status %06x%s%s sig=%s%s%s%s%s%s%s%s%s%s",
+                "%s%sport:%d status %06x %d %s%s%s%s%s%s "
+                "sig=%s%s%s%s%s%s%s%s%s%s%s",
                 label, label [0] ? " " : "", port, status,
+                status>>25,/*device address */
+                (status & PORT_SSTS)>>23 == PORTSC_SUSPEND_STS_ACK ?
+                                                " ACK" : "",
+                (status & PORT_SSTS)>>23 == PORTSC_SUSPEND_STS_NYET ?
+                                                " NYET" : "",
+                (status & PORT_SSTS)>>23 == PORTSC_SUSPEND_STS_STALL ?
+                                                " STALL" : "",
+                (status & PORT_SSTS)>>23 == PORTSC_SUSPEND_STS_ERR ?
+                                                " ERR" : "",
                 (status & PORT_POWER) ? " POWER" : "",
                 (status & PORT_OWNER) ? " OWNER" : "",
                 sig,
+                (status & PORT_LPM) ? " LPM" : "",
                 (status & PORT_RESET) ? " RESET" : "",
                 (status & PORT_SUSPEND) ? " SUSPEND" : "",
                 (status & PORT_RESUME) ? " RESUME" : "",
@@ -330,6 +354,13 @@ static int debug_async_open(struct inode *, struct file *);
 static int debug_periodic_open(struct inode *, struct file *);
 static int debug_registers_open(struct inode *, struct file *);
 static int debug_async_open(struct inode *, struct file *);
+static int debug_lpm_open(struct inode *, struct file *);
+static ssize_t debug_lpm_read(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos);
+static ssize_t debug_lpm_write(struct file *file, const char __user *buffer,
+                              size_t count, loff_t *ppos);
+static int debug_lpm_close(struct inode *inode, struct file *file);
+
 static ssize_t debug_output(struct file*, char __user*, size_t, loff_t*);
 static int debug_close(struct inode *, struct file *);
 
@@ -351,6 +382,13 @@ static const struct file_operations debug_registers_fops = {
         .read           = debug_output,
         .release        = debug_close,
 };
+static const struct file_operations debug_lpm_fops = {
+        .owner          = THIS_MODULE,
+        .open           = debug_lpm_open,
+        .read           = debug_lpm_read,
+        .write          = debug_lpm_write,
+        .release        = debug_lpm_close,
+};
 
 static struct dentry *ehci_debug_root;
 
@@ -674,7 +712,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf)
 
         spin_lock_irqsave (&ehci->lock, flags);
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 size = scnprintf (next, size,
                         "bus %s, device %s\n"
                         "%s\n"
@@ -917,51 +955,127 @@ static int debug_registers_open(struct inode *inode, struct file *file)
         return file->private_data ? 0 : -ENOMEM;
 }
 
+static int debug_lpm_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static int debug_lpm_close(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
+static ssize_t debug_lpm_read(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        /* TODO: show lpm stats */
+        return 0;
+}
+
+static ssize_t debug_lpm_write(struct file *file, const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct usb_hcd          *hcd;
+        struct ehci_hcd         *ehci;
+        char buf[50];
+        size_t len;
+        u32 temp;
+        unsigned long port;
+        u32 __iomem     *portsc ;
+        u32 params;
+
+        hcd = bus_to_hcd(file->private_data);
+        ehci = hcd_to_ehci(hcd);
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+        if (len > 0 && buf[len - 1] == '\n')
+                buf[len - 1] = '\0';
+
+        if (strncmp(buf, "enable", 5) == 0) {
+                if (strict_strtoul(buf + 7, 10, &port))
+                        return -EINVAL;
+                params = ehci_readl(ehci, &ehci->caps->hcs_params);
+                if (port > HCS_N_PORTS(params)) {
+                        ehci_dbg(ehci, "ERR: LPM on bad port %lu\n", port);
+                        return -ENODEV;
+                }
+                portsc = &ehci->regs->port_status[port-1];
+                temp = ehci_readl(ehci, portsc);
+                if (!(temp & PORT_DEV_ADDR)) {
+                        ehci_dbg(ehci, "LPM: no device attached\n");
+                        return -ENODEV;
+                }
+                temp |= PORT_LPM;
+                ehci_writel(ehci, temp, portsc);
+                printk(KERN_INFO "force enable LPM for port %lu\n", port);
+        } else if (strncmp(buf, "hird=", 5) == 0) {
+                unsigned long hird;
+                if (strict_strtoul(buf + 5, 16, &hird))
+                        return -EINVAL;
+                printk(KERN_INFO "setting hird %s %lu\n", buf + 6, hird);
+                temp = ehci_readl(ehci, &ehci->regs->command);
+                temp &= ~CMD_HIRD;
+                temp |= hird << 24;
+                ehci_writel(ehci, temp, &ehci->regs->command);
+        } else if (strncmp(buf, "disable", 7) == 0) {
+                if (strict_strtoul(buf + 8, 10, &port))
+                        return -EINVAL;
+                params = ehci_readl(ehci, &ehci->caps->hcs_params);
+                if (port > HCS_N_PORTS(params)) {
+                        ehci_dbg(ehci, "ERR: LPM off bad port %lu\n", port);
+                        return -ENODEV;
+                }
+                portsc = &ehci->regs->port_status[port-1];
+                temp = ehci_readl(ehci, portsc);
+                if (!(temp & PORT_DEV_ADDR)) {
+                        ehci_dbg(ehci, "ERR: no device attached\n");
+                        return -ENODEV;
+                }
+                temp &= ~PORT_LPM;
+                ehci_writel(ehci, temp, portsc);
+                printk(KERN_INFO "disabled LPM for port %lu\n", port);
+        } else
+                return -EOPNOTSUPP;
+        return count;
+}
+
 static inline void create_debug_files (struct ehci_hcd *ehci)
 {
         struct usb_bus *bus = &ehci_to_hcd(ehci)->self;
 
         ehci->debug_dir = debugfs_create_dir(bus->bus_name, ehci_debug_root);
         if (!ehci->debug_dir)
-                goto dir_error;
-
-        ehci->debug_async = debugfs_create_file("async", S_IRUGO,
-                                                ehci->debug_dir, bus,
-                                                &debug_async_fops);
-        if (!ehci->debug_async)
-                goto async_error;
-
-        ehci->debug_periodic = debugfs_create_file("periodic", S_IRUGO,
-                                                   ehci->debug_dir, bus,
-                                                   &debug_periodic_fops);
-        if (!ehci->debug_periodic)
-                goto periodic_error;
-
-        ehci->debug_registers = debugfs_create_file("registers", S_IRUGO,
-                                                    ehci->debug_dir, bus,
-                                                    &debug_registers_fops);
-        if (!ehci->debug_registers)
-                goto registers_error;
+                return;
+
+        if (!debugfs_create_file("async", S_IRUGO, ehci->debug_dir, bus,
+                                                &debug_async_fops))
+                goto file_error;
+
+        if (!debugfs_create_file("periodic", S_IRUGO, ehci->debug_dir, bus,
+                                                &debug_periodic_fops))
+                goto file_error;
+
+        if (!debugfs_create_file("registers", S_IRUGO, ehci->debug_dir, bus,
+                                                    &debug_registers_fops))
+                goto file_error;
+
+        if (!debugfs_create_file("lpm", S_IRUGO|S_IWUGO, ehci->debug_dir, bus,
+                                                    &debug_lpm_fops))
+                goto file_error;
+
         return;
 
-registers_error:
-        debugfs_remove(ehci->debug_periodic);
-periodic_error:
-        debugfs_remove(ehci->debug_async);
-async_error:
-        debugfs_remove(ehci->debug_dir);
-dir_error:
-        ehci->debug_periodic = NULL;
-        ehci->debug_async = NULL;
-        ehci->debug_dir = NULL;
+file_error:
+        debugfs_remove_recursive(ehci->debug_dir);
 }
 
 static inline void remove_debug_files (struct ehci_hcd *ehci)
 {
-        debugfs_remove(ehci->debug_registers);
-        debugfs_remove(ehci->debug_periodic);
-        debugfs_remove(ehci->debug_async);
-        debugfs_remove(ehci->debug_dir);
+        debugfs_remove_recursive(ehci->debug_dir);
 }
 
 #endif /* STUB_DEBUG_FILES */
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 5cd967d28938..a416421abfa2 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -313,7 +313,8 @@ static int ehci_fsl_drv_suspend(struct device *dev)
         struct ehci_fsl *ehci_fsl = hcd_to_ehci_fsl(hcd);
         void __iomem *non_ehci = hcd->regs;
 
-        ehci_prepare_ports_for_controller_suspend(hcd_to_ehci(hcd));
+        ehci_prepare_ports_for_controller_suspend(hcd_to_ehci(hcd),
+                        device_may_wakeup(dev));
         if (!fsl_deep_sleep())
                 return 0;
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a3ef2a9d9dc2..34a928d3b7d2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -36,6 +36,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/debugfs.h>
 #include <linux/slab.h>
+#include <linux/uaccess.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -78,7 +79,13 @@ static const char	hcd_name [] = "ehci_hcd";
 #define EHCI_TUNE_RL_TT         0
 #define EHCI_TUNE_MULT_HS       1       /* 1-3 transactions/uframe; 4.10.3 */
 #define EHCI_TUNE_MULT_TT       1
-#define EHCI_TUNE_FLS           2       /* (small) 256 frame schedule */
+/*
+ * Some drivers think it's safe to schedule isochronous transfers more than
+ * 256 ms into the future (partly as a result of an old bug in the scheduling
+ * code).  In an attempt to avoid trouble, we will use a minimum scheduling
+ * length of 512 frames instead of 256.
+ */
+#define EHCI_TUNE_FLS           1       /* (medium) 512-frame schedule */
 
 #define EHCI_IAA_MSECS          10              /* arbitrary */
 #define EHCI_IO_JIFFIES         (HZ/10)         /* io watchdog > irq_thresh */
@@ -100,6 +107,11 @@ static int ignore_oc = 0;
 module_param (ignore_oc, bool, S_IRUGO);
 MODULE_PARM_DESC (ignore_oc, "ignore bogus hardware overcurrent indications");
 
+/* for link power management(LPM) feature */
+static unsigned int hird;
+module_param(hird, int, S_IRUGO);
+MODULE_PARM_DESC(hird, "host initiated resume duration, +1 for each 75us\n");
+
 #define INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
 
 /*-------------------------------------------------------------------------*/
@@ -304,6 +316,7 @@ static void end_unlink_async(struct ehci_hcd *ehci);
 static void ehci_work(struct ehci_hcd *ehci);
 
 #include "ehci-hub.c"
+#include "ehci-lpm.c"
 #include "ehci-mem.c"
 #include "ehci-q.c"
 #include "ehci-sched.c"
@@ -577,6 +590,11 @@ static int ehci_init(struct usb_hcd *hcd)
         if (log2_irq_thresh < 0 || log2_irq_thresh > 6)
                 log2_irq_thresh = 0;
         temp = 1 << (16 + log2_irq_thresh);
+        if (HCC_PER_PORT_CHANGE_EVENT(hcc_params)) {
+                ehci->has_ppcd = 1;
+                ehci_dbg(ehci, "enable per-port change event\n");
+                temp |= CMD_PPCEE;
+        }
         if (HCC_CANPARK(hcc_params)) {
                 /* HW default park == 3, on hardware that supports it (like
                  * NVidia and ALI silicon), maximizes throughput on the async
@@ -603,10 +621,22 @@ static int ehci_init(struct usb_hcd *hcd)
                 default:        BUG();
                 }
         }
+        if (HCC_LPM(hcc_params)) {
+                /* support link power management EHCI 1.1 addendum */
+                ehci_dbg(ehci, "support lpm\n");
+                ehci->has_lpm = 1;
+                if (hird > 0xf) {
+                        ehci_dbg(ehci, "hird %d invalid, use default 0",
+                        hird);
+                        hird = 0;
+                }
+                temp |= hird << 24;
+        }
         ehci->command = temp;
 
         /* Accept arbitrarily long scatter-gather lists */
-        hcd->self.sg_tablesize = ~0;
+        if (!(hcd->driver->flags & HCD_LOCAL_MEM))
+                hcd->self.sg_tablesize = ~0;
         return 0;
 }
 
@@ -619,7 +649,6 @@ static int ehci_run (struct usb_hcd *hcd)
         u32                     hcc_params;
 
         hcd->uses_new_polling = 1;
-        hcd->poll_rh = 0;
 
         /* EHCI spec section 4.1 */
         if ((retval = ehci_reset(ehci)) != 0) {
@@ -764,6 +793,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
         /* remote wakeup [4.3.1] */
         if (status & STS_PCD) {
                 unsigned        i = HCS_N_PORTS (ehci->hcs_params);
+                u32             ppcd = 0;
 
                 /* kick root hub later */
                 pcd_status = status;
@@ -772,9 +802,18 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                 if (!(cmd & CMD_RUN))
                         usb_hcd_resume_root_hub(hcd);
 
+                /* get per-port change detect bits */
+                if (ehci->has_ppcd)
+                        ppcd = status >> 16;
+
                 while (i--) {
-                        int pstatus = ehci_readl(ehci,
-                                                 &ehci->regs->port_status [i]);
+                        int pstatus;
+
+                        /* leverage per-port change bits feature */
+                        if (ehci->has_ppcd && !(ppcd & (1 << i)))
+                                continue;
+                        pstatus = ehci_readl(ehci,
+                                         &ehci->regs->port_status[i]);
 
                         if (pstatus & PORT_OWNER)
                                 continue;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index e7d3d8def282..796ea0c8900f 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -107,7 +107,7 @@ static void ehci_handover_companion_ports(struct ehci_hcd *ehci)
 }
 
 static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
-                bool suspending)
+                bool suspending, bool do_wakeup)
 {
         int             port;
         u32             temp;
@@ -117,8 +117,7 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
          * when the controller is suspended or resumed.  In all other
          * cases they don't need to be changed.
          */
-        if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup ||
-                        device_may_wakeup(ehci_to_hcd(ehci)->self.controller))
+        if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup || do_wakeup)
                 return;
 
         /* clear phy low-power mode before changing wakeup flags */
@@ -167,6 +166,10 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
                         ehci_writel(ehci, temp | HOSTPC_PHCD, hostpc_reg);
                 }
         }
+
+        /* Does the root hub have a port wakeup pending? */
+        if (!suspending && (ehci_readl(ehci, &ehci->regs->status) & STS_PCD))
+                usb_hcd_resume_root_hub(ehci_to_hcd(ehci));
 }
 
 static int ehci_bus_suspend (struct usb_hcd *hcd)
@@ -316,7 +319,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
         if (time_before (jiffies, ehci->next_statechange))
                 msleep(5);
         spin_lock_irq (&ehci->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 spin_unlock_irq(&ehci->lock);
                 return -ESHUTDOWN;
         }
@@ -603,6 +606,7 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
         u32             mask;
         int             ports, i, retval = 1;
         unsigned long   flags;
+        u32             ppcd = 0;
 
         /* if !USB_SUSPEND, root hub timers won't get shut down ... */
         if (!HC_IS_RUNNING(hcd->state))
@@ -632,7 +636,15 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
 
         /* port N changes (bit N)? */
         spin_lock_irqsave (&ehci->lock, flags);
+
+        /* get per-port change detect bits */
+        if (ehci->has_ppcd)
+                ppcd = ehci_readl(ehci, &ehci->regs->status) >> 16;
+
         for (i = 0; i < ports; i++) {
+                /* leverage per-port change bits feature */
+                if (ehci->has_ppcd && !(ppcd & (1 << i)))
+                        continue;
                 temp = ehci_readl(ehci, &ehci->regs->port_status [i]);
 
                 /*
@@ -790,6 +802,11 @@ static int ehci_hub_control (
                                           status_reg);
                         break;
                 case USB_PORT_FEAT_C_CONNECTION:
+                        if (ehci->has_lpm) {
+                                /* clear PORTSC bits on disconnect */
+                                temp &= ~PORT_LPM;
+                                temp &= ~PORT_DEV_ADDR;
+                        }
                         ehci_writel(ehci, (temp & ~PORT_RWC_BITS) | PORT_CSC,
                                         status_reg);
                         break;
diff --git a/drivers/usb/host/ehci-lpm.c b/drivers/usb/host/ehci-lpm.c
new file mode 100644
index 000000000000..b4d4d63c13ed
--- /dev/null
+++ b/drivers/usb/host/ehci-lpm.c
@@ -0,0 +1,83 @@
+/* ehci-lpm.c EHCI HCD LPM support code
+ * Copyright (c) 2008 - 2010,  Intel Corporation.
+ * Author: Jacob Pan <jacob.jun.pan@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/* this file is part of ehci-hcd.c */
+static int ehci_lpm_set_da(struct ehci_hcd *ehci, int dev_addr, int port_num)
+{
+        u32 __iomem portsc;
+
+        ehci_dbg(ehci, "set dev address %d for port %d\n", dev_addr, port_num);
+        if (port_num > HCS_N_PORTS(ehci->hcs_params)) {
+                ehci_dbg(ehci, "invalid port number %d\n", port_num);
+                return -ENODEV;
+        }
+        portsc = ehci_readl(ehci, &ehci->regs->port_status[port_num-1]);
+        portsc &= ~PORT_DEV_ADDR;
+        portsc |= dev_addr<<25;
+        ehci_writel(ehci, portsc, &ehci->regs->port_status[port_num-1]);
+        return 0;
+}
+
+/*
+ * this function is used to check if the device support LPM
+ * if yes, mark the PORTSC register with PORT_LPM bit
+ */
+static int ehci_lpm_check(struct ehci_hcd *ehci, int port)
+{
+        u32 __iomem     *portsc ;
+        u32 val32;
+        int retval;
+
+        portsc = &ehci->regs->port_status[port-1];
+        val32 = ehci_readl(ehci, portsc);
+        if (!(val32 & PORT_DEV_ADDR)) {
+                ehci_dbg(ehci, "LPM: no device attached\n");
+                return -ENODEV;
+        }
+        val32 |= PORT_LPM;
+        ehci_writel(ehci, val32, portsc);
+        msleep(5);
+        val32 |= PORT_SUSPEND;
+        ehci_dbg(ehci, "Sending LPM 0x%08x to port %d\n", val32, port);
+        ehci_writel(ehci, val32, portsc);
+        /* wait for ACK */
+        msleep(10);
+        retval = handshake(ehci, &ehci->regs->port_status[port-1], PORT_SSTS,
+                        PORTSC_SUSPEND_STS_ACK, 125);
+        dbg_port(ehci, "LPM", port, val32);
+        if (retval != -ETIMEDOUT) {
+                ehci_dbg(ehci, "LPM: device ACK for LPM\n");
+                val32 |= PORT_LPM;
+                /*
+                 * now device should be in L1 sleep, let's wake up the device
+                 * so that we can complete enumeration.
+                 */
+                ehci_writel(ehci, val32, portsc);
+                msleep(10);
+                val32 |= PORT_RESUME;
+                ehci_writel(ehci, val32, portsc);
+        } else {
+                ehci_dbg(ehci, "LPM: device does not ACK, disable LPM %d\n",
+                        retval);
+                val32 &= ~PORT_LPM;
+                retval = -ETIMEDOUT;
+                ehci_writel(ehci, val32, portsc);
+        }
+
+        return retval;
+}
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 5450e628157f..116ae280053a 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -38,6 +38,7 @@
 #include <linux/gpio.h>
 #include <linux/regulator/consumer.h>
 #include <linux/slab.h>
+#include <linux/usb/ulpi.h>
 #include <plat/usb.h>
 
 /*
@@ -236,6 +237,35 @@ static void omap_usb_utmi_init(struct ehci_hcd_omap *omap, u8 tll_channel_mask)
 
 /*-------------------------------------------------------------------------*/
 
+static void omap_ehci_soft_phy_reset(struct ehci_hcd_omap *omap, u8 port)
+{
+        unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+        unsigned reg = 0;
+
+        reg = ULPI_FUNC_CTRL_RESET
+                /* FUNCTION_CTRL_SET register */
+                | (ULPI_SET(ULPI_FUNC_CTRL) << EHCI_INSNREG05_ULPI_REGADD_SHIFT)
+                /* Write */
+                | (2 << EHCI_INSNREG05_ULPI_OPSEL_SHIFT)
+                /* PORTn */
+                | ((port + 1) << EHCI_INSNREG05_ULPI_PORTSEL_SHIFT)
+                /* start ULPI access*/
+                | (1 << EHCI_INSNREG05_ULPI_CONTROL_SHIFT);
+
+        ehci_omap_writel(omap->ehci_base, EHCI_INSNREG05_ULPI, reg);
+
+        /* Wait for ULPI access completion */
+        while ((ehci_omap_readl(omap->ehci_base, EHCI_INSNREG05_ULPI)
+                        & (1 << EHCI_INSNREG05_ULPI_CONTROL_SHIFT))) {
+                cpu_relax();
+
+                if (time_after(jiffies, timeout)) {
+                        dev_dbg(omap->dev, "phy reset operation timed out\n");
+                        break;
+                }
+        }
+}
+
 /* omap_start_ehc
  *      - Start the TI USBHOST controller
  */
@@ -425,6 +455,12 @@ static int omap_start_ehc(struct ehci_hcd_omap *omap, struct usb_hcd *hcd)
                         gpio_set_value(omap->reset_gpio_port[1], 1);
         }
 
+        /* Soft reset the PHY using PHY reset command over ULPI */
+        if (omap->port_mode[0] == EHCI_HCD_OMAP_MODE_PHY)
+                omap_ehci_soft_phy_reset(omap, 0);
+        if (omap->port_mode[1] == EHCI_HCD_OMAP_MODE_PHY)
+                omap_ehci_soft_phy_reset(omap, 1);
+
         return 0;
 
 err_sys_status:
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index d43d176161aa..58b72d741d93 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -114,6 +114,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         case PCI_VENDOR_ID_INTEL:
                 ehci->need_io_watchdog = 0;
+                ehci->fs_i_thresh = 1;
                 if (pdev->device == 0x27cc) {
                         ehci->broken_periodic = 1;
                         ehci_info(ehci, "using broken periodic workaround\n");
@@ -277,7 +278,7 @@ done:
  * Also they depend on separate root hub suspend/resume.
  */
 
-static int ehci_pci_suspend(struct usb_hcd *hcd)
+static int ehci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
 {
         struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
         unsigned long           flags;
@@ -291,7 +292,7 @@ static int ehci_pci_suspend(struct usb_hcd *hcd)
          * the root hub is either suspended or stopped.
          */
         spin_lock_irqsave (&ehci->lock, flags);
-        ehci_prepare_ports_for_controller_suspend(ehci);
+        ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup);
         ehci_writel(ehci, 0, &ehci->regs->intr_enable);
         (void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
@@ -361,6 +362,22 @@ static int ehci_pci_resume(struct usb_hcd *hcd, bool hibernated)
 }
 #endif
 
+static int ehci_update_device(struct usb_hcd *hcd, struct usb_device *udev)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int rc = 0;
+
+        if (!udev->parent) /* udev is root hub itself, impossible */
+                rc = -1;
+        /* we only support lpm device connected to root hub yet */
+        if (ehci->has_lpm && !udev->parent->parent) {
+                rc = ehci_lpm_set_da(ehci, udev->devnum, udev->portnum);
+                if (!rc)
+                        rc = ehci_lpm_check(ehci, udev->portnum);
+        }
+        return rc;
+}
+
 static const struct hc_driver ehci_pci_hc_driver = {
         .description =          hcd_name,
         .product_desc =         "EHCI Host Controller",
@@ -407,6 +424,11 @@ static const struct hc_driver ehci_pci_hc_driver = {
         .relinquish_port =      ehci_relinquish_port,
         .port_handed_over =     ehci_port_handed_over,
 
+        /*
+         * call back when device connected and addressed
+         */
+        .update_device =        ehci_update_device,
+
         .clear_tt_buffer_complete       = ehci_clear_tt_buffer_complete,
 };
 
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 11a79c4f4a9d..233c288e3f93 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1126,8 +1126,7 @@ submit_async (
 #endif
 
         spin_lock_irqsave (&ehci->lock, flags);
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(ehci_to_hcd(ehci)))) {
                 rc = -ESHUTDOWN;
                 goto done;
         }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 805ec633a652..a92526d6e5ae 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -880,8 +880,7 @@ static int intr_submit (
 
         spin_lock_irqsave (&ehci->lock, flags);
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                        &ehci_to_hcd(ehci)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(ehci_to_hcd(ehci)))) {
                 status = -ESHUTDOWN;
                 goto done_not_linked;
         }
@@ -1075,15 +1074,6 @@ iso_stream_put(struct ehci_hcd *ehci, struct ehci_iso_stream *stream)
                 if (stream->ep)
                         stream->ep->hcpriv = NULL;
 
-                if (stream->rescheduled) {
-                        ehci_info (ehci, "ep%d%s-iso rescheduled "
-                                "%lu times in %lu seconds\n",
-                                stream->bEndpointAddress, is_in ? "in" : "out",
-                                stream->rescheduled,
-                                ((jiffies - stream->start)/HZ)
-                                );
-                }
-
                 kfree(stream);
         }
 }
@@ -1396,30 +1386,25 @@ iso_stream_schedule (
         struct ehci_iso_stream  *stream
 )
 {
-        u32                     now, next, start, period;
+        u32                     now, next, start, period, span;
         int                     status;
         unsigned                mod = ehci->periodic_size << 3;
         struct ehci_iso_sched   *sched = urb->hcpriv;
-        struct pci_dev          *pdev;
 
-        if (sched->span > (mod - SCHEDULE_SLOP)) {
-                ehci_dbg (ehci, "iso request %p too long\n", urb);
-                status = -EFBIG;
-                goto fail;
+        period = urb->interval;
+        span = sched->span;
+        if (!stream->highspeed) {
+                period <<= 3;
+                span <<= 3;
         }
 
-        if ((stream->depth + sched->span) > mod) {
-                ehci_dbg (ehci, "request %p would overflow (%d+%d>%d)\n",
-                        urb, stream->depth, sched->span, mod);
+        if (span > mod - SCHEDULE_SLOP) {
+                ehci_dbg (ehci, "iso request %p too long\n", urb);
                 status = -EFBIG;
                 goto fail;
         }
 
-        period = urb->interval;
-        if (!stream->highspeed)
-                period <<= 3;
-
-        now = ehci_readl(ehci, &ehci->regs->frame_index) % mod;
+        now = ehci_readl(ehci, &ehci->regs->frame_index) & (mod - 1);
 
         /* Typical case: reuse current schedule, stream is still active.
          * Hopefully there are no gaps from the host falling behind
@@ -1427,34 +1412,35 @@ iso_stream_schedule (
          * slot in the schedule, implicitly assuming URB_ISO_ASAP.
          */
         if (likely (!list_empty (&stream->td_list))) {
-                pdev = to_pci_dev(ehci_to_hcd(ehci)->self.controller);
-                start = stream->next_uframe;
+                u32     excess;
 
                 /* For high speed devices, allow scheduling within the
-                 * isochronous scheduling threshold.  For full speed devices,
-                 * don't. (Work around for Intel ICH9 bug.)
+                 * isochronous scheduling threshold.  For full speed devices
+                 * and Intel PCI-based controllers, don't (work around for
+                 * Intel ICH9 bug).
                  */
-                if (!stream->highspeed &&
-                                pdev->vendor == PCI_VENDOR_ID_INTEL)
+                if (!stream->highspeed && ehci->fs_i_thresh)
                         next = now + ehci->i_thresh;
                 else
                         next = now;
 
-                /* Fell behind (by up to twice the slop amount)? */
-                if (((start - next) & (mod - 1)) >=
-                                mod - 2 * SCHEDULE_SLOP)
-                        start += period * DIV_ROUND_UP(
-                                        (next - start) & (mod - 1),
-                                        period);
-
-                /* Tried to schedule too far into the future? */
-                if (unlikely(((start - now) & (mod - 1)) + sched->span
-                                        >= mod - 2 * SCHEDULE_SLOP)) {
+                /* Fell behind (by up to twice the slop amount)?
+                 * We decide based on the time of the last currently-scheduled
+                 * slot, not the time of the next available slot.
+                 */
+                excess = (stream->next_uframe - period - next) & (mod - 1);
+                if (excess >= mod - 2 * SCHEDULE_SLOP)
+                        start = next + excess - mod + period *
+                                        DIV_ROUND_UP(mod - excess, period);
+                else
+                        start = next + excess + period;
+                if (start - now >= mod) {
+                        ehci_dbg(ehci, "request %p would overflow (%d+%d >= %d)\n",
+                                        urb, start - now - period, period,
+                                        mod);
                         status = -EFBIG;
                         goto fail;
                 }
-                stream->next_uframe = start;
-                goto ready;
         }
 
         /* need to schedule; when's the next (u)frame we could start?
@@ -1463,51 +1449,60 @@ iso_stream_schedule (
          * can also help high bandwidth if the dma and irq loads don't
          * jump until after the queue is primed.
          */
-        start = SCHEDULE_SLOP + (now & ~0x07);
-        start %= mod;
-        stream->next_uframe = start;
-
-        /* NOTE:  assumes URB_ISO_ASAP, to limit complexity/bugs */
-
-        /* find a uframe slot with enough bandwidth */
-        for (; start < (stream->next_uframe + period); start++) {
-                int             enough_space;
-
-                /* check schedule: enough space? */
-                if (stream->highspeed)
-                        enough_space = itd_slot_ok (ehci, mod, start,
-                                        stream->usecs, period);
-                else {
-                        if ((start % 8) >= 6)
-                                continue;
-                        enough_space = sitd_slot_ok (ehci, mod, stream,
-                                        start, sched, period);
+        else {
+                start = SCHEDULE_SLOP + (now & ~0x07);
+
+                /* NOTE:  assumes URB_ISO_ASAP, to limit complexity/bugs */
+
+                /* find a uframe slot with enough bandwidth */
+                next = start + period;
+                for (; start < next; start++) {
+
+                        /* check schedule: enough space? */
+                        if (stream->highspeed) {
+                                if (itd_slot_ok(ehci, mod, start,
+                                                stream->usecs, period))
+                                        break;
+                        } else {
+                                if ((start % 8) >= 6)
+                                        continue;
+                                if (sitd_slot_ok(ehci, mod, stream,
+                                                start, sched, period))
+                                        break;
+                        }
                 }
 
-                /* schedule it here if there's enough bandwidth */
-                if (enough_space) {
-                        stream->next_uframe = start % mod;
-                        goto ready;
+                /* no room in the schedule */
+                if (start == next) {
+                        ehci_dbg(ehci, "iso resched full %p (now %d max %d)\n",
+                                urb, now, now + mod);
+                        status = -ENOSPC;
+                        goto fail;
                 }
         }
 
-        /* no room in the schedule */
-        ehci_dbg (ehci, "iso %ssched full %p (now %d max %d)\n",
-                list_empty (&stream->td_list) ? "" : "re",
-                urb, now, now + mod);
-        status = -ENOSPC;
+        /* Tried to schedule too far into the future? */
+        if (unlikely(start - now + span - period
+                                >= mod - 2 * SCHEDULE_SLOP)) {
+                ehci_dbg(ehci, "request %p would overflow (%d+%d >= %d)\n",
+                                urb, start - now, span - period,
+                                mod - 2 * SCHEDULE_SLOP);
+                status = -EFBIG;
+                goto fail;
+        }
 
-fail:
-        iso_sched_free (stream, sched);
-        urb->hcpriv = NULL;
-        return status;
+        stream->next_uframe = start & (mod - 1);
 
-ready:
         /* report high speed start in uframes; full speed, in frames */
         urb->start_frame = stream->next_uframe;
         if (!stream->highspeed)
                 urb->start_frame >>= 3;
         return 0;
+
+ fail:
+        iso_sched_free(stream, sched);
+        urb->hcpriv = NULL;
+        return status;
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1602,7 +1597,7 @@ itd_link_urb (
         struct ehci_iso_sched   *iso_sched = urb->hcpriv;
         struct ehci_itd         *itd;
 
-        next_uframe = stream->next_uframe % mod;
+        next_uframe = stream->next_uframe & (mod - 1);
 
         if (unlikely (list_empty(&stream->td_list))) {
                 ehci_to_hcd(ehci)->self.bandwidth_allocated
@@ -1613,7 +1608,6 @@ itd_link_urb (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out",
                         urb->interval,
                         next_uframe >> 3, next_uframe & 0x7);
-                stream->start = jiffies;
         }
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
 
@@ -1639,14 +1633,13 @@ itd_link_urb (
                 itd_patch(ehci, itd, iso_sched, packet, uframe);
 
                 next_uframe += stream->interval;
-                stream->depth += stream->interval;
-                next_uframe %= mod;
+                next_uframe &= mod - 1;
                 packet++;
 
                 /* link completed itds into the schedule */
                 if (((next_uframe >> 3) != frame)
                                 || packet == urb->number_of_packets) {
-                        itd_link (ehci, frame % ehci->periodic_size, itd);
+                        itd_link(ehci, frame & (ehci->periodic_size - 1), itd);
                         itd = NULL;
                 }
         }
@@ -1695,7 +1688,6 @@ itd_complete (
 
                 t = hc32_to_cpup(ehci, &itd->hw_transaction [uframe]);
                 itd->hw_transaction [uframe] = 0;
-                stream->depth -= stream->interval;
 
                 /* report transfer status */
                 if (unlikely (t & ISO_ERRS)) {
@@ -1815,8 +1807,7 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb,
 
         /* schedule ... need to lock */
         spin_lock_irqsave (&ehci->lock, flags);
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(ehci_to_hcd(ehci)))) {
                 status = -ESHUTDOWN;
                 goto done_not_linked;
         }
@@ -2024,9 +2015,8 @@ sitd_link_urb (
                         "sched devp %s ep%d%s-iso [%d] %dms/%04x\n",
                         urb->dev->devpath, stream->bEndpointAddress & 0x0f,
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out",
-                        (next_uframe >> 3) % ehci->periodic_size,
+                        (next_uframe >> 3) & (ehci->periodic_size - 1),
                         stream->interval, hc32_to_cpu(ehci, stream->splits));
-                stream->start = jiffies;
         }
         ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
 
@@ -2047,13 +2037,12 @@ sitd_link_urb (
                 sitd->urb = urb;
 
                 sitd_patch(ehci, stream, sitd, sched, packet);
-                sitd_link (ehci, (next_uframe >> 3) % ehci->periodic_size,
+                sitd_link(ehci, (next_uframe >> 3) & (ehci->periodic_size - 1),
                                 sitd);
 
                 next_uframe += stream->interval << 3;
-                stream->depth += stream->interval << 3;
         }
-        stream->next_uframe = next_uframe % mod;
+        stream->next_uframe = next_uframe & (mod - 1);
 
         /* don't need that schedule data any more */
         iso_sched_free (stream, sched);
@@ -2111,7 +2100,6 @@ sitd_complete (
                 desc->actual_length = desc->length - SITD_LENGTH(t);
                 urb->actual_length += desc->actual_length;
         }
-        stream->depth -= stream->interval << 3;
 
         /* handle completion now? */
         if ((urb_index + 1) != urb->number_of_packets)
@@ -2201,8 +2189,7 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb,
 
         /* schedule ... need to lock */
         spin_lock_irqsave (&ehci->lock, flags);
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(ehci_to_hcd(ehci)))) {
                 status = -ESHUTDOWN;
                 goto done_not_linked;
         }
@@ -2263,7 +2250,7 @@ scan_periodic (struct ehci_hcd *ehci)
         now_uframe = ehci->next_uframe;
         if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
                 clock = ehci_readl(ehci, &ehci->regs->frame_index);
-                clock_frame = (clock >> 3) % ehci->periodic_size;
+                clock_frame = (clock >> 3) & (ehci->periodic_size - 1);
         } else  {
                 clock = now_uframe + mod - 1;
                 clock_frame = -1;
@@ -2272,7 +2259,7 @@ scan_periodic (struct ehci_hcd *ehci)
                 free_cached_lists(ehci);
                 ehci->clock_frame = clock_frame;
         }
-        clock %= mod;
+        clock &= mod - 1;
         clock_frame = clock >> 3;
 
         for (;;) {
@@ -2361,7 +2348,7 @@ restart:
                                  * frame is current.
                                  */
                                 if (((frame == clock_frame) ||
-                                     (((frame + 1) % ehci->periodic_size)
+                                     (((frame + 1) & (ehci->periodic_size - 1))
                                       == clock_frame))
                                     && live
                                     && (q.sitd->hw_results &
@@ -2428,7 +2415,8 @@ restart:
                                         || ehci->periodic_sched == 0)
                                 break;
                         ehci->next_uframe = now_uframe;
-                        now = ehci_readl(ehci, &ehci->regs->frame_index) % mod;
+                        now = ehci_readl(ehci, &ehci->regs->frame_index) &
+                                        (mod - 1);
                         if (now_uframe == now)
                                 break;
 
@@ -2441,7 +2429,7 @@ restart:
                         }
                 } else {
                         now_uframe++;
-                        now_uframe %= mod;
+                        now_uframe &= mod - 1;
                 }
         }
 }
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 650a687f2854..bde823f704e9 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -130,6 +130,7 @@ struct ehci_hcd {			/* one per controller */
         unsigned                has_amcc_usb23:1;
         unsigned                need_io_watchdog:1;
         unsigned                broken_periodic:1;
+        unsigned                fs_i_thresh:1;  /* Intel iso scheduling */
 
         /* required for usb32 quirk */
         #define OHCI_CTRL_HCFS          (3 << 6)
@@ -140,7 +141,8 @@ struct ehci_hcd {			/* one per controller */
         #define OHCI_HCCTRL_LEN         0x4
         __hc32                  *ohci_hcctrl_reg;
         unsigned                has_hostpc:1;
-
+        unsigned                has_lpm:1;  /* support link power management */
+        unsigned                has_ppcd:1; /* support per-port change bits */
         u8                      sbrn;           /* packed release number */
 
         /* irq statistics */
@@ -154,9 +156,6 @@ struct ehci_hcd {			/* one per controller */
         /* debug files */
 #ifdef DEBUG
         struct dentry           *debug_dir;
-        struct dentry           *debug_async;
-        struct dentry           *debug_periodic;
-        struct dentry           *debug_registers;
 #endif
 };
 
@@ -401,15 +400,12 @@ struct ehci_iso_stream {
         u32                     refcount;
         u8                      bEndpointAddress;
         u8                      highspeed;
-        u16                     depth;          /* depth in uframes */
         struct list_head        td_list;        /* queued itds/sitds */
         struct list_head        free_list;      /* list of unused itds/sitds */
         struct usb_device       *udev;
         struct usb_host_endpoint *ep;
 
         /* output of (re)scheduling */
-        unsigned long           start;          /* jiffies */
-        unsigned long           rescheduled;
         int                     next_uframe;
         __hc32                  splits;
 
@@ -538,11 +534,11 @@ struct ehci_fstn {
 
 /* Prepare the PORTSC wakeup flags during controller suspend/resume */
 
-#define ehci_prepare_ports_for_controller_suspend(ehci)         \
-                ehci_adjust_port_wakeup_flags(ehci, true);
+#define ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup)      \
+                ehci_adjust_port_wakeup_flags(ehci, true, do_wakeup);
 
-#define ehci_prepare_ports_for_controller_resume(ehci)          \
-                ehci_adjust_port_wakeup_flags(ehci, false);
+#define ehci_prepare_ports_for_controller_resume(ehci)                  \
+                ehci_adjust_port_wakeup_flags(ehci, false, false);
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 35742f8c7cda..9bfac657572e 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -159,7 +159,7 @@ static int hwahc_op_start(struct usb_hcd *usb_hcd)
                 goto error_set_cluster_id;
 
         usb_hcd->uses_new_polling = 1;
-        usb_hcd->poll_rh = 1;
+        set_bit(HCD_FLAG_POLL_RH, &usb_hcd->flags);
         usb_hcd->state = HC_STATE_RUNNING;
         result = 0;
 out:
@@ -776,7 +776,7 @@ static int hwahc_probe(struct usb_interface *usb_iface,
                 goto error_alloc;
         }
         usb_hcd->wireless = 1;
-        usb_hcd->flags |= HCD_FLAG_SAW_IRQ;
+        set_bit(HCD_FLAG_SAW_IRQ, &usb_hcd->flags);
         wusbhc = usb_hcd_to_wusbhc(usb_hcd);
         hwahc = container_of(wusbhc, struct hwahc, wusbhc);
         hwahc_init(hwahc);
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index ca0e98d8e1f4..3e5630369c31 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -1521,7 +1521,7 @@ static int imx21_hc_reset(struct usb_hcd *hcd)
                         return -ETIMEDOUT;
                 }
                 spin_unlock_irq(&imx21->lock);
-                schedule_timeout(1);
+                schedule_timeout_uninterruptible(1);
                 spin_lock_irq(&imx21->lock);
         }
         spin_unlock_irqrestore(&imx21->lock, flags);
diff --git a/drivers/usb/host/isp1362.h b/drivers/usb/host/isp1362.h
index d995351f9bed..0f97820e65be 100644
--- a/drivers/usb/host/isp1362.h
+++ b/drivers/usb/host/isp1362.h
@@ -8,29 +8,7 @@
 /*
  * Platform specific compile time options
  */
-#if defined(CONFIG_ARCH_KARO)
-#include <asm/arch/hardware.h>
-#include <asm/arch/pxa-regs.h>
-#include <asm/arch/karo.h>
-
-#define USE_32BIT               1
-
-
-/* These options are mutually eclusive */
-#define USE_PLATFORM_DELAY      1
-#define USE_NDELAY              0
-/*
- * MAX_ROOT_PORTS: Number of downstream ports
- *
- * The chip has two USB ports, one of which can be configured as
- * an USB device port, so the value of this constant is implementation
- * specific.
- */
-#define MAX_ROOT_PORTS          2
-#define DUMMY_DELAY_ACCESS do {} while (0)
-
-/* insert platform specific definitions for other machines here */
-#elif defined(CONFIG_BLACKFIN)
+#if defined(CONFIG_BLACKFIN)
 
 #include <linux/io.h>
 #define USE_32BIT               0
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index dbcafa29c775..d1a3dfc9a408 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -482,7 +482,6 @@ static int isp1760_run(struct usb_hcd *hcd)
         u32 chipid;
 
         hcd->uses_new_polling = 1;
-        hcd->poll_rh = 0;
 
         hcd->state = HC_STATE_RUNNING;
         isp1760_enable_interrupts(hcd);
@@ -1450,7 +1449,7 @@ static int isp1760_prepare_enqueue(struct isp1760_hcd *priv, struct urb *urb,
         epnum = urb->ep->desc.bEndpointAddress;
 
         spin_lock_irqsave(&priv->lock, flags);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &priv_to_hcd(priv)->flags)) {
+        if (!HCD_HW_ACCESSIBLE(priv_to_hcd(priv))) {
                 rc = -ESHUTDOWN;
                 goto done;
         }
diff --git a/drivers/usb/host/ohci-dbg.c b/drivers/usb/host/ohci-dbg.c
index 8ad2441b0284..36abd2baa3ea 100644
--- a/drivers/usb/host/ohci-dbg.c
+++ b/drivers/usb/host/ohci-dbg.c
@@ -645,7 +645,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf)
                 hcd->product_desc,
                 hcd_name);
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 size -= scnprintf (next, size,
                         "SUSPENDED (no register access)\n");
                 goto done;
@@ -687,7 +687,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf)
         next += temp;
 
         temp = scnprintf (next, size, "hub poll timer %s\n",
-                        ohci_to_hcd(ohci)->poll_rh ? "ON" : "off");
+                        HCD_POLL_RH(ohci_to_hcd(ohci)) ? "ON" : "off");
         size -= temp;
         next += temp;
 
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 02864a237a2c..c3b4ccc7337b 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -212,7 +212,7 @@ static int ohci_urb_enqueue (
         spin_lock_irqsave (&ohci->lock, flags);
 
         /* don't submit to a dead HC */
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 retval = -ENODEV;
                 goto fail;
         }
@@ -685,7 +685,7 @@ retry:
         }
 
         /* use rhsc irqs after khubd is fully initialized */
-        hcd->poll_rh = 1;
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         hcd->uses_new_polling = 1;
 
         /* start controller operations */
@@ -822,7 +822,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
         else if (ints & OHCI_INTR_RD) {
                 ohci_vdbg(ohci, "resume detect\n");
                 ohci_writel(ohci, OHCI_INTR_RD, &regs->intrstatus);
-                hcd->poll_rh = 1;
+                set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
                 if (ohci->autostop) {
                         spin_lock (&ohci->lock);
                         ohci_rh_resume (ohci);
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 65cac8cc8921..cddcda95b579 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -284,7 +284,7 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
 
         spin_lock_irq (&ohci->lock);
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))
+        if (unlikely(!HCD_HW_ACCESSIBLE(hcd)))
                 rc = -ESHUTDOWN;
         else
                 rc = ohci_rh_suspend (ohci, 0);
@@ -302,7 +302,7 @@ static int ohci_bus_resume (struct usb_hcd *hcd)
 
         spin_lock_irq (&ohci->lock);
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))
+        if (unlikely(!HCD_HW_ACCESSIBLE(hcd)))
                 rc = -ESHUTDOWN;
         else
                 rc = ohci_rh_resume (ohci);
@@ -355,6 +355,11 @@ static void ohci_finish_controller_resume(struct usb_hcd *hcd)
                 ohci_readl(ohci, &ohci->regs->intrenable);
                 msleep(20);
         }
+
+        /* Does the root hub have a port wakeup pending? */
+        if (ohci_readl(ohci, &ohci->regs->intrstatus) &
+                        (OHCI_INTR_RD | OHCI_INTR_RHSC))
+                usb_hcd_resume_root_hub(hcd);
 }
 
 /* Carry out polling-, autostop-, and autoresume-related state changes */
@@ -364,7 +369,7 @@ static int ohci_root_hub_state_changes(struct ohci_hcd *ohci, int changed,
         int     poll_rh = 1;
         int     rhsc_enable;
 
-        /* Some broken controllers never turn off RHCS in the interrupt
+        /* Some broken controllers never turn off RHSC in the interrupt
          * status register.  For their sake we won't re-enable RHSC
          * interrupts if the interrupt bit is already active.
          */
@@ -489,7 +494,7 @@ ohci_hub_status_data (struct usb_hcd *hcd, char *buf)
         unsigned long   flags;
 
         spin_lock_irqsave (&ohci->lock, flags);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 goto done;
 
         /* undocumented erratum seen on at least rev D */
@@ -533,8 +538,12 @@ ohci_hub_status_data (struct usb_hcd *hcd, char *buf)
                 }
         }
 
-        hcd->poll_rh = ohci_root_hub_state_changes(ohci, changed,
-                        any_connected, rhsc_status);
+        if (ohci_root_hub_state_changes(ohci, changed,
+                        any_connected, rhsc_status))
+                set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        else
+                clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+
 
 done:
         spin_unlock_irqrestore (&ohci->lock, flags);
@@ -701,7 +710,7 @@ static int ohci_hub_control (
         u32             temp;
         int             retval = 0;
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))
+        if (unlikely(!HCD_HW_ACCESSIBLE(hcd)))
                 return -ESHUTDOWN;
 
         switch (typeReq) {
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index b8a1148f248e..6bdc8b25a6a1 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -392,7 +392,7 @@ static int __devinit ohci_pci_start (struct usb_hcd *hcd)
 
 #ifdef  CONFIG_PM
 
-static int ohci_pci_suspend(struct usb_hcd *hcd)
+static int ohci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
 {
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
         unsigned long   flags;
diff --git a/drivers/usb/host/ohci-ssb.c b/drivers/usb/host/ohci-ssb.c
index 23fd6a886bdd..48ee6943bf35 100644
--- a/drivers/usb/host/ohci-ssb.c
+++ b/drivers/usb/host/ohci-ssb.c
@@ -93,8 +93,11 @@ static void ssb_ohci_detach(struct ssb_device *dev)
 {
         struct usb_hcd *hcd = ssb_get_drvdata(dev);
 
+        if (hcd->driver->shutdown)
+                hcd->driver->shutdown(hcd);
         usb_remove_hcd(hcd);
         iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
         usb_put_hcd(hcd);
         ssb_device_disable(dev, 0);
 }
@@ -106,10 +109,52 @@ static int ssb_ohci_attach(struct ssb_device *dev)
         int err = -ENOMEM;
         u32 tmp, flags = 0;
 
-        if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV)
-                flags |= SSB_OHCI_TMSLOW_HOSTMODE;
+        if (dma_set_mask(dev->dma_dev, DMA_BIT_MASK(32)) ||
+            dma_set_coherent_mask(dev->dma_dev, DMA_BIT_MASK(32)))
+                return -EOPNOTSUPP;
 
-        ssb_device_enable(dev, flags);
+        if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV) {
+                /* Put the device into host-mode. */
+                flags |= SSB_OHCI_TMSLOW_HOSTMODE;
+                ssb_device_enable(dev, flags);
+        } else if (dev->id.coreid == SSB_DEV_USB20_HOST) {
+                /*
+                 * USB 2.0 special considerations:
+                 *
+                 * In addition to the standard SSB reset sequence, the Host
+                 * Control Register must be programmed to bring the USB core
+                 * and various phy components out of reset.
+                 */
+                ssb_device_enable(dev, 0);
+                ssb_write32(dev, 0x200, 0x7ff);
+
+                /* Change Flush control reg */
+                tmp = ssb_read32(dev, 0x400);
+                tmp &= ~8;
+                ssb_write32(dev, 0x400, tmp);
+                tmp = ssb_read32(dev, 0x400);
+
+                /* Change Shim control reg */
+                tmp = ssb_read32(dev, 0x304);
+                tmp &= ~0x100;
+                ssb_write32(dev, 0x304, tmp);
+                tmp = ssb_read32(dev, 0x304);
+
+                udelay(1);
+
+                /* Work around for 5354 failures */
+                if (dev->id.revision == 2 && dev->bus->chip_id == 0x5354) {
+                        /* Change syn01 reg */
+                        tmp = 0x00fe00fe;
+                        ssb_write32(dev, 0x894, tmp);
+
+                        /* Change syn03 reg */
+                        tmp = ssb_read32(dev, 0x89c);
+                        tmp |= 0x1;
+                        ssb_write32(dev, 0x89c, tmp);
+                }
+        } else
+                ssb_device_enable(dev, 0);
 
         hcd = usb_create_hcd(&ssb_ohci_hc_driver, dev->dev,
                         dev_name(dev->dev));
@@ -200,6 +245,7 @@ static int ssb_ohci_resume(struct ssb_device *dev)
 static const struct ssb_device_id ssb_ohci_table[] = {
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOSTDEV, SSB_ANY_REV),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOST, SSB_ANY_REV),
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB20_HOST, SSB_ANY_REV),
         SSB_DEVTABLE_END
 };
 MODULE_DEVICE_TABLE(ssb, ssb_ohci_table);
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index f608dfd09a8a..d9c85a292737 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -1641,8 +1641,7 @@ static int submit_async(struct oxu_hcd	*oxu, struct urb *urb,
 #endif
 
         spin_lock_irqsave(&oxu->lock, flags);
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &oxu_to_hcd(oxu)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(oxu_to_hcd(oxu)))) {
                 rc = -ESHUTDOWN;
                 goto done;
         }
@@ -2209,8 +2208,7 @@ static int intr_submit(struct oxu_hcd *oxu, struct urb *urb,
 
         spin_lock_irqsave(&oxu->lock, flags);
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &oxu_to_hcd(oxu)->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(oxu_to_hcd(oxu)))) {
                 status = -ESHUTDOWN;
                 goto done;
         }
@@ -2715,7 +2713,6 @@ static int oxu_run(struct usb_hcd *hcd)
         u32 temp, hcc_params;
 
         hcd->uses_new_polling = 1;
-        hcd->poll_rh = 0;
 
         /* EHCI spec section 4.1 */
         retval = ehci_reset(oxu);
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index bcf9f0e809de..990f06b89eaa 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -813,8 +813,11 @@ static int sl811h_urb_enqueue(
 #endif
 
         /* avoid all allocations within spinlocks */
-        if (!hep->hcpriv)
+        if (!hep->hcpriv) {
                 ep = kzalloc(sizeof *ep, mem_flags);
+                if (ep == NULL)
+                        return -ENOMEM;
+        }
 
         spin_lock_irqsave(&sl811->lock, flags);
 
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 98cf0b26b968..6e7fb5f38db6 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -17,7 +17,6 @@
 
 #include "uhci-hcd.h"
 
-#define uhci_debug_operations (* (const struct file_operations *) NULL)
 static struct dentry *uhci_debugfs_root;
 
 #ifdef DEBUG
@@ -495,18 +494,16 @@ static int uhci_debug_open(struct inode *inode, struct file *file)
 {
         struct uhci_hcd *uhci = inode->i_private;
         struct uhci_debug *up;
-        int ret = -ENOMEM;
         unsigned long flags;
 
-        lock_kernel();
         up = kmalloc(sizeof(*up), GFP_KERNEL);
         if (!up)
-                goto out;
+                return -ENOMEM;
 
         up->data = kmalloc(MAX_OUTPUT, GFP_KERNEL);
         if (!up->data) {
                 kfree(up);
-                goto out;
+                return -ENOMEM;
         }
 
         up->size = 0;
@@ -517,10 +514,7 @@ static int uhci_debug_open(struct inode *inode, struct file *file)
 
         file->private_data = up;
 
-        ret = 0;
-out:
-        unlock_kernel();
-        return ret;
+        return 0;
 }
 
 static loff_t uhci_debug_lseek(struct file *file, loff_t off, int whence)
@@ -528,9 +522,9 @@ static loff_t uhci_debug_lseek(struct file *file, loff_t off, int whence)
         struct uhci_debug *up;
         loff_t new = -1;
 
-        lock_kernel();
         up = file->private_data;
 
+        /* XXX: atomic 64bit seek access, but that needs to be fixed in the VFS */
         switch (whence) {
         case 0:
                 new = off;
@@ -539,11 +533,10 @@ static loff_t uhci_debug_lseek(struct file *file, loff_t off, int whence)
                 new = file->f_pos + off;
                 break;
         }
-        if (new < 0 || new > up->size) {
-                unlock_kernel();
+
+        if (new < 0 || new > up->size)
                 return -EINVAL;
-        }
-        unlock_kernel();
+
         return (file->f_pos = new);
 }
 
@@ -564,7 +557,6 @@ static int uhci_debug_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-#undef uhci_debug_operations
 static const struct file_operations uhci_debug_operations = {
         .owner =        THIS_MODULE,
         .open =         uhci_debug_open,
@@ -572,6 +564,7 @@ static const struct file_operations uhci_debug_operations = {
         .read =         uhci_debug_read,
         .release =      uhci_debug_release,
 };
+#define UHCI_DEBUG_OPS
 
 #endif  /* CONFIG_DEBUG_FS */
 
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 6637e52736dd..f52d04db28f4 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -140,7 +140,7 @@ static void finish_reset(struct uhci_hcd *uhci)
         uhci->rh_state = UHCI_RH_RESET;
         uhci->is_stopped = UHCI_IS_STOPPED;
         uhci_to_hcd(uhci)->state = HC_STATE_HALT;
-        uhci_to_hcd(uhci)->poll_rh = 0;
+        clear_bit(HCD_FLAG_POLL_RH, &uhci_to_hcd(uhci)->flags);
 
         uhci->dead = 0;         /* Full reset resurrects the controller */
 }
@@ -176,6 +176,8 @@ static void check_and_reset_hc(struct uhci_hcd *uhci)
  */
 static void configure_hc(struct uhci_hcd *uhci)
 {
+        struct pci_dev *pdev = to_pci_dev(uhci_dev(uhci));
+
         /* Set the frame length to the default: 1 ms exactly */
         outb(USBSOF_DEFAULT, uhci->io_addr + USBSOF);
 
@@ -191,8 +193,11 @@ static void configure_hc(struct uhci_hcd *uhci)
         mb();
 
         /* Enable PIRQ */
-        pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP,
-                        USBLEGSUP_DEFAULT);
+        pci_write_config_word(pdev, USBLEGSUP, USBLEGSUP_DEFAULT);
+
+        /* Disable platform-specific non-PME# wakeup */
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+                pci_write_config_byte(pdev, USBRES_INTEL, 0);
 }
 
 
@@ -344,7 +349,10 @@ __acquires(uhci->lock)
         /* If interrupts don't work and remote wakeup is enabled then
          * the suspended root hub needs to be polled.
          */
-        uhci_to_hcd(uhci)->poll_rh = (!int_enable && wakeup_enable);
+        if (!int_enable && wakeup_enable)
+                set_bit(HCD_FLAG_POLL_RH, &uhci_to_hcd(uhci)->flags);
+        else
+                clear_bit(HCD_FLAG_POLL_RH, &uhci_to_hcd(uhci)->flags);
 
         uhci_scan_schedule(uhci);
         uhci_fsbr_off(uhci);
@@ -363,7 +371,7 @@ static void start_rh(struct uhci_hcd *uhci)
                         uhci->io_addr + USBINTR);
         mb();
         uhci->rh_state = UHCI_RH_RUNNING;
-        uhci_to_hcd(uhci)->poll_rh = 1;
+        set_bit(HCD_FLAG_POLL_RH, &uhci_to_hcd(uhci)->flags);
 }
 
 static void wakeup_rh(struct uhci_hcd *uhci)
@@ -589,7 +597,7 @@ static int uhci_start(struct usb_hcd *hcd)
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
         int retval = -EBUSY;
         int i;
-        struct dentry *dentry;
+        struct dentry __maybe_unused *dentry;
 
         hcd->uses_new_polling = 1;
 
@@ -599,18 +607,16 @@ static int uhci_start(struct usb_hcd *hcd)
         INIT_LIST_HEAD(&uhci->idle_qh_list);
         init_waitqueue_head(&uhci->waitqh);
 
-        if (DEBUG_CONFIGURED) {
-                dentry = debugfs_create_file(hcd->self.bus_name,
-                                S_IFREG|S_IRUGO|S_IWUSR, uhci_debugfs_root,
-                                uhci, &uhci_debug_operations);
-                if (!dentry) {
-                        dev_err(uhci_dev(uhci), "couldn't create uhci "
-                                        "debugfs entry\n");
-                        retval = -ENOMEM;
-                        goto err_create_debug_entry;
-                }
-                uhci->dentry = dentry;
+#ifdef UHCI_DEBUG_OPS
+        dentry = debugfs_create_file(hcd->self.bus_name,
+                        S_IFREG|S_IRUGO|S_IWUSR, uhci_debugfs_root,
+                        uhci, &uhci_debug_operations);
+        if (!dentry) {
+                dev_err(uhci_dev(uhci), "couldn't create uhci debugfs entry\n");
+                return -ENOMEM;
         }
+        uhci->dentry = dentry;
+#endif
 
         uhci->frame = dma_alloc_coherent(uhci_dev(uhci),
                         UHCI_NUMFRAMES * sizeof(*uhci->frame),
@@ -691,7 +697,9 @@ static int uhci_start(struct usb_hcd *hcd)
 
         configure_hc(uhci);
         uhci->is_initialized = 1;
+        spin_lock_irq(&uhci->lock);
         start_rh(uhci);
+        spin_unlock_irq(&uhci->lock);
         return 0;
 
 /*
@@ -722,7 +730,6 @@ err_alloc_frame_cpu:
 err_alloc_frame:
         debugfs_remove(uhci->dentry);
 
-err_create_debug_entry:
         return retval;
 }
 
@@ -731,7 +738,7 @@ static void uhci_stop(struct usb_hcd *hcd)
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 
         spin_lock_irq(&uhci->lock);
-        if (test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) && !uhci->dead)
+        if (HCD_HW_ACCESSIBLE(hcd) && !uhci->dead)
                 uhci_hc_died(uhci);
         uhci_scan_schedule(uhci);
         spin_unlock_irq(&uhci->lock);
@@ -748,7 +755,7 @@ static int uhci_rh_suspend(struct usb_hcd *hcd)
         int rc = 0;
 
         spin_lock_irq(&uhci->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 rc = -ESHUTDOWN;
         else if (uhci->dead)
                 ;               /* Dead controllers tell no tales */
@@ -775,7 +782,7 @@ static int uhci_rh_resume(struct usb_hcd *hcd)
         int rc = 0;
 
         spin_lock_irq(&uhci->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+        if (!HCD_HW_ACCESSIBLE(hcd))
                 rc = -ESHUTDOWN;
         else if (!uhci->dead)
                 wakeup_rh(uhci);
@@ -783,15 +790,16 @@ static int uhci_rh_resume(struct usb_hcd *hcd)
         return rc;
 }
 
-static int uhci_pci_suspend(struct usb_hcd *hcd)
+static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
 {
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+        struct pci_dev *pdev = to_pci_dev(uhci_dev(uhci));
         int rc = 0;
 
         dev_dbg(uhci_dev(uhci), "%s\n", __func__);
 
         spin_lock_irq(&uhci->lock);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
+        if (!HCD_HW_ACCESSIBLE(hcd) || uhci->dead)
                 goto done_okay;         /* Already suspended or dead */
 
         if (uhci->rh_state > UHCI_RH_SUSPENDED) {
@@ -803,11 +811,15 @@ static int uhci_pci_suspend(struct usb_hcd *hcd)
         /* All PCI host controllers are required to disable IRQ generation
          * at the source, so we must turn off PIRQ.
          */
-        pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP, 0);
-        mb();
-        hcd->poll_rh = 0;
-
-        /* FIXME: Enable non-PME# remote wakeup? */
+        pci_write_config_word(pdev, USBLEGSUP, 0);
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+
+        /* Enable platform-specific non-PME# wakeup */
+        if (do_wakeup) {
+                if (pdev->vendor == PCI_VENDOR_ID_INTEL)
+                        pci_write_config_byte(pdev, USBRES_INTEL,
+                                        USBPORT1EN | USBPORT2EN);
+        }
 
 done_okay:
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
@@ -826,7 +838,6 @@ static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
          * even if the controller was dead.
          */
         set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-        mb();
 
         spin_lock_irq(&uhci->lock);
 
@@ -834,8 +845,6 @@ static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
         if (hibernated)
                 uhci_hc_died(uhci);
 
-        /* FIXME: Disable non-PME# remote wakeup? */
-
         /* The firmware or a boot kernel may have changed the controller
          * settings during a system wakeup.  Check it and reconfigure
          * to avoid problems.
@@ -845,22 +854,20 @@ static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
         /* If the controller was dead before, it's back alive now */
         configure_hc(uhci);
 
-        if (uhci->rh_state == UHCI_RH_RESET) {
-
-                /* The controller had to be reset */
+        /* Tell the core if the controller had to be reset */
+        if (uhci->rh_state == UHCI_RH_RESET)
                 usb_root_hub_lost_power(hcd->self.root_hub);
-                suspend_rh(uhci, UHCI_RH_SUSPENDED);
-        }
 
         spin_unlock_irq(&uhci->lock);
 
         /* If interrupts don't work and remote wakeup is enabled then
          * the suspended root hub needs to be polled.
          */
-        if (!uhci->RD_enable && hcd->self.root_hub->do_remote_wakeup) {
-                hcd->poll_rh = 1;
-                usb_hcd_poll_rh_status(hcd);
-        }
+        if (!uhci->RD_enable && hcd->self.root_hub->do_remote_wakeup)
+                set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+
+        /* Does the root hub have a port wakeup pending? */
+        usb_hcd_poll_rh_status(hcd);
         return 0;
 }
 #endif
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index 26bd1b2bcbfc..49bf2790f9c2 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -67,12 +67,17 @@
 #define   USBPORTSC_RES3        0x4000  /* reserved, write zeroes */
 #define   USBPORTSC_RES4        0x8000  /* reserved, write zeroes */
 
-/* Legacy support register */
+/* PCI legacy support register */
 #define USBLEGSUP               0xc0
 #define   USBLEGSUP_DEFAULT     0x2000  /* only PIRQ enable set */
 #define   USBLEGSUP_RWC         0x8f00  /* the R/WC bits */
 #define   USBLEGSUP_RO          0x5040  /* R/O and reserved bits */
 
+/* PCI Intel-specific resume-enable register */
+#define USBRES_INTEL            0xc4
+#define   USBPORT1EN            0x01
+#define   USBPORT2EN            0x02
+
 #define UHCI_PTR_BITS           cpu_to_le32(0x000F)
 #define UHCI_PTR_TERM           cpu_to_le32(0x0001)
 #define UHCI_PTR_QH             cpu_to_le32(0x0002)
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 8270055848ca..6d59c0f77f25 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -190,7 +190,7 @@ static int uhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         spin_lock_irqsave(&uhci->lock, flags);
 
         uhci_scan_schedule(uhci);
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
+        if (!HCD_HW_ACCESSIBLE(hcd) || uhci->dead)
                 goto done;
         uhci_check_ports(uhci);
 
@@ -200,7 +200,7 @@ static int uhci_hub_status_data(struct usb_hcd *hcd, char *buf)
             case UHCI_RH_SUSPENDING:
             case UHCI_RH_SUSPENDED:
                 /* if port change, ask to be resumed */
-                if (status)
+                if (status || uhci->resuming_ports)
                         usb_hcd_resume_root_hub(hcd);
                 break;
 
@@ -246,7 +246,7 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
         u16 wPortChange, wPortStatus;
         unsigned long flags;
 
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
+        if (!HCD_HW_ACCESSIBLE(hcd) || uhci->dead)
                 return -ETIMEDOUT;
 
         spin_lock_irqsave(&uhci->lock, flags);
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index acd582c02802..d3ade4018487 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -565,7 +565,7 @@ static void uhci_unlink_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
         qh->unlink_frame = uhci->frame_number;
 
         /* Force an interrupt so we know when the QH is fully unlinked */
-        if (list_empty(&uhci->skel_unlink_qh->node))
+        if (list_empty(&uhci->skel_unlink_qh->node) || uhci->is_stopped)
                 uhci_set_next_interrupt(uhci);
 
         /* Move the QH from its old list to the end of the unlinking list */
@@ -1667,7 +1667,7 @@ static int uhci_advance_check(struct uhci_hcd *uhci, struct uhci_qh *qh)
                         qh->advance_jiffies = jiffies;
                         goto done;
                 }
-                ret = 0;
+                ret = uhci->is_stopped;
         }
 
         /* The queue hasn't advanced; check for timeout */
diff --git a/drivers/usb/host/whci/hcd.c b/drivers/usb/host/whci/hcd.c
index e0d3401285c8..72b6892fda67 100644
--- a/drivers/usb/host/whci/hcd.c
+++ b/drivers/usb/host/whci/hcd.c
@@ -68,7 +68,7 @@ static int whc_start(struct usb_hcd *usb_hcd)
         whc_write_wusbcmd(whc, WUSBCMD_RUN, WUSBCMD_RUN);
 
         usb_hcd->uses_new_polling = 1;
-        usb_hcd->poll_rh = 1;
+        set_bit(HCD_FLAG_POLL_RH, &usb_hcd->flags);
         usb_hcd->state = HC_STATE_RUNNING;
 
 out:
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index ab5a14fbfeeb..dc0ab8382f5d 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -475,7 +475,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
                             || (prev_end & (WHCI_PAGE_SIZE-1))
                             || (dma_addr & (WHCI_PAGE_SIZE-1))
                             || std->len + WHCI_PAGE_SIZE > QTD_MAX_XFER_SIZE) {
-                                if (std->len % qset->max_packet != 0)
+                                if (std && std->len % qset->max_packet != 0)
                                         return -EINVAL;
                                 std = qset_new_std(whc, qset, urb, mem_flags);
                                 if (std == NULL) {
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 2eb658d26394..4e51343ddffc 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -391,49 +391,6 @@ struct xhci_ring *xhci_stream_id_to_ring(
         return ep->stream_info->stream_rings[stream_id];
 }
 
-struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
-                unsigned int slot_id, unsigned int ep_index,
-                unsigned int stream_id)
-{
-        struct xhci_virt_ep *ep;
-
-        ep = &xhci->devs[slot_id]->eps[ep_index];
-        /* Common case: no streams */
-        if (!(ep->ep_state & EP_HAS_STREAMS))
-                return ep->ring;
-
-        if (stream_id == 0) {
-                xhci_warn(xhci,
-                                "WARN: Slot ID %u, ep index %u has streams, "
-                                "but URB has no stream ID.\n",
-                                slot_id, ep_index);
-                return NULL;
-        }
-
-        if (stream_id < ep->stream_info->num_streams)
-                return ep->stream_info->stream_rings[stream_id];
-
-        xhci_warn(xhci,
-                        "WARN: Slot ID %u, ep index %u has "
-                        "stream IDs 1 to %u allocated, "
-                        "but stream ID %u is requested.\n",
-                        slot_id, ep_index,
-                        ep->stream_info->num_streams - 1,
-                        stream_id);
-        return NULL;
-}
-
-/* Get the right ring for the given URB.
- * If the endpoint supports streams, boundary check the URB's stream ID.
- * If the endpoint doesn't support streams, return the singular endpoint ring.
- */
-struct xhci_ring *xhci_urb_to_transfer_ring(struct xhci_hcd *xhci,
-                struct urb *urb)
-{
-        return xhci_triad_to_transfer_ring(xhci, urb->dev->slot_id,
-                xhci_get_endpoint_index(&urb->ep->desc), urb->stream_id);
-}
-
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
 static int xhci_test_radix_tree(struct xhci_hcd *xhci,
                 unsigned int num_streams,
@@ -1112,8 +1069,18 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
 
         /* Set up the endpoint ring */
-        virt_dev->eps[ep_index].new_ring =
-                xhci_ring_alloc(xhci, 1, true, mem_flags);
+        /*
+         * Isochronous endpoint ring needs bigger size because one isoc URB
+         * carries multiple packets and it will insert multiple tds to the
+         * ring.
+         * This should be replaced with dynamic ring resizing in the future.
+         */
+        if (usb_endpoint_xfer_isoc(&ep->desc))
+                virt_dev->eps[ep_index].new_ring =
+                        xhci_ring_alloc(xhci, 8, true, mem_flags);
+        else
+                virt_dev->eps[ep_index].new_ring =
+                        xhci_ring_alloc(xhci, 1, true, mem_flags);
         if (!virt_dev->eps[ep_index].new_ring) {
                 /* Attempt to use the ring cache */
                 if (virt_dev->num_rings_cached == 0)
@@ -1124,6 +1091,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                 virt_dev->num_rings_cached--;
                 xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring);
         }
+        virt_dev->eps[ep_index].skip = false;
         ep_ring = virt_dev->eps[ep_index].new_ring;
         ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
@@ -1389,6 +1357,22 @@ struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
         return command;
 }
 
+void xhci_urb_free_priv(struct xhci_hcd *xhci, struct urb_priv *urb_priv)
+{
+        int last;
+
+        if (!urb_priv)
+                return;
+
+        last = urb_priv->length - 1;
+        if (last >= 0) {
+                int     i;
+                for (i = 0; i <= last; i++)
+                        kfree(urb_priv->td[i]);
+        }
+        kfree(urb_priv);
+}
+
 void xhci_free_command(struct xhci_hcd *xhci,
                 struct xhci_command *command)
 {
@@ -1588,7 +1572,7 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
         unsigned int num_tests;
         int i, ret;
 
-        num_tests = sizeof(simple_test_vector) / sizeof(simple_test_vector[0]);
+        num_tests = ARRAY_SIZE(simple_test_vector);
         for (i = 0; i < num_tests; i++) {
                 ret = xhci_test_trb_in_td(xhci,
                                 xhci->event_ring->first_seg,
@@ -1601,7 +1585,7 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
                         return ret;
         }
 
-        num_tests = sizeof(complex_test_vector) / sizeof(complex_test_vector[0]);
+        num_tests = ARRAY_SIZE(complex_test_vector);
         for (i = 0; i < num_tests; i++) {
                 ret = xhci_test_trb_in_td(xhci,
                                 complex_test_vector[i].input_seg,
@@ -1617,6 +1601,29 @@ static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
         return 0;
 }
 
+static void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
+{
+        u64 temp;
+        dma_addr_t deq;
+
+        deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
+                        xhci->event_ring->dequeue);
+        if (deq == 0 && !in_interrupt())
+                xhci_warn(xhci, "WARN something wrong with SW event ring "
+                                "dequeue ptr.\n");
+        /* Update HC event ring dequeue pointer */
+        temp = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        temp &= ERST_PTR_MASK;
+        /* Don't clear the EHB bit (which is RW1C) because
+         * there might be more events to service.
+         */
+        temp &= ~ERST_EHB;
+        xhci_dbg(xhci, "// Write event ring dequeue pointer, "
+                        "preserving EHB bit\n");
+        xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
+                        &xhci->ir_set->erst_dequeue);
+}
+
 
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 {
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 11482b6b9381..f7efe025beda 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -53,6 +53,7 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
         struct xhci_hcd         *xhci = hcd_to_xhci(hcd);
         struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
         int                     retval;
+        u32                     temp;
 
         hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 2;
 
@@ -93,6 +94,14 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
                 return retval;
         xhci_dbg(xhci, "Reset complete\n");
 
+        temp = xhci_readl(xhci, &xhci->cap_regs->hcc_params);
+        if (HCC_64BIT_ADDR(temp)) {
+                xhci_dbg(xhci, "Enabling 64-bit DMA addresses.\n");
+                dma_set_mask(hcd->self.controller, DMA_BIT_MASK(64));
+        } else {
+                dma_set_mask(hcd->self.controller, DMA_BIT_MASK(32));
+        }
+
         xhci_dbg(xhci, "Calling HCD init\n");
         /* Initialize HCD and host controller data structures. */
         retval = xhci_init(hcd);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index bfc99a939455..bc3f4f427065 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -301,28 +301,6 @@ static int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
         return 1;
 }
 
-void xhci_set_hc_event_deq(struct xhci_hcd *xhci)
-{
-        u64 temp;
-        dma_addr_t deq;
-
-        deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
-                        xhci->event_ring->dequeue);
-        if (deq == 0 && !in_interrupt())
-                xhci_warn(xhci, "WARN something wrong with SW event ring "
-                                "dequeue ptr.\n");
-        /* Update HC event ring dequeue pointer */
-        temp = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
-        temp &= ERST_PTR_MASK;
-        /* Don't clear the EHB bit (which is RW1C) because
-         * there might be more events to service.
-         */
-        temp &= ~ERST_EHB;
-        xhci_dbg(xhci, "// Write event ring dequeue pointer, preserving EHB bit\n");
-        xhci_write_64(xhci, ((u64) deq & (u64) ~ERST_PTR_MASK) | temp,
-                        &xhci->ir_set->erst_dequeue);
-}
-
 /* Ring the host controller doorbell after placing a command on the ring */
 void xhci_ring_cmd_db(struct xhci_hcd *xhci)
 {
@@ -359,11 +337,6 @@ static void ring_ep_doorbell(struct xhci_hcd *xhci,
                 field = xhci_readl(xhci, db_addr) & DB_MASK;
                 field |= EPI_TO_DB(ep_index) | STREAM_ID_TO_DB(stream_id);
                 xhci_writel(xhci, field, db_addr);
-                /* Flush PCI posted writes - FIXME Matthew Wilcox says this
-                 * isn't time-critical and we shouldn't make the CPU wait for
-                 * the flush.
-                 */
-                xhci_readl(xhci, db_addr);
         }
 }
 
@@ -419,6 +392,50 @@ static struct xhci_segment *find_trb_seg(
         return cur_seg;
 }
 
+
+static struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
+                unsigned int slot_id, unsigned int ep_index,
+                unsigned int stream_id)
+{
+        struct xhci_virt_ep *ep;
+
+        ep = &xhci->devs[slot_id]->eps[ep_index];
+        /* Common case: no streams */
+        if (!(ep->ep_state & EP_HAS_STREAMS))
+                return ep->ring;
+
+        if (stream_id == 0) {
+                xhci_warn(xhci,
+                                "WARN: Slot ID %u, ep index %u has streams, "
+                                "but URB has no stream ID.\n",
+                                slot_id, ep_index);
+                return NULL;
+        }
+
+        if (stream_id < ep->stream_info->num_streams)
+                return ep->stream_info->stream_rings[stream_id];
+
+        xhci_warn(xhci,
+                        "WARN: Slot ID %u, ep index %u has "
+                        "stream IDs 1 to %u allocated, "
+                        "but stream ID %u is requested.\n",
+                        slot_id, ep_index,
+                        ep->stream_info->num_streams - 1,
+                        stream_id);
+        return NULL;
+}
+
+/* Get the right ring for the given URB.
+ * If the endpoint supports streams, boundary check the URB's stream ID.
+ * If the endpoint doesn't support streams, return the singular endpoint ring.
+ */
+static struct xhci_ring *xhci_urb_to_transfer_ring(struct xhci_hcd *xhci,
+                struct urb *urb)
+{
+        return xhci_triad_to_transfer_ring(xhci, urb->dev->slot_id,
+                xhci_get_endpoint_index(&urb->ep->desc), urb->stream_id);
+}
+
 /*
  * Move the xHC's endpoint ring dequeue pointer past cur_td.
  * Record the new state of the xHC's endpoint ring dequeue segment,
@@ -578,16 +595,24 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
                 struct xhci_td *cur_td, int status, char *adjective)
 {
         struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        struct urb      *urb;
+        struct urb_priv *urb_priv;
 
-        cur_td->urb->hcpriv = NULL;
-        usb_hcd_unlink_urb_from_ep(hcd, cur_td->urb);
-        xhci_dbg(xhci, "Giveback %s URB %p\n", adjective, cur_td->urb);
+        urb = cur_td->urb;
+        urb_priv = urb->hcpriv;
+        urb_priv->td_cnt++;
 
-        spin_unlock(&xhci->lock);
-        usb_hcd_giveback_urb(hcd, cur_td->urb, status);
-        kfree(cur_td);
-        spin_lock(&xhci->lock);
-        xhci_dbg(xhci, "%s URB given back\n", adjective);
+        /* Only giveback urb when this is the last td in urb */
+        if (urb_priv->td_cnt == urb_priv->length) {
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+                xhci_dbg(xhci, "Giveback %s URB %p\n", adjective, urb);
+
+                spin_unlock(&xhci->lock);
+                usb_hcd_giveback_urb(hcd, urb, status);
+                xhci_urb_free_priv(xhci, urb_priv);
+                spin_lock(&xhci->lock);
+                xhci_dbg(xhci, "%s URB given back\n", adjective);
+        }
 }
 
 /*
@@ -1132,7 +1157,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
 
         /* Update event ring dequeue pointer before dropping the lock */
         inc_deq(xhci, xhci->event_ring, true);
-        xhci_set_hc_event_deq(xhci);
 
         spin_unlock(&xhci->lock);
         /* Pass this up to the core */
@@ -1258,6 +1282,421 @@ int xhci_is_vendor_info_code(struct xhci_hcd *xhci, unsigned int trb_comp_code)
 }
 
 /*
+ * Finish the td processing, remove the td from td list;
+ * Return 1 if the urb can be given back.
+ */
+static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+        union xhci_trb *event_trb, struct xhci_transfer_event *event,
+        struct xhci_virt_ep *ep, int *status, bool skip)
+{
+        struct xhci_virt_device *xdev;
+        struct xhci_ring *ep_ring;
+        unsigned int slot_id;
+        int ep_index;
+        struct urb *urb = NULL;
+        struct xhci_ep_ctx *ep_ctx;
+        int ret = 0;
+        struct urb_priv *urb_priv;
+        u32 trb_comp_code;
+
+        slot_id = TRB_TO_SLOT_ID(event->flags);
+        xdev = xhci->devs[slot_id];
+        ep_index = TRB_TO_EP_ID(event->flags) - 1;
+        ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
+        trb_comp_code = GET_COMP_CODE(event->transfer_len);
+
+        if (skip)
+                goto td_cleanup;
+
+        if (trb_comp_code == COMP_STOP_INVAL ||
+                        trb_comp_code == COMP_STOP) {
+                /* The Endpoint Stop Command completion will take care of any
+                 * stopped TDs.  A stopped TD may be restarted, so don't update
+                 * the ring dequeue pointer or take this TD off any lists yet.
+                 */
+                ep->stopped_td = td;
+                ep->stopped_trb = event_trb;
+                return 0;
+        } else {
+                if (trb_comp_code == COMP_STALL) {
+                        /* The transfer is completed from the driver's
+                         * perspective, but we need to issue a set dequeue
+                         * command for this stalled endpoint to move the dequeue
+                         * pointer past the TD.  We can't do that here because
+                         * the halt condition must be cleared first.  Let the
+                         * USB class driver clear the stall later.
+                         */
+                        ep->stopped_td = td;
+                        ep->stopped_trb = event_trb;
+                        ep->stopped_stream = ep_ring->stream_id;
+                } else if (xhci_requires_manual_halt_cleanup(xhci,
+                                        ep_ctx, trb_comp_code)) {
+                        /* Other types of errors halt the endpoint, but the
+                         * class driver doesn't call usb_reset_endpoint() unless
+                         * the error is -EPIPE.  Clear the halted status in the
+                         * xHCI hardware manually.
+                         */
+                        xhci_cleanup_halted_endpoint(xhci,
+                                        slot_id, ep_index, ep_ring->stream_id,
+                                        td, event_trb);
+                } else {
+                        /* Update ring dequeue pointer */
+                        while (ep_ring->dequeue != td->last_trb)
+                                inc_deq(xhci, ep_ring, false);
+                        inc_deq(xhci, ep_ring, false);
+                }
+
+td_cleanup:
+                /* Clean up the endpoint's TD list */
+                urb = td->urb;
+                urb_priv = urb->hcpriv;
+
+                /* Do one last check of the actual transfer length.
+                 * If the host controller said we transferred more data than
+                 * the buffer length, urb->actual_length will be a very big
+                 * number (since it's unsigned).  Play it safe and say we didn't
+                 * transfer anything.
+                 */
+                if (urb->actual_length > urb->transfer_buffer_length) {
+                        xhci_warn(xhci, "URB transfer length is wrong, "
+                                        "xHC issue? req. len = %u, "
+                                        "act. len = %u\n",
+                                        urb->transfer_buffer_length,
+                                        urb->actual_length);
+                        urb->actual_length = 0;
+                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                *status = -EREMOTEIO;
+                        else
+                                *status = 0;
+                }
+                list_del(&td->td_list);
+                /* Was this TD slated to be cancelled but completed anyway? */
+                if (!list_empty(&td->cancelled_td_list))
+                        list_del(&td->cancelled_td_list);
+
+                urb_priv->td_cnt++;
+                /* Giveback the urb when all the tds are completed */
+                if (urb_priv->td_cnt == urb_priv->length)
+                        ret = 1;
+        }
+
+        return ret;
+}
+
+/*
+ * Process control tds, update urb status and actual_length.
+ */
+static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+        union xhci_trb *event_trb, struct xhci_transfer_event *event,
+        struct xhci_virt_ep *ep, int *status)
+{
+        struct xhci_virt_device *xdev;
+        struct xhci_ring *ep_ring;
+        unsigned int slot_id;
+        int ep_index;
+        struct xhci_ep_ctx *ep_ctx;
+        u32 trb_comp_code;
+
+        slot_id = TRB_TO_SLOT_ID(event->flags);
+        xdev = xhci->devs[slot_id];
+        ep_index = TRB_TO_EP_ID(event->flags) - 1;
+        ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
+        trb_comp_code = GET_COMP_CODE(event->transfer_len);
+
+        xhci_debug_trb(xhci, xhci->event_ring->dequeue);
+        switch (trb_comp_code) {
+        case COMP_SUCCESS:
+                if (event_trb == ep_ring->dequeue) {
+                        xhci_warn(xhci, "WARN: Success on ctrl setup TRB "
+                                        "without IOC set??\n");
+                        *status = -ESHUTDOWN;
+                } else if (event_trb != td->last_trb) {
+                        xhci_warn(xhci, "WARN: Success on ctrl data TRB "
+                                        "without IOC set??\n");
+                        *status = -ESHUTDOWN;
+                } else {
+                        xhci_dbg(xhci, "Successful control transfer!\n");
+                        *status = 0;
+                }
+                break;
+        case COMP_SHORT_TX:
+                xhci_warn(xhci, "WARN: short transfer on control ep\n");
+                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                        *status = -EREMOTEIO;
+                else
+                        *status = 0;
+                break;
+        default:
+                if (!xhci_requires_manual_halt_cleanup(xhci,
+                                        ep_ctx, trb_comp_code))
+                        break;
+                xhci_dbg(xhci, "TRB error code %u, "
+                                "halted endpoint index = %u\n",
+                                trb_comp_code, ep_index);
+                /* else fall through */
+        case COMP_STALL:
+                /* Did we transfer part of the data (middle) phase? */
+                if (event_trb != ep_ring->dequeue &&
+                                event_trb != td->last_trb)
+                        td->urb->actual_length =
+                                td->urb->transfer_buffer_length
+                                - TRB_LEN(event->transfer_len);
+                else
+                        td->urb->actual_length = 0;
+
+                xhci_cleanup_halted_endpoint(xhci,
+                        slot_id, ep_index, 0, td, event_trb);
+                return finish_td(xhci, td, event_trb, event, ep, status, true);
+        }
+        /*
+         * Did we transfer any data, despite the errors that might have
+         * happened?  I.e. did we get past the setup stage?
+         */
+        if (event_trb != ep_ring->dequeue) {
+                /* The event was for the status stage */
+                if (event_trb == td->last_trb) {
+                        if (td->urb->actual_length != 0) {
+                                /* Don't overwrite a previously set error code
+                                 */
+                                if ((*status == -EINPROGRESS || *status == 0) &&
+                                                (td->urb->transfer_flags
+                                                 & URB_SHORT_NOT_OK))
+                                        /* Did we already see a short data
+                                         * stage? */
+                                        *status = -EREMOTEIO;
+                        } else {
+                                td->urb->actual_length =
+                                        td->urb->transfer_buffer_length;
+                        }
+                } else {
+                /* Maybe the event was for the data stage? */
+                        if (trb_comp_code != COMP_STOP_INVAL) {
+                                /* We didn't stop on a link TRB in the middle */
+                                td->urb->actual_length =
+                                        td->urb->transfer_buffer_length -
+                                        TRB_LEN(event->transfer_len);
+                                xhci_dbg(xhci, "Waiting for status "
+                                                "stage event\n");
+                                return 0;
+                        }
+                }
+        }
+
+        return finish_td(xhci, td, event_trb, event, ep, status, false);
+}
+
+/*
+ * Process isochronous tds, update urb packet status and actual_length.
+ */
+static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+        union xhci_trb *event_trb, struct xhci_transfer_event *event,
+        struct xhci_virt_ep *ep, int *status)
+{
+        struct xhci_ring *ep_ring;
+        struct urb_priv *urb_priv;
+        int idx;
+        int len = 0;
+        int skip_td = 0;
+        union xhci_trb *cur_trb;
+        struct xhci_segment *cur_seg;
+        u32 trb_comp_code;
+
+        ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+        trb_comp_code = GET_COMP_CODE(event->transfer_len);
+        urb_priv = td->urb->hcpriv;
+        idx = urb_priv->td_cnt;
+
+        if (ep->skip) {
+                /* The transfer is partly done */
+                *status = -EXDEV;
+                td->urb->iso_frame_desc[idx].status = -EXDEV;
+        } else {
+                /* handle completion code */
+                switch (trb_comp_code) {
+                case COMP_SUCCESS:
+                        td->urb->iso_frame_desc[idx].status = 0;
+                        xhci_dbg(xhci, "Successful isoc transfer!\n");
+                        break;
+                case COMP_SHORT_TX:
+                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                td->urb->iso_frame_desc[idx].status =
+                                         -EREMOTEIO;
+                        else
+                                td->urb->iso_frame_desc[idx].status = 0;
+                        break;
+                case COMP_BW_OVER:
+                        td->urb->iso_frame_desc[idx].status = -ECOMM;
+                        skip_td = 1;
+                        break;
+                case COMP_BUFF_OVER:
+                case COMP_BABBLE:
+                        td->urb->iso_frame_desc[idx].status = -EOVERFLOW;
+                        skip_td = 1;
+                        break;
+                case COMP_STALL:
+                        td->urb->iso_frame_desc[idx].status = -EPROTO;
+                        skip_td = 1;
+                        break;
+                case COMP_STOP:
+                case COMP_STOP_INVAL:
+                        break;
+                default:
+                        td->urb->iso_frame_desc[idx].status = -1;
+                        break;
+                }
+        }
+
+        /* calc actual length */
+        if (ep->skip) {
+                td->urb->iso_frame_desc[idx].actual_length = 0;
+                return finish_td(xhci, td, event_trb, event, ep, status, true);
+        }
+
+        if (trb_comp_code == COMP_SUCCESS || skip_td == 1) {
+                td->urb->iso_frame_desc[idx].actual_length =
+                        td->urb->iso_frame_desc[idx].length;
+                td->urb->actual_length +=
+                        td->urb->iso_frame_desc[idx].length;
+        } else {
+                for (cur_trb = ep_ring->dequeue,
+                     cur_seg = ep_ring->deq_seg; cur_trb != event_trb;
+                     next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) {
+                        if ((cur_trb->generic.field[3] &
+                         TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) &&
+                            (cur_trb->generic.field[3] &
+                         TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK))
+                                len +=
+                                    TRB_LEN(cur_trb->generic.field[2]);
+                }
+                len += TRB_LEN(cur_trb->generic.field[2]) -
+                        TRB_LEN(event->transfer_len);
+
+                if (trb_comp_code != COMP_STOP_INVAL) {
+                        td->urb->iso_frame_desc[idx].actual_length = len;
+                        td->urb->actual_length += len;
+                }
+        }
+
+        if ((idx == urb_priv->length - 1) && *status == -EINPROGRESS)
+                *status = 0;
+
+        return finish_td(xhci, td, event_trb, event, ep, status, false);
+}
+
+/*
+ * Process bulk and interrupt tds, update urb status and actual_length.
+ */
+static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+        union xhci_trb *event_trb, struct xhci_transfer_event *event,
+        struct xhci_virt_ep *ep, int *status)
+{
+        struct xhci_ring *ep_ring;
+        union xhci_trb *cur_trb;
+        struct xhci_segment *cur_seg;
+        u32 trb_comp_code;
+
+        ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
+        trb_comp_code = GET_COMP_CODE(event->transfer_len);
+
+        switch (trb_comp_code) {
+        case COMP_SUCCESS:
+                /* Double check that the HW transferred everything. */
+                if (event_trb != td->last_trb) {
+                        xhci_warn(xhci, "WARN Successful completion "
+                                        "on short TX\n");
+                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                *status = -EREMOTEIO;
+                        else
+                                *status = 0;
+                } else {
+                        if (usb_endpoint_xfer_bulk(&td->urb->ep->desc))
+                                xhci_dbg(xhci, "Successful bulk "
+                                                "transfer!\n");
+                        else
+                                xhci_dbg(xhci, "Successful interrupt "
+                                                "transfer!\n");
+                        *status = 0;
+                }
+                break;
+        case COMP_SHORT_TX:
+                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                        *status = -EREMOTEIO;
+                else
+                        *status = 0;
+                break;
+        default:
+                /* Others already handled above */
+                break;
+        }
+        dev_dbg(&td->urb->dev->dev,
+                        "ep %#x - asked for %d bytes, "
+                        "%d bytes untransferred\n",
+                        td->urb->ep->desc.bEndpointAddress,
+                        td->urb->transfer_buffer_length,
+                        TRB_LEN(event->transfer_len));
+        /* Fast path - was this the last TRB in the TD for this URB? */
+        if (event_trb == td->last_trb) {
+                if (TRB_LEN(event->transfer_len) != 0) {
+                        td->urb->actual_length =
+                                td->urb->transfer_buffer_length -
+                                TRB_LEN(event->transfer_len);
+                        if (td->urb->transfer_buffer_length <
+                                        td->urb->actual_length) {
+                                xhci_warn(xhci, "HC gave bad length "
+                                                "of %d bytes left\n",
+                                                TRB_LEN(event->transfer_len));
+                                td->urb->actual_length = 0;
+                                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                        *status = -EREMOTEIO;
+                                else
+                                        *status = 0;
+                        }
+                        /* Don't overwrite a previously set error code */
+                        if (*status == -EINPROGRESS) {
+                                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                        *status = -EREMOTEIO;
+                                else
+                                        *status = 0;
+                        }
+                } else {
+                        td->urb->actual_length =
+                                td->urb->transfer_buffer_length;
+                        /* Ignore a short packet completion if the
+                         * untransferred length was zero.
+                         */
+                        if (*status == -EREMOTEIO)
+                                *status = 0;
+                }
+        } else {
+                /* Slow path - walk the list, starting from the dequeue
+                 * pointer, to get the actual length transferred.
+                 */
+                td->urb->actual_length = 0;
+                for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg;
+                                cur_trb != event_trb;
+                                next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) {
+                        if ((cur_trb->generic.field[3] &
+                         TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) &&
+                            (cur_trb->generic.field[3] &
+                         TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK))
+                                td->urb->actual_length +=
+                                        TRB_LEN(cur_trb->generic.field[2]);
+                }
+                /* If the ring didn't stop on a Link or No-op TRB, add
+                 * in the actual bytes transferred from the Normal TRB
+                 */
+                if (trb_comp_code != COMP_STOP_INVAL)
+                        td->urb->actual_length +=
+                                TRB_LEN(cur_trb->generic.field[2]) -
+                                TRB_LEN(event->transfer_len);
+        }
+
+        return finish_td(xhci, td, event_trb, event, ep, status, false);
+}
+
+/*
  * If this function returns an error condition, it means it got a Transfer
  * event with a corrupted Slot ID, Endpoint ID, or TRB DMA address.
  * At this point, the host controller is probably hosed and should be reset.
@@ -1276,10 +1715,11 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         union xhci_trb *event_trb;
         struct urb *urb = NULL;
         int status = -EINPROGRESS;
+        struct urb_priv *urb_priv;
         struct xhci_ep_ctx *ep_ctx;
         u32 trb_comp_code;
+        int ret = 0;
 
-        xhci_dbg(xhci, "In %s\n", __func__);
         slot_id = TRB_TO_SLOT_ID(event->flags);
         xdev = xhci->devs[slot_id];
         if (!xdev) {
@@ -1293,51 +1733,16 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         ep = &xdev->eps[ep_index];
         ep_ring = xhci_dma_to_transfer_ring(ep, event->buffer);
         ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
-        if (!ep_ring || (ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_DISABLED) {
+        if (!ep_ring ||
+                (ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_DISABLED) {
                 xhci_err(xhci, "ERROR Transfer event for disabled endpoint "
                                 "or incorrect stream ring\n");
                 return -ENODEV;
         }
 
         event_dma = event->buffer;
-        /* This TRB should be in the TD at the head of this ring's TD list */
-        xhci_dbg(xhci, "%s - checking for list empty\n", __func__);
-        if (list_empty(&ep_ring->td_list)) {
-                xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
-                                TRB_TO_SLOT_ID(event->flags), ep_index);
-                xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
-                                (unsigned int) (event->flags & TRB_TYPE_BITMASK)>>10);
-                xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
-                urb = NULL;
-                goto cleanup;
-        }
-        xhci_dbg(xhci, "%s - getting list entry\n", __func__);
-        td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
-
-        /* Is this a TRB in the currently executing TD? */
-        xhci_dbg(xhci, "%s - looking for TD\n", __func__);
-        event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
-                        td->last_trb, event_dma);
-        xhci_dbg(xhci, "%s - found event_seg = %p\n", __func__, event_seg);
-        if (!event_seg) {
-                /* HC is busted, give up! */
-                xhci_err(xhci, "ERROR Transfer event TRB DMA ptr not part of current TD\n");
-                return -ESHUTDOWN;
-        }
-        event_trb = &event_seg->trbs[(event_dma - event_seg->dma) / sizeof(*event_trb)];
-        xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
-                        (unsigned int) (event->flags & TRB_TYPE_BITMASK)>>10);
-        xhci_dbg(xhci, "Offset 0x00 (buffer lo) = 0x%x\n",
-                        lower_32_bits(event->buffer));
-        xhci_dbg(xhci, "Offset 0x04 (buffer hi) = 0x%x\n",
-                        upper_32_bits(event->buffer));
-        xhci_dbg(xhci, "Offset 0x08 (transfer length) = 0x%x\n",
-                        (unsigned int) event->transfer_len);
-        xhci_dbg(xhci, "Offset 0x0C (flags) = 0x%x\n",
-                        (unsigned int) event->flags);
-
-        /* Look for common error cases */
         trb_comp_code = GET_COMP_CODE(event->transfer_len);
+        /* Look for common error cases */
         switch (trb_comp_code) {
         /* Skip codes that require special handling depending on
          * transfer type
@@ -1373,278 +1778,156 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 xhci_warn(xhci, "WARN: HC couldn't access mem fast enough\n");
                 status = -ENOSR;
                 break;
+        case COMP_BW_OVER:
+                xhci_warn(xhci, "WARN: bandwidth overrun event on endpoint\n");
+                break;
+        case COMP_BUFF_OVER:
+                xhci_warn(xhci, "WARN: buffer overrun event on endpoint\n");
+                break;
+        case COMP_UNDERRUN:
+                /*
+                 * When the Isoch ring is empty, the xHC will generate
+                 * a Ring Overrun Event for IN Isoch endpoint or Ring
+                 * Underrun Event for OUT Isoch endpoint.
+                 */
+                xhci_dbg(xhci, "underrun event on endpoint\n");
+                if (!list_empty(&ep_ring->td_list))
+                        xhci_dbg(xhci, "Underrun Event for slot %d ep %d "
+                                        "still with TDs queued?\n",
+                                TRB_TO_SLOT_ID(event->flags), ep_index);
+                goto cleanup;
+        case COMP_OVERRUN:
+                xhci_dbg(xhci, "overrun event on endpoint\n");
+                if (!list_empty(&ep_ring->td_list))
+                        xhci_dbg(xhci, "Overrun Event for slot %d ep %d "
+                                        "still with TDs queued?\n",
+                                TRB_TO_SLOT_ID(event->flags), ep_index);
+                goto cleanup;
+        case COMP_MISSED_INT:
+                /*
+                 * When encounter missed service error, one or more isoc tds
+                 * may be missed by xHC.
+                 * Set skip flag of the ep_ring; Complete the missed tds as
+                 * short transfer when process the ep_ring next time.
+                 */
+                ep->skip = true;
+                xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
+                goto cleanup;
         default:
                 if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
                         status = 0;
                         break;
                 }
-                xhci_warn(xhci, "ERROR Unknown event condition, HC probably busted\n");
-                urb = NULL;
+                xhci_warn(xhci, "ERROR Unknown event condition, HC probably "
+                                "busted\n");
                 goto cleanup;
         }
-        /* Now update the urb's actual_length and give back to the core */
-        /* Was this a control transfer? */
-        if (usb_endpoint_xfer_control(&td->urb->ep->desc)) {
-                xhci_debug_trb(xhci, xhci->event_ring->dequeue);
-                switch (trb_comp_code) {
-                case COMP_SUCCESS:
-                        if (event_trb == ep_ring->dequeue) {
-                                xhci_warn(xhci, "WARN: Success on ctrl setup TRB without IOC set??\n");
-                                status = -ESHUTDOWN;
-                        } else if (event_trb != td->last_trb) {
-                                xhci_warn(xhci, "WARN: Success on ctrl data TRB without IOC set??\n");
-                                status = -ESHUTDOWN;
-                        } else {
-                                xhci_dbg(xhci, "Successful control transfer!\n");
-                                status = 0;
-                        }
-                        break;
-                case COMP_SHORT_TX:
-                        xhci_warn(xhci, "WARN: short transfer on control ep\n");
-                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                status = -EREMOTEIO;
-                        else
-                                status = 0;
-                        break;
 
-                default:
-                        if (!xhci_requires_manual_halt_cleanup(xhci,
-                                                ep_ctx, trb_comp_code))
-                                break;
-                        xhci_dbg(xhci, "TRB error code %u, "
-                                        "halted endpoint index = %u\n",
-                                        trb_comp_code, ep_index);
-                        /* else fall through */
-                case COMP_STALL:
-                        /* Did we transfer part of the data (middle) phase? */
-                        if (event_trb != ep_ring->dequeue &&
-                                        event_trb != td->last_trb)
-                                td->urb->actual_length =
-                                        td->urb->transfer_buffer_length
-                                        - TRB_LEN(event->transfer_len);
-                        else
-                                td->urb->actual_length = 0;
-
-                        xhci_cleanup_halted_endpoint(xhci,
-                                        slot_id, ep_index, 0, td, event_trb);
-                        goto td_cleanup;
-                }
-                /*
-                 * Did we transfer any data, despite the errors that might have
-                 * happened?  I.e. did we get past the setup stage?
+        do {
+                /* This TRB should be in the TD at the head of this ring's
+                 * TD list.
                  */
-                if (event_trb != ep_ring->dequeue) {
-                        /* The event was for the status stage */
-                        if (event_trb == td->last_trb) {
-                                if (td->urb->actual_length != 0) {
-                                        /* Don't overwrite a previously set error code */
-                                        if ((status == -EINPROGRESS ||
-                                                                status == 0) &&
-                                                        (td->urb->transfer_flags
-                                                         & URB_SHORT_NOT_OK))
-                                                /* Did we already see a short data stage? */
-                                                status = -EREMOTEIO;
-                                } else {
-                                        td->urb->actual_length =
-                                                td->urb->transfer_buffer_length;
-                                }
-                        } else {
-                        /* Maybe the event was for the data stage? */
-                                if (trb_comp_code != COMP_STOP_INVAL) {
-                                        /* We didn't stop on a link TRB in the middle */
-                                        td->urb->actual_length =
-                                                td->urb->transfer_buffer_length -
-                                                TRB_LEN(event->transfer_len);
-                                        xhci_dbg(xhci, "Waiting for status stage event\n");
-                                        urb = NULL;
-                                        goto cleanup;
-                                }
+                if (list_empty(&ep_ring->td_list)) {
+                        xhci_warn(xhci, "WARN Event TRB for slot %d ep %d "
+                                        "with no TDs queued?\n",
+                                  TRB_TO_SLOT_ID(event->flags), ep_index);
+                        xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
+                          (unsigned int) (event->flags & TRB_TYPE_BITMASK)>>10);
+                        xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                        if (ep->skip) {
+                                ep->skip = false;
+                                xhci_dbg(xhci, "td_list is empty while skip "
+                                                "flag set. Clear skip flag.\n");
                         }
+                        ret = 0;
+                        goto cleanup;
                 }
-        } else {
-                switch (trb_comp_code) {
-                case COMP_SUCCESS:
-                        /* Double check that the HW transferred everything. */
-                        if (event_trb != td->last_trb) {
-                                xhci_warn(xhci, "WARN Successful completion "
-                                                "on short TX\n");
-                                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                        status = -EREMOTEIO;
-                                else
-                                        status = 0;
-                        } else {
-                                if (usb_endpoint_xfer_bulk(&td->urb->ep->desc))
-                                        xhci_dbg(xhci, "Successful bulk "
-                                                        "transfer!\n");
-                                else
-                                        xhci_dbg(xhci, "Successful interrupt "
-                                                        "transfer!\n");
-                                status = 0;
-                        }
-                        break;
-                case COMP_SHORT_TX:
-                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                status = -EREMOTEIO;
-                        else
-                                status = 0;
-                        break;
-                default:
-                        /* Others already handled above */
-                        break;
+
+                td = list_entry(ep_ring->td_list.next, struct xhci_td, td_list);
+                /* Is this a TRB in the currently executing TD? */
+                event_seg = trb_in_td(ep_ring->deq_seg, ep_ring->dequeue,
+                                td->last_trb, event_dma);
+                if (event_seg && ep->skip) {
+                        xhci_dbg(xhci, "Found td. Clear skip flag.\n");
+                        ep->skip = false;
+                }
+                if (!event_seg &&
+                   (!ep->skip || !usb_endpoint_xfer_isoc(&td->urb->ep->desc))) {
+                        /* HC is busted, give up! */
+                        xhci_err(xhci, "ERROR Transfer event TRB DMA ptr not "
+                                        "part of current TD\n");
+                        return -ESHUTDOWN;
                 }
-                dev_dbg(&td->urb->dev->dev,
-                                "ep %#x - asked for %d bytes, "
-                                "%d bytes untransferred\n",
-                                td->urb->ep->desc.bEndpointAddress,
-                                td->urb->transfer_buffer_length,
-                                TRB_LEN(event->transfer_len));
-                /* Fast path - was this the last TRB in the TD for this URB? */
-                if (event_trb == td->last_trb) {
-                        if (TRB_LEN(event->transfer_len) != 0) {
-                                td->urb->actual_length =
-                                        td->urb->transfer_buffer_length -
-                                        TRB_LEN(event->transfer_len);
-                                if (td->urb->transfer_buffer_length <
-                                                td->urb->actual_length) {
-                                        xhci_warn(xhci, "HC gave bad length "
-                                                        "of %d bytes left\n",
-                                                        TRB_LEN(event->transfer_len));
-                                        td->urb->actual_length = 0;
-                                        if (td->urb->transfer_flags &
-                                                        URB_SHORT_NOT_OK)
-                                                status = -EREMOTEIO;
-                                        else
-                                                status = 0;
-                                }
-                                /* Don't overwrite a previously set error code */
-                                if (status == -EINPROGRESS) {
-                                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                                status = -EREMOTEIO;
-                                        else
-                                                status = 0;
-                                }
-                        } else {
-                                td->urb->actual_length = td->urb->transfer_buffer_length;
-                                /* Ignore a short packet completion if the
-                                 * untransferred length was zero.
-                                 */
-                                if (status == -EREMOTEIO)
-                                        status = 0;
-                        }
-                } else {
-                        /* Slow path - walk the list, starting from the dequeue
-                         * pointer, to get the actual length transferred.
-                         */
-                        union xhci_trb *cur_trb;
-                        struct xhci_segment *cur_seg;
 
-                        td->urb->actual_length = 0;
-                        for (cur_trb = ep_ring->dequeue, cur_seg = ep_ring->deq_seg;
-                                        cur_trb != event_trb;
-                                        next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) {
-                                if ((cur_trb->generic.field[3] &
-                                 TRB_TYPE_BITMASK) != TRB_TYPE(TRB_TR_NOOP) &&
-                                    (cur_trb->generic.field[3] &
-                                 TRB_TYPE_BITMASK) != TRB_TYPE(TRB_LINK))
-                                        td->urb->actual_length +=
-                                                TRB_LEN(cur_trb->generic.field[2]);
-                        }
-                        /* If the ring didn't stop on a Link or No-op TRB, add
-                         * in the actual bytes transferred from the Normal TRB
+                if (event_seg) {
+                        event_trb = &event_seg->trbs[(event_dma -
+                                         event_seg->dma) / sizeof(*event_trb)];
+                        /*
+                         * No-op TRB should not trigger interrupts.
+                         * If event_trb is a no-op TRB, it means the
+                         * corresponding TD has been cancelled. Just ignore
+                         * the TD.
                          */
-                        if (trb_comp_code != COMP_STOP_INVAL)
-                                td->urb->actual_length +=
-                                        TRB_LEN(cur_trb->generic.field[2]) -
-                                        TRB_LEN(event->transfer_len);
+                        if ((event_trb->generic.field[3] & TRB_TYPE_BITMASK)
+                                         == TRB_TYPE(TRB_TR_NOOP)) {
+                                xhci_dbg(xhci, "event_trb is a no-op TRB. "
+                                                "Skip it\n");
+                                goto cleanup;
+                        }
                 }
-        }
-        if (trb_comp_code == COMP_STOP_INVAL ||
-                        trb_comp_code == COMP_STOP) {
-                /* The Endpoint Stop Command completion will take care of any
-                 * stopped TDs.  A stopped TD may be restarted, so don't update
-                 * the ring dequeue pointer or take this TD off any lists yet.
+
+                /* Now update the urb's actual_length and give back to
+                 * the core
                  */
-                ep->stopped_td = td;
-                ep->stopped_trb = event_trb;
-        } else {
-                if (trb_comp_code == COMP_STALL) {
-                        /* The transfer is completed from the driver's
-                         * perspective, but we need to issue a set dequeue
-                         * command for this stalled endpoint to move the dequeue
-                         * pointer past the TD.  We can't do that here because
-                         * the halt condition must be cleared first.  Let the
-                         * USB class driver clear the stall later.
-                         */
-                        ep->stopped_td = td;
-                        ep->stopped_trb = event_trb;
-                        ep->stopped_stream = ep_ring->stream_id;
-                } else if (xhci_requires_manual_halt_cleanup(xhci,
-                                        ep_ctx, trb_comp_code)) {
-                        /* Other types of errors halt the endpoint, but the
-                         * class driver doesn't call usb_reset_endpoint() unless
-                         * the error is -EPIPE.  Clear the halted status in the
-                         * xHCI hardware manually.
-                         */
-                        xhci_cleanup_halted_endpoint(xhci,
-                                        slot_id, ep_index, ep_ring->stream_id, td, event_trb);
-                } else {
-                        /* Update ring dequeue pointer */
-                        while (ep_ring->dequeue != td->last_trb)
-                                inc_deq(xhci, ep_ring, false);
-                        inc_deq(xhci, ep_ring, false);
-                }
+                if (usb_endpoint_xfer_control(&td->urb->ep->desc))
+                        ret = process_ctrl_td(xhci, td, event_trb, event, ep,
+                                                 &status);
+                else if (usb_endpoint_xfer_isoc(&td->urb->ep->desc))
+                        ret = process_isoc_td(xhci, td, event_trb, event, ep,
+                                                 &status);
+                else
+                        ret = process_bulk_intr_td(xhci, td, event_trb, event,
+                                                 ep, &status);
 
-td_cleanup:
-                /* Clean up the endpoint's TD list */
-                urb = td->urb;
-                /* Do one last check of the actual transfer length.
-                 * If the host controller said we transferred more data than
-                 * the buffer length, urb->actual_length will be a very big
-                 * number (since it's unsigned).  Play it safe and say we didn't
-                 * transfer anything.
+cleanup:
+                /*
+                 * Do not update event ring dequeue pointer if ep->skip is set.
+                 * Will roll back to continue process missed tds.
                  */
-                if (urb->actual_length > urb->transfer_buffer_length) {
-                        xhci_warn(xhci, "URB transfer length is wrong, "
-                                        "xHC issue? req. len = %u, "
-                                        "act. len = %u\n",
-                                        urb->transfer_buffer_length,
-                                        urb->actual_length);
-                        urb->actual_length = 0;
-                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-                                status = -EREMOTEIO;
-                        else
-                                status = 0;
+                if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+                        inc_deq(xhci, xhci->event_ring, true);
                 }
-                list_del(&td->td_list);
-                /* Was this TD slated to be cancelled but completed anyway? */
-                if (!list_empty(&td->cancelled_td_list))
-                        list_del(&td->cancelled_td_list);
 
-                /* Leave the TD around for the reset endpoint function to use
-                 * (but only if it's not a control endpoint, since we already
-                 * queued the Set TR dequeue pointer command for stalled
-                 * control endpoints).
-                 */
-                if (usb_endpoint_xfer_control(&urb->ep->desc) ||
-                        (trb_comp_code != COMP_STALL &&
-                                trb_comp_code != COMP_BABBLE)) {
-                        kfree(td);
+                if (ret) {
+                        urb = td->urb;
+                        urb_priv = urb->hcpriv;
+                        /* Leave the TD around for the reset endpoint function
+                         * to use(but only if it's not a control endpoint,
+                         * since we already queued the Set TR dequeue pointer
+                         * command for stalled control endpoints).
+                         */
+                        if (usb_endpoint_xfer_control(&urb->ep->desc) ||
+                                (trb_comp_code != COMP_STALL &&
+                                        trb_comp_code != COMP_BABBLE))
+                                xhci_urb_free_priv(xhci, urb_priv);
+
+                        usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
+                        xhci_dbg(xhci, "Giveback URB %p, len = %d, "
+                                        "status = %d\n",
+                                        urb, urb->actual_length, status);
+                        spin_unlock(&xhci->lock);
+                        usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);
+                        spin_lock(&xhci->lock);
                 }
-                urb->hcpriv = NULL;
-        }
-cleanup:
-        inc_deq(xhci, xhci->event_ring, true);
-        xhci_set_hc_event_deq(xhci);
 
-        /* FIXME for multi-TD URBs (who have buffers bigger than 64MB) */
-        if (urb) {
-                usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
-                xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",
-                                urb, urb->actual_length, status);
-                spin_unlock(&xhci->lock);
-                usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);
-                spin_lock(&xhci->lock);
-        }
+        /*
+         * If ep->skip is set, it means there are missed tds on the
+         * endpoint ring need to take care of.
+         * Process them as short transfer until reach the td pointed by
+         * the event.
+         */
+        } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+
         return 0;
 }
 
@@ -1652,7 +1935,7 @@ cleanup:
  * This function handles all OS-owned events on the event ring.  It may drop
  * xhci->lock between event processing (e.g. to pass up port status changes).
  */
-void xhci_handle_event(struct xhci_hcd *xhci)
+static void xhci_handle_event(struct xhci_hcd *xhci)
 {
         union xhci_trb *event;
         int update_ptrs = 1;
@@ -1710,15 +1993,130 @@ void xhci_handle_event(struct xhci_hcd *xhci)
                 return;
         }
 
-        if (update_ptrs) {
-                /* Update SW and HC event ring dequeue pointer */
+        if (update_ptrs)
+                /* Update SW event ring dequeue pointer */
                 inc_deq(xhci, xhci->event_ring, true);
-                xhci_set_hc_event_deq(xhci);
-        }
+
         /* Are there more items on the event ring? */
         xhci_handle_event(xhci);
 }
 
+/*
+ * xHCI spec says we can get an interrupt, and if the HC has an error condition,
+ * we might get bad data out of the event ring.  Section 4.10.2.7 has a list of
+ * indicators of an event TRB error, but we check the status *first* to be safe.
+ */
+irqreturn_t xhci_irq(struct usb_hcd *hcd)
+{
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        u32 status;
+        union xhci_trb *trb;
+        u64 temp_64;
+        union xhci_trb *event_ring_deq;
+        dma_addr_t deq;
+
+        spin_lock(&xhci->lock);
+        trb = xhci->event_ring->dequeue;
+        /* Check if the xHC generated the interrupt, or the irq is shared */
+        status = xhci_readl(xhci, &xhci->op_regs->status);
+        if (status == 0xffffffff)
+                goto hw_died;
+
+        if (!(status & STS_EINT)) {
+                spin_unlock(&xhci->lock);
+                xhci_warn(xhci, "Spurious interrupt.\n");
+                return IRQ_NONE;
+        }
+        xhci_dbg(xhci, "op reg status = %08x\n", status);
+        xhci_dbg(xhci, "Event ring dequeue ptr:\n");
+        xhci_dbg(xhci, "@%llx %08x %08x %08x %08x\n",
+                        (unsigned long long)
+                        xhci_trb_virt_to_dma(xhci->event_ring->deq_seg, trb),
+                        lower_32_bits(trb->link.segment_ptr),
+                        upper_32_bits(trb->link.segment_ptr),
+                        (unsigned int) trb->link.intr_target,
+                        (unsigned int) trb->link.control);
+
+        if (status & STS_FATAL) {
+                xhci_warn(xhci, "WARNING: Host System Error\n");
+                xhci_halt(xhci);
+hw_died:
+                xhci_to_hcd(xhci)->state = HC_STATE_HALT;
+                spin_unlock(&xhci->lock);
+                return -ESHUTDOWN;
+        }
+
+        /*
+         * Clear the op reg interrupt status first,
+         * so we can receive interrupts from other MSI-X interrupters.
+         * Write 1 to clear the interrupt status.
+         */
+        status |= STS_EINT;
+        xhci_writel(xhci, status, &xhci->op_regs->status);
+        /* FIXME when MSI-X is supported and there are multiple vectors */
+        /* Clear the MSI-X event interrupt status */
+
+        if (hcd->irq != -1) {
+                u32 irq_pending;
+                /* Acknowledge the PCI interrupt */
+                irq_pending = xhci_readl(xhci, &xhci->ir_set->irq_pending);
+                irq_pending |= 0x3;
+                xhci_writel(xhci, irq_pending, &xhci->ir_set->irq_pending);
+        }
+
+        if (xhci->xhc_state & XHCI_STATE_DYING) {
+                xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
+                                "Shouldn't IRQs be disabled?\n");
+                /* Clear the event handler busy flag (RW1C);
+                 * the event ring should be empty.
+                 */
+                temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+                xhci_write_64(xhci, temp_64 | ERST_EHB,
+                                &xhci->ir_set->erst_dequeue);
+                spin_unlock(&xhci->lock);
+
+                return IRQ_HANDLED;
+        }
+
+        event_ring_deq = xhci->event_ring->dequeue;
+        /* FIXME this should be a delayed service routine
+         * that clears the EHB.
+         */
+        xhci_handle_event(xhci);
+
+        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
+        /* If necessary, update the HW's version of the event ring deq ptr. */
+        if (event_ring_deq != xhci->event_ring->dequeue) {
+                deq = xhci_trb_virt_to_dma(xhci->event_ring->deq_seg,
+                                xhci->event_ring->dequeue);
+                if (deq == 0)
+                        xhci_warn(xhci, "WARN something wrong with SW event "
+                                        "ring dequeue ptr.\n");
+                /* Update HC event ring dequeue pointer */
+                temp_64 &= ERST_PTR_MASK;
+                temp_64 |= ((u64) deq & (u64) ~ERST_PTR_MASK);
+        }
+
+        /* Clear the event handler busy flag (RW1C); event ring is empty. */
+        temp_64 |= ERST_EHB;
+        xhci_write_64(xhci, temp_64, &xhci->ir_set->erst_dequeue);
+
+        spin_unlock(&xhci->lock);
+
+        return IRQ_HANDLED;
+}
+
+irqreturn_t xhci_msi_irq(int irq, struct usb_hcd *hcd)
+{
+        irqreturn_t ret;
+
+        set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);
+
+        ret = xhci_irq(hcd);
+
+        return ret;
+}
+
 /****           Endpoint Ring Operations        ****/
 
 /*
@@ -1827,10 +2225,12 @@ static int prepare_transfer(struct xhci_hcd *xhci,
                 unsigned int stream_id,
                 unsigned int num_trbs,
                 struct urb *urb,
-                struct xhci_td **td,
+                unsigned int td_index,
                 gfp_t mem_flags)
 {
         int ret;
+        struct urb_priv *urb_priv;
+        struct xhci_td  *td;
         struct xhci_ring *ep_ring;
         struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
 
@@ -1846,24 +2246,29 @@ static int prepare_transfer(struct xhci_hcd *xhci,
                         num_trbs, mem_flags);
         if (ret)
                 return ret;
-        *td = kzalloc(sizeof(struct xhci_td), mem_flags);
-        if (!*td)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&(*td)->td_list);
-        INIT_LIST_HEAD(&(*td)->cancelled_td_list);
 
-        ret = usb_hcd_link_urb_to_ep(xhci_to_hcd(xhci), urb);
-        if (unlikely(ret)) {
-                kfree(*td);
-                return ret;
+        urb_priv = urb->hcpriv;
+        td = urb_priv->td[td_index];
+
+        INIT_LIST_HEAD(&td->td_list);
+        INIT_LIST_HEAD(&td->cancelled_td_list);
+
+        if (td_index == 0) {
+                ret = usb_hcd_link_urb_to_ep(xhci_to_hcd(xhci), urb);
+                if (unlikely(ret)) {
+                        xhci_urb_free_priv(xhci, urb_priv);
+                        urb->hcpriv = NULL;
+                        return ret;
+                }
         }
 
-        (*td)->urb = urb;
-        urb->hcpriv = (void *) (*td);
+        td->urb = urb;
         /* Add this TD to the tail of the endpoint ring's TD list */
-        list_add_tail(&(*td)->td_list, &ep_ring->td_list);
-        (*td)->start_seg = ep_ring->enq_seg;
-        (*td)->first_trb = ep_ring->enqueue;
+        list_add_tail(&td->td_list, &ep_ring->td_list);
+        td->start_seg = ep_ring->enq_seg;
+        td->first_trb = ep_ring->enqueue;
+
+        urb_priv->td[td_index] = td;
 
         return 0;
 }
@@ -2002,6 +2407,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 {
         struct xhci_ring *ep_ring;
         unsigned int num_trbs;
+        struct urb_priv *urb_priv;
         struct xhci_td *td;
         struct scatterlist *sg;
         int num_sgs;
@@ -2022,9 +2428,13 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
                         ep_index, urb->stream_id,
-                        num_trbs, urb, &td, mem_flags);
+                        num_trbs, urb, 0, mem_flags);
         if (trb_buff_len < 0)
                 return trb_buff_len;
+
+        urb_priv = urb->hcpriv;
+        td = urb_priv->td[0];
+
         /*
          * Don't give the first TRB to the hardware (by toggling the cycle bit)
          * until we've finished creating all the other TRBs.  The ring's cycle
@@ -2145,6 +2555,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 struct urb *urb, int slot_id, unsigned int ep_index)
 {
         struct xhci_ring *ep_ring;
+        struct urb_priv *urb_priv;
         struct xhci_td *td;
         int num_trbs;
         struct xhci_generic_trb *start_trb;
@@ -2190,10 +2601,13 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         ret = prepare_transfer(xhci, xhci->devs[slot_id],
                         ep_index, urb->stream_id,
-                        num_trbs, urb, &td, mem_flags);
+                        num_trbs, urb, 0, mem_flags);
         if (ret < 0)
                 return ret;
 
+        urb_priv = urb->hcpriv;
+        td = urb_priv->td[0];
+
         /*
          * Don't give the first TRB to the hardware (by toggling the cycle bit)
          * until we've finished creating all the other TRBs.  The ring's cycle
@@ -2279,6 +2693,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         struct xhci_generic_trb *start_trb;
         int start_cycle;
         u32 field, length_field;
+        struct urb_priv *urb_priv;
         struct xhci_td *td;
 
         ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
@@ -2306,10 +2721,13 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 num_trbs++;
         ret = prepare_transfer(xhci, xhci->devs[slot_id],
                         ep_index, urb->stream_id,
-                        num_trbs, urb, &td, mem_flags);
+                        num_trbs, urb, 0, mem_flags);
         if (ret < 0)
                 return ret;
 
+        urb_priv = urb->hcpriv;
+        td = urb_priv->td[0];
+
         /*
          * Don't give the first TRB to the hardware (by toggling the cycle bit)
          * until we've finished creating all the other TRBs.  The ring's cycle
@@ -2366,6 +2784,224 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         return 0;
 }
 
+static int count_isoc_trbs_needed(struct xhci_hcd *xhci,
+                struct urb *urb, int i)
+{
+        int num_trbs = 0;
+        u64 addr, td_len, running_total;
+
+        addr = (u64) (urb->transfer_dma + urb->iso_frame_desc[i].offset);
+        td_len = urb->iso_frame_desc[i].length;
+
+        running_total = TRB_MAX_BUFF_SIZE -
+                        (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+        if (running_total != 0)
+                num_trbs++;
+
+        while (running_total < td_len) {
+                num_trbs++;
+                running_total += TRB_MAX_BUFF_SIZE;
+        }
+
+        return num_trbs;
+}
+
+/* This is for isoc transfer */
+static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+                struct urb *urb, int slot_id, unsigned int ep_index)
+{
+        struct xhci_ring *ep_ring;
+        struct urb_priv *urb_priv;
+        struct xhci_td *td;
+        int num_tds, trbs_per_td;
+        struct xhci_generic_trb *start_trb;
+        bool first_trb;
+        int start_cycle;
+        u32 field, length_field;
+        int running_total, trb_buff_len, td_len, td_remain_len, ret;
+        u64 start_addr, addr;
+        int i, j;
+
+        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
+
+        num_tds = urb->number_of_packets;
+        if (num_tds < 1) {
+                xhci_dbg(xhci, "Isoc URB with zero packets?\n");
+                return -EINVAL;
+        }
+
+        if (!in_interrupt())
+                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %#x (%d),"
+                                " addr = %#llx, num_tds = %d\n",
+                                urb->ep->desc.bEndpointAddress,
+                                urb->transfer_buffer_length,
+                                urb->transfer_buffer_length,
+                                (unsigned long long)urb->transfer_dma,
+                                num_tds);
+
+        start_addr = (u64) urb->transfer_dma;
+        start_trb = &ep_ring->enqueue->generic;
+        start_cycle = ep_ring->cycle_state;
+
+        /* Queue the first TRB, even if it's zero-length */
+        for (i = 0; i < num_tds; i++) {
+                first_trb = true;
+
+                running_total = 0;
+                addr = start_addr + urb->iso_frame_desc[i].offset;
+                td_len = urb->iso_frame_desc[i].length;
+                td_remain_len = td_len;
+
+                trbs_per_td = count_isoc_trbs_needed(xhci, urb, i);
+
+                ret = prepare_transfer(xhci, xhci->devs[slot_id], ep_index,
+                                urb->stream_id, trbs_per_td, urb, i, mem_flags);
+                if (ret < 0)
+                        return ret;
+
+                urb_priv = urb->hcpriv;
+                td = urb_priv->td[i];
+
+                for (j = 0; j < trbs_per_td; j++) {
+                        u32 remainder = 0;
+                        field = 0;
+
+                        if (first_trb) {
+                                /* Queue the isoc TRB */
+                                field |= TRB_TYPE(TRB_ISOC);
+                                /* Assume URB_ISO_ASAP is set */
+                                field |= TRB_SIA;
+                                if (i > 0)
+                                        field |= ep_ring->cycle_state;
+                                first_trb = false;
+                        } else {
+                                /* Queue other normal TRBs */
+                                field |= TRB_TYPE(TRB_NORMAL);
+                                field |= ep_ring->cycle_state;
+                        }
+
+                        /* Chain all the TRBs together; clear the chain bit in
+                         * the last TRB to indicate it's the last TRB in the
+                         * chain.
+                         */
+                        if (j < trbs_per_td - 1) {
+                                field |= TRB_CHAIN;
+                        } else {
+                                td->last_trb = ep_ring->enqueue;
+                                field |= TRB_IOC;
+                        }
+
+                        /* Calculate TRB length */
+                        trb_buff_len = TRB_MAX_BUFF_SIZE -
+                                (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+                        if (trb_buff_len > td_remain_len)
+                                trb_buff_len = td_remain_len;
+
+                        remainder = xhci_td_remainder(td_len - running_total);
+                        length_field = TRB_LEN(trb_buff_len) |
+                                remainder |
+                                TRB_INTR_TARGET(0);
+                        queue_trb(xhci, ep_ring, false, false,
+                                lower_32_bits(addr),
+                                upper_32_bits(addr),
+                                length_field,
+                                /* We always want to know if the TRB was short,
+                                 * or we won't get an event when it completes.
+                                 * (Unless we use event data TRBs, which are a
+                                 * waste of space and HC resources.)
+                                 */
+                                field | TRB_ISP);
+                        running_total += trb_buff_len;
+
+                        addr += trb_buff_len;
+                        td_remain_len -= trb_buff_len;
+                }
+
+                /* Check TD length */
+                if (running_total != td_len) {
+                        xhci_err(xhci, "ISOC TD length unmatch\n");
+                        return -EINVAL;
+                }
+        }
+
+        wmb();
+        start_trb->field[3] |= start_cycle;
+
+        ring_ep_doorbell(xhci, slot_id, ep_index, urb->stream_id);
+        return 0;
+}
+
+/*
+ * Check transfer ring to guarantee there is enough room for the urb.
+ * Update ISO URB start_frame and interval.
+ * Update interval as xhci_queue_intr_tx does. Just use xhci frame_index to
+ * update the urb->start_frame by now.
+ * Always assume URB_ISO_ASAP set, and NEVER use urb->start_frame as input.
+ */
+int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
+                struct urb *urb, int slot_id, unsigned int ep_index)
+{
+        struct xhci_virt_device *xdev;
+        struct xhci_ring *ep_ring;
+        struct xhci_ep_ctx *ep_ctx;
+        int start_frame;
+        int xhci_interval;
+        int ep_interval;
+        int num_tds, num_trbs, i;
+        int ret;
+
+        xdev = xhci->devs[slot_id];
+        ep_ring = xdev->eps[ep_index].ring;
+        ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
+
+        num_trbs = 0;
+        num_tds = urb->number_of_packets;
+        for (i = 0; i < num_tds; i++)
+                num_trbs += count_isoc_trbs_needed(xhci, urb, i);
+
+        /* Check the ring to guarantee there is enough room for the whole urb.
+         * Do not insert any td of the urb to the ring if the check failed.
+         */
+        ret = prepare_ring(xhci, ep_ring, ep_ctx->ep_info & EP_STATE_MASK,
+                                num_trbs, mem_flags);
+        if (ret)
+                return ret;
+
+        start_frame = xhci_readl(xhci, &xhci->run_regs->microframe_index);
+        start_frame &= 0x3fff;
+
+        urb->start_frame = start_frame;
+        if (urb->dev->speed == USB_SPEED_LOW ||
+                        urb->dev->speed == USB_SPEED_FULL)
+                urb->start_frame >>= 3;
+
+        xhci_interval = EP_INTERVAL_TO_UFRAMES(ep_ctx->ep_info);
+        ep_interval = urb->interval;
+        /* Convert to microframes */
+        if (urb->dev->speed == USB_SPEED_LOW ||
+                        urb->dev->speed == USB_SPEED_FULL)
+                ep_interval *= 8;
+        /* FIXME change this to a warning and a suggestion to use the new API
+         * to set the polling interval (once the API is added).
+         */
+        if (xhci_interval != ep_interval) {
+                if (!printk_ratelimit())
+                        dev_dbg(&urb->dev->dev, "Driver uses different interval"
+                                        " (%d microframe%s) than xHCI "
+                                        "(%d microframe%s)\n",
+                                        ep_interval,
+                                        ep_interval == 1 ? "" : "s",
+                                        xhci_interval,
+                                        xhci_interval == 1 ? "" : "s");
+                urb->interval = xhci_interval;
+                /* Convert back to frames for LS/FS devices */
+                if (urb->dev->speed == USB_SPEED_LOW ||
+                                urb->dev->speed == USB_SPEED_FULL)
+                        urb->interval /= 8;
+        }
+        return xhci_queue_isoc_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
+}
+
 /****           Command Ring Operations         ****/
 
 /* Generic function for queueing a command TRB on the command ring.
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 3998f72cd0c4..d5c550ea3e68 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -20,6 +20,7 @@
  * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/pci.h>
 #include <linux/irq.h>
 #include <linux/log2.h>
 #include <linux/module.h>
@@ -171,22 +172,84 @@ int xhci_reset(struct xhci_hcd *xhci)
         return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
 }
 
+/*
+ * Free IRQs
+ * free all IRQs request
+ */
+static void xhci_free_irq(struct xhci_hcd *xhci)
+{
+        int i;
+        struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
 
-#if 0
-/* Set up MSI-X table for entry 0 (may claim other entries later) */
-static int xhci_setup_msix(struct xhci_hcd *xhci)
+        /* return if using legacy interrupt */
+        if (xhci_to_hcd(xhci)->irq >= 0)
+                return;
+
+        if (xhci->msix_entries) {
+                for (i = 0; i < xhci->msix_count; i++)
+                        if (xhci->msix_entries[i].vector)
+                                free_irq(xhci->msix_entries[i].vector,
+                                                xhci_to_hcd(xhci));
+        } else if (pdev->irq >= 0)
+                free_irq(pdev->irq, xhci_to_hcd(xhci));
+
+        return;
+}
+
+/*
+ * Set up MSI
+ */
+static int xhci_setup_msi(struct xhci_hcd *xhci)
 {
         int ret;
+        struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+
+        ret = pci_enable_msi(pdev);
+        if (ret) {
+                xhci_err(xhci, "failed to allocate MSI entry\n");
+                return ret;
+        }
+
+        ret = request_irq(pdev->irq, (irq_handler_t)xhci_msi_irq,
+                                0, "xhci_hcd", xhci_to_hcd(xhci));
+        if (ret) {
+                xhci_err(xhci, "disable MSI interrupt\n");
+                pci_disable_msi(pdev);
+        }
+
+        return ret;
+}
+
+/*
+ * Set up MSI-X
+ */
+static int xhci_setup_msix(struct xhci_hcd *xhci)
+{
+        int i, ret = 0;
         struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
 
-        xhci->msix_count = 0;
-        /* XXX: did I do this right?  ixgbe does kcalloc for more than one */
-        xhci->msix_entries = kmalloc(sizeof(struct msix_entry), GFP_KERNEL);
+        /*
+         * calculate number of msi-x vectors supported.
+         * - HCS_MAX_INTRS: the max number of interrupts the host can handle,
+         *   with max number of interrupters based on the xhci HCSPARAMS1.
+         * - num_online_cpus: maximum msi-x vectors per CPUs core.
+         *   Add additional 1 vector to ensure always available interrupt.
+         */
+        xhci->msix_count = min(num_online_cpus() + 1,
+                                HCS_MAX_INTRS(xhci->hcs_params1));
+
+        xhci->msix_entries =
+                kmalloc((sizeof(struct msix_entry))*xhci->msix_count,
+                                GFP_KERNEL);
         if (!xhci->msix_entries) {
                 xhci_err(xhci, "Failed to allocate MSI-X entries\n");
                 return -ENOMEM;
         }
-        xhci->msix_entries[0].entry = 0;
+
+        for (i = 0; i < xhci->msix_count; i++) {
+                xhci->msix_entries[i].entry = i;
+                xhci->msix_entries[i].vector = 0;
+        }
 
         ret = pci_enable_msix(pdev, xhci->msix_entries, xhci->msix_count);
         if (ret) {
@@ -194,20 +257,19 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
                 goto free_entries;
         }
 
-        /*
-         * Pass the xhci pointer value as the request_irq "cookie".
-         * If more irqs are added, this will need to be unique for each one.
-         */
-        ret = request_irq(xhci->msix_entries[0].vector, &xhci_irq, 0,
-                        "xHCI", xhci_to_hcd(xhci));
-        if (ret) {
-                xhci_err(xhci, "Failed to allocate MSI-X interrupt\n");
-                goto disable_msix;
+        for (i = 0; i < xhci->msix_count; i++) {
+                ret = request_irq(xhci->msix_entries[i].vector,
+                                (irq_handler_t)xhci_msi_irq,
+                                0, "xhci_hcd", xhci_to_hcd(xhci));
+                if (ret)
+                        goto disable_msix;
         }
-        xhci_dbg(xhci, "Finished setting up MSI-X\n");
-        return 0;
+
+        return ret;
 
 disable_msix:
+        xhci_err(xhci, "disable MSI-X interrupt\n");
+        xhci_free_irq(xhci);
         pci_disable_msix(pdev);
 free_entries:
         kfree(xhci->msix_entries);
@@ -215,21 +277,23 @@ free_entries:
         return ret;
 }
 
-/* XXX: code duplication; can xhci_setup_msix call this? */
 /* Free any IRQs and disable MSI-X */
 static void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
         struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
-        if (!xhci->msix_entries)
-                return;
 
-        free_irq(xhci->msix_entries[0].vector, xhci);
-        pci_disable_msix(pdev);
-        kfree(xhci->msix_entries);
-        xhci->msix_entries = NULL;
-        xhci_dbg(xhci, "Finished cleaning up MSI-X\n");
+        xhci_free_irq(xhci);
+
+        if (xhci->msix_entries) {
+                pci_disable_msix(pdev);
+                kfree(xhci->msix_entries);
+                xhci->msix_entries = NULL;
+        } else {
+                pci_disable_msi(pdev);
+        }
+
+        return;
 }
-#endif
 
 /*
  * Initialize memory for HCD and xHC (one-time init).
@@ -257,100 +321,8 @@ int xhci_init(struct usb_hcd *hcd)
         return retval;
 }
 
-/*
- * Called in interrupt context when there might be work
- * queued on the event ring
- *
- * xhci->lock must be held by caller.
- */
-static void xhci_work(struct xhci_hcd *xhci)
-{
-        u32 temp;
-        u64 temp_64;
-
-        /*
-         * Clear the op reg interrupt status first,
-         * so we can receive interrupts from other MSI-X interrupters.
-         * Write 1 to clear the interrupt status.
-         */
-        temp = xhci_readl(xhci, &xhci->op_regs->status);
-        temp |= STS_EINT;
-        xhci_writel(xhci, temp, &xhci->op_regs->status);
-        /* FIXME when MSI-X is supported and there are multiple vectors */
-        /* Clear the MSI-X event interrupt status */
-
-        /* Acknowledge the interrupt */
-        temp = xhci_readl(xhci, &xhci->ir_set->irq_pending);
-        temp |= 0x3;
-        xhci_writel(xhci, temp, &xhci->ir_set->irq_pending);
-        /* Flush posted writes */
-        xhci_readl(xhci, &xhci->ir_set->irq_pending);
-
-        if (xhci->xhc_state & XHCI_STATE_DYING)
-                xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
-                                "Shouldn't IRQs be disabled?\n");
-        else
-                /* FIXME this should be a delayed service routine
-                 * that clears the EHB.
-                 */
-                xhci_handle_event(xhci);
-
-        /* Clear the event handler busy flag (RW1C); the event ring should be empty. */
-        temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
-        xhci_write_64(xhci, temp_64 | ERST_EHB, &xhci->ir_set->erst_dequeue);
-        /* Flush posted writes -- FIXME is this necessary? */
-        xhci_readl(xhci, &xhci->ir_set->irq_pending);
-}
-
 /*-------------------------------------------------------------------------*/
 
-/*
- * xHCI spec says we can get an interrupt, and if the HC has an error condition,
- * we might get bad data out of the event ring.  Section 4.10.2.7 has a list of
- * indicators of an event TRB error, but we check the status *first* to be safe.
- */
-irqreturn_t xhci_irq(struct usb_hcd *hcd)
-{
-        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-        u32 temp, temp2;
-        union xhci_trb *trb;
-
-        spin_lock(&xhci->lock);
-        trb = xhci->event_ring->dequeue;
-        /* Check if the xHC generated the interrupt, or the irq is shared */
-        temp = xhci_readl(xhci, &xhci->op_regs->status);
-        temp2 = xhci_readl(xhci, &xhci->ir_set->irq_pending);
-        if (temp == 0xffffffff && temp2 == 0xffffffff)
-                goto hw_died;
-
-        if (!(temp & STS_EINT) && !ER_IRQ_PENDING(temp2)) {
-                spin_unlock(&xhci->lock);
-                return IRQ_NONE;
-        }
-        xhci_dbg(xhci, "op reg status = %08x\n", temp);
-        xhci_dbg(xhci, "ir set irq_pending = %08x\n", temp2);
-        xhci_dbg(xhci, "Event ring dequeue ptr:\n");
-        xhci_dbg(xhci, "@%llx %08x %08x %08x %08x\n",
-                        (unsigned long long)xhci_trb_virt_to_dma(xhci->event_ring->deq_seg, trb),
-                        lower_32_bits(trb->link.segment_ptr),
-                        upper_32_bits(trb->link.segment_ptr),
-                        (unsigned int) trb->link.intr_target,
-                        (unsigned int) trb->link.control);
-
-        if (temp & STS_FATAL) {
-                xhci_warn(xhci, "WARNING: Host System Error\n");
-                xhci_halt(xhci);
-hw_died:
-                xhci_to_hcd(xhci)->state = HC_STATE_HALT;
-                spin_unlock(&xhci->lock);
-                return -ESHUTDOWN;
-        }
-
-        xhci_work(xhci);
-        spin_unlock(&xhci->lock);
-
-        return IRQ_HANDLED;
-}
 
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
 void xhci_event_ring_work(unsigned long arg)
@@ -423,21 +395,36 @@ int xhci_run(struct usb_hcd *hcd)
 {
         u32 temp;
         u64 temp_64;
+        u32 ret;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
         void (*doorbell)(struct xhci_hcd *) = NULL;
 
         hcd->uses_new_polling = 1;
-        hcd->poll_rh = 0;
 
         xhci_dbg(xhci, "xhci_run\n");
-#if 0   /* FIXME: MSI not setup yet */
-        /* Do this at the very last minute */
+        /* unregister the legacy interrupt */
+        if (hcd->irq)
+                free_irq(hcd->irq, hcd);
+        hcd->irq = -1;
+
         ret = xhci_setup_msix(xhci);
-        if (!ret)
-                return ret;
+        if (ret)
+                /* fall back to msi*/
+                ret = xhci_setup_msi(xhci);
+
+        if (ret) {
+                /* fall back to legacy interrupt*/
+                ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+                                        hcd->irq_descr, hcd);
+                if (ret) {
+                        xhci_err(xhci, "request interrupt %d failed\n",
+                                        pdev->irq);
+                        return ret;
+                }
+                hcd->irq = pdev->irq;
+        }
 
-        return -ENOSYS;
-#endif
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
         init_timer(&xhci->event_ring_timer);
         xhci->event_ring_timer.data = (unsigned long) xhci;
@@ -495,7 +482,6 @@ int xhci_run(struct usb_hcd *hcd)
                 return -ENODEV;
         }
 
-        xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp);
         if (doorbell)
                 (*doorbell)(xhci);
         if (xhci->quirks & XHCI_NEC_HOST)
@@ -522,11 +508,9 @@ void xhci_stop(struct usb_hcd *hcd)
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
         xhci_reset(xhci);
+        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
-#if 0   /* No MSI yet */
-        xhci_cleanup_msix(xhci);
-#endif
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
         /* Tell the event ring poll function not to reschedule */
         xhci->zombie = 1;
@@ -560,11 +544,8 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
-        spin_unlock_irq(&xhci->lock);
-
-#if 0
         xhci_cleanup_msix(xhci);
-#endif
+        spin_unlock_irq(&xhci->lock);
 
         xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
                     xhci_readl(xhci, &xhci->op_regs->status));
@@ -720,7 +701,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
         unsigned long flags;
         int ret = 0;
         unsigned int slot_id, ep_index;
-
+        struct urb_priv *urb_priv;
+        int size, i;
 
         if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, true, __func__) <= 0)
                 return -EINVAL;
@@ -734,12 +716,36 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 ret = -EINVAL;
                 goto exit;
         }
-        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+        if (!HCD_HW_ACCESSIBLE(hcd)) {
                 if (!in_interrupt())
                         xhci_dbg(xhci, "urb submitted during PCI suspend\n");
                 ret = -ESHUTDOWN;
                 goto exit;
         }
+
+        if (usb_endpoint_xfer_isoc(&urb->ep->desc))
+                size = urb->number_of_packets;
+        else
+                size = 1;
+
+        urb_priv = kzalloc(sizeof(struct urb_priv) +
+                                  size * sizeof(struct xhci_td *), mem_flags);
+        if (!urb_priv)
+                return -ENOMEM;
+
+        for (i = 0; i < size; i++) {
+                urb_priv->td[i] = kzalloc(sizeof(struct xhci_td), mem_flags);
+                if (!urb_priv->td[i]) {
+                        urb_priv->length = i;
+                        xhci_urb_free_priv(xhci, urb_priv);
+                        return -ENOMEM;
+                }
+        }
+
+        urb_priv->length = size;
+        urb_priv->td_cnt = 0;
+        urb->hcpriv = urb_priv;
+
         if (usb_endpoint_xfer_control(&urb->ep->desc)) {
                 /* Check to see if the max packet size for the default control
                  * endpoint changed during FS device enumeration
@@ -788,11 +794,18 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                                 slot_id, ep_index);
                 spin_unlock_irqrestore(&xhci->lock, flags);
         } else {
-                ret = -EINVAL;
+                spin_lock_irqsave(&xhci->lock, flags);
+                if (xhci->xhc_state & XHCI_STATE_DYING)
+                        goto dying;
+                ret = xhci_queue_isoc_tx_prepare(xhci, GFP_ATOMIC, urb,
+                                slot_id, ep_index);
+                spin_unlock_irqrestore(&xhci->lock, flags);
         }
 exit:
         return ret;
 dying:
+        xhci_urb_free_priv(xhci, urb_priv);
+        urb->hcpriv = NULL;
         xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for "
                         "non-responsive xHCI host.\n",
                         urb->ep->desc.bEndpointAddress, urb);
@@ -800,6 +813,47 @@ dying:
         return -ESHUTDOWN;
 }
 
+/* Get the right ring for the given URB.
+ * If the endpoint supports streams, boundary check the URB's stream ID.
+ * If the endpoint doesn't support streams, return the singular endpoint ring.
+ */
+static struct xhci_ring *xhci_urb_to_transfer_ring(struct xhci_hcd *xhci,
+                struct urb *urb)
+{
+        unsigned int slot_id;
+        unsigned int ep_index;
+        unsigned int stream_id;
+        struct xhci_virt_ep *ep;
+
+        slot_id = urb->dev->slot_id;
+        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+        stream_id = urb->stream_id;
+        ep = &xhci->devs[slot_id]->eps[ep_index];
+        /* Common case: no streams */
+        if (!(ep->ep_state & EP_HAS_STREAMS))
+                return ep->ring;
+
+        if (stream_id == 0) {
+                xhci_warn(xhci,
+                                "WARN: Slot ID %u, ep index %u has streams, "
+                                "but URB has no stream ID.\n",
+                                slot_id, ep_index);
+                return NULL;
+        }
+
+        if (stream_id < ep->stream_info->num_streams)
+                return ep->stream_info->stream_rings[stream_id];
+
+        xhci_warn(xhci,
+                        "WARN: Slot ID %u, ep index %u has "
+                        "stream IDs 1 to %u allocated, "
+                        "but stream ID %u is requested.\n",
+                        slot_id, ep_index,
+                        ep->stream_info->num_streams - 1,
+                        stream_id);
+        return NULL;
+}
+
 /*
  * Remove the URB's TD from the endpoint ring.  This may cause the HC to stop
  * USB transfers, potentially stopping in the middle of a TRB buffer.  The HC
@@ -834,9 +888,10 @@ dying:
 int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
         unsigned long flags;
-        int ret;
+        int ret, i;
         u32 temp;
         struct xhci_hcd *xhci;
+        struct urb_priv *urb_priv;
         struct xhci_td *td;
         unsigned int ep_index;
         struct xhci_ring *ep_ring;
@@ -851,12 +906,12 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         if (temp == 0xffffffff) {
                 xhci_dbg(xhci, "HW died, freeing TD.\n");
-                td = (struct xhci_td *) urb->hcpriv;
+                urb_priv = urb->hcpriv;
 
                 usb_hcd_unlink_urb_from_ep(hcd, urb);
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, -ESHUTDOWN);
-                kfree(td);
+                xhci_urb_free_priv(xhci, urb_priv);
                 return ret;
         }
         if (xhci->xhc_state & XHCI_STATE_DYING) {
@@ -884,9 +939,14 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
         xhci_dbg(xhci, "Endpoint ring:\n");
         xhci_debug_ring(xhci, ep_ring);
-        td = (struct xhci_td *) urb->hcpriv;
 
-        list_add_tail(&td->cancelled_td_list, &ep->cancelled_td_list);
+        urb_priv = urb->hcpriv;
+
+        for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
+                td = urb_priv->td[i];
+                list_add_tail(&td->cancelled_td_list, &ep->cancelled_td_list);
+        }
+
         /* Queue a stop endpoint command, but only if this is
          * the first cancellation to be handled.
          */
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 6c7e3430ec93..34a60d9f056a 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -720,6 +720,14 @@ struct xhci_virt_ep {
         struct timer_list       stop_cmd_timer;
         int                     stop_cmds_pending;
         struct xhci_hcd         *xhci;
+        /*
+         * Sometimes the xHC can not process isochronous endpoint ring quickly
+         * enough, and it will miss some isoc tds on the ring and generate
+         * a Missed Service Error Event.
+         * Set skip flag when receive a Missed Service Error Event and
+         * process the missed tds on the endpoint ring.
+         */
+        bool                    skip;
 };
 
 struct xhci_virt_device {
@@ -911,6 +919,9 @@ struct xhci_event_cmd {
 /* Control transfer TRB specific fields */
 #define TRB_DIR_IN              (1<<16)
 
+/* Isochronous TRB specific fields */
+#define TRB_SIA                 (1<<31)
+
 struct xhci_generic_trb {
         u32 field[4];
 };
@@ -1082,6 +1093,12 @@ struct xhci_scratchpad {
         dma_addr_t *sp_dma_buffers;
 };
 
+struct urb_priv {
+        int     length;
+        int     td_cnt;
+        struct  xhci_td *td[0];
+};
+
 /*
  * Each segment table entry is 4*32bits long.  1K seems like an ok size:
  * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
@@ -1130,7 +1147,7 @@ struct xhci_hcd {
         int             page_size;
         /* Valid values are 12 to 20, inclusive */
         int             page_shift;
-        /* only one MSI vector for now, but might need more later */
+        /* msi-x vectors */
         int             msix_count;
         struct msix_entry       *msix_entries;
         /* data structures */
@@ -1327,11 +1344,6 @@ void xhci_setup_no_streams_ep_input_ctx(struct xhci_hcd *xhci,
 struct xhci_ring *xhci_dma_to_transfer_ring(
                 struct xhci_virt_ep *ep,
                 u64 address);
-struct xhci_ring *xhci_urb_to_transfer_ring(struct xhci_hcd *xhci,
-                struct urb *urb);
-struct xhci_ring *xhci_triad_to_transfer_ring(struct xhci_hcd *xhci,
-                unsigned int slot_id, unsigned int ep_index,
-                unsigned int stream_id);
 struct xhci_ring *xhci_stream_id_to_ring(
                 struct xhci_virt_device *dev,
                 unsigned int ep_index,
@@ -1339,6 +1351,7 @@ struct xhci_ring *xhci_stream_id_to_ring(
 struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
                 bool allocate_in_ctx, bool allocate_completion,
                 gfp_t mem_flags);
+void xhci_urb_free_priv(struct xhci_hcd *xhci, struct urb_priv *urb_priv);
 void xhci_free_command(struct xhci_hcd *xhci,
                 struct xhci_command *command);
 
@@ -1358,6 +1371,7 @@ void xhci_stop(struct usb_hcd *hcd);
 void xhci_shutdown(struct usb_hcd *hcd);
 int xhci_get_frame(struct usb_hcd *hcd);
 irqreturn_t xhci_irq(struct usb_hcd *hcd);
+irqreturn_t xhci_msi_irq(int irq, struct usb_hcd *hcd);
 int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev);
 void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev);
 int xhci_alloc_streams(struct usb_hcd *hcd, struct usb_device *udev,
@@ -1386,8 +1400,6 @@ struct xhci_segment *trb_in_td(struct xhci_segment *start_seg,
 int xhci_is_vendor_info_code(struct xhci_hcd *xhci, unsigned int trb_comp_code);
 void xhci_ring_cmd_db(struct xhci_hcd *xhci);
 void *xhci_setup_one_noop(struct xhci_hcd *xhci);
-void xhci_handle_event(struct xhci_hcd *xhci);
-void xhci_set_hc_event_deq(struct xhci_hcd *xhci);
 int xhci_queue_slot_control(struct xhci_hcd *xhci, u32 trb_type, u32 slot_id);
 int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id);
@@ -1401,6 +1413,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
                 int slot_id, unsigned int ep_index);
 int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
                 int slot_id, unsigned int ep_index);
+int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
+                struct urb *urb, int slot_id, unsigned int ep_index);
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id, bool command_must_succeed);
 int xhci_queue_evaluate_context(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index 82e16630a78b..aecf380f6ecc 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -650,7 +650,7 @@ static int ftdi_elan_open(struct inode *inode, struct file *file)
 
 static int ftdi_elan_release(struct inode *inode, struct file *file)
 {
-        struct usb_ftdi *ftdi = (struct usb_ftdi *)file->private_data;
+        struct usb_ftdi *ftdi = file->private_data;
         if (ftdi == NULL)
                 return -ENODEV;
         up(&ftdi->sw_lock);        /* decrement the count on our device */
@@ -673,7 +673,7 @@ static ssize_t ftdi_elan_read(struct file *file, char __user *buffer,
         int bytes_read = 0;
         int retry_on_empty = 10;
         int retry_on_timeout = 5;
-        struct usb_ftdi *ftdi = (struct usb_ftdi *)file->private_data;
+        struct usb_ftdi *ftdi = file->private_data;
         if (ftdi->disconnected > 0) {
                 return -ENODEV;
         }
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 7dc9d3c69984..2de49c8887c5 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -18,7 +18,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/poll.h>
 #include <linux/usb/iowarrior.h>
 
@@ -61,6 +61,7 @@ MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
 /* Module parameters */
+static DEFINE_MUTEX(iowarrior_mutex);
 static int debug = 0;
 module_param(debug, bool, 0644);
 MODULE_PARM_DESC(debug, "debug=1 enables debugging messages");
@@ -282,7 +283,7 @@ static ssize_t iowarrior_read(struct file *file, char __user *buffer,
         int read_idx;
         int offset;
 
-        dev = (struct iowarrior *)file->private_data;
+        dev = file->private_data;
 
         /* verify that the device wasn't unplugged */
         if (dev == NULL || !dev->present)
@@ -348,7 +349,7 @@ static ssize_t iowarrior_write(struct file *file,
         char *buf = NULL;       /* for IOW24 and IOW56 we need a buffer */
         struct urb *int_out_urb = NULL;
 
-        dev = (struct iowarrior *)file->private_data;
+        dev = file->private_data;
 
         mutex_lock(&dev->mutex);
         /* verify that the device wasn't unplugged */
@@ -483,7 +484,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
         int retval;
         int io_res;             /* checks for bytes read/written and copy_to/from_user results */
 
-        dev = (struct iowarrior *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL) {
                 return -ENODEV;
         }
@@ -493,7 +494,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                 return -ENOMEM;
 
         /* lock this object */
-        lock_kernel();
+        mutex_lock(&iowarrior_mutex);
         mutex_lock(&dev->mutex);
 
         /* verify that the device wasn't unplugged */
@@ -585,7 +586,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
 error_out:
         /* unlock the device */
         mutex_unlock(&dev->mutex);
-        unlock_kernel();
+        mutex_unlock(&iowarrior_mutex);
         kfree(buffer);
         return retval;
 }
@@ -602,12 +603,12 @@ static int iowarrior_open(struct inode *inode, struct file *file)
 
         dbg("%s", __func__);
 
-        lock_kernel();
+        mutex_lock(&iowarrior_mutex);
         subminor = iminor(inode);
 
         interface = usb_find_interface(&iowarrior_driver, subminor);
         if (!interface) {
-                unlock_kernel();
+                mutex_unlock(&iowarrior_mutex);
                 err("%s - error, can't find device for minor %d", __func__,
                     subminor);
                 return -ENODEV;
@@ -617,7 +618,7 @@ static int iowarrior_open(struct inode *inode, struct file *file)
         dev = usb_get_intfdata(interface);
         if (!dev) {
                 mutex_unlock(&iowarrior_open_disc_lock);
-                unlock_kernel();
+                mutex_unlock(&iowarrior_mutex);
                 return -ENODEV;
         }
 
@@ -644,7 +645,7 @@ static int iowarrior_open(struct inode *inode, struct file *file)
 
 out:
         mutex_unlock(&dev->mutex);
-        unlock_kernel();
+        mutex_unlock(&iowarrior_mutex);
         return retval;
 }
 
@@ -656,7 +657,7 @@ static int iowarrior_release(struct inode *inode, struct file *file)
         struct iowarrior *dev;
         int retval = 0;
 
-        dev = (struct iowarrior *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL) {
                 return -ENODEV;
         }
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index 8547bf9e3175..6482c6e2e6bd 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -448,7 +448,7 @@ static int tower_release (struct inode *inode, struct file *file)
 
         dbg(2, "%s: enter", __func__);
 
-        dev = (struct lego_usb_tower *)file->private_data;
+        dev = file->private_data;
 
         if (dev == NULL) {
                 dbg(1, "%s: object is NULL", __func__);
@@ -597,7 +597,7 @@ static ssize_t tower_read (struct file *file, char __user *buffer, size_t count,
 
         dbg(2, "%s: enter, count = %Zd", __func__, count);
 
-        dev = (struct lego_usb_tower *)file->private_data;
+        dev = file->private_data;
 
         /* lock this object */
         if (mutex_lock_interruptible(&dev->lock)) {
@@ -686,7 +686,7 @@ static ssize_t tower_write (struct file *file, const char __user *buffer, size_t
 
         dbg(2, "%s: enter, count = %Zd", __func__, count);
 
-        dev = (struct lego_usb_tower *)file->private_data;
+        dev = file->private_data;
 
         /* lock this object */
         if (mutex_lock_interruptible(&dev->lock)) {
diff --git a/drivers/usb/misc/rio500.c b/drivers/usb/misc/rio500.c
index a85771b1563d..cc13ae61712a 100644
--- a/drivers/usb/misc/rio500.c
+++ b/drivers/usb/misc/rio500.c
@@ -32,7 +32,7 @@
 #include <linux/kernel.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
+#include <linux/mutex.h>
 #include <linux/errno.h>
 #include <linux/random.h>
 #include <linux/poll.h>
@@ -72,6 +72,7 @@ struct rio_usb_data {
         struct mutex lock;          /* general race avoidance */
 };
 
+static DEFINE_MUTEX(rio500_mutex);
 static struct rio_usb_data rio_instance;
 
 static int open_rio(struct inode *inode, struct file *file)
@@ -79,12 +80,12 @@ static int open_rio(struct inode *inode, struct file *file)
         struct rio_usb_data *rio = &rio_instance;
 
         /* against disconnect() */
-        lock_kernel();
+        mutex_lock(&rio500_mutex);
         mutex_lock(&(rio->lock));
 
         if (rio->isopen || !rio->present) {
                 mutex_unlock(&(rio->lock));
-                unlock_kernel();
+                mutex_unlock(&rio500_mutex);
                 return -EBUSY;
         }
         rio->isopen = 1;
@@ -94,7 +95,7 @@ static int open_rio(struct inode *inode, struct file *file)
         mutex_unlock(&(rio->lock));
 
         dev_info(&rio->rio_dev->dev, "Rio opened.\n");
-        unlock_kernel();
+        mutex_unlock(&rio500_mutex);
 
         return 0;
 }
@@ -491,7 +492,7 @@ static void disconnect_rio(struct usb_interface *intf)
         struct rio_usb_data *rio = usb_get_intfdata (intf);
 
         usb_set_intfdata (intf, NULL);
-        lock_kernel();
+        mutex_lock(&rio500_mutex);
         if (rio) {
                 usb_deregister_dev(intf, &usb_rio_class);
 
@@ -501,7 +502,7 @@ static void disconnect_rio(struct usb_interface *intf)
                         /* better let it finish - the release will do whats needed */
                         rio->rio_dev = NULL;
                         mutex_unlock(&(rio->lock));
-                        unlock_kernel();
+                        mutex_unlock(&rio500_mutex);
                         return;
                 }
                 kfree(rio->ibuf);
@@ -512,7 +513,7 @@ static void disconnect_rio(struct usb_interface *intf)
                 rio->present = 0;
                 mutex_unlock(&(rio->lock));
         }
-        unlock_kernel();
+        mutex_unlock(&rio500_mutex);
 }
 
 static const struct usb_device_id rio_table[] = {
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index d25814c172b2..70d00e99a4b4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -2487,7 +2487,7 @@ sisusb_release(struct inode *inode, struct file *file)
 {
         struct sisusb_usb_data *sisusb;
 
-        if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
+        if (!(sisusb = file->private_data))
                 return -ENODEV;
 
         mutex_lock(&sisusb->lock);
@@ -2519,7 +2519,7 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
         u16 buf16;
         u32 buf32, address;
 
-        if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
+        if (!(sisusb = file->private_data))
                 return -ENODEV;
 
         mutex_lock(&sisusb->lock);
@@ -2661,7 +2661,7 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
         u16 buf16;
         u32 buf32, address;
 
-        if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
+        if (!(sisusb = file->private_data))
                 return -ENODEV;
 
         mutex_lock(&sisusb->lock);
@@ -2804,7 +2804,7 @@ sisusb_lseek(struct file *file, loff_t offset, int orig)
         struct sisusb_usb_data *sisusb;
         loff_t ret;
 
-        if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
+        if (!(sisusb = file->private_data))
                 return -ENODEV;
 
         mutex_lock(&sisusb->lock);
@@ -2969,7 +2969,7 @@ sisusb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         long retval = 0;
         u32 __user *argp = (u32 __user *)arg;
 
-        if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
+        if (!(sisusb = file->private_data))
                 return -ENODEV;
 
         mutex_lock(&sisusb->lock);
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index 7828c764b323..d00dde19194c 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
@@ -30,6 +29,7 @@
 #define IOCTL_GET_DRV_VERSION   2
 
 
+static DEFINE_MUTEX(lcd_mutex);
 static const struct usb_device_id id_table[] = {
         { .idVendor = 0x10D2, .match_flags = USB_DEVICE_ID_MATCH_VENDOR, },
         { },
@@ -74,12 +74,12 @@ static int lcd_open(struct inode *inode, struct file *file)
         struct usb_interface *interface;
         int subminor, r;
 
-        lock_kernel();
+        mutex_lock(&lcd_mutex);
         subminor = iminor(inode);
 
         interface = usb_find_interface(&lcd_driver, subminor);
         if (!interface) {
-                unlock_kernel();
+                mutex_unlock(&lcd_mutex);
                 err ("USBLCD: %s - error, can't find device for minor %d",
                      __func__, subminor);
                 return -ENODEV;
@@ -89,7 +89,7 @@ static int lcd_open(struct inode *inode, struct file *file)
         dev = usb_get_intfdata(interface);
         if (!dev) {
                 mutex_unlock(&open_disc_mutex);
-                unlock_kernel();
+                mutex_unlock(&lcd_mutex);
                 return -ENODEV;
         }
 
@@ -101,13 +101,13 @@ static int lcd_open(struct inode *inode, struct file *file)
         r = usb_autopm_get_interface(interface);
         if (r < 0) {
                 kref_put(&dev->kref, lcd_delete);
-                unlock_kernel();
+                mutex_unlock(&lcd_mutex);
                 return r;
         }
 
         /* save our object in the file's private structure */
         file->private_data = dev;
-        unlock_kernel();
+        mutex_unlock(&lcd_mutex);
 
         return 0;
 }
@@ -116,7 +116,7 @@ static int lcd_release(struct inode *inode, struct file *file)
 {
         struct usb_lcd *dev;
 
-        dev = (struct usb_lcd *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL)
                 return -ENODEV;
 
@@ -132,7 +132,7 @@ static ssize_t lcd_read(struct file *file, char __user * buffer, size_t count, l
         int retval = 0;
         int bytes_read;
 
-        dev = (struct usb_lcd *)file->private_data;
+        dev = file->private_data;
 
         /* do a blocking bulk read to get data from the device */
         retval = usb_bulk_msg(dev->udev, 
@@ -158,20 +158,20 @@ static long lcd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         u16 bcdDevice;
         char buf[30];
 
-        dev = (struct usb_lcd *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL)
                 return -ENODEV;
         
         switch (cmd) {
         case IOCTL_GET_HARD_VERSION:
-                lock_kernel();
+                mutex_lock(&lcd_mutex);
                 bcdDevice = le16_to_cpu((dev->udev)->descriptor.bcdDevice);
                 sprintf(buf,"%1d%1d.%1d%1d",
                         (bcdDevice & 0xF000)>>12,
                         (bcdDevice & 0xF00)>>8,
                         (bcdDevice & 0xF0)>>4,
                         (bcdDevice & 0xF));
-                unlock_kernel();
+                mutex_unlock(&lcd_mutex);
                 if (copy_to_user((void __user *)arg,buf,strlen(buf))!=0)
                         return -EFAULT;
                 break;
@@ -217,7 +217,7 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer, siz
         struct urb *urb = NULL;
         char *buf = NULL;
         
-        dev = (struct usb_lcd *)file->private_data;
+        dev = file->private_data;
         
         /* verify that we actually have some data to write */
         if (count == 0)
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 16dffe99d9f1..eef370eb7a54 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -136,7 +136,7 @@ try_iso:
                                         iso_out = e;
                         }
                 }
-                if ((in && out)  ||  (iso_in && iso_out))
+                if ((in && out)  ||  iso_in || iso_out)
                         goto found;
         }
         return -EINVAL;
@@ -162,6 +162,9 @@ found:
                 dev->in_iso_pipe = usb_rcvisocpipe (udev,
                                 iso_in->desc.bEndpointAddress
                                         & USB_ENDPOINT_NUMBER_MASK);
+        }
+
+        if (iso_out) {
                 dev->iso_out = &iso_out->desc;
                 dev->out_iso_pipe = usb_sndisocpipe (udev,
                                 iso_out->desc.bEndpointAddress
@@ -1378,7 +1381,6 @@ static void iso_callback (struct urb *urb)
                         break;
                 }
         }
-        simple_free_urb (urb);
 
         ctx->pending--;
         if (ctx->pending == 0) {
@@ -1495,6 +1497,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
                         }
 
                         simple_free_urb (urbs [i]);
+                        urbs[i] = NULL;
                         context.pending--;
                         context.submit_error = 1;
                         break;
@@ -1504,6 +1507,10 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
         wait_for_completion (&context.done);
 
+        for (i = 0; i < param->sglen; i++) {
+                if (urbs[i])
+                        simple_free_urb(urbs[i]);
+        }
         /*
          * Isochronous transfers are expected to fail sometimes.  As an
          * arbitrary limit, we will report an error if any submissions
@@ -1548,6 +1555,7 @@ fail:
  * off just killing the userspace task and waiting for it to exit.
  */
 
+/* No BKL needed */
 static int
 usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
 {
@@ -2170,7 +2178,7 @@ static struct usb_driver usbtest_driver = {
         .name =         "usbtest",
         .id_table =     id_table,
         .probe =        usbtest_probe,
-        .ioctl =        usbtest_ioctl,
+        .unlocked_ioctl = usbtest_ioctl,
         .disconnect =   usbtest_disconnect,
         .suspend =      usbtest_suspend,
         .resume =       usbtest_resume,
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 61c76b13f0f1..44cb37b5a4dc 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -646,17 +646,14 @@ static int mon_bin_open(struct inode *inode, struct file *file)
         size_t size;
         int rc;
 
-        lock_kernel();
         mutex_lock(&mon_lock);
         if ((mbus = mon_bus_lookup(iminor(inode))) == NULL) {
                 mutex_unlock(&mon_lock);
-                unlock_kernel();
                 return -ENODEV;
         }
         if (mbus != &mon_bus0 && mbus->u_bus == NULL) {
                 printk(KERN_ERR TAG ": consistency error on open\n");
                 mutex_unlock(&mon_lock);
-                unlock_kernel();
                 return -ENODEV;
         }
 
@@ -689,7 +686,6 @@ static int mon_bin_open(struct inode *inode, struct file *file)
 
         file->private_data = rp;
         mutex_unlock(&mon_lock);
-        unlock_kernel();
         return 0;
 
 err_allocbuff:
@@ -698,7 +694,6 @@ err_allocvec:
         kfree(rp);
 err_alloc:
         mutex_unlock(&mon_lock);
-        unlock_kernel();
         return rc;
 }
 
@@ -954,7 +949,7 @@ static int mon_bin_queued(struct mon_reader_bin *rp)
 
 /*
  */
-static int mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         struct mon_reader_bin *rp = file->private_data;
         // struct mon_bus* mbus = rp->r.m_bus;
@@ -1009,7 +1004,7 @@ static int mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 mutex_lock(&rp->fetch_lock);
                 spin_lock_irqsave(&rp->b_lock, flags);
-                mon_free_buff(rp->b_vec, size/CHUNK_SIZE);
+                mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE);
                 kfree(rp->b_vec);
                 rp->b_vec  = vec;
                 rp->b_size = size;
@@ -1094,19 +1089,6 @@ static int mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         return ret;
 }
 
-static long mon_bin_unlocked_ioctl(struct file *file, unsigned int cmd,
-                                   unsigned long arg)
-{
-        int ret;
-
-        lock_kernel();
-        ret = mon_bin_ioctl(file, cmd, arg);
-        unlock_kernel();
-
-        return ret;
-}
-
-
 #ifdef CONFIG_COMPAT
 static long mon_bin_compat_ioctl(struct file *file,
     unsigned int cmd, unsigned long arg)
@@ -1250,7 +1232,7 @@ static const struct file_operations mon_fops_binary = {
         .read =         mon_bin_read,
         /* .write =     mon_text_write, */
         .poll =         mon_bin_poll,
-        .unlocked_ioctl = mon_bin_unlocked_ioctl,
+        .unlocked_ioctl = mon_bin_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = mon_bin_compat_ioctl,
 #endif
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 3b795c56221f..540c766c4f86 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -704,7 +704,6 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
         if (int_usb & MUSB_INTR_CONNECT) {
                 struct usb_hcd *hcd = musb_to_hcd(musb);
-                void __iomem *mbase = musb->mregs;
 
                 handled = IRQ_HANDLED;
                 musb->is_active = 1;
@@ -717,9 +716,9 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 if (is_peripheral_active(musb)) {
                         /* REVISIT HNP; just force disconnect */
                 }
-                musb_writew(mbase, MUSB_INTRTXE, musb->epmask);
-                musb_writew(mbase, MUSB_INTRRXE, musb->epmask & 0xfffe);
-                musb_writeb(mbase, MUSB_INTRUSBE, 0xf7);
+                musb_writew(musb->mregs, MUSB_INTRTXE, musb->epmask);
+                musb_writew(musb->mregs, MUSB_INTRRXE, musb->epmask & 0xfffe);
+                musb_writeb(musb->mregs, MUSB_INTRUSBE, 0xf7);
 #endif
                 musb->port1_status &= ~(USB_PORT_STAT_LOW_SPEED
                                         |USB_PORT_STAT_HIGH_SPEED
diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
index bba76af0c0c6..c79a5e30d437 100644
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -92,29 +92,29 @@ static const struct musb_register_map musb_regmap[] = {
         { "LS_EOF1",            0x7E,   8 },
         { "SOFT_RST",           0x7F,   8 },
         { "DMA_CNTLch0",        0x204,  16 },
-        { "DMA_ADDRch0",        0x208,  16 },
-        { "DMA_COUNTch0",       0x20C,  16 },
+        { "DMA_ADDRch0",        0x208,  32 },
+        { "DMA_COUNTch0",       0x20C,  32 },
         { "DMA_CNTLch1",        0x214,  16 },
-        { "DMA_ADDRch1",        0x218,  16 },
-        { "DMA_COUNTch1",       0x21C,  16 },
+        { "DMA_ADDRch1",        0x218,  32 },
+        { "DMA_COUNTch1",       0x21C,  32 },
         { "DMA_CNTLch2",        0x224,  16 },
-        { "DMA_ADDRch2",        0x228,  16 },
-        { "DMA_COUNTch2",       0x22C,  16 },
+        { "DMA_ADDRch2",        0x228,  32 },
+        { "DMA_COUNTch2",       0x22C,  32 },
         { "DMA_CNTLch3",        0x234,  16 },
-        { "DMA_ADDRch3",        0x238,  16 },
-        { "DMA_COUNTch3",       0x23C,  16 },
+        { "DMA_ADDRch3",        0x238,  32 },
+        { "DMA_COUNTch3",       0x23C,  32 },
         { "DMA_CNTLch4",        0x244,  16 },
-        { "DMA_ADDRch4",        0x248,  16 },
-        { "DMA_COUNTch4",       0x24C,  16 },
+        { "DMA_ADDRch4",        0x248,  32 },
+        { "DMA_COUNTch4",       0x24C,  32 },
         { "DMA_CNTLch5",        0x254,  16 },
-        { "DMA_ADDRch5",        0x258,  16 },
-        { "DMA_COUNTch5",       0x25C,  16 },
+        { "DMA_ADDRch5",        0x258,  32 },
+        { "DMA_COUNTch5",       0x25C,  32 },
         { "DMA_CNTLch6",        0x264,  16 },
-        { "DMA_ADDRch6",        0x268,  16 },
-        { "DMA_COUNTch6",       0x26C,  16 },
+        { "DMA_ADDRch6",        0x268,  32 },
+        { "DMA_COUNTch6",       0x26C,  32 },
         { "DMA_CNTLch7",        0x274,  16 },
-        { "DMA_ADDRch7",        0x278,  16 },
-        { "DMA_COUNTch7",       0x27C,  16 },
+        { "DMA_ADDRch7",        0x278,  32 },
+        { "DMA_COUNTch7",       0x27C,  32 },
         {  }    /* Terminating Entry */
 };
 
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 21b9788d0243..59bef8f3a358 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -402,6 +402,9 @@ __acquires(musb->lock)
                                         musb->g.a_alt_hnp_support = 1;
                                         break;
 #endif
+                                case USB_DEVICE_DEBUG_MODE:
+                                        handled = 0;
+                                        break;
 stall:
                                 default:
                                         handled = -EINVAL;
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 92e85e027cfb..43233c397b6e 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -244,7 +244,7 @@ int musb_hub_control(
 
         spin_lock_irqsave(&musb->lock, flags);
 
-        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {
+        if (unlikely(!HCD_HW_ACCESSIBLE(hcd))) {
                 spin_unlock_irqrestore(&musb->lock, flags);
                 return -ESHUTDOWN;
         }
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index dc66e4376d49..6dc107f25245 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -173,10 +173,7 @@ static int dma_channel_program(struct dma_channel *channel,
         musb_channel->max_packet_sz = packet_sz;
         channel->status = MUSB_DMA_STATUS_BUSY;
 
-        if ((mode == 1) && (len >= packet_sz))
-                configure_channel(channel, packet_sz, 1, dma_addr, len);
-        else
-                configure_channel(channel, packet_sz, 0, dma_addr, len);
+        configure_channel(channel, packet_sz, mode, dma_addr, len);
 
         return true;
 }
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index e06d65e36bf7..2111a241dd03 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -32,8 +32,6 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 
-#include <plat/mux.h>
-
 #include "musb_core.h"
 #include "omap2430.h"
 
@@ -194,10 +192,6 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
         u32 l;
         struct omap_musb_board_data *data = board_data;
 
-#if defined(CONFIG_ARCH_OMAP2430)
-        omap_cfg_reg(AE5_2430_USB0HS_STP);
-#endif
-
         /* We require some kind of external transceiver, hooked
          * up through ULPI.  TWL4030-family PMICs include one,
          * which needs a driver, drivers aren't always needed.
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index 3d2d3e549bd1..3b1289572d72 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -49,8 +49,6 @@ config USB_ULPI
           Enable this to support ULPI connected USB OTG transceivers which
           are likely found on embedded boards.
 
-          The only chip currently supported is NXP's ISP1504
-
 config TWL4030_USB
         tristate "TWL4030 USB Transceiver Driver"
         depends on TWL4030_CORE && REGULATOR_TWL4030
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index d331b222ad21..ccc81950822b 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -31,30 +31,110 @@
 
 #define ULPI_ID(vendor, product) (((vendor) << 16) | (product))
 
-#define TR_FLAG(flags, a, b)    (((flags) & a) ? b : 0)
-
 /* ULPI hardcoded IDs, used for probing */
 static unsigned int ulpi_ids[] = {
         ULPI_ID(0x04cc, 0x1504),        /* NXP ISP1504 */
+        ULPI_ID(0x0424, 0x0006),        /* SMSC USB3319 */
 };
 
-static int ulpi_set_flags(struct otg_transceiver *otg)
+static int ulpi_set_otg_flags(struct otg_transceiver *otg)
 {
-        unsigned int flags = 0;
+        unsigned int flags = ULPI_OTG_CTRL_DP_PULLDOWN |
+                             ULPI_OTG_CTRL_DM_PULLDOWN;
 
-        if (otg->flags & USB_OTG_PULLUP_ID)
+        if (otg->flags & ULPI_OTG_ID_PULLUP)
                 flags |= ULPI_OTG_CTRL_ID_PULLUP;
 
-        if (otg->flags & USB_OTG_PULLDOWN_DM)
-                flags |= ULPI_OTG_CTRL_DM_PULLDOWN;
+        /*
+         * ULPI Specification rev.1.1 default
+         * for Dp/DmPulldown is enabled.
+         */
+        if (otg->flags & ULPI_OTG_DP_PULLDOWN_DIS)
+                flags &= ~ULPI_OTG_CTRL_DP_PULLDOWN;
 
-        if (otg->flags & USB_OTG_PULLDOWN_DP)
-                flags |= ULPI_OTG_CTRL_DP_PULLDOWN;
+        if (otg->flags & ULPI_OTG_DM_PULLDOWN_DIS)
+                flags &= ~ULPI_OTG_CTRL_DM_PULLDOWN;
 
-        if (otg->flags & USB_OTG_EXT_VBUS_INDICATOR)
+        if (otg->flags & ULPI_OTG_EXTVBUSIND)
                 flags |= ULPI_OTG_CTRL_EXTVBUSIND;
 
-        return otg_io_write(otg, flags, ULPI_SET(ULPI_OTG_CTRL));
+        return otg_io_write(otg, flags, ULPI_OTG_CTRL);
+}
+
+static int ulpi_set_fc_flags(struct otg_transceiver *otg)
+{
+        unsigned int flags = 0;
+
+        /*
+         * ULPI Specification rev.1.1 default
+         * for XcvrSelect is Full Speed.
+         */
+        if (otg->flags & ULPI_FC_HS)
+                flags |= ULPI_FUNC_CTRL_HIGH_SPEED;
+        else if (otg->flags & ULPI_FC_LS)
+                flags |= ULPI_FUNC_CTRL_LOW_SPEED;
+        else if (otg->flags & ULPI_FC_FS4LS)
+                flags |= ULPI_FUNC_CTRL_FS4LS;
+        else
+                flags |= ULPI_FUNC_CTRL_FULL_SPEED;
+
+        if (otg->flags & ULPI_FC_TERMSEL)
+                flags |= ULPI_FUNC_CTRL_TERMSELECT;
+
+        /*
+         * ULPI Specification rev.1.1 default
+         * for OpMode is Normal Operation.
+         */
+        if (otg->flags & ULPI_FC_OP_NODRV)
+                flags |= ULPI_FUNC_CTRL_OPMODE_NONDRIVING;
+        else if (otg->flags & ULPI_FC_OP_DIS_NRZI)
+                flags |= ULPI_FUNC_CTRL_OPMODE_DISABLE_NRZI;
+        else if (otg->flags & ULPI_FC_OP_NSYNC_NEOP)
+                flags |= ULPI_FUNC_CTRL_OPMODE_NOSYNC_NOEOP;
+        else
+                flags |= ULPI_FUNC_CTRL_OPMODE_NORMAL;
+
+        /*
+         * ULPI Specification rev.1.1 default
+         * for SuspendM is Powered.
+         */
+        flags |= ULPI_FUNC_CTRL_SUSPENDM;
+
+        return otg_io_write(otg, flags, ULPI_FUNC_CTRL);
+}
+
+static int ulpi_set_ic_flags(struct otg_transceiver *otg)
+{
+        unsigned int flags = 0;
+
+        if (otg->flags & ULPI_IC_AUTORESUME)
+                flags |= ULPI_IFC_CTRL_AUTORESUME;
+
+        if (otg->flags & ULPI_IC_EXTVBUS_INDINV)
+                flags |= ULPI_IFC_CTRL_EXTERNAL_VBUS;
+
+        if (otg->flags & ULPI_IC_IND_PASSTHRU)
+                flags |= ULPI_IFC_CTRL_PASSTHRU;
+
+        if (otg->flags & ULPI_IC_PROTECT_DIS)
+                flags |= ULPI_IFC_CTRL_PROTECT_IFC_DISABLE;
+
+        return otg_io_write(otg, flags, ULPI_IFC_CTRL);
+}
+
+static int ulpi_set_flags(struct otg_transceiver *otg)
+{
+        int ret;
+
+        ret = ulpi_set_otg_flags(otg);
+        if (ret)
+                return ret;
+
+        ret = ulpi_set_ic_flags(otg);
+        if (ret)
+                return ret;
+
+        return ulpi_set_fc_flags(otg);
 }
 
 static int ulpi_init(struct otg_transceiver *otg)
@@ -81,6 +161,31 @@ static int ulpi_init(struct otg_transceiver *otg)
         return -ENODEV;
 }
 
+static int ulpi_set_host(struct otg_transceiver *otg, struct usb_bus *host)
+{
+        unsigned int flags = otg_io_read(otg, ULPI_IFC_CTRL);
+
+        if (!host) {
+                otg->host = NULL;
+                return 0;
+        }
+
+        otg->host = host;
+
+        flags &= ~(ULPI_IFC_CTRL_6_PIN_SERIAL_MODE |
+                   ULPI_IFC_CTRL_3_PIN_SERIAL_MODE |
+                   ULPI_IFC_CTRL_CARKITMODE);
+
+        if (otg->flags & ULPI_IC_6PIN_SERIAL)
+                flags |= ULPI_IFC_CTRL_6_PIN_SERIAL_MODE;
+        else if (otg->flags & ULPI_IC_3PIN_SERIAL)
+                flags |= ULPI_IFC_CTRL_3_PIN_SERIAL_MODE;
+        else if (otg->flags & ULPI_IC_CARKIT)
+                flags |= ULPI_IFC_CTRL_CARKITMODE;
+
+        return otg_io_write(otg, flags, ULPI_IFC_CTRL);
+}
+
 static int ulpi_set_vbus(struct otg_transceiver *otg, bool on)
 {
         unsigned int flags = otg_io_read(otg, ULPI_OTG_CTRL);
@@ -88,14 +193,14 @@ static int ulpi_set_vbus(struct otg_transceiver *otg, bool on)
         flags &= ~(ULPI_OTG_CTRL_DRVVBUS | ULPI_OTG_CTRL_DRVVBUS_EXT);
 
         if (on) {
-                if (otg->flags & USB_OTG_DRV_VBUS)
+                if (otg->flags & ULPI_OTG_DRVVBUS)
                         flags |= ULPI_OTG_CTRL_DRVVBUS;
 
-                if (otg->flags & USB_OTG_DRV_VBUS_EXT)
+                if (otg->flags & ULPI_OTG_DRVVBUS_EXT)
                         flags |= ULPI_OTG_CTRL_DRVVBUS_EXT;
         }
 
-        return otg_io_write(otg, flags, ULPI_SET(ULPI_OTG_CTRL));
+        return otg_io_write(otg, flags, ULPI_OTG_CTRL);
 }
 
 struct otg_transceiver *
@@ -112,6 +217,7 @@ otg_ulpi_create(struct otg_io_access_ops *ops,
         otg->flags      = flags;
         otg->io_ops     = ops;
         otg->init       = ulpi_init;
+        otg->set_host   = ulpi_set_host;
         otg->set_vbus   = ulpi_set_vbus;
 
         return otg;
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index bd8aab0ef1cf..916b2b6d765f 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -642,6 +642,15 @@ config USB_SERIAL_ZIO
           To compile this driver as a module, choose M here: the
           module will be called zio.
 
+config USB_SERIAL_SSU100
+        tristate "USB Quatech SSU-100 Single Port Serial Driver"
+        help
+          Say Y here if you want to use the Quatech SSU-100 single
+          port usb to serial adapter.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ssu100.
+
 config USB_SERIAL_DEBUG
         tristate "USB Debugging Device"
         help
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index e54c728c016e..40ebe17b6ea8 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -51,6 +51,7 @@ obj-$(CONFIG_USB_SERIAL_SAFE)			+= safe_serial.o
 obj-$(CONFIG_USB_SERIAL_SIEMENS_MPI)            += siemens_mpi.o
 obj-$(CONFIG_USB_SERIAL_SIERRAWIRELESS)         += sierra.o
 obj-$(CONFIG_USB_SERIAL_SPCP8X5)                += spcp8x5.o
+obj-$(CONFIG_USB_SERIAL_SSU100)                 += ssu100.o
 obj-$(CONFIG_USB_SERIAL_SYMBOL)                 += symbolserial.o
 obj-$(CONFIG_USB_SERIAL_WWAN)                   += usb_wwan.o
 obj-$(CONFIG_USB_SERIAL_TI)                     += ti_usb_3410_5052.o
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 8b8c7976b4c0..2bef4415c19c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -126,6 +126,10 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+        { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
+        { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
+        { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
+        { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
         { } /* Terminating Entry */
 };
 
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index fd35f73b5721..b92070c103cd 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -609,8 +609,10 @@ static void digi_wakeup_write_lock(struct work_struct *work)
 static void digi_wakeup_write(struct usb_serial_port *port)
 {
         struct tty_struct *tty = tty_port_tty_get(&port->port);
-        tty_wakeup(tty);
-        tty_kref_put(tty);
+        if (tty) {
+                tty_wakeup(tty);
+                tty_kref_put(tty);
+        }
 }
 
 
@@ -1682,7 +1684,7 @@ static int digi_read_inb_callback(struct urb *urb)
                 priv->dp_throttle_restart = 1;
 
         /* receive data */
-        if (opcode == DIGI_CMD_RECEIVE_DATA) {
+        if (tty && opcode == DIGI_CMD_RECEIVE_DATA) {
                 /* get flag from port_status */
                 flag = 0;
 
@@ -1763,10 +1765,12 @@ static int digi_read_oob_callback(struct urb *urb)
                         return -1;
 
                 tty = tty_port_tty_get(&port->port);
+
                 rts = 0;
-                rts = tty->termios->c_cflag & CRTSCTS;
+                if (tty)
+                        rts = tty->termios->c_cflag & CRTSCTS;
                 
-                if (opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
+                if (tty && opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
                         spin_lock(&priv->dp_port_lock);
                         /* convert from digi flags to termiox flags */
                         if (val & DIGI_READ_INPUT_SIGNALS_CTS) {
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index e298dc4baed7..eb12d9b096b4 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -157,6 +157,9 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_5_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_6_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_7_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_USINT_CAT_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_USINT_WKEY_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_USINT_RS232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
@@ -746,6 +749,7 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index d01946db8fac..6e612c52e763 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -40,6 +40,11 @@
 
 #define FTDI_NXTCAM_PID         0xABB8 /* NXTCam for Mindstorms NXT */
 
+/* US Interface Navigator (http://www.usinterface.com/) */
+#define FTDI_USINT_CAT_PID      0xb810  /* Navigator CAT and 2nd PTT lines */
+#define FTDI_USINT_WKEY_PID     0xb811  /* Navigator WKEY and FSK lines */
+#define FTDI_USINT_RS232_PID    0xb812  /* Navigator RS232 and CONFIG lines */
+
 /* OOCDlink by Joern Kaipf <joernk@web.de>
  * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
 #define FTDI_OOCDLINK_PID       0xbaf8  /* Amontec JTAGkey */
@@ -1032,3 +1037,8 @@
 #define XVERVE_SIGNALYZER_SH2_PID       0xBCA2
 #define XVERVE_SIGNALYZER_SH4_PID       0xBCA4
 
+/*
+ * Segway Robotic Mobility Platform USB interface (using VID 0x0403)
+ * Submitted by John G. Rogers
+ */
+#define SEGWAY_RMP200_PID       0xe729
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index a817ced82835..ca92f67747cc 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -208,18 +208,23 @@ retry:
         urb->transfer_buffer_length = count;
         usb_serial_debug_data(debug, &port->dev, __func__, count,
                                                 urb->transfer_buffer);
+        spin_lock_irqsave(&port->lock, flags);
+        port->tx_bytes += count;
+        spin_unlock_irqrestore(&port->lock, flags);
+
+        clear_bit(i, &port->write_urbs_free);
         result = usb_submit_urb(urb, GFP_ATOMIC);
         if (result) {
                 dev_err(&port->dev, "%s - error submitting urb: %d\n",
                                                 __func__, result);
+                set_bit(i, &port->write_urbs_free);
+                spin_lock_irqsave(&port->lock, flags);
+                port->tx_bytes -= count;
+                spin_unlock_irqrestore(&port->lock, flags);
+
                 clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
                 return result;
         }
-        clear_bit(i, &port->write_urbs_free);
-
-        spin_lock_irqsave(&port->lock, flags);
-        port->tx_bytes += count;
-        spin_unlock_irqrestore(&port->lock, flags);
 
         /* Try sending off another urb, unless in irq context (in which case
          * there will be no free urb). */
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 0fca2659206f..dc47f986df57 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1298,7 +1298,7 @@ static int download_fw(struct edgeport_serial *serial)
                                 kfree(header);
                                 kfree(rom_desc);
                                 kfree(ti_manuf_desc);
-                                return status;
+                                return -EINVAL;
                         }
 
                         /* verify the write -- must do this in order for
@@ -1321,7 +1321,7 @@ static int download_fw(struct edgeport_serial *serial)
                                 kfree(header);
                                 kfree(rom_desc);
                                 kfree(ti_manuf_desc);
-                                return status;
+                                return -EINVAL;
                         }
 
                         kfree(vheader);
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 28913fa95fb7..4735931b4c7b 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -534,7 +534,6 @@ static struct usb_device_id ipaq_id_table [] = {
         { USB_DEVICE(0x413C, 0x4009) }, /* Dell Axim USB Sync */
         { USB_DEVICE(0x4505, 0x0010) }, /* Smartphone */
         { USB_DEVICE(0x5E04, 0xCE00) }, /* SAGEM Wireless Assistant */
-        { USB_DEVICE(0x0BB4, 0x00CF) }, /* HTC smartphone modems */
         { }                             /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 74551cb2e8ee..efc72113216b 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -1,6 +1,8 @@
 /*
  * Infinity Unlimited USB Phoenix driver
  *
+ * Copyright (C) 2010 James Courtier-Dutton (James@superbug.co.uk)
+
  * Copyright (C) 2007 Alain Degreffe (eczema@ecze.com)
  *
  * Original code taken from iuutool (Copyright (C) 2006 Juan Carlos Borrás)
@@ -40,7 +42,7 @@ static int debug;
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v0.11"
+#define DRIVER_VERSION "v0.12"
 #define DRIVER_DESC "Infinity USB Unlimited Phoenix driver"
 
 static const struct usb_device_id id_table[] = {
@@ -81,6 +83,9 @@ struct iuu_private {
         u8 *dbgbuf;             /* debug buffer */
         u8 len;
         int vcc;                /* vcc (either 3 or 5 V) */
+        u32 baud;
+        u32 boost;
+        u32 clk;
 };
 
 
@@ -157,13 +162,14 @@ static int iuu_tiocmset(struct tty_struct *tty, struct file *file,
             port->number, set, clear);
 
         spin_lock_irqsave(&priv->lock, flags);
-        if (set & TIOCM_RTS)
-                priv->tiostatus = TIOCM_RTS;
 
-        if (!(set & TIOCM_RTS) && priv->tiostatus == TIOCM_RTS) {
+        if ((set & TIOCM_RTS) && !(priv->tiostatus == TIOCM_RTS)) {
                 dbg("%s TIOCMSET RESET called !!!", __func__);
                 priv->reset = 1;
         }
+        if (set & TIOCM_RTS)
+                priv->tiostatus = TIOCM_RTS;
+
         spin_unlock_irqrestore(&priv->lock, flags);
         return 0;
 }
@@ -851,20 +857,24 @@ static int iuu_uart_off(struct usb_serial_port *port)
         return status;
 }
 
-static int iuu_uart_baud(struct usb_serial_port *port, u32 baud,
+static int iuu_uart_baud(struct usb_serial_port *port, u32 baud_base,
                          u32 *actual, u8 parity)
 {
         int status;
+        u32 baud;
         u8 *dataout;
         u8 DataCount = 0;
         u8 T1Frekvens = 0;
         u8 T1reload = 0;
         unsigned int T1FrekvensHZ = 0;
 
+        dbg("%s - enter baud_base=%d", __func__, baud_base);
         dataout = kmalloc(sizeof(u8) * 5, GFP_KERNEL);
 
         if (!dataout)
                 return -ENOMEM;
+        /*baud = (((priv->clk / 35) * baud_base) / 100000); */
+        baud = baud_base;
 
         if (baud < 1200 || baud > 230400) {
                 kfree(dataout);
@@ -948,15 +958,20 @@ static void iuu_set_termios(struct tty_struct *tty,
                 struct usb_serial_port *port, struct ktermios *old_termios)
 {
         const u32 supported_mask = CMSPAR|PARENB|PARODD;
-
+        struct iuu_private *priv = usb_get_serial_port_data(port);
         unsigned int cflag = tty->termios->c_cflag;
         int status;
         u32 actual;
         u32 parity;
         int csize = CS7;
-        int baud = 9600;        /* Fixed for the moment */
+        int baud;
         u32 newval = cflag & supported_mask;
 
+        /* Just use the ospeed. ispeed should be the same. */
+        baud = tty->termios->c_ospeed;
+
+        dbg("%s - enter c_ospeed or baud=%d", __func__, baud);
+
         /* compute the parity parameter */
         parity = 0;
         if (cflag & CMSPAR) {   /* Using mark space */
@@ -976,15 +991,15 @@ static void iuu_set_termios(struct tty_struct *tty,
 
         /* set it */
         status = iuu_uart_baud(port,
-                        (clockmode == 2) ? 16457 : 9600 * boost / 100,
+                        baud * priv->boost / 100,
                         &actual, parity);
 
         /* set the termios value to the real one, so the user now what has
          * changed. We support few fields so its easies to copy the old hw
          * settings back over and then adjust them
          */
-        if (old_termios)
-                tty_termios_copy_hw(tty->termios, old_termios);
+        if (old_termios)
+                tty_termios_copy_hw(tty->termios, old_termios);
         if (status != 0)        /* Set failed - return old bits */
                 return;
         /* Re-encode speed, parity and csize */
@@ -1018,6 +1033,7 @@ static void iuu_close(struct usb_serial_port *port)
 
 static void iuu_init_termios(struct tty_struct *tty)
 {
+        dbg("%s - enter", __func__);
         *(tty->termios) = tty_std_termios;
         tty->termios->c_cflag = CLOCAL | CREAD | CS8 | B9600
                                 | TIOCM_CTS | CSTOPB | PARENB;
@@ -1033,10 +1049,16 @@ static int iuu_open(struct tty_struct *tty, struct usb_serial_port *port)
         struct usb_serial *serial = port->serial;
         u8 *buf;
         int result;
+        int baud;
         u32 actual;
         struct iuu_private *priv = usb_get_serial_port_data(port);
 
-        dbg("%s -  port %d", __func__, port->number);
+        baud = tty->termios->c_ospeed;
+        tty->termios->c_ispeed = baud;
+        /* Re-encode speed */
+        tty_encode_baud_rate(tty, baud, baud);
+
+        dbg("%s -  port %d, baud %d", __func__, port->number, baud);
         usb_clear_halt(serial->dev, port->write_urb->pipe);
         usb_clear_halt(serial->dev, port->read_urb->pipe);
 
@@ -1071,23 +1093,29 @@ static int iuu_open(struct tty_struct *tty, struct usb_serial_port *port)
         iuu_uart_on(port);
         if (boost < 100)
                 boost = 100;
+        priv->boost = boost;
+        priv->baud = baud;
         switch (clockmode) {
         case 2:         /*  3.680 Mhz */
+                priv->clk = IUU_CLK_3680000;
                 iuu_clk(port, IUU_CLK_3680000 * boost / 100);
                 result =
-                    iuu_uart_baud(port, 9600 * boost / 100, &actual,
+                    iuu_uart_baud(port, baud * boost / 100, &actual,
                                   IUU_PARITY_EVEN);
                 break;
         case 3:         /*  6.00 Mhz */
                 iuu_clk(port, IUU_CLK_6000000 * boost / 100);
+                priv->clk = IUU_CLK_6000000;
+                /* Ratio of 6000000 to 3500000 for baud 9600 */
                 result =
                     iuu_uart_baud(port, 16457 * boost / 100, &actual,
                                   IUU_PARITY_EVEN);
                 break;
         default:                /*  3.579 Mhz */
                 iuu_clk(port, IUU_CLK_3579000 * boost / 100);
+                priv->clk = IUU_CLK_3579000;
                 result =
-                    iuu_uart_baud(port, 9600 * boost / 100, &actual,
+                    iuu_uart_baud(port, baud * boost / 100, &actual,
                                   IUU_PARITY_EVEN);
         }
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5cd30e4345c6..9fc6ea2c681f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -145,7 +145,10 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_E143D                    0x143D
 #define HUAWEI_PRODUCT_E143E                    0x143E
 #define HUAWEI_PRODUCT_E143F                    0x143F
+#define HUAWEI_PRODUCT_K4505                    0x1464
+#define HUAWEI_PRODUCT_K3765                    0x1465
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
+#define HUAWEI_PRODUCT_ETS1220                  0x1803
 
 #define QUANTA_VENDOR_ID                        0x0408
 #define QUANTA_PRODUCT_Q101                     0xEA02
@@ -264,9 +267,6 @@ static void option_instat_callback(struct urb *urb);
 #define BANDRICH_PRODUCT_1011                   0x1011
 #define BANDRICH_PRODUCT_1012                   0x1012
 
-#define AMOI_VENDOR_ID                  0x1614
-#define AMOI_PRODUCT_9508                       0x0800
-
 #define QUALCOMM_VENDOR_ID                      0x05C6
 
 #define CMOTECH_VENDOR_ID                       0x16d8
@@ -482,8 +482,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
-        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V740) }, /* Novatel Merlin EX720/V740/X720 */
@@ -1017,6 +1019,13 @@ static int option_probe(struct usb_serial *serial,
                 serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)
                 return -ENODEV;
 
+        /* Don't bind network interfaces on Huawei K3765 & K4505 */
+        if (serial->dev->descriptor.idVendor == HUAWEI_VENDOR_ID &&
+                (serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K3765 ||
+                        serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4505) &&
+                serial->interface->cur_altsetting->desc.bInterfaceNumber == 1)
+                return -ENODEV;
+
         data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
 
         if (!data)
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
new file mode 100644
index 000000000000..6e82d4f54bc8
--- /dev/null
+++ b/drivers/usb/serial/ssu100.c
@@ -0,0 +1,698 @@
+/*
+ * usb-serial driver for Quatech SSU-100
+ *
+ * based on ftdi_sio.c and the original serqt_usb.c from Quatech
+ *
+ */
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+#include <linux/module.h>
+#include <linux/serial.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <linux/uaccess.h>
+
+#define QT_OPEN_CLOSE_CHANNEL       0xca
+#define QT_SET_GET_DEVICE           0xc2
+#define QT_SET_GET_REGISTER         0xc0
+#define QT_GET_SET_PREBUF_TRIG_LVL  0xcc
+#define QT_SET_ATF                  0xcd
+#define QT_GET_SET_UART             0xc1
+#define QT_TRANSFER_IN              0xc0
+#define QT_HW_FLOW_CONTROL_MASK     0xc5
+#define QT_SW_FLOW_CONTROL_MASK     0xc6
+
+#define MODEM_CTL_REGISTER         0x04
+#define MODEM_STATUS_REGISTER      0x06
+
+
+#define SERIAL_LSR_OE       0x02
+#define SERIAL_LSR_PE       0x04
+#define SERIAL_LSR_FE       0x08
+#define SERIAL_LSR_BI       0x10
+
+#define SERIAL_LSR_TEMT     0x40
+
+#define  SERIAL_MCR_DTR             0x01
+#define  SERIAL_MCR_RTS             0x02
+#define  SERIAL_MCR_LOOP            0x10
+
+#define  SERIAL_MSR_CTS             0x10
+#define  SERIAL_MSR_CD              0x80
+#define  SERIAL_MSR_RI              0x40
+#define  SERIAL_MSR_DSR             0x20
+#define  SERIAL_MSR_MASK            0xf0
+
+#define  SERIAL_CRTSCTS ((SERIAL_MCR_RTS << 8) | SERIAL_MSR_CTS)
+
+#define  SERIAL_8_DATA              0x03
+#define  SERIAL_7_DATA              0x02
+#define  SERIAL_6_DATA              0x01
+#define  SERIAL_5_DATA              0x00
+
+#define  SERIAL_ODD_PARITY          0X08
+#define  SERIAL_EVEN_PARITY         0X18
+
+#define  MAX_BAUD_RATE              460800
+
+#define ATC_DISABLED                0x00
+#define DUPMODE_BITS        0xc0
+#define RR_BITS             0x03
+#define LOOPMODE_BITS       0x41
+#define RS232_MODE          0x00
+#define RTSCTS_TO_CONNECTOR 0x40
+#define CLKS_X4             0x02
+#define FULLPWRBIT          0x00000080
+#define NEXT_BOARD_POWER_BIT        0x00000004
+
+static int debug = 1;
+
+/* Version Information */
+#define DRIVER_VERSION "v0.1"
+#define DRIVER_DESC "Quatech SSU-100 USB to Serial Driver"
+
+#define USB_VENDOR_ID_QUATECH   0x061d  /* Quatech VID */
+#define QUATECH_SSU100  0xC020  /* SSU100 */
+
+static const struct usb_device_id id_table[] = {
+        {USB_DEVICE(USB_VENDOR_ID_QUATECH, QUATECH_SSU100)},
+        {}                      /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, id_table);
+
+
+static struct usb_driver ssu100_driver = {
+        .name                          = "ssu100",
+        .probe                         = usb_serial_probe,
+        .disconnect                    = usb_serial_disconnect,
+        .id_table                      = id_table,
+        .suspend                       = usb_serial_suspend,
+        .resume                        = usb_serial_resume,
+        .no_dynamic_id                 = 1,
+        .supports_autosuspend          = 1,
+};
+
+struct ssu100_port_private {
+        u8 shadowLSR;
+        u8 shadowMSR;
+        wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+        unsigned short max_packet_size;
+};
+
+static void ssu100_release(struct usb_serial *serial)
+{
+        struct ssu100_port_private *priv = usb_get_serial_port_data(*serial->port);
+
+        dbg("%s", __func__);
+        kfree(priv);
+}
+
+static inline int ssu100_control_msg(struct usb_device *dev,
+                                     u8 request, u16 data, u16 index)
+{
+        return usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                               request, 0x40, data, index,
+                               NULL, 0, 300);
+}
+
+static inline int ssu100_setdevice(struct usb_device *dev, u8 *data)
+{
+        u16 x = ((u16)(data[1] << 8) | (u16)(data[0]));
+
+        return ssu100_control_msg(dev, QT_SET_GET_DEVICE, x, 0);
+}
+
+
+static inline int ssu100_getdevice(struct usb_device *dev, u8 *data)
+{
+        return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                               QT_SET_GET_DEVICE, 0xc0, 0, 0,
+                               data, 3, 300);
+}
+
+static inline int ssu100_getregister(struct usb_device *dev,
+                                     unsigned short uart,
+                                     unsigned short reg,
+                                     u8 *data)
+{
+        return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                               QT_SET_GET_REGISTER, 0xc0, reg,
+                               uart, data, sizeof(*data), 300);
+
+}
+
+
+static inline int ssu100_setregister(struct usb_device *dev,
+                                     unsigned short uart,
+                                     u16 data)
+{
+        u16 value = (data << 8) | MODEM_CTL_REGISTER;
+
+        return usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+                               QT_SET_GET_REGISTER, 0x40, value, uart,
+                               NULL, 0, 300);
+
+}
+
+#define set_mctrl(dev, set)             update_mctrl((dev), (set), 0)
+#define clear_mctrl(dev, clear) update_mctrl((dev), 0, (clear))
+
+/* these do not deal with device that have more than 1 port */
+static inline int update_mctrl(struct usb_device *dev, unsigned int set,
+                               unsigned int clear)
+{
+        unsigned urb_value;
+        int result;
+
+        if (((set | clear) & (TIOCM_DTR | TIOCM_RTS)) == 0) {
+                dbg("%s - DTR|RTS not being set|cleared", __func__);
+                return 0;       /* no change */
+        }
+
+        clear &= ~set;  /* 'set' takes precedence over 'clear' */
+        urb_value = 0;
+        if (set & TIOCM_DTR)
+                urb_value |= SERIAL_MCR_DTR;
+        if (set & TIOCM_RTS)
+                urb_value |= SERIAL_MCR_RTS;
+
+        result = ssu100_setregister(dev, 0, urb_value);
+        if (result < 0)
+                dbg("%s Error from MODEM_CTRL urb", __func__);
+
+        return result;
+}
+
+static int ssu100_initdevice(struct usb_device *dev)
+{
+        u8 *data;
+        int result = 0;
+
+        dbg("%s", __func__);
+
+        data = kzalloc(3, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        result = ssu100_getdevice(dev, data);
+        if (result < 0) {
+                dbg("%s - get_device failed %i", __func__, result);
+                goto out;
+        }
+
+        data[1] &= ~FULLPWRBIT;
+
+        result = ssu100_setdevice(dev, data);
+        if (result < 0) {
+                dbg("%s - setdevice failed %i", __func__, result);
+                goto out;
+        }
+
+        result = ssu100_control_msg(dev, QT_GET_SET_PREBUF_TRIG_LVL, 128, 0);
+        if (result < 0) {
+                dbg("%s - set prebuffer level failed %i", __func__, result);
+                goto out;
+        }
+
+        result = ssu100_control_msg(dev, QT_SET_ATF, ATC_DISABLED, 0);
+        if (result < 0) {
+                dbg("%s - set ATFprebuffer level failed %i", __func__, result);
+                goto out;
+        }
+
+        result = ssu100_getdevice(dev, data);
+        if (result < 0) {
+                dbg("%s - get_device failed %i", __func__, result);
+                goto out;
+        }
+
+        data[0] &= ~(RR_BITS | DUPMODE_BITS);
+        data[0] |= CLKS_X4;
+        data[1] &= ~(LOOPMODE_BITS);
+        data[1] |= RS232_MODE;
+
+        result = ssu100_setdevice(dev, data);
+        if (result < 0) {
+                dbg("%s - setdevice failed %i", __func__, result);
+                goto out;
+        }
+
+out:    kfree(data);
+        return result;
+
+}
+
+
+static void ssu100_set_termios(struct tty_struct *tty,
+                               struct usb_serial_port *port,
+                               struct ktermios *old_termios)
+{
+        struct usb_device *dev = port->serial->dev;
+        struct ktermios *termios = tty->termios;
+        u16 baud, divisor, remainder;
+        unsigned int cflag = termios->c_cflag;
+        u16 urb_value = 0; /* will hold the new flags */
+        int result;
+
+        dbg("%s", __func__);
+
+        if (cflag & PARENB) {
+                if (cflag & PARODD)
+                        urb_value |= SERIAL_ODD_PARITY;
+                else
+                        urb_value |= SERIAL_EVEN_PARITY;
+        }
+
+        switch (cflag & CSIZE) {
+        case CS5:
+                urb_value |= SERIAL_5_DATA;
+                break;
+        case CS6:
+                urb_value |= SERIAL_6_DATA;
+                break;
+        case CS7:
+                urb_value |= SERIAL_7_DATA;
+                break;
+        default:
+        case CS8:
+                urb_value |= SERIAL_8_DATA;
+                break;
+        }
+
+        baud = tty_get_baud_rate(tty);
+        if (!baud)
+                baud = 9600;
+
+        dbg("%s - got baud = %d\n", __func__, baud);
+
+
+        divisor = MAX_BAUD_RATE / baud;
+        remainder = MAX_BAUD_RATE % baud;
+        if (((remainder * 2) >= baud) && (baud != 110))
+                divisor++;
+
+        urb_value = urb_value << 8;
+
+        result = ssu100_control_msg(dev, QT_GET_SET_UART, divisor, urb_value);
+        if (result < 0)
+                dbg("%s - set uart failed", __func__);
+
+        if (cflag & CRTSCTS)
+                result = ssu100_control_msg(dev, QT_HW_FLOW_CONTROL_MASK,
+                                            SERIAL_CRTSCTS, 0);
+        else
+                result = ssu100_control_msg(dev, QT_HW_FLOW_CONTROL_MASK,
+                                            0, 0);
+        if (result < 0)
+                dbg("%s - set HW flow control failed", __func__);
+
+        if (I_IXOFF(tty) || I_IXON(tty)) {
+                u16 x = ((u16)(START_CHAR(tty) << 8) | (u16)(STOP_CHAR(tty)));
+
+                result = ssu100_control_msg(dev, QT_SW_FLOW_CONTROL_MASK,
+                                            x, 0);
+        } else
+                result = ssu100_control_msg(dev, QT_SW_FLOW_CONTROL_MASK,
+                                            0, 0);
+
+        if (result < 0)
+                dbg("%s - set SW flow control failed", __func__);
+
+}
+
+
+static int ssu100_open(struct tty_struct *tty, struct usb_serial_port *port)
+{
+        struct usb_device *dev = port->serial->dev;
+        struct ssu100_port_private *priv = usb_get_serial_port_data(port);
+        u8 *data;
+        int result;
+
+        dbg("%s - port %d", __func__, port->number);
+
+        data = kzalloc(2, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
+                                 QT_OPEN_CLOSE_CHANNEL,
+                                 QT_TRANSFER_IN, 0x01,
+                                 0, data, 2, 300);
+        if (result < 0) {
+                dbg("%s - open failed %i", __func__, result);
+                kfree(data);
+                return result;
+        }
+
+        priv->shadowLSR = data[0]  & (SERIAL_LSR_OE | SERIAL_LSR_PE |
+                                      SERIAL_LSR_FE | SERIAL_LSR_BI);
+
+        priv->shadowMSR = data[1]  & (SERIAL_MSR_CTS | SERIAL_MSR_DSR |
+                                      SERIAL_MSR_RI | SERIAL_MSR_CD);
+
+        kfree(data);
+
+/* set to 9600 */
+        result = ssu100_control_msg(dev, QT_GET_SET_UART, 0x30, 0x0300);
+        if (result < 0)
+                dbg("%s - set uart failed", __func__);
+
+        if (tty)
+                ssu100_set_termios(tty, port, tty->termios);
+
+        return usb_serial_generic_open(tty, port);
+}
+
+static void ssu100_close(struct usb_serial_port *port)
+{
+        dbg("%s", __func__);
+        usb_serial_generic_close(port);
+}
+
+static int get_serial_info(struct usb_serial_port *port,
+                           struct serial_struct __user *retinfo)
+{
+        struct serial_struct tmp;
+
+        if (!retinfo)
+                return -EFAULT;
+
+        memset(&tmp, 0, sizeof(tmp));
+        tmp.line                = port->serial->minor;
+        tmp.port                = 0;
+        tmp.irq                 = 0;
+        tmp.flags               = ASYNC_SKIP_TEST | ASYNC_AUTO_IRQ;
+        tmp.xmit_fifo_size      = port->bulk_out_size;
+        tmp.baud_base           = 9600;
+        tmp.close_delay         = 5*HZ;
+        tmp.closing_wait        = 30*HZ;
+
+        if (copy_to_user(retinfo, &tmp, sizeof(*retinfo)))
+                return -EFAULT;
+        return 0;
+}
+
+static int ssu100_ioctl(struct tty_struct *tty, struct file *file,
+                    unsigned int cmd, unsigned long arg)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct ssu100_port_private *priv = usb_get_serial_port_data(port);
+
+        dbg("%s cmd 0x%04x", __func__, cmd);
+
+        switch (cmd) {
+        case TIOCGSERIAL:
+                return get_serial_info(port,
+                                       (struct serial_struct __user *) arg);
+
+        case TIOCMIWAIT:
+                while (priv != NULL) {
+                        u8 prevMSR = priv->shadowMSR & SERIAL_MSR_MASK;
+                        interruptible_sleep_on(&priv->delta_msr_wait);
+                        /* see if a signal did it */
+                        if (signal_pending(current))
+                                return -ERESTARTSYS;
+                        else {
+                                u8 diff = (priv->shadowMSR & SERIAL_MSR_MASK) ^ prevMSR;
+                                if (!diff)
+                                        return -EIO; /* no change => error */
+
+                                /* Return 0 if caller wanted to know about
+                                   these bits */
+
+                                if (((arg & TIOCM_RNG) && (diff & SERIAL_MSR_RI)) ||
+                                    ((arg & TIOCM_DSR) && (diff & SERIAL_MSR_DSR)) ||
+                                    ((arg & TIOCM_CD) && (diff & SERIAL_MSR_CD)) ||
+                                    ((arg & TIOCM_CTS) && (diff & SERIAL_MSR_CTS)))
+                                        return 0;
+                        }
+                }
+                return 0;
+
+        default:
+                break;
+        }
+
+        dbg("%s arg not supported", __func__);
+
+        return -ENOIOCTLCMD;
+}
+
+static void ssu100_set_max_packet_size(struct usb_serial_port *port)
+{
+        struct ssu100_port_private *priv = usb_get_serial_port_data(port);
+        struct usb_serial *serial = port->serial;
+        struct usb_device *udev = serial->dev;
+
+        struct usb_interface *interface = serial->interface;
+        struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
+
+        unsigned num_endpoints;
+        int i;
+
+        num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
+        dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
+
+        for (i = 0; i < num_endpoints; i++) {
+                dev_info(&udev->dev, "Endpoint %d MaxPacketSize %d\n", i+1,
+                        interface->cur_altsetting->endpoint[i].desc.wMaxPacketSize);
+                ep_desc = &interface->cur_altsetting->endpoint[i].desc;
+        }
+
+        /* set max packet size based on descriptor */
+        priv->max_packet_size = ep_desc->wMaxPacketSize;
+
+        dev_info(&udev->dev, "Setting MaxPacketSize %d\n", priv->max_packet_size);
+}
+
+static int ssu100_attach(struct usb_serial *serial)
+{
+        struct ssu100_port_private *priv;
+        struct usb_serial_port *port = *serial->port;
+
+        dbg("%s", __func__);
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv) {
+                dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n", __func__,
+                        sizeof(*priv));
+                return -ENOMEM;
+        }
+
+        init_waitqueue_head(&priv->delta_msr_wait);
+        usb_set_serial_port_data(port, priv);
+
+        ssu100_set_max_packet_size(port);
+
+        return ssu100_initdevice(serial->dev);
+}
+
+static int ssu100_tiocmget(struct tty_struct *tty, struct file *file)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct usb_device *dev = port->serial->dev;
+        u8 *d;
+        int r;
+
+        dbg("%s\n", __func__);
+
+        d = kzalloc(2, GFP_KERNEL);
+        if (!d)
+                return -ENOMEM;
+
+        r = ssu100_getregister(dev, 0, MODEM_CTL_REGISTER, d);
+        if (r < 0)
+                goto mget_out;
+
+        r = ssu100_getregister(dev, 0, MODEM_STATUS_REGISTER, d+1);
+        if (r < 0)
+                goto mget_out;
+
+        r = (d[0] & SERIAL_MCR_DTR ? TIOCM_DTR : 0) |
+                (d[0] & SERIAL_MCR_RTS ? TIOCM_RTS : 0) |
+                (d[1] & SERIAL_MSR_CTS ? TIOCM_CTS : 0) |
+                (d[1] & SERIAL_MSR_CD ? TIOCM_CAR : 0) |
+                (d[1] & SERIAL_MSR_RI ? TIOCM_RI : 0) |
+                (d[1] & SERIAL_MSR_DSR ? TIOCM_DSR : 0);
+
+mget_out:
+        kfree(d);
+        return r;
+}
+
+static int ssu100_tiocmset(struct tty_struct *tty, struct file *file,
+                           unsigned int set, unsigned int clear)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct usb_device *dev = port->serial->dev;
+
+        dbg("%s\n", __func__);
+        return update_mctrl(dev, set, clear);
+}
+
+static void ssu100_dtr_rts(struct usb_serial_port *port, int on)
+{
+        struct usb_device *dev = port->serial->dev;
+
+        dbg("%s\n", __func__);
+
+        mutex_lock(&port->serial->disc_mutex);
+        if (!port->serial->disconnected) {
+                /* Disable flow control */
+                if (!on &&
+                    ssu100_setregister(dev, 0, 0) < 0)
+                        dev_err(&port->dev, "error from flowcontrol urb\n");
+                /* drop RTS and DTR */
+                if (on)
+                        set_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
+                else
+                        clear_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
+        }
+        mutex_unlock(&port->serial->disc_mutex);
+}
+
+static int ssu100_process_packet(struct tty_struct *tty,
+                                 struct usb_serial_port *port,
+                                 struct ssu100_port_private *priv,
+                                 char *packet, int len)
+{
+        int i;
+        char flag;
+        char *ch;
+
+        dbg("%s - port %d", __func__, port->number);
+
+        if (len < 4) {
+                dbg("%s - malformed packet", __func__);
+                return 0;
+        }
+
+        if ((packet[0] == 0x1b) && (packet[1] == 0x1b) &&
+            ((packet[2] == 0x00) || (packet[2] == 0x01))) {
+                if (packet[2] == 0x00)
+                        priv->shadowLSR = packet[3] & (SERIAL_LSR_OE |
+                                                       SERIAL_LSR_PE |
+                                                       SERIAL_LSR_FE |
+                                                       SERIAL_LSR_BI);
+
+                if (packet[2] == 0x01) {
+                        priv->shadowMSR = packet[3];
+                        wake_up_interruptible(&priv->delta_msr_wait);
+                }
+
+                len -= 4;
+                ch = packet + 4;
+        } else
+                ch = packet;
+
+        if (!len)
+                return 0;       /* status only */
+
+        if (port->port.console && port->sysrq) {
+                for (i = 0; i < len; i++, ch++) {
+                        if (!usb_serial_handle_sysrq_char(tty, port, *ch))
+                                tty_insert_flip_char(tty, *ch, flag);
+                }
+        } else
+                tty_insert_flip_string_fixed_flag(tty, ch, flag, len);
+
+        return len;
+}
+
+static void ssu100_process_read_urb(struct urb *urb)
+{
+        struct usb_serial_port *port = urb->context;
+        struct ssu100_port_private *priv = usb_get_serial_port_data(port);
+        char *data = (char *)urb->transfer_buffer;
+        struct tty_struct *tty;
+        int count = 0;
+        int i;
+        int len;
+
+        dbg("%s", __func__);
+
+        tty = tty_port_tty_get(&port->port);
+        if (!tty)
+                return;
+
+        for (i = 0; i < urb->actual_length; i += priv->max_packet_size) {
+                len = min_t(int, urb->actual_length - i, priv->max_packet_size);
+                count += ssu100_process_packet(tty, port, priv, &data[i], len);
+        }
+
+        if (count)
+                tty_flip_buffer_push(tty);
+        tty_kref_put(tty);
+}
+
+
+static struct usb_serial_driver ssu100_device = {
+        .driver = {
+                .owner = THIS_MODULE,
+                .name = "ssu100",
+        },
+        .description         = DRIVER_DESC,
+        .id_table            = id_table,
+        .usb_driver          = &ssu100_driver,
+        .num_ports           = 1,
+        .bulk_in_size        = 256,
+        .bulk_out_size       = 256,
+        .open                = ssu100_open,
+        .close               = ssu100_close,
+        .attach              = ssu100_attach,
+        .release             = ssu100_release,
+        .dtr_rts             = ssu100_dtr_rts,
+        .process_read_urb    = ssu100_process_read_urb,
+        .tiocmget            = ssu100_tiocmget,
+        .tiocmset            = ssu100_tiocmset,
+        .ioctl               = ssu100_ioctl,
+        .set_termios         = ssu100_set_termios,
+};
+
+static int __init ssu100_init(void)
+{
+        int retval;
+
+        dbg("%s", __func__);
+
+        /* register with usb-serial */
+        retval = usb_serial_register(&ssu100_device);
+
+        if (retval)
+                goto failed_usb_sio_register;
+
+        retval = usb_register(&ssu100_driver);
+        if (retval)
+                goto failed_usb_register;
+
+        printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
+               DRIVER_DESC "\n");
+
+        return 0;
+
+failed_usb_register:
+        usb_serial_deregister(&ssu100_device);
+failed_usb_sio_register:
+        return retval;
+}
+
+static void __exit ssu100_exit(void)
+{
+        usb_deregister(&ssu100_driver);
+        usb_serial_deregister(&ssu100_device);
+}
+
+module_init(ssu100_init);
+module_exit(ssu100_exit);
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 941c2d409f85..2a982e62963b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -653,6 +653,7 @@ exit:
         return id;
 }
 
+/* Caller must hold table_lock */
 static struct usb_serial_driver *search_serial_device(
                                         struct usb_interface *iface)
 {
@@ -718,17 +719,23 @@ int usb_serial_probe(struct usb_interface *interface,
         int num_ports = 0;
         int max_endpoints;
 
-        lock_kernel(); /* guard against unloading a serial driver module */
+        mutex_lock(&table_lock);
         type = search_serial_device(interface);
         if (!type) {
-                unlock_kernel();
+                mutex_unlock(&table_lock);
                 dbg("none matched");
                 return -ENODEV;
         }
 
+        if (!try_module_get(type->driver.owner)) {
+                mutex_unlock(&table_lock);
+                dev_err(&interface->dev, "module get failed, exiting\n");
+                return -EIO;
+        }
+        mutex_unlock(&table_lock);
+
         serial = create_serial(dev, interface, type);
         if (!serial) {
-                unlock_kernel();
                 dev_err(&interface->dev, "%s - out of memory\n", __func__);
                 return -ENOMEM;
         }
@@ -737,20 +744,11 @@ int usb_serial_probe(struct usb_interface *interface,
         if (type->probe) {
                 const struct usb_device_id *id;
 
-                if (!try_module_get(type->driver.owner)) {
-                        unlock_kernel();
-                        dev_err(&interface->dev,
-                                "module get failed, exiting\n");
-                        kfree(serial);
-                        return -EIO;
-                }
-
                 id = get_iface_id(type, interface);
                 retval = type->probe(serial, id);
                 module_put(type->driver.owner);
 
                 if (retval) {
-                        unlock_kernel();
                         dbg("sub driver rejected device");
                         kfree(serial);
                         return retval;
@@ -822,7 +820,6 @@ int usb_serial_probe(struct usb_interface *interface,
                  * properly during a later invocation of usb_serial_probe
                  */
                 if (num_bulk_in == 0 || num_bulk_out == 0) {
-                        unlock_kernel();
                         dev_info(&interface->dev, "PL-2303 hack: descriptors matched but endpoints did not\n");
                         kfree(serial);
                         return -ENODEV;
@@ -835,7 +832,6 @@ int usb_serial_probe(struct usb_interface *interface,
         if (type == &usb_serial_generic_device) {
                 num_ports = num_bulk_out;
                 if (num_ports == 0) {
-                        unlock_kernel();
                         dev_err(&interface->dev,
                             "Generic device with no bulk out, not allowed.\n");
                         kfree(serial);
@@ -847,7 +843,6 @@ int usb_serial_probe(struct usb_interface *interface,
                 /* if this device type has a calc_num_ports function, call it */
                 if (type->calc_num_ports) {
                         if (!try_module_get(type->driver.owner)) {
-                                unlock_kernel();
                                 dev_err(&interface->dev,
                                         "module get failed, exiting\n");
                                 kfree(serial);
@@ -878,7 +873,6 @@ int usb_serial_probe(struct usb_interface *interface,
         max_endpoints = max(max_endpoints, num_interrupt_out);
         max_endpoints = max(max_endpoints, (int)serial->num_ports);
         serial->num_port_pointers = max_endpoints;
-        unlock_kernel();
 
         dbg("%s - setting up %d port structures for this device",
                                                 __func__, max_endpoints);
@@ -1077,6 +1071,8 @@ int usb_serial_probe(struct usb_interface *interface,
                 dev_set_name(&port->dev, "ttyUSB%d", port->number);
                 dbg ("%s - registering %s", __func__, dev_name(&port->dev));
                 port->dev_state = PORT_REGISTERING;
+                device_enable_async_suspend(&port->dev);
+
                 retval = device_add(&port->dev);
                 if (retval) {
                         dev_err(&port->dev, "Error registering port device, "
@@ -1349,6 +1345,7 @@ int usb_serial_register(struct usb_serial_driver *driver)
                 driver->description = driver->driver.name;
 
         /* Add this device to our list of devices */
+        mutex_lock(&table_lock);
         list_add(&driver->driver_list, &usb_serial_driver_list);
 
         retval = usb_serial_bus_register(driver);
@@ -1360,6 +1357,7 @@ int usb_serial_register(struct usb_serial_driver *driver)
                 printk(KERN_INFO "USB Serial support registered for %s\n",
                                                 driver->description);
 
+        mutex_unlock(&table_lock);
         return retval;
 }
 EXPORT_SYMBOL_GPL(usb_serial_register);
@@ -1370,8 +1368,10 @@ void usb_serial_deregister(struct usb_serial_driver *device)
         /* must be called with BKL held */
         printk(KERN_INFO "USB Serial deregistering driver %s\n",
                device->description);
+        mutex_lock(&table_lock);
         list_del(&device->driver_list);
         usb_serial_bus_deregister(device);
+        mutex_unlock(&table_lock);
 }
 EXPORT_SYMBOL_GPL(usb_serial_deregister);
 
diff --git a/drivers/usb/storage/freecom.c b/drivers/usb/storage/freecom.c
index 54cc94277acb..6542ca40d505 100644
--- a/drivers/usb/storage/freecom.c
+++ b/drivers/usb/storage/freecom.c
@@ -269,7 +269,7 @@ static int freecom_transport(struct scsi_cmnd *srb, struct us_data *us)
         /* The firmware will time-out commands after 20 seconds. Some commands
          * can legitimately take longer than this, so we use a different
          * command that only waits for the interrupt and then sends status,
-         * without having to send a new ATAPI command to the device. 
+         * without having to send a new ATAPI command to the device.
          *
          * NOTE: There is some indication that a data transfer after a timeout
          * may not work, but that is a condition that should never happen.
@@ -324,14 +324,14 @@ static int freecom_transport(struct scsi_cmnd *srb, struct us_data *us)
 
         /* Find the length we desire to read. */
         switch (srb->cmnd[0]) {
-                case INQUIRY:
-                case REQUEST_SENSE:             /* 16 or 18 bytes? spec says 18, lots of devices only have 16 */
-                case MODE_SENSE:
-                case MODE_SENSE_10:
-                        length = le16_to_cpu(fst->Count);
-                        break;
-                default:
-                        length = scsi_bufflen(srb);
+        case INQUIRY:
+        case REQUEST_SENSE:     /* 16 or 18 bytes? spec says 18, lots of devices only have 16 */
+        case MODE_SENSE:
+        case MODE_SENSE_10:
+                length = le16_to_cpu(fst->Count);
+                break;
+        default:
+                length = scsi_bufflen(srb);
         }
 
         /* verify that this amount is legal */
@@ -414,7 +414,7 @@ static int freecom_transport(struct scsi_cmnd *srb, struct us_data *us)
                 /* should never hit here -- filtered in usb.c */
                 US_DEBUGP ("freecom unimplemented direction: %d\n",
                                 us->srb->sc_data_direction);
-                // Return fail, SCSI seems to handle this better.
+                /* Return fail, SCSI seems to handle this better. */
                 return USB_STOR_TRANSPORT_FAILED;
                 break;
         }
@@ -494,8 +494,7 @@ static void pdump (void *ibuffer, int length)
                                 offset = 0;
                         }
                         offset += sprintf (line+offset, "%08x:", i);
-                }
-                else if ((i & 7) == 0) {
+                } else if ((i & 7) == 0) {
                         offset += sprintf (line+offset, " -");
                 }
                 offset += sprintf (line+offset, " %02x", buffer[i] & 0xff);
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index e9cbc1467f76..6b9982cd5423 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1456,8 +1456,7 @@ static int isd200_init_info(struct us_data *us)
         int retStatus = ISD200_GOOD;
         struct isd200_info *info;
 
-        info = (struct isd200_info *)
-                        kzalloc(sizeof(struct isd200_info), GFP_KERNEL);
+        info = kzalloc(sizeof(struct isd200_info), GFP_KERNEL);
         if (!info)
                 retStatus = ISD200_ERROR;
         else {
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index a7d0bf9d92a7..90bb0175a152 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -336,6 +336,7 @@ static int usb_stor_control_thread(void * __us)
                 else {
                         US_DEBUG(usb_stor_show_command(us->srb));
                         us->proto_handler(us->srb, us);
+                        usb_mark_last_busy(us->pusb_dev);
                 }
 
                 /* lock access to the state */
@@ -845,6 +846,7 @@ static int usb_stor_scan_thread(void * __us)
                 /* Should we unbind if no devices were detected? */
         }
 
+        usb_autopm_put_interface(us->pusb_intf);
         complete_and_exit(&us->scanning_done, 0);
 }
 
@@ -968,6 +970,7 @@ int usb_stor_probe2(struct us_data *us)
                 goto BadDevice;
         }
 
+        usb_autopm_get_interface_no_resume(us->pusb_intf);
         wake_up_process(th);
 
         return 0;
@@ -1040,6 +1043,7 @@ static struct usb_driver usb_storage_driver = {
         .pre_reset =    usb_stor_pre_reset,
         .post_reset =   usb_stor_post_reset,
         .id_table =     usb_storage_usb_ids,
+        .supports_autosuspend = 1,
         .soft_unbind =  1,
 };
 
diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
index d110588b56f1..552679b8dbd1 100644
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -142,7 +142,7 @@ static int skel_release(struct inode *inode, struct file *file)
 {
         struct usb_skel *dev;
 
-        dev = (struct usb_skel *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL)
                 return -ENODEV;
 
@@ -162,7 +162,7 @@ static int skel_flush(struct file *file, fl_owner_t id)
         struct usb_skel *dev;
         int res;
 
-        dev = (struct usb_skel *)file->private_data;
+        dev = file->private_data;
         if (dev == NULL)
                 return -ENODEV;
 
@@ -246,7 +246,7 @@ static ssize_t skel_read(struct file *file, char *buffer, size_t count,
         int rv;
         bool ongoing_io;
 
-        dev = (struct usb_skel *)file->private_data;
+        dev = file->private_data;
 
         /* if we cannot read at all, return EOF */
         if (!dev->bulk_in_urb || !count)
@@ -401,7 +401,7 @@ static ssize_t skel_write(struct file *file, const char *user_buffer,
         char *buf = NULL;
         size_t writesize = min(count, (size_t)MAX_TRANSFER);
 
-        dev = (struct usb_skel *)file->private_data;
+        dev = file->private_data;
 
         /* verify that we actually have some data to write */
         if (count == 0)
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 3b3f5749af92..26bf7cbfecc2 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -283,7 +283,8 @@ static inline int fbcon_is_inactive(struct vc_data *vc, struct fb_info *info)
         struct fbcon_ops *ops = info->fbcon_par;
 
         return (info->state != FBINFO_STATE_RUNNING ||
-                vc->vc_mode != KD_TEXT || ops->graphics);
+                vc->vc_mode != KD_TEXT || ops->graphics) &&
+                !vt_force_oops_output(vc);
 }
 
 static inline int get_color(struct vc_data *vc, struct fb_info *info,
@@ -1073,6 +1074,7 @@ static void fbcon_init(struct vc_data *vc, int init)
         if (p->userfont)
                 charcnt = FNTCHARCNT(p->fontdata);
 
+        vc->vc_panic_force_write = !!(info->flags & FBINFO_CAN_FORCE_OUTPUT);
         vc->vc_can_do_color = (fb_get_color_depth(&info->var, &info->fix)!=1);
         vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
         if (charcnt == 256) {
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 182dd6f8aadd..54e32c513610 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1108,7 +1108,6 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512)
                 charmap += 4 * cmapsz;
 #endif
 
-        unlock_kernel();
         spin_lock_irq(&vga_lock);
         /* First, the Sequencer */
         vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x1);
@@ -1192,7 +1191,6 @@ static int vgacon_do_font_op(struct vgastate *state,char *arg,int set,int ch512)
                 vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0);    
         }
         spin_unlock_irq(&vga_lock);
-        lock_kernel();
         return 0;
 }
 
diff --git a/drivers/video/w100fb.c b/drivers/video/w100fb.c
index e66b8b19ce5d..d8b12c32e3ef 100644
--- a/drivers/video/w100fb.c
+++ b/drivers/video/w100fb.c
@@ -858,9 +858,9 @@ unsigned long w100fb_gpio_read(int port)
 void w100fb_gpio_write(int port, unsigned long value)
 {
         if (port==W100_GPIO_PORT_A)
-                value = writel(value, remapped_regs + mmGPIO_DATA);
+                writel(value, remapped_regs + mmGPIO_DATA);
         else
-                value = writel(value, remapped_regs + mmGPIO_DATA2);
+                writel(value, remapped_regs + mmGPIO_DATA2);
 }
 EXPORT_SYMBOL(w100fb_gpio_read);
 EXPORT_SYMBOL(w100fb_gpio_write);
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index b04b18468932..4d2992aadfb7 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -73,6 +73,13 @@ config WM8350_WATCHDOG
 
 # ARM Architecture
 
+config ARM_SP805_WATCHDOG
+        tristate "ARM SP805 Watchdog"
+        depends on ARM_AMBA
+        help
+          ARM Primecell SP805 Watchdog timer. This will reboot your system when
+          the timeout is reached.
+
 config AT91RM9200_WATCHDOG
         tristate "AT91RM9200 watchdog"
         depends on ARCH_AT91RM9200
@@ -401,6 +408,17 @@ config ALIM7101_WDT
 
           Most people will say N.
 
+config F71808E_WDT
+        tristate "Fintek F71808E and F71882FG Watchdog"
+        depends on X86 && EXPERIMENTAL
+        help
+          This is the driver for the hardware watchdog on the Fintek
+          F71808E and F71882FG Super I/O controllers.
+
+          You can compile this driver directly into the kernel, or use
+          it as a module.  The module will be called f71808e_wdt.
+
+
 config GEODE_WDT
         tristate "AMD Geode CS5535/CS5536 Watchdog"
         depends on CS5535_MFGPT
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index e30289a5e367..8374503fcc6a 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 # ALPHA Architecture
 
 # ARM Architecture
+obj-$(CONFIG_ARM_SP805_WATCHDOG) += sp805_wdt.o
 obj-$(CONFIG_AT91RM9200_WATCHDOG) += at91rm9200_wdt.o
 obj-$(CONFIG_AT91SAM9X_WATCHDOG) += at91sam9_wdt.o
 obj-$(CONFIG_OMAP_WATCHDOG) += omap_wdt.o
@@ -66,6 +67,7 @@ obj-$(CONFIG_ACQUIRE_WDT) += acquirewdt.o
 obj-$(CONFIG_ADVANTECH_WDT) += advantechwdt.o
 obj-$(CONFIG_ALIM1535_WDT) += alim1535_wdt.o
 obj-$(CONFIG_ALIM7101_WDT) += alim7101_wdt.o
+obj-$(CONFIG_F71808E_WDT) += f71808e_wdt.o
 obj-$(CONFIG_GEODE_WDT) += geodewdt.o
 obj-$(CONFIG_SC520_WDT) += sc520_wdt.o
 obj-$(CONFIG_SBC_FITPC2_WATCHDOG) += sbc_fitpc2_wdt.o
diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
new file mode 100644
index 000000000000..7e5c266cda48
--- /dev/null
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -0,0 +1,768 @@
+/***************************************************************************
+ *   Copyright (C) 2006 by Hans Edgington <hans@edgington.nl>              *
+ *   Copyright (C) 2007-2009 Hans de Goede <hdegoede@redhat.com>           *
+ *   Copyright (C) 2010 Giel van Schijndel <me@mortis.eu>                  *
+ *                                                                         *
+ *   This program is free software; you can redistribute it and/or modify  *
+ *   it under the terms of the GNU General Public License as published by  *
+ *   the Free Software Foundation; either version 2 of the License, or     *
+ *   (at your option) any later version.                                   *
+ *                                                                         *
+ *   This program is distributed in the hope that it will be useful,       *
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ *   GNU General Public License for more details.                          *
+ *                                                                         *
+ *   You should have received a copy of the GNU General Public License     *
+ *   along with this program; if not, write to the                         *
+ *   Free Software Foundation, Inc.,                                       *
+ *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ ***************************************************************************/
+
+#include <linux/err.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
+#include <linux/uaccess.h>
+#include <linux/watchdog.h>
+
+#define DRVNAME "f71808e_wdt"
+
+#define SIO_F71808FG_LD_WDT     0x07    /* Watchdog timer logical device */
+#define SIO_UNLOCK_KEY          0x87    /* Key to enable Super-I/O */
+#define SIO_LOCK_KEY            0xAA    /* Key to diasble Super-I/O */
+
+#define SIO_REG_LDSEL           0x07    /* Logical device select */
+#define SIO_REG_DEVID           0x20    /* Device ID (2 bytes) */
+#define SIO_REG_DEVREV          0x22    /* Device revision */
+#define SIO_REG_MANID           0x23    /* Fintek ID (2 bytes) */
+#define SIO_REG_ENABLE          0x30    /* Logical device enable */
+#define SIO_REG_ADDR            0x60    /* Logical device address (2 bytes) */
+
+#define SIO_FINTEK_ID           0x1934  /* Manufacturers ID */
+#define SIO_F71808_ID           0x0901  /* Chipset ID */
+#define SIO_F71858_ID           0x0507  /* Chipset ID */
+#define SIO_F71862_ID           0x0601  /* Chipset ID */
+#define SIO_F71882_ID           0x0541  /* Chipset ID */
+#define SIO_F71889_ID           0x0723  /* Chipset ID */
+
+#define F71882FG_REG_START              0x01
+
+#define F71808FG_REG_WDO_CONF           0xf0
+#define F71808FG_REG_WDT_CONF           0xf5
+#define F71808FG_REG_WD_TIME            0xf6
+
+#define F71808FG_FLAG_WDOUT_EN          7
+
+#define F71808FG_FLAG_WDTMOUT_STS       5
+#define F71808FG_FLAG_WD_EN             5
+#define F71808FG_FLAG_WD_PULSE          4
+#define F71808FG_FLAG_WD_UNIT           3
+
+/* Default values */
+#define WATCHDOG_TIMEOUT        60      /* 1 minute default timeout */
+#define WATCHDOG_MAX_TIMEOUT    (60 * 255)
+#define WATCHDOG_PULSE_WIDTH    125     /* 125 ms, default pulse width for
+                                           watchdog signal */
+
+static unsigned short force_id;
+module_param(force_id, ushort, 0);
+MODULE_PARM_DESC(force_id, "Override the detected device ID");
+
+static const int max_timeout = WATCHDOG_MAX_TIMEOUT;
+static int timeout = 60;        /* default timeout in seconds */
+module_param(timeout, int, 0);
+MODULE_PARM_DESC(timeout,
+        "Watchdog timeout in seconds. 1<= timeout <="
+                        __MODULE_STRING(WATCHDOG_MAX_TIMEOUT) " (default="
+                        __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
+
+static unsigned int pulse_width = WATCHDOG_PULSE_WIDTH;
+module_param(pulse_width, uint, 0);
+MODULE_PARM_DESC(pulse_width,
+        "Watchdog signal pulse width. 0(=level), 1 ms, 25 ms, 125 ms or 5000 ms"
+                        " (default=" __MODULE_STRING(WATCHDOG_PULSE_WIDTH) ")");
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, bool, 0444);
+MODULE_PARM_DESC(nowayout, "Disable watchdog shutdown on close");
+
+static unsigned int start_withtimeout;
+module_param(start_withtimeout, uint, 0);
+MODULE_PARM_DESC(start_withtimeout, "Start watchdog timer on module load with"
+        " given initial timeout. Zero (default) disables this feature.");
+
+enum chips { f71808fg, f71858fg, f71862fg, f71882fg, f71889fg };
+
+static const char *f71808e_names[] = {
+        "f71808fg",
+        "f71858fg",
+        "f71862fg",
+        "f71882fg",
+        "f71889fg",
+};
+
+/* Super-I/O Function prototypes */
+static inline int superio_inb(int base, int reg);
+static inline int superio_inw(int base, int reg);
+static inline void superio_outb(int base, int reg, u8 val);
+static inline void superio_set_bit(int base, int reg, int bit);
+static inline void superio_clear_bit(int base, int reg, int bit);
+static inline int superio_enter(int base);
+static inline void superio_select(int base, int ld);
+static inline void superio_exit(int base);
+
+struct watchdog_data {
+        unsigned short  sioaddr;
+        enum chips      type;
+        unsigned long   opened;
+        struct mutex    lock;
+        char            expect_close;
+        struct watchdog_info ident;
+
+        unsigned short  timeout;
+        u8              timer_val;      /* content for the wd_time register */
+        char            minutes_mode;
+        u8              pulse_val;      /* pulse width flag */
+        char            pulse_mode;     /* enable pulse output mode? */
+        char            caused_reboot;  /* last reboot was by the watchdog */
+};
+
+static struct watchdog_data watchdog = {
+        .lock = __MUTEX_INITIALIZER(watchdog.lock),
+};
+
+/* Super I/O functions */
+static inline int superio_inb(int base, int reg)
+{
+        outb(reg, base);
+        return inb(base + 1);
+}
+
+static int superio_inw(int base, int reg)
+{
+        int val;
+        val  = superio_inb(base, reg) << 8;
+        val |= superio_inb(base, reg + 1);
+        return val;
+}
+
+static inline void superio_outb(int base, int reg, u8 val)
+{
+        outb(reg, base);
+        outb(val, base + 1);
+}
+
+static inline void superio_set_bit(int base, int reg, int bit)
+{
+        unsigned long val = superio_inb(base, reg);
+        __set_bit(bit, &val);
+        superio_outb(base, reg, val);
+}
+
+static inline void superio_clear_bit(int base, int reg, int bit)
+{
+        unsigned long val = superio_inb(base, reg);
+        __clear_bit(bit, &val);
+        superio_outb(base, reg, val);
+}
+
+static inline int superio_enter(int base)
+{
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                (int)base);
+                return -EBUSY;
+        }
+
+        /* according to the datasheet the key must be send twice! */
+        outb(SIO_UNLOCK_KEY, base);
+        outb(SIO_UNLOCK_KEY, base);
+
+        return 0;
+}
+
+static inline void superio_select(int base, int ld)
+{
+        outb(SIO_REG_LDSEL, base);
+        outb(ld, base + 1);
+}
+
+static inline void superio_exit(int base)
+{
+        outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
+}
+
+static int watchdog_set_timeout(int timeout)
+{
+        if (timeout <= 0
+         || timeout >  max_timeout) {
+                printk(KERN_ERR DRVNAME ": watchdog timeout out of range\n");
+                return -EINVAL;
+        }
+
+        mutex_lock(&watchdog.lock);
+
+        watchdog.timeout = timeout;
+        if (timeout > 0xff) {
+                watchdog.timer_val = DIV_ROUND_UP(timeout, 60);
+                watchdog.minutes_mode = true;
+        } else {
+                watchdog.timer_val = timeout;
+                watchdog.minutes_mode = false;
+        }
+
+        mutex_unlock(&watchdog.lock);
+
+        return 0;
+}
+
+static int watchdog_set_pulse_width(unsigned int pw)
+{
+        int err = 0;
+
+        mutex_lock(&watchdog.lock);
+
+        if        (pw <=    1) {
+                watchdog.pulse_val = 0;
+        } else if (pw <=   25) {
+                watchdog.pulse_val = 1;
+        } else if (pw <=  125) {
+                watchdog.pulse_val = 2;
+        } else if (pw <= 5000) {
+                watchdog.pulse_val = 3;
+        } else {
+                printk(KERN_ERR DRVNAME ": pulse width out of range\n");
+                err = -EINVAL;
+                goto exit_unlock;
+        }
+
+        watchdog.pulse_mode = pw;
+
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+        return err;
+}
+
+static int watchdog_keepalive(void)
+{
+        int err = 0;
+
+        mutex_lock(&watchdog.lock);
+        err = superio_enter(watchdog.sioaddr);
+        if (err)
+                goto exit_unlock;
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+        if (watchdog.minutes_mode)
+                /* select minutes for timer units */
+                superio_set_bit(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                                F71808FG_FLAG_WD_UNIT);
+        else
+                /* select seconds for timer units */
+                superio_clear_bit(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                                F71808FG_FLAG_WD_UNIT);
+
+        /* Set timer value */
+        superio_outb(watchdog.sioaddr, F71808FG_REG_WD_TIME,
+                           watchdog.timer_val);
+
+        superio_exit(watchdog.sioaddr);
+
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+        return err;
+}
+
+static int watchdog_start(void)
+{
+        /* Make sure we don't die as soon as the watchdog is enabled below */
+        int err = watchdog_keepalive();
+        if (err)
+                return err;
+
+        mutex_lock(&watchdog.lock);
+        err = superio_enter(watchdog.sioaddr);
+        if (err)
+                goto exit_unlock;
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+        /* Watchdog pin configuration */
+        switch (watchdog.type) {
+        case f71808fg:
+                /* Set pin 21 to GPIO23/WDTRST#, then to WDTRST# */
+                superio_clear_bit(watchdog.sioaddr, 0x2a, 3);
+                superio_clear_bit(watchdog.sioaddr, 0x2b, 3);
+                break;
+
+        case f71882fg:
+                /* Set pin 56 to WDTRST# */
+                superio_set_bit(watchdog.sioaddr, 0x29, 1);
+                break;
+
+        default:
+                /*
+                 * 'default' label to shut up the compiler and catch
+                 * programmer errors
+                 */
+                err = -ENODEV;
+                goto exit_superio;
+        }
+
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+        superio_set_bit(watchdog.sioaddr, SIO_REG_ENABLE, 0);
+        superio_set_bit(watchdog.sioaddr, F71808FG_REG_WDO_CONF,
+                        F71808FG_FLAG_WDOUT_EN);
+
+        superio_set_bit(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                        F71808FG_FLAG_WD_EN);
+
+        if (watchdog.pulse_mode) {
+                /* Select "pulse" output mode with given duration */
+                u8 wdt_conf = superio_inb(watchdog.sioaddr,
+                                F71808FG_REG_WDT_CONF);
+
+                /* Set WD_PSWIDTH bits (1:0) */
+                wdt_conf = (wdt_conf & 0xfc) | (watchdog.pulse_val & 0x03);
+                /* Set WD_PULSE to "pulse" mode */
+                wdt_conf |= BIT(F71808FG_FLAG_WD_PULSE);
+
+                superio_outb(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                                wdt_conf);
+        } else {
+                /* Select "level" output mode */
+                superio_clear_bit(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                                F71808FG_FLAG_WD_PULSE);
+        }
+
+exit_superio:
+        superio_exit(watchdog.sioaddr);
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+
+        return err;
+}
+
+static int watchdog_stop(void)
+{
+        int err = 0;
+
+        mutex_lock(&watchdog.lock);
+        err = superio_enter(watchdog.sioaddr);
+        if (err)
+                goto exit_unlock;
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+        superio_clear_bit(watchdog.sioaddr, F71808FG_REG_WDT_CONF,
+                        F71808FG_FLAG_WD_EN);
+
+        superio_exit(watchdog.sioaddr);
+
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+
+        return err;
+}
+
+static int watchdog_get_status(void)
+{
+        int status = 0;
+
+        mutex_lock(&watchdog.lock);
+        status = (watchdog.caused_reboot) ? WDIOF_CARDRESET : 0;
+        mutex_unlock(&watchdog.lock);
+
+        return status;
+}
+
+static bool watchdog_is_running(void)
+{
+        /*
+         * if we fail to determine the watchdog's status assume it to be
+         * running to be on the safe side
+         */
+        bool is_running = true;
+
+        mutex_lock(&watchdog.lock);
+        if (superio_enter(watchdog.sioaddr))
+                goto exit_unlock;
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+        is_running = (superio_inb(watchdog.sioaddr, SIO_REG_ENABLE) & BIT(0))
+                && (superio_inb(watchdog.sioaddr, F71808FG_REG_WDT_CONF)
+                        & F71808FG_FLAG_WD_EN);
+
+        superio_exit(watchdog.sioaddr);
+
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+        return is_running;
+}
+
+/* /dev/watchdog api */
+
+static int watchdog_open(struct inode *inode, struct file *file)
+{
+        int err;
+
+        /* If the watchdog is alive we don't need to start it again */
+        if (test_and_set_bit(0, &watchdog.opened))
+                return -EBUSY;
+
+        err = watchdog_start();
+        if (err) {
+                clear_bit(0, &watchdog.opened);
+                return err;
+        }
+
+        if (nowayout)
+                __module_get(THIS_MODULE);
+
+        watchdog.expect_close = 0;
+        return nonseekable_open(inode, file);
+}
+
+static int watchdog_release(struct inode *inode, struct file *file)
+{
+        clear_bit(0, &watchdog.opened);
+
+        if (!watchdog.expect_close) {
+                watchdog_keepalive();
+                printk(KERN_CRIT DRVNAME
+                        ": Unexpected close, not stopping watchdog!\n");
+        } else if (!nowayout) {
+                watchdog_stop();
+        }
+        return 0;
+}
+
+/*
+ *      watchdog_write:
+ *      @file: file handle to the watchdog
+ *      @buf: buffer to write
+ *      @count: count of bytes
+ *      @ppos: pointer to the position to write. No seeks allowed
+ *
+ *      A write to a watchdog device is defined as a keepalive signal. Any
+ *      write of data will do, as we we don't define content meaning.
+ */
+
+static ssize_t watchdog_write(struct file *file, const char __user *buf,
+                            size_t count, loff_t *ppos)
+{
+        if (count) {
+                if (!nowayout) {
+                        size_t i;
+
+                        /* In case it was set long ago */
+                        bool expect_close = false;
+
+                        for (i = 0; i != count; i++) {
+                                char c;
+                                if (get_user(c, buf + i))
+                                        return -EFAULT;
+                                expect_close = (c == 'V');
+                        }
+
+                        /* Properly order writes across fork()ed processes */
+                        mutex_lock(&watchdog.lock);
+                        watchdog.expect_close = expect_close;
+                        mutex_unlock(&watchdog.lock);
+                }
+
+                /* someone wrote to us, we should restart timer */
+                watchdog_keepalive();
+        }
+        return count;
+}
+
+/*
+ *      watchdog_ioctl:
+ *      @inode: inode of the device
+ *      @file: file handle to the device
+ *      @cmd: watchdog command
+ *      @arg: argument pointer
+ *
+ *      The watchdog API defines a common set of functions for all watchdogs
+ *      according to their available features.
+ */
+static long watchdog_ioctl(struct file *file, unsigned int cmd,
+        unsigned long arg)
+{
+        int status;
+        int new_options;
+        int new_timeout;
+        union {
+                struct watchdog_info __user *ident;
+                int __user *i;
+        } uarg;
+
+        uarg.i = (int __user *)arg;
+
+        switch (cmd) {
+        case WDIOC_GETSUPPORT:
+                return copy_to_user(uarg.ident, &watchdog.ident,
+                        sizeof(watchdog.ident)) ? -EFAULT : 0;
+
+        case WDIOC_GETSTATUS:
+                status = watchdog_get_status();
+                if (status < 0)
+                        return status;
+                return put_user(status, uarg.i);
+
+        case WDIOC_GETBOOTSTATUS:
+                return put_user(0, uarg.i);
+
+        case WDIOC_SETOPTIONS:
+                if (get_user(new_options, uarg.i))
+                        return -EFAULT;
+
+                if (new_options & WDIOS_DISABLECARD)
+                        watchdog_stop();
+
+                if (new_options & WDIOS_ENABLECARD)
+                        return watchdog_start();
+
+
+        case WDIOC_KEEPALIVE:
+                watchdog_keepalive();
+                return 0;
+
+        case WDIOC_SETTIMEOUT:
+                if (get_user(new_timeout, uarg.i))
+                        return -EFAULT;
+
+                if (watchdog_set_timeout(new_timeout))
+                        return -EINVAL;
+
+                watchdog_keepalive();
+                /* Fall */
+
+        case WDIOC_GETTIMEOUT:
+                return put_user(watchdog.timeout, uarg.i);
+
+        default:
+                return -ENOTTY;
+
+        }
+}
+
+static int watchdog_notify_sys(struct notifier_block *this, unsigned long code,
+        void *unused)
+{
+        if (code == SYS_DOWN || code == SYS_HALT)
+                watchdog_stop();
+        return NOTIFY_DONE;
+}
+
+static const struct file_operations watchdog_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .open           = watchdog_open,
+        .release        = watchdog_release,
+        .write          = watchdog_write,
+        .unlocked_ioctl = watchdog_ioctl,
+};
+
+static struct miscdevice watchdog_miscdev = {
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &watchdog_fops,
+};
+
+static struct notifier_block watchdog_notifier = {
+        .notifier_call = watchdog_notify_sys,
+};
+
+static int __init watchdog_init(int sioaddr)
+{
+        int wdt_conf, err = 0;
+
+        /* No need to lock watchdog.lock here because no entry points
+         * into the module have been registered yet.
+         */
+        watchdog.sioaddr = sioaddr;
+        watchdog.ident.options = WDIOC_SETTIMEOUT
+                                | WDIOF_MAGICCLOSE
+                                | WDIOF_KEEPALIVEPING;
+
+        snprintf(watchdog.ident.identity,
+                sizeof(watchdog.ident.identity), "%s watchdog",
+                f71808e_names[watchdog.type]);
+
+        err = superio_enter(sioaddr);
+        if (err)
+                return err;
+        superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+        wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF);
+        watchdog.caused_reboot = wdt_conf & F71808FG_FLAG_WDTMOUT_STS;
+
+        superio_exit(sioaddr);
+
+        err = watchdog_set_timeout(timeout);
+        if (err)
+                return err;
+        err = watchdog_set_pulse_width(pulse_width);
+        if (err)
+                return err;
+
+        err = register_reboot_notifier(&watchdog_notifier);
+        if (err)
+                return err;
+
+        err = misc_register(&watchdog_miscdev);
+        if (err) {
+                printk(KERN_ERR DRVNAME
+                        ": cannot register miscdev on minor=%d\n",
+                                watchdog_miscdev.minor);
+                goto exit_reboot;
+        }
+
+        if (start_withtimeout) {
+                if (start_withtimeout <= 0
+                 || start_withtimeout >  max_timeout) {
+                        printk(KERN_ERR DRVNAME
+                                ": starting timeout out of range\n");
+                        err = -EINVAL;
+                        goto exit_miscdev;
+                }
+
+                err = watchdog_start();
+                if (err) {
+                        printk(KERN_ERR DRVNAME
+                                ": cannot start watchdog timer\n");
+                        goto exit_miscdev;
+                }
+
+                mutex_lock(&watchdog.lock);
+                err = superio_enter(sioaddr);
+                if (err)
+                        goto exit_unlock;
+                superio_select(watchdog.sioaddr, SIO_F71808FG_LD_WDT);
+
+                if (start_withtimeout > 0xff) {
+                        /* select minutes for timer units */
+                        superio_set_bit(sioaddr, F71808FG_REG_WDT_CONF,
+                                F71808FG_FLAG_WD_UNIT);
+                        superio_outb(sioaddr, F71808FG_REG_WD_TIME,
+                                DIV_ROUND_UP(start_withtimeout, 60));
+                } else {
+                        /* select seconds for timer units */
+                        superio_clear_bit(sioaddr, F71808FG_REG_WDT_CONF,
+                                F71808FG_FLAG_WD_UNIT);
+                        superio_outb(sioaddr, F71808FG_REG_WD_TIME,
+                                start_withtimeout);
+                }
+
+                superio_exit(sioaddr);
+                mutex_unlock(&watchdog.lock);
+
+                if (nowayout)
+                        __module_get(THIS_MODULE);
+
+                printk(KERN_INFO DRVNAME
+                        ": watchdog started with initial timeout of %u sec\n",
+                        start_withtimeout);
+        }
+
+        return 0;
+
+exit_unlock:
+        mutex_unlock(&watchdog.lock);
+exit_miscdev:
+        misc_deregister(&watchdog_miscdev);
+exit_reboot:
+        unregister_reboot_notifier(&watchdog_notifier);
+
+        return err;
+}
+
+static int __init f71808e_find(int sioaddr)
+{
+        u16 devid;
+        int err = superio_enter(sioaddr);
+        if (err)
+                return err;
+
+        devid = superio_inw(sioaddr, SIO_REG_MANID);
+        if (devid != SIO_FINTEK_ID) {
+                pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
+                goto exit;
+        }
+
+        devid = force_id ? force_id : superio_inw(sioaddr, SIO_REG_DEVID);
+        switch (devid) {
+        case SIO_F71808_ID:
+                watchdog.type = f71808fg;
+                break;
+        case SIO_F71882_ID:
+                watchdog.type = f71882fg;
+                break;
+        case SIO_F71862_ID:
+        case SIO_F71889_ID:
+                /* These have a watchdog, though it isn't implemented (yet). */
+                err = -ENOSYS;
+                goto exit;
+        case SIO_F71858_ID:
+                /* Confirmed (by datasheet) not to have a watchdog. */
+                err = -ENODEV;
+                goto exit;
+        default:
+                printk(KERN_INFO DRVNAME ": Unrecognized Fintek device: %04x\n",
+                       (unsigned int)devid);
+                err = -ENODEV;
+                goto exit;
+        }
+
+        printk(KERN_INFO DRVNAME ": Found %s watchdog chip, revision %d\n",
+                f71808e_names[watchdog.type],
+                (int)superio_inb(sioaddr, SIO_REG_DEVREV));
+exit:
+        superio_exit(sioaddr);
+        return err;
+}
+
+static int __init f71808e_init(void)
+{
+        static const unsigned short addrs[] = { 0x2e, 0x4e };
+        int err = -ENODEV;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+                err = f71808e_find(addrs[i]);
+                if (err == 0)
+                        break;
+        }
+        if (i == ARRAY_SIZE(addrs))
+                return err;
+
+        return watchdog_init(addrs[i]);
+}
+
+static void __exit f71808e_exit(void)
+{
+        if (watchdog_is_running()) {
+                printk(KERN_WARNING DRVNAME
+                        ": Watchdog timer still running, stopping it\n");
+                watchdog_stop();
+        }
+        misc_deregister(&watchdog_miscdev);
+        unregister_reboot_notifier(&watchdog_notifier);
+}
+
+MODULE_DESCRIPTION("F71808E Watchdog Driver");
+MODULE_AUTHOR("Giel van Schijndel <me@mortis.eu>");
+MODULE_LICENSE("GPL");
+
+module_init(f71808e_init);
+module_exit(f71808e_exit);
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 809e7167a624..fd312fc8940e 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -246,8 +246,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                         physical_bios_offset);
                 printk(KERN_DEBUG "hpwdt: CRU Length:         0x%lx\n",
                         cru_length);
-                printk(KERN_DEBUG "hpwdt: CRU Mapped Address: 0x%x\n",
-                        (unsigned int)&cru_rom_addr);
+                printk(KERN_DEBUG "hpwdt: CRU Mapped Address: %p\n",
+                        &cru_rom_addr);
         }
         iounmap(bios32_map);
         return retval;
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 300932580ded..ae53662c29bc 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -532,21 +532,22 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
 static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
-        s3c2410wdt_cpufreq_deregister();
-
-        release_resource(wdt_mem);
-        kfree(wdt_mem);
-        wdt_mem = NULL;
+        misc_deregister(&s3c2410wdt_miscdev);
 
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
+        s3c2410wdt_cpufreq_deregister();
 
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
         wdt_clock = NULL;
 
+        free_irq(wdt_irq->start, dev);
+        wdt_irq = NULL;
+
         iounmap(wdt_base);
-        misc_deregister(&s3c2410wdt_miscdev);
+
+        release_resource(wdt_mem);
+        kfree(wdt_mem);
+        wdt_mem = NULL;
         return 0;
 }
 
diff --git a/drivers/watchdog/sch311x_wdt.c b/drivers/watchdog/sch311x_wdt.c
index 9c40f48804f5..0461858e07d0 100644
--- a/drivers/watchdog/sch311x_wdt.c
+++ b/drivers/watchdog/sch311x_wdt.c
@@ -425,6 +425,8 @@ static int __devinit sch311x_wdt_probe(struct platform_device *pdev)
         val = therm_trip ? 0x06 : 0x04;
         outb(val, sch311x_wdt_data.runtime_reg + RESGEN);
 
+        sch311x_wdt_miscdev.parent = dev;
+
         err = misc_register(&sch311x_wdt_miscdev);
         if (err != 0) {
                 dev_err(dev, "cannot register miscdev on minor=%d (err=%d)\n",
@@ -432,8 +434,6 @@ static int __devinit sch311x_wdt_probe(struct platform_device *pdev)
                 goto exit_release_region3;
         }
 
-        sch311x_wdt_miscdev.parent = dev;
-
         dev_info(dev,
                 "SMSC SCH311x WDT initialized. timeout=%d sec (nowayout=%d)\n",
                 timeout, nowayout);
diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
new file mode 100644
index 000000000000..9127eda2145b
--- /dev/null
+++ b/drivers/watchdog/sp805_wdt.c
@@ -0,0 +1,387 @@
+/*
+ * drivers/char/watchdog/sp805-wdt.c
+ *
+ * Watchdog driver for ARM SP805 watchdog module
+ *
+ * Copyright (C) 2010 ST Microelectronics
+ * Viresh Kumar<viresh.kumar@st.com>
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2 or later. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+
+#include <linux/device.h>
+#include <linux/resource.h>
+#include <linux/amba/bus.h>
+#include <linux/bitops.h>
+#include <linux/clk.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/math64.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/watchdog.h>
+
+/* default timeout in seconds */
+#define DEFAULT_TIMEOUT         60
+
+#define MODULE_NAME             "sp805-wdt"
+
+/* watchdog register offsets and masks */
+#define WDTLOAD                 0x000
+        #define LOAD_MIN        0x00000001
+        #define LOAD_MAX        0xFFFFFFFF
+#define WDTVALUE                0x004
+#define WDTCONTROL              0x008
+        /* control register masks */
+        #define INT_ENABLE      (1 << 0)
+        #define RESET_ENABLE    (1 << 1)
+#define WDTINTCLR               0x00C
+#define WDTRIS                  0x010
+#define WDTMIS                  0x014
+        #define INT_MASK        (1 << 0)
+#define WDTLOCK                 0xC00
+        #define UNLOCK          0x1ACCE551
+        #define LOCK            0x00000001
+
+/**
+ * struct sp805_wdt: sp805 wdt device structure
+ *
+ * lock: spin lock protecting dev structure and io access
+ * base: base address of wdt
+ * clk: clock structure of wdt
+ * dev: amba device structure of wdt
+ * status: current status of wdt
+ * load_val: load value to be set for current timeout
+ * timeout: current programmed timeout
+ */
+struct sp805_wdt {
+        spinlock_t                      lock;
+        void __iomem                    *base;
+        struct clk                      *clk;
+        struct amba_device              *adev;
+        unsigned long                   status;
+        #define WDT_BUSY                0
+        #define WDT_CAN_BE_CLOSED       1
+        unsigned int                    load_val;
+        unsigned int                    timeout;
+};
+
+/* local variables */
+static struct sp805_wdt *wdt;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+/* This routine finds load value that will reset system in required timout */
+static void wdt_setload(unsigned int timeout)
+{
+        u64 load, rate;
+
+        rate = clk_get_rate(wdt->clk);
+
+        /*
+         * sp805 runs counter with given value twice, after the end of first
+         * counter it gives an interrupt and then starts counter again. If
+         * interrupt already occured then it resets the system. This is why
+         * load is half of what should be required.
+         */
+        load = div_u64(rate, 2) * timeout - 1;
+
+        load = (load > LOAD_MAX) ? LOAD_MAX : load;
+        load = (load < LOAD_MIN) ? LOAD_MIN : load;
+
+        spin_lock(&wdt->lock);
+        wdt->load_val = load;
+        /* roundup timeout to closest positive integer value */
+        wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate);
+        spin_unlock(&wdt->lock);
+}
+
+/* returns number of seconds left for reset to occur */
+static u32 wdt_timeleft(void)
+{
+        u64 load, rate;
+
+        rate = clk_get_rate(wdt->clk);
+
+        spin_lock(&wdt->lock);
+        load = readl(wdt->base + WDTVALUE);
+
+        /*If the interrupt is inactive then time left is WDTValue + WDTLoad. */
+        if (!(readl(wdt->base + WDTRIS) & INT_MASK))
+                load += wdt->load_val + 1;
+        spin_unlock(&wdt->lock);
+
+        return div_u64(load, rate);
+}
+
+/* enables watchdog timers reset */
+static void wdt_enable(void)
+{
+        spin_lock(&wdt->lock);
+
+        writel(UNLOCK, wdt->base + WDTLOCK);
+        writel(wdt->load_val, wdt->base + WDTLOAD);
+        writel(INT_MASK, wdt->base + WDTINTCLR);
+        writel(INT_ENABLE | RESET_ENABLE, wdt->base + WDTCONTROL);
+        writel(LOCK, wdt->base + WDTLOCK);
+
+        spin_unlock(&wdt->lock);
+}
+
+/* disables watchdog timers reset */
+static void wdt_disable(void)
+{
+        spin_lock(&wdt->lock);
+
+        writel(UNLOCK, wdt->base + WDTLOCK);
+        writel(0, wdt->base + WDTCONTROL);
+        writel(0, wdt->base + WDTLOAD);
+        writel(LOCK, wdt->base + WDTLOCK);
+
+        spin_unlock(&wdt->lock);
+}
+
+static ssize_t sp805_wdt_write(struct file *file, const char *data,
+                size_t len, loff_t *ppos)
+{
+        if (len) {
+                if (!nowayout) {
+                        size_t i;
+
+                        clear_bit(WDT_CAN_BE_CLOSED, &wdt->status);
+
+                        for (i = 0; i != len; i++) {
+                                char c;
+
+                                if (get_user(c, data + i))
+                                        return -EFAULT;
+                                /* Check for Magic Close character */
+                                if (c == 'V') {
+                                        set_bit(WDT_CAN_BE_CLOSED,
+                                                        &wdt->status);
+                                        break;
+                                }
+                        }
+                }
+                wdt_enable();
+        }
+        return len;
+}
+
+static const struct watchdog_info ident = {
+        .options = WDIOF_MAGICCLOSE | WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+        .identity = MODULE_NAME,
+};
+
+static long sp805_wdt_ioctl(struct file *file, unsigned int cmd,
+                unsigned long arg)
+{
+        int ret = -ENOTTY;
+        unsigned int timeout;
+
+        switch (cmd) {
+        case WDIOC_GETSUPPORT:
+                ret = copy_to_user((struct watchdog_info *)arg, &ident,
+                                sizeof(ident)) ? -EFAULT : 0;
+                break;
+
+        case WDIOC_GETSTATUS:
+                ret = put_user(0, (int *)arg);
+                break;
+
+        case WDIOC_KEEPALIVE:
+                wdt_enable();
+                ret = 0;
+                break;
+
+        case WDIOC_SETTIMEOUT:
+                ret = get_user(timeout, (unsigned int *)arg);
+                if (ret)
+                        break;
+
+                wdt_setload(timeout);
+
+                wdt_enable();
+                /* Fall through */
+
+        case WDIOC_GETTIMEOUT:
+                ret = put_user(wdt->timeout, (unsigned int *)arg);
+                break;
+        case WDIOC_GETTIMELEFT:
+                ret = put_user(wdt_timeleft(), (unsigned int *)arg);
+                break;
+        }
+        return ret;
+}
+
+static int sp805_wdt_open(struct inode *inode, struct file *file)
+{
+        int ret = 0;
+
+        if (test_and_set_bit(WDT_BUSY, &wdt->status))
+                return -EBUSY;
+
+        ret = clk_enable(wdt->clk);
+        if (ret) {
+                dev_err(&wdt->adev->dev, "clock enable fail");
+                goto err;
+        }
+
+        wdt_enable();
+
+        /* can not be closed, once enabled */
+        clear_bit(WDT_CAN_BE_CLOSED, &wdt->status);
+        return nonseekable_open(inode, file);
+
+err:
+        clear_bit(WDT_BUSY, &wdt->status);
+        return ret;
+}
+
+static int sp805_wdt_release(struct inode *inode, struct file *file)
+{
+        if (!test_bit(WDT_CAN_BE_CLOSED, &wdt->status)) {
+                clear_bit(WDT_BUSY, &wdt->status);
+                dev_warn(&wdt->adev->dev, "Device closed unexpectedly\n");
+                return 0;
+        }
+
+        wdt_disable();
+        clk_disable(wdt->clk);
+        clear_bit(WDT_BUSY, &wdt->status);
+
+        return 0;
+}
+
+static const struct file_operations sp805_wdt_fops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .write = sp805_wdt_write,
+        .unlocked_ioctl = sp805_wdt_ioctl,
+        .open = sp805_wdt_open,
+        .release = sp805_wdt_release,
+};
+
+static struct miscdevice sp805_wdt_miscdev = {
+        .minor = WATCHDOG_MINOR,
+        .name = "watchdog",
+        .fops = &sp805_wdt_fops,
+};
+
+static int __devinit
+sp805_wdt_probe(struct amba_device *adev, struct amba_id *id)
+{
+        int ret = 0;
+
+        if (!request_mem_region(adev->res.start, resource_size(&adev->res),
+                                "sp805_wdt")) {
+                dev_warn(&adev->dev, "Failed to get memory region resource\n");
+                ret = -ENOENT;
+                goto err;
+        }
+
+        wdt = kzalloc(sizeof(*wdt), GFP_KERNEL);
+        if (!wdt) {
+                dev_warn(&adev->dev, "Kzalloc failed\n");
+                ret = -ENOMEM;
+                goto err_kzalloc;
+        }
+
+        wdt->clk = clk_get(&adev->dev, NULL);
+        if (IS_ERR(wdt->clk)) {
+                dev_warn(&adev->dev, "Clock not found\n");
+                ret = PTR_ERR(wdt->clk);
+                goto err_clk_get;
+        }
+
+        wdt->base = ioremap(adev->res.start, resource_size(&adev->res));
+        if (!wdt->base) {
+                ret = -ENOMEM;
+                dev_warn(&adev->dev, "ioremap fail\n");
+                goto err_ioremap;
+        }
+
+        wdt->adev = adev;
+        spin_lock_init(&wdt->lock);
+        wdt_setload(DEFAULT_TIMEOUT);
+
+        ret = misc_register(&sp805_wdt_miscdev);
+        if (ret < 0) {
+                dev_warn(&adev->dev, "cannot register misc device\n");
+                goto err_misc_register;
+        }
+
+        dev_info(&adev->dev, "registration successful\n");
+        return 0;
+
+err_misc_register:
+        iounmap(wdt->base);
+err_ioremap:
+        clk_put(wdt->clk);
+err_clk_get:
+        kfree(wdt);
+        wdt = NULL;
+err_kzalloc:
+        release_mem_region(adev->res.start, resource_size(&adev->res));
+err:
+        dev_err(&adev->dev, "Probe Failed!!!\n");
+        return ret;
+}
+
+static int __devexit sp805_wdt_remove(struct amba_device *adev)
+{
+        misc_deregister(&sp805_wdt_miscdev);
+        iounmap(wdt->base);
+        clk_put(wdt->clk);
+        kfree(wdt);
+        release_mem_region(adev->res.start, resource_size(&adev->res));
+
+        return 0;
+}
+
+static struct amba_id sp805_wdt_ids[] __initdata = {
+        {
+                .id     = 0x00141805,
+                .mask   = 0x00ffffff,
+        },
+        { 0, 0 },
+};
+
+static struct amba_driver sp805_wdt_driver = {
+        .drv = {
+                .name   = MODULE_NAME,
+        },
+        .id_table       = sp805_wdt_ids,
+        .probe          = sp805_wdt_probe,
+        .remove = __devexit_p(sp805_wdt_remove),
+};
+
+static int __init sp805_wdt_init(void)
+{
+        return amba_driver_register(&sp805_wdt_driver);
+}
+module_init(sp805_wdt_init);
+
+static void __exit sp805_wdt_exit(void)
+{
+        amba_driver_unregister(&sp805_wdt_driver);
+}
+module_exit(sp805_wdt_exit);
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout,
+                "Set to 1 to keep watchdog running after device release");
+
+MODULE_AUTHOR("Viresh Kumar <viresh.kumar@st.com>");
+MODULE_DESCRIPTION("ARM SP805 Watchdog Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/watchdog/wdt_pci.c b/drivers/watchdog/wdt_pci.c
index 7b22e3cdbc81..6130c88fa5ac 100644
--- a/drivers/watchdog/wdt_pci.c
+++ b/drivers/watchdog/wdt_pci.c
@@ -60,19 +60,6 @@
 
 #define PFX "wdt_pci: "
 
-/*
- * Until Access I/O gets their application for a PCI vendor ID approved,
- * I don't think that it's appropriate to move these constants into the
- * regular pci_ids.h file. -- JPN 2000/01/18
- */
-
-#ifndef PCI_VENDOR_ID_ACCESSIO
-#define PCI_VENDOR_ID_ACCESSIO 0x494f
-#endif
-#ifndef PCI_DEVICE_ID_WDG_CSM
-#define PCI_DEVICE_ID_WDG_CSM 0x22c0
-#endif
-
 /* We can only use 1 card due to the /dev/watchdog restriction */
 static int dev_count;
 
@@ -743,7 +730,7 @@ static void __devexit wdtpci_remove_one(struct pci_dev *pdev)
 static struct pci_device_id wdtpci_pci_tbl[] = {
         {
                 .vendor    = PCI_VENDOR_ID_ACCESSIO,
-                .device    = PCI_DEVICE_ID_WDG_CSM,
+                .device    = PCI_DEVICE_ID_ACCESSIO_WDG_CSM,
                 .subvendor = PCI_ANY_ID,
                 .subdevice = PCI_ANY_ID,
         },
diff --git a/drivers/zorro/proc.c b/drivers/zorro/proc.c
index 3c7046d79654..cafc50454292 100644
--- a/drivers/zorro/proc.c
+++ b/drivers/zorro/proc.c
@@ -22,8 +22,9 @@ static loff_t
 proc_bus_zorro_lseek(struct file *file, loff_t off, int whence)
 {
         loff_t new = -1;
+        struct inode *inode = file->f_path.dentry->d_inode;
 
-        lock_kernel();
+        mutex_lock(&inode->i_mutex);
         switch (whence) {
         case 0:
                 new = off;
@@ -35,12 +36,12 @@ proc_bus_zorro_lseek(struct file *file, loff_t off, int whence)
                 new = sizeof(struct ConfigDev) + off;
                 break;
         }
-        if (new < 0 || new > sizeof(struct ConfigDev)) {
-                unlock_kernel();
-                return -EINVAL;
-        }
-        unlock_kernel();
-        return (file->f_pos = new);
+        if (new < 0 || new > sizeof(struct ConfigDev))
+                new = -EINVAL;
+        else
+                file->f_pos = new;
+        mutex_unlock(&inode->i_mutex);
+        return new;
 }
 
 static ssize_t
@@ -67,7 +68,7 @@ proc_bus_zorro_read(struct file *file, char __user *buf, size_t nbytes, loff_t *
         cd.cd_BoardAddr = (void *)zorro_resource_start(z);
         cd.cd_BoardSize = zorro_resource_len(z);
 
-        if (copy_to_user(buf, &cd, nbytes))
+        if (copy_to_user(buf, (void *)&cd + pos, nbytes))
                 return -EFAULT;
         *ppos += nbytes;