490 files changed, 19698 insertions, 6420 deletions

diff --git a/drivers/Makefile b/drivers/Makefile
index 34f1e1064dbc..f42a03029b7c 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -17,6 +17,7 @@ obj-$(CONFIG_SFI)		+= sfi/
 obj-$(CONFIG_PNP)               += pnp/
 obj-$(CONFIG_ARM_AMBA)          += amba/
 
+obj-$(CONFIG_VIRTIO)            += virtio/
 obj-$(CONFIG_XEN)               += xen/
 
 # regulators early, since some subsystems rely on them to initialize
@@ -108,7 +109,6 @@ obj-$(CONFIG_PPC_PS3)		+= ps3/
 obj-$(CONFIG_OF)                += of/
 obj-$(CONFIG_SSB)               += ssb/
 obj-$(CONFIG_VHOST_NET)         += vhost/
-obj-$(CONFIG_VIRTIO)            += virtio/
 obj-$(CONFIG_VLYNQ)             += vlynq/
 obj-$(CONFIG_STAGING)           += staging/
 obj-y                           += platform/
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 19dacfd43163..62122134693b 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -31,7 +31,7 @@
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
-#define ACPI_PROCESSOR_AGGREGATOR_CLASS "processor_aggregator"
+#define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 37132dc2da03..743576bf1bd7 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -527,7 +527,7 @@ int acpi_bus_generate_proc_event4(const char *device_class, const char *bus_id,
         if (!event_is_open)
                 return 0;
 
-        event = kmalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
+        event = kzalloc(sizeof(struct acpi_bus_event), GFP_ATOMIC);
         if (!event)
                 return -ENOMEM;
 
diff --git a/drivers/acpi/hest.c b/drivers/acpi/hest.c
index 4bb18c980ac6..1c527a192872 100644
--- a/drivers/acpi/hest.c
+++ b/drivers/acpi/hest.c
@@ -123,6 +123,10 @@ int acpi_hest_firmware_first_pci(struct pci_dev *pci)
 {
         acpi_status status = AE_NOT_FOUND;
         struct acpi_table_header *hest = NULL;
+
+        if (acpi_disabled)
+                return 0;
+
         status = acpi_get_table(ACPI_SIG_HEST, 1, &hest);
 
         if (ACPI_SUCCESS(status)) {
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index b0a71ecee682..e4804fb05e23 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -401,11 +401,13 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
          * driver reported one, then use it. Exit in any case.
          */
         if (gsi < 0) {
+                u32 dev_gsi;
                 dev_warn(&dev->dev, "PCI INT %c: no GSI", pin_name(pin));
                 /* Interrupt Line values above 0xF are forbidden */
-                if (dev->irq > 0 && (dev->irq <= 0xF)) {
-                        printk(" - using IRQ %d\n", dev->irq);
-                        acpi_register_gsi(&dev->dev, dev->irq,
+                if (dev->irq > 0 && (dev->irq <= 0xF) &&
+                    (acpi_isa_irq_to_gsi(dev->irq, &dev_gsi) == 0)) {
+                        printk(" - using ISA IRQ %d\n", dev->irq);
+                        acpi_register_gsi(&dev->dev, dev_gsi,
                                           ACPI_LEVEL_SENSITIVE,
                                           ACPI_ACTIVE_LOW);
                         return 0;
diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
index e8c32a49f14e..66f67293341e 100644
--- a/drivers/acpi/power_meter.c
+++ b/drivers/acpi/power_meter.c
@@ -35,7 +35,7 @@
 #define ACPI_POWER_METER_NAME           "power_meter"
 ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
 #define ACPI_POWER_METER_DEVICE_NAME    "Power Meter"
-#define ACPI_POWER_METER_CLASS          "power_meter_resource"
+#define ACPI_POWER_METER_CLASS          "pwr_meter_resource"
 
 #define NUM_SENSORS                     17
 
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 5939e7f7d8e9..c3817e1f32c7 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -698,7 +698,7 @@ static int acpi_processor_power_seq_show(struct seq_file *seq, void *offset)
                    "max_cstate:              C%d\n"
                    "maximum allowed latency: %d usec\n",
                    pr->power.state ? pr->power.state - pr->power.states : 0,
-                   max_cstate, pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY));
+                   max_cstate, pm_qos_request(PM_QOS_CPU_DMA_LATENCY));
 
         seq_puts(seq, "states:\n");
 
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index 36704b887ccf..f8be23b6c129 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -18,7 +18,7 @@
 
 #define PREFIX "ACPI: "
 
-#define ACPI_SMB_HC_CLASS       "smbus_host_controller"
+#define ACPI_SMB_HC_CLASS       "smbus_host_ctl"
 #define ACPI_SMB_HC_DEVICE_NAME "ACPI SMBus HC"
 
 struct acpi_smb_hc {
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index f74834a544fd..baa76bbf244a 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -450,6 +450,38 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 },
         },
         {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad T410",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad T510",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad W510",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Lenovo ThinkPad X201[s]",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
+                },
+        },
+        {
         .callback = init_old_suspend_ordering,
         .ident = "Panasonic CF51-2L",
         .matches = {
@@ -458,6 +490,30 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                 },
         },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1558",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1557",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
+                },
+        },
+        {
+        .callback = init_set_sci_en_on_resume,
+        .ident = "Dell Studio 1555",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
+                },
+        },
         {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 9f6cfac0f2cc..228740f356c9 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -879,6 +879,8 @@ static void ata_eh_set_pending(struct ata_port *ap, int fastdrain)
 void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
+        struct request_queue *q = qc->scsicmd->device->request_queue;
+        unsigned long flags;
 
         WARN_ON(!ap->ops->error_handler);
 
@@ -890,7 +892,9 @@ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
          * Note that ATA_QCFLAG_FAILED is unconditionally set after
          * this function completes.
          */
+        spin_lock_irqsave(q->queue_lock, flags);
         blk_abort_request(qc->scsicmd->request);
+        spin_unlock_irqrestore(q->queue_lock, flags);
 }
 
 /**
@@ -1624,6 +1628,7 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
         }
 
         /* okay, this error is ours */
+        memset(&tf, 0, sizeof(tf));
         rc = ata_eh_read_log_10h(dev, &tag, &tf);
         if (rc) {
                 ata_link_printk(link, KERN_ERR, "failed to read log page 10h "
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index 3c3172d3c34e..aa39bda6441a 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -45,16 +45,6 @@
 #define DRV_NAME "pata_pcmcia"
 #define DRV_VERSION "0.3.5"
 
-/*
- *      Private data structure to glue stuff together
- */
-
-struct ata_pcmcia_info {
-        struct pcmcia_device *pdev;
-        int             ndev;
-        dev_node_t      node;
-};
-
 /**
  *      pcmcia_set_mode -       PCMCIA specific mode setup
  *      @link: link
@@ -248,7 +238,6 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
 {
         struct ata_host *host;
         struct ata_port *ap;
-        struct ata_pcmcia_info *info;
         struct pcmcia_config_check *stk = NULL;
         int is_kme = 0, ret = -ENOMEM, p;
         unsigned long io_base, ctl_base;
@@ -256,19 +245,10 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
         int n_ports = 1;
         struct ata_port_operations *ops = &pcmcia_port_ops;
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
-        if (info == NULL)
-                return -ENOMEM;
-
-        /* Glue stuff together. FIXME: We may be able to get rid of info with care */
-        info->pdev = pdev;
-        pdev->priv = info;
-
         /* Set up attributes in order to probe card and get resources */
         pdev->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
         pdev->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
         pdev->io.IOAddrLines = 3;
-        pdev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         pdev->conf.Attributes = CONF_ENABLE_IRQ;
         pdev->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -293,8 +273,7 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
         }
         io_base = pdev->io.BasePort1;
         ctl_base = stk->ctl_base;
-        ret = pcmcia_request_irq(pdev, &pdev->irq);
-        if (ret)
+        if (!pdev->irq)
                 goto failed;
 
         ret = pcmcia_request_configuration(pdev, &pdev->conf);
@@ -344,21 +323,19 @@ static int pcmcia_init_one(struct pcmcia_device *pdev)
         }
 
         /* activate */
-        ret = ata_host_activate(host, pdev->irq.AssignedIRQ, ata_sff_interrupt,
+        ret = ata_host_activate(host, pdev->irq, ata_sff_interrupt,
                                 IRQF_SHARED, &pcmcia_sht);
         if (ret)
                 goto failed;
 
-        info->ndev = 1;
+        pdev->priv = host;
         kfree(stk);
         return 0;
 
 failed:
         kfree(stk);
-        info->ndev = 0;
         pcmcia_disable_device(pdev);
 out1:
-        kfree(info);
         return ret;
 }
 
@@ -372,20 +349,12 @@ out1:
 
 static void pcmcia_remove_one(struct pcmcia_device *pdev)
 {
-        struct ata_pcmcia_info *info = pdev->priv;
-        struct device *dev = &pdev->dev;
-
-        if (info != NULL) {
-                /* If we have attached the device to the ATA layer, detach it */
-                if (info->ndev) {
-                        struct ata_host *host = dev_get_drvdata(dev);
-                        ata_host_detach(host);
-                }
-                info->ndev = 0;
-                pdev->priv = NULL;
-        }
+        struct ata_host *host = pdev->priv;
+
+        if (host)
+                ata_host_detach(host);
+
         pcmcia_disable_device(pdev);
-        kfree(info);
 }
 
 static struct pcmcia_device_id pcmcia_devices[] = {
@@ -424,6 +393,8 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
         PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
         PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
@@ -444,6 +415,8 @@ static struct pcmcia_device_id pcmcia_devices[] = {
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
         PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
         PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
diff --git a/drivers/base/iommu.c b/drivers/base/iommu.c
index 8ad4ffea6920..6e6b6a11b3ce 100644
--- a/drivers/base/iommu.c
+++ b/drivers/base/iommu.c
@@ -80,20 +80,6 @@ void iommu_detach_device(struct iommu_domain *domain, struct device *dev)
 }
 EXPORT_SYMBOL_GPL(iommu_detach_device);
 
-int iommu_map_range(struct iommu_domain *domain, unsigned long iova,
-                    phys_addr_t paddr, size_t size, int prot)
-{
-        return iommu_ops->map(domain, iova, paddr, size, prot);
-}
-EXPORT_SYMBOL_GPL(iommu_map_range);
-
-void iommu_unmap_range(struct iommu_domain *domain, unsigned long iova,
-                      size_t size)
-{
-        iommu_ops->unmap(domain, iova, size);
-}
-EXPORT_SYMBOL_GPL(iommu_unmap_range);
-
 phys_addr_t iommu_iova_to_phys(struct iommu_domain *domain,
                                unsigned long iova)
 {
@@ -107,3 +93,32 @@ int iommu_domain_has_cap(struct iommu_domain *domain,
         return iommu_ops->domain_has_cap(domain, cap);
 }
 EXPORT_SYMBOL_GPL(iommu_domain_has_cap);
+
+int iommu_map(struct iommu_domain *domain, unsigned long iova,
+              phys_addr_t paddr, int gfp_order, int prot)
+{
+        unsigned long invalid_mask;
+        size_t size;
+
+        size         = 0x1000UL << gfp_order;
+        invalid_mask = size - 1;
+
+        BUG_ON((iova | paddr) & invalid_mask);
+
+        return iommu_ops->map(domain, iova, paddr, gfp_order, prot);
+}
+EXPORT_SYMBOL_GPL(iommu_map);
+
+int iommu_unmap(struct iommu_domain *domain, unsigned long iova, int gfp_order)
+{
+        unsigned long invalid_mask;
+        size_t size;
+
+        size         = 0x1000UL << gfp_order;
+        invalid_mask = size - 1;
+
+        BUG_ON(iova & invalid_mask);
+
+        return iommu_ops->unmap(domain, iova, gfp_order);
+}
+EXPORT_SYMBOL_GPL(iommu_unmap);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 4b4b565c835f..ada6397c23a5 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -187,7 +187,7 @@ EXPORT_SYMBOL_GPL(platform_device_alloc);
  * released.
  */
 int platform_device_add_resources(struct platform_device *pdev,
-                                  struct resource *res, unsigned int num)
+                                  const struct resource *res, unsigned int num)
 {
         struct resource *r;
 
@@ -367,7 +367,7 @@ EXPORT_SYMBOL_GPL(platform_device_unregister);
  */
 struct platform_device *platform_device_register_simple(const char *name,
                                                         int id,
-                                                        struct resource *res,
+                                                        const struct resource *res,
                                                         unsigned int num)
 {
         struct platform_device *pdev;
@@ -967,17 +967,17 @@ static int platform_pm_restore_noirq(struct device *dev)
 
 int __weak platform_pm_runtime_suspend(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_suspend(dev);
 };
 
 int __weak platform_pm_runtime_resume(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_resume(dev);
 };
 
 int __weak platform_pm_runtime_idle(struct device *dev)
 {
-        return -ENOSYS;
+        return pm_generic_runtime_idle(dev);
 };
 
 #else /* !CONFIG_PM_RUNTIME */
@@ -1254,6 +1254,26 @@ static int __init early_platform_driver_probe_id(char *class_str,
                 }
 
                 if (match) {
+                        /*
+                         * Set up a sensible init_name to enable
+                         * dev_name() and others to be used before the
+                         * rest of the driver core is initialized.
+                         */
+                        if (!match->dev.init_name && slab_is_available()) {
+                                if (match->id != -1)
+                                        match->dev.init_name =
+                                                kasprintf(GFP_KERNEL, "%s.%d",
+                                                          match->name,
+                                                          match->id);
+                                else
+                                        match->dev.init_name =
+                                                kasprintf(GFP_KERNEL, "%s",
+                                                          match->name);
+
+                                if (!match->dev.init_name)
+                                        return -ENOMEM;
+                        }
+
                         if (epdrv->pdrv->probe(match))
                                 pr_warning("%s: unable to probe %s early.\n",
                                            class_str, match->name);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 626dd147b75f..b0ec0e9f27e9 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -229,14 +229,16 @@ int __pm_runtime_suspend(struct device *dev, bool from_wq)
 
         if (retval) {
                 dev->power.runtime_status = RPM_ACTIVE;
-                pm_runtime_cancel_pending(dev);
-
                 if (retval == -EAGAIN || retval == -EBUSY) {
-                        notify = true;
+                        if (dev->power.timer_expires == 0)
+                                notify = true;
                         dev->power.runtime_error = 0;
+                } else {
+                        pm_runtime_cancel_pending(dev);
                 }
         } else {
                 dev->power.runtime_status = RPM_SUSPENDED;
+                pm_runtime_deactivate_timer(dev);
 
                 if (dev->parent) {
                         parent = dev->parent;
@@ -659,8 +661,6 @@ int pm_schedule_suspend(struct device *dev, unsigned int delay)
 
         if (dev->power.runtime_status == RPM_SUSPENDED)
                 retval = 1;
-        else if (dev->power.runtime_status == RPM_SUSPENDING)
-                retval = -EINPROGRESS;
         else if (atomic_read(&dev->power.usage_count) > 0
             || dev->power.disable_depth > 0)
                 retval = -EAGAIN;
diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
index 86fd9373447e..a4c33bc51257 100644
--- a/drivers/base/power/sysfs.c
+++ b/drivers/base/power/sysfs.c
@@ -5,6 +5,7 @@
 #include <linux/device.h>
 #include <linux/string.h>
 #include <linux/pm_runtime.h>
+#include <asm/atomic.h>
 #include "power.h"
 
 /*
@@ -143,7 +144,59 @@ wake_store(struct device * dev, struct device_attribute *attr,
 
 static DEVICE_ATTR(wakeup, 0644, wake_show, wake_store);
 
-#ifdef CONFIG_PM_SLEEP_ADVANCED_DEBUG
+#ifdef CONFIG_PM_ADVANCED_DEBUG
+#ifdef CONFIG_PM_RUNTIME
+
+static ssize_t rtpm_usagecount_show(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", atomic_read(&dev->power.usage_count));
+}
+
+static ssize_t rtpm_children_show(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", dev->power.ignore_children ?
+                0 : atomic_read(&dev->power.child_count));
+}
+
+static ssize_t rtpm_enabled_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        if ((dev->power.disable_depth) && (dev->power.runtime_auto == false))
+                return sprintf(buf, "disabled & forbidden\n");
+        else if (dev->power.disable_depth)
+                return sprintf(buf, "disabled\n");
+        else if (dev->power.runtime_auto == false)
+                return sprintf(buf, "forbidden\n");
+        return sprintf(buf, "enabled\n");
+}
+
+static ssize_t rtpm_status_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        if (dev->power.runtime_error)
+                return sprintf(buf, "error\n");
+        switch (dev->power.runtime_status) {
+        case RPM_SUSPENDED:
+                return sprintf(buf, "suspended\n");
+        case RPM_SUSPENDING:
+                return sprintf(buf, "suspending\n");
+        case RPM_RESUMING:
+                return sprintf(buf, "resuming\n");
+        case RPM_ACTIVE:
+                return sprintf(buf, "active\n");
+        }
+        return -EIO;
+}
+
+static DEVICE_ATTR(runtime_usage, 0444, rtpm_usagecount_show, NULL);
+static DEVICE_ATTR(runtime_active_kids, 0444, rtpm_children_show, NULL);
+static DEVICE_ATTR(runtime_status, 0444, rtpm_status_show, NULL);
+static DEVICE_ATTR(runtime_enabled, 0444, rtpm_enabled_show, NULL);
+
+#endif
+
 static ssize_t async_show(struct device *dev, struct device_attribute *attr,
                           char *buf)
 {
@@ -170,15 +223,21 @@ static ssize_t async_store(struct device *dev, struct device_attribute *attr,
 }
 
 static DEVICE_ATTR(async, 0644, async_show, async_store);
-#endif /* CONFIG_PM_SLEEP_ADVANCED_DEBUG */
+#endif /* CONFIG_PM_ADVANCED_DEBUG */
 
 static struct attribute * power_attrs[] = {
 #ifdef CONFIG_PM_RUNTIME
         &dev_attr_control.attr,
 #endif
         &dev_attr_wakeup.attr,
-#ifdef CONFIG_PM_SLEEP_ADVANCED_DEBUG
+#ifdef CONFIG_PM_ADVANCED_DEBUG
         &dev_attr_async.attr,
+#ifdef CONFIG_PM_RUNTIME
+        &dev_attr_runtime_usage.attr,
+        &dev_attr_runtime_active_kids.attr,
+        &dev_attr_runtime_status.attr,
+        &dev_attr_runtime_enabled.attr,
+#endif
 #endif
         NULL,
 };
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 0182a22c423a..832798aa14f6 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -66,6 +66,7 @@
 #include <linux/blkdev.h>
 #include <linux/elevator.h>
 #include <linux/interrupt.h>
+#include <linux/platform_device.h>
 
 #include <asm/setup.h>
 #include <asm/uaccess.h>
@@ -1696,34 +1697,18 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         return get_disk(unit[drive].gendisk);
 }
 
-static int __init amiga_floppy_init(void)
+static int __init amiga_floppy_probe(struct platform_device *pdev)
 {
         int i, ret;
 
-        if (!MACH_IS_AMIGA)
-                return -ENODEV;
-
-        if (!AMIGAHW_PRESENT(AMI_FLOPPY))
-                return -ENODEV;
-
         if (register_blkdev(FLOPPY_MAJOR,"fd"))
                 return -EBUSY;
 
-        /*
-         *  We request DSKPTR, DSKLEN and DSKDATA only, because the other
-         *  floppy registers are too spreaded over the custom register space
-         */
-        ret = -EBUSY;
-        if (!request_mem_region(CUSTOM_PHYSADDR+0x20, 8, "amiflop [Paula]")) {
-                printk("fd: cannot get floppy registers\n");
-                goto out_blkdev;
-        }
-
         ret = -ENOMEM;
         if ((raw_buf = (char *)amiga_chip_alloc (RAW_BUF_SIZE, "Floppy")) ==
             NULL) {
                 printk("fd: cannot get chip mem buffer\n");
-                goto out_memregion;
+                goto out_blkdev;
         }
 
         ret = -EBUSY;
@@ -1792,18 +1777,13 @@ out_irq2:
         free_irq(IRQ_AMIGA_DSKBLK, NULL);
 out_irq:
         amiga_chip_free(raw_buf);
-out_memregion:
-        release_mem_region(CUSTOM_PHYSADDR+0x20, 8);
 out_blkdev:
         unregister_blkdev(FLOPPY_MAJOR,"fd");
         return ret;
 }
 
-module_init(amiga_floppy_init);
-#ifdef MODULE
-
 #if 0 /* not safe to unload */
-void cleanup_module(void)
+static int __exit amiga_floppy_remove(struct platform_device *pdev)
 {
         int i;
 
@@ -1820,12 +1800,25 @@ void cleanup_module(void)
         custom.dmacon = DMAF_DISK; /* disable DMA */
         amiga_chip_free(raw_buf);
         blk_cleanup_queue(floppy_queue);
-        release_mem_region(CUSTOM_PHYSADDR+0x20, 8);
         unregister_blkdev(FLOPPY_MAJOR, "fd");
 }
 #endif
 
-#else
+static struct platform_driver amiga_floppy_driver = {
+        .driver   = {
+                .name   = "amiga-floppy",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init amiga_floppy_init(void)
+{
+        return platform_driver_probe(&amiga_floppy_driver, amiga_floppy_probe);
+}
+
+module_init(amiga_floppy_init);
+
+#ifndef MODULE
 static int __init amiga_floppy_setup (char *str)
 {
         int n;
@@ -1840,3 +1833,5 @@ static int __init amiga_floppy_setup (char *str)
 
 __setup("floppy=", amiga_floppy_setup);
 #endif
+
+MODULE_ALIAS("platform:amiga-floppy");
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 67e0fc542249..93d1f9b469d4 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1695,6 +1695,7 @@ int drbd_send_protocol(struct drbd_conf *mdev)
                         cf |= CF_DRY_RUN;
                 else {
                         dev_err(DEV, "--dry-run is not supported by peer");
+                        kfree(p);
                         return 0;
                 }
         }
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index ed9f1de24a71..3f096e7959b4 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -899,7 +899,8 @@ retry:
 
         drbd_thread_start(&mdev->asender);
 
-        drbd_send_protocol(mdev);
+        if (!drbd_send_protocol(mdev))
+                return -1;
         drbd_send_sync_param(mdev, &mdev->sync_conf);
         drbd_send_sizes(mdev, 0);
         drbd_send_uuids(mdev);
diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
index 44bf6d11197e..d48a1dfd7b24 100644
--- a/drivers/block/drbd/drbd_worker.c
+++ b/drivers/block/drbd/drbd_worker.c
@@ -235,7 +235,7 @@ void drbd_endio_pri(struct bio *bio, int error)
         if (unlikely(error)) {
                 what = (bio_data_dir(bio) == WRITE)
                         ? write_completed_with_error
-                        : (bio_rw(bio) == READA)
+                        : (bio_rw(bio) == READ)
                           ? read_completed_with_error
                           : read_ahead_completed_with_error;
         } else
diff --git a/drivers/block/hd.c b/drivers/block/hd.c
index 034e6dfc878c..81c78b3ce2df 100644
--- a/drivers/block/hd.c
+++ b/drivers/block/hd.c
@@ -164,12 +164,12 @@ unsigned long read_timer(void)
         unsigned long t, flags;
         int i;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         t = jiffies * 11932;
         outb_p(0, 0x43);
         i = inb_p(0x40);
         i |= inb(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
         return(t - i);
 }
 #endif
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index ddf19425245d..8a549db2aa78 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -48,6 +48,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/compat.h>
 #include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
@@ -2984,7 +2985,7 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
         mutex_unlock(&ctl_mutex);
 }
 
-static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long pkt_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         void __user *argp = (void __user *)arg;
         struct pkt_ctrl_command ctrl_cmd;
@@ -3021,10 +3022,20 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
         return ret;
 }
 
+#ifdef CONFIG_COMPAT
+static long pkt_ctl_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return pkt_ctl_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
 
 static const struct file_operations pkt_ctl_fops = {
-        .ioctl   = pkt_ctl_ioctl,
-        .owner   = THIS_MODULE,
+        .open           = nonseekable_open,
+        .unlocked_ioctl = pkt_ctl_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = pkt_ctl_compat_ioctl,
+#endif
+        .owner          = THIS_MODULE,
 };
 
 static struct miscdevice pkt_misc = {
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index d9bf87ca9e83..6f907ebed2d5 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -65,7 +65,6 @@ MODULE_LICENSE("GPL");
 
 typedef struct bluecard_info_t {
         struct pcmcia_device *p_dev;
-        dev_node_t node;
 
         struct hci_dev *hdev;
 
@@ -869,9 +868,6 @@ static int bluecard_probe(struct pcmcia_device *link)
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         link->io.NumPorts1 = 8;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
-        link->irq.Handler = bluecard_interrupt;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
@@ -908,9 +904,9 @@ static int bluecard_config(struct pcmcia_device *link)
         if (i != 0)
                 goto failed;
 
-        i = pcmcia_request_irq(link, &link->irq);
+        i = pcmcia_request_irq(link, bluecard_interrupt);
         if (i != 0)
-                link->irq.AssignedIRQ = 0;
+                goto failed;
 
         i = pcmcia_request_configuration(link, &link->conf);
         if (i != 0)
@@ -919,9 +915,6 @@ static int bluecard_config(struct pcmcia_device *link)
         if (bluecard_open(info) != 0)
                 goto failed;
 
-        strcpy(info->node.dev_name, info->hdev->name);
-        link->dev_node = &info->node;
-
         return 0;
 
 failed:
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index 027cb8bf650f..21e05fdc9121 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -72,7 +72,6 @@ MODULE_FIRMWARE("BT3CPCC.bin");
 
 typedef struct bt3c_info_t {
         struct pcmcia_device *p_dev;
-        dev_node_t node;
 
         struct hci_dev *hdev;
 
@@ -661,9 +660,6 @@ static int bt3c_probe(struct pcmcia_device *link)
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         link->io.NumPorts1 = 8;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
-        link->irq.Handler = bt3c_interrupt;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
@@ -743,9 +739,9 @@ static int bt3c_config(struct pcmcia_device *link)
         goto failed;
 
 found_port:
-        i = pcmcia_request_irq(link, &link->irq);
+        i = pcmcia_request_irq(link, &bt3c_interrupt);
         if (i != 0)
-                link->irq.AssignedIRQ = 0;
+                goto failed;
 
         i = pcmcia_request_configuration(link, &link->conf);
         if (i != 0)
@@ -754,9 +750,6 @@ found_port:
         if (bt3c_open(info) != 0)
                 goto failed;
 
-        strcpy(info->node.dev_name, info->hdev->name);
-        link->dev_node = &info->node;
-
         return 0;
 
 failed:
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index 60c0953d7d00..4ed7288f99db 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -67,7 +67,6 @@ MODULE_LICENSE("GPL");
 
 typedef struct btuart_info_t {
         struct pcmcia_device *p_dev;
-        dev_node_t node;
 
         struct hci_dev *hdev;
 
@@ -590,9 +589,6 @@ static int btuart_probe(struct pcmcia_device *link)
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         link->io.NumPorts1 = 8;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
-        link->irq.Handler = btuart_interrupt;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
@@ -672,9 +668,9 @@ static int btuart_config(struct pcmcia_device *link)
         goto failed;
 
 found_port:
-        i = pcmcia_request_irq(link, &link->irq);
+        i = pcmcia_request_irq(link, btuart_interrupt);
         if (i != 0)
-                link->irq.AssignedIRQ = 0;
+                goto failed;
 
         i = pcmcia_request_configuration(link, &link->conf);
         if (i != 0)
@@ -683,9 +679,6 @@ found_port:
         if (btuart_open(info) != 0)
                 goto failed;
 
-        strcpy(info->node.dev_name, info->hdev->name);
-        link->dev_node = &info->node;
-
         return 0;
 
 failed:
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 17788317c51a..ef044d55cb25 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -67,7 +67,6 @@ MODULE_LICENSE("GPL");
 
 typedef struct dtl1_info_t {
         struct pcmcia_device *p_dev;
-        dev_node_t node;
 
         struct hci_dev *hdev;
 
@@ -575,9 +574,6 @@ static int dtl1_probe(struct pcmcia_device *link)
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         link->io.NumPorts1 = 8;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
-        link->irq.Handler = dtl1_interrupt;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
@@ -621,9 +617,9 @@ static int dtl1_config(struct pcmcia_device *link)
         if (pcmcia_loop_config(link, dtl1_confcheck, NULL) < 0)
                 goto failed;
 
-        i = pcmcia_request_irq(link, &link->irq);
+        i = pcmcia_request_irq(link, dtl1_interrupt);
         if (i != 0)
-                link->irq.AssignedIRQ = 0;
+                goto failed;
 
         i = pcmcia_request_configuration(link, &link->conf);
         if (i != 0)
@@ -632,9 +628,6 @@ static int dtl1_config(struct pcmcia_device *link)
         if (dtl1_open(info) != 0)
                 goto failed;
 
-        strcpy(info->node.dev_name, info->hdev->name);
-        link->dev_node = &info->node;
-
         return 0;
 
 failed:
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index fc8cf7ac7f2b..4cd8b227c11f 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -23,6 +23,7 @@
 #include <linux/seq_file.h>
 #include <linux/dmi.h>
 #include <linux/capability.h>
+#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -82,8 +83,7 @@ module_param(fan_mult, int, 0);
 MODULE_PARM_DESC(fan_mult, "Factor to multiply fan speed with");
 
 static int i8k_open_fs(struct inode *inode, struct file *file);
-static int i8k_ioctl(struct inode *, struct file *, unsigned int,
-                     unsigned long);
+static long i8k_ioctl(struct file *, unsigned int, unsigned long);
 
 static const struct file_operations i8k_fops = {
         .owner          = THIS_MODULE,
@@ -91,7 +91,7 @@ static const struct file_operations i8k_fops = {
         .read           = seq_read,
         .llseek         = seq_lseek,
         .release        = single_release,
-        .ioctl          = i8k_ioctl,
+        .unlocked_ioctl = i8k_ioctl,
 };
 
 struct smm_regs {
@@ -307,8 +307,8 @@ static int i8k_get_dell_signature(int req_fn)
         return regs.eax == 1145651527 && regs.edx == 1145392204 ? 0 : -1;
 }
 
-static int i8k_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
-                     unsigned long arg)
+static int
+i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
 {
         int val = 0;
         int speed;
@@ -395,6 +395,17 @@ static int i8k_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
         return 0;
 }
 
+static long i8k_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
+{
+        long ret;
+
+        lock_kernel();
+        ret = i8k_ioctl_unlocked(fp, cmd, arg);
+        unlock_kernel();
+
+        return ret;
+}
+
 /*
  * Print the information for /proc/i8k.
  */
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 0fa2e4a0835d..c1ab303455cf 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -879,8 +879,8 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
         if (tport == NULL)
                 return -ENODEV;
         port = container_of(tport, struct isi_port, port);
-        card = &isi_card[BOARD(tty->index)];
 
+        tty->driver_data = port;
         return tty_port_open(tport, tty, filp);
 }
 
@@ -936,7 +936,12 @@ static void isicom_shutdown(struct tty_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
         struct isi_port *ip = tty->driver_data;
-        struct tty_port *port = &ip->port;
+        struct tty_port *port;
+
+        if (ip == NULL)
+                return;
+
+        port = &ip->port;
         if (isicom_paranoia_check(ip, tty->name, "isicom_close"))
                 return;
         tty_port_close(port, tty, filp);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 4cd6c527ee41..4e395c956a09 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -827,6 +827,8 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
                 return -ENODEV;
         if (portp->devnr < 1)
                 return -ENODEV;
+
+        tty->driver_data = portp;
         return tty_port_open(&portp->port, tty, filp);
 }
 
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 47023053ee85..d2692d443f7b 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1011,6 +1011,7 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
         if (!info->ioaddr)
                 return -ENODEV;
 
+        tty->driver_data = info;
         return tty_port_open(&info->port, tty, filp);
 }
 
@@ -1074,7 +1075,7 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
         struct mxser_port *info = tty->driver_data;
         struct tty_port *port = &info->port;
 
-        if (tty->index == MXSER_PORTS)
+        if (tty->index == MXSER_PORTS || info == NULL)
                 return;
         if (tty_port_close_start(port, tty, filp) == 0)
                 return;
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 90b199f97bec..e7956acf2ad6 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -106,7 +106,6 @@ static int major;		/* major number we get from the kernel */
 
 struct cm4000_dev {
         struct pcmcia_device *p_dev;
-        dev_node_t node;                /* OS node (major,minor) */
 
         unsigned char atr[MAX_ATR];
         unsigned char rbuf[512];
@@ -884,8 +883,7 @@ static void monitor_card(unsigned long p)
                 /* slow down warning, but prompt immediately after insertion */
                 if (dev->cwarn == 0 || dev->cwarn == 10) {
                         set_bit(IS_BAD_CARD, &dev->flags);
-                        printk(KERN_WARNING MODULE_NAME ": device %s: ",
-                               dev->node.dev_name);
+                        dev_warn(&dev->p_dev->dev, MODULE_NAME ": ");
                         if (test_bit(IS_BAD_CSUM, &dev->flags)) {
                                 DEBUGP(4, dev, "ATR checksum (0x%.2x, should "
                                        "be zero) failed\n", dev->atr_csum);
@@ -1781,11 +1779,6 @@ static int cm4000_config(struct pcmcia_device * link, int devno)
                 goto cs_release;
 
         dev = link->priv;
-        sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
-        dev->node.major = major;
-        dev->node.minor = devno;
-        dev->node.next = NULL;
-        link->dev_node = &dev->node;
 
         return 0;
 
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index a6a70e476bea..c0775c844e08 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -72,7 +72,6 @@ static struct class *cmx_class;
 
 struct reader_dev {
         struct pcmcia_device    *p_dev;
-        dev_node_t              node;
         wait_queue_head_t       devq;
         wait_queue_head_t       poll_wait;
         wait_queue_head_t       read_wait;
@@ -568,10 +567,6 @@ static int reader_config(struct pcmcia_device *link, int devno)
         }
 
         dev = link->priv;
-        sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
-        dev->node.major = major;
-        dev->node.minor = devno;
-        dev->node.next = &dev->node;
 
         DEBUGP(2, dev, "device " DEVICE_NAME "%d at 0x%.4x-0x%.4x\n", devno,
               link->io.BasePort1, link->io.BasePort1+link->io.NumPorts1);
diff --git a/drivers/char/pcmcia/ipwireless/main.c b/drivers/char/pcmcia/ipwireless/main.c
index dff24dae1485..63c32e3f23ba 100644
--- a/drivers/char/pcmcia/ipwireless/main.c
+++ b/drivers/char/pcmcia/ipwireless/main.c
@@ -195,9 +195,6 @@ static int config_ipwireless(struct ipw_dev *ipw)
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = ipwireless_interrupt;
-
         INIT_WORK(&ipw->work_reboot, signalled_reboot_work);
 
         ipwireless_init_hardware_v1(ipw->hardware, link->io.BasePort1,
@@ -205,8 +202,7 @@ static int config_ipwireless(struct ipw_dev *ipw)
                                     ipw->is_v2_card, signalled_reboot_callback,
                                     ipw);
 
-        ret = pcmcia_request_irq(link, &link->irq);
-
+        ret = pcmcia_request_irq(link, ipwireless_interrupt);
         if (ret != 0)
                 goto exit;
 
@@ -217,7 +213,7 @@ static int config_ipwireless(struct ipw_dev *ipw)
                         (unsigned int) link->io.BasePort1,
                         (unsigned int) (link->io.BasePort1 +
                                 link->io.NumPorts1 - 1),
-                        (unsigned int) link->irq.AssignedIRQ);
+                        (unsigned int) link->irq);
         if (ipw->attr_memory && ipw->common_memory)
                 printk(KERN_INFO IPWIRELESS_PCCARD_NAME
                         ": attr memory 0x%08lx-0x%08lx, common memory 0x%08lx-0x%08lx\n",
@@ -232,8 +228,7 @@ static int config_ipwireless(struct ipw_dev *ipw)
         if (!ipw->network)
                 goto exit;
 
-        ipw->tty = ipwireless_tty_create(ipw->hardware, ipw->network,
-                        ipw->nodes);
+        ipw->tty = ipwireless_tty_create(ipw->hardware, ipw->network);
         if (!ipw->tty)
                 goto exit;
 
@@ -248,8 +243,6 @@ static int config_ipwireless(struct ipw_dev *ipw)
         if (ret != 0)
                 goto exit;
 
-        link->dev_node = &ipw->nodes[0];
-
         return 0;
 
 exit:
@@ -271,8 +264,6 @@ exit:
 
 static void release_ipwireless(struct ipw_dev *ipw)
 {
-        pcmcia_disable_device(ipw->link);
-
         if (ipw->common_memory) {
                 release_mem_region(ipw->request_common_memory.Base,
                                 ipw->request_common_memory.Size);
@@ -288,7 +279,6 @@ static void release_ipwireless(struct ipw_dev *ipw)
         if (ipw->attr_memory)
                 pcmcia_release_window(ipw->link, ipw->handle_attr_memory);
 
-        /* Break the link with Card Services */
         pcmcia_disable_device(ipw->link);
 }
 
@@ -313,9 +303,6 @@ static int ipwireless_attach(struct pcmcia_device *link)
         ipw->link = link;
         link->priv = ipw;
 
-        /* Link this device into our device list. */
-        link->dev_node = &ipw->nodes[0];
-
         ipw->hardware = ipwireless_hardware_create();
         if (!ipw->hardware) {
                 kfree(ipw);
diff --git a/drivers/char/pcmcia/ipwireless/main.h b/drivers/char/pcmcia/ipwireless/main.h
index 0e0363af9ab2..96d0ef31b172 100644
--- a/drivers/char/pcmcia/ipwireless/main.h
+++ b/drivers/char/pcmcia/ipwireless/main.h
@@ -54,7 +54,6 @@ struct ipw_dev {
         void __iomem *common_memory;
         win_req_t request_common_memory;
 
-        dev_node_t nodes[2];
         /* Reference to attribute memory, containing CIS data */
         void *attribute_memory;
 
diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
index 2bb7874a6899..1a2c2c3b068f 100644
--- a/drivers/char/pcmcia/ipwireless/tty.c
+++ b/drivers/char/pcmcia/ipwireless/tty.c
@@ -487,7 +487,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty, struct file *file,
         return tty_mode_ioctl(linux_tty, file, cmd , arg);
 }
 
-static int add_tty(dev_node_t *nodesp, int j,
+static int add_tty(int j,
                     struct ipw_hardware *hardware,
                     struct ipw_network *network, int channel_idx,
                     int secondary_channel_idx, int tty_type)
@@ -510,19 +510,13 @@ static int add_tty(dev_node_t *nodesp, int j,
                 ipwireless_associate_network_tty(network,
                                                  secondary_channel_idx,
                                                  ttys[j]);
-        if (nodesp != NULL) {
-                sprintf(nodesp->dev_name, "ttyIPWp%d", j);
-                nodesp->major = ipw_tty_driver->major;
-                nodesp->minor = j + ipw_tty_driver->minor_start;
-        }
         if (get_tty(j + ipw_tty_driver->minor_start) == ttys[j])
                 report_registering(ttys[j]);
         return 0;
 }
 
 struct ipw_tty *ipwireless_tty_create(struct ipw_hardware *hardware,
-                                      struct ipw_network *network,
-                                      dev_node_t *nodes)
+                                      struct ipw_network *network)
 {
         int i, j;
 
@@ -539,26 +533,23 @@ struct ipw_tty *ipwireless_tty_create(struct ipw_hardware *hardware,
                 if (allfree) {
                         j = i;
 
-                        if (add_tty(&nodes[0], j, hardware, network,
+                        if (add_tty(j, hardware, network,
                                         IPW_CHANNEL_DIALLER, IPW_CHANNEL_RAS,
                                         TTYTYPE_MODEM))
                                 return NULL;
 
                         j += IPWIRELESS_PCMCIA_MINOR_RANGE;
-                        if (add_tty(&nodes[1], j, hardware, network,
+                        if (add_tty(j, hardware, network,
                                         IPW_CHANNEL_DIALLER, -1,
                                         TTYTYPE_MONITOR))
                                 return NULL;
 
                         j += IPWIRELESS_PCMCIA_MINOR_RANGE;
-                        if (add_tty(NULL, j, hardware, network,
+                        if (add_tty(j, hardware, network,
                                         IPW_CHANNEL_RAS, -1,
                                         TTYTYPE_RAS_RAW))
                                 return NULL;
 
-                        nodes[0].next = &nodes[1];
-                        nodes[1].next = NULL;
-
                         return ttys[i];
                 }
         }
diff --git a/drivers/char/pcmcia/ipwireless/tty.h b/drivers/char/pcmcia/ipwireless/tty.h
index b0deb9168b6b..4da6c201f727 100644
--- a/drivers/char/pcmcia/ipwireless/tty.h
+++ b/drivers/char/pcmcia/ipwireless/tty.h
@@ -34,8 +34,7 @@ int ipwireless_tty_init(void);
 void ipwireless_tty_release(void);
 
 struct ipw_tty *ipwireless_tty_create(struct ipw_hardware *hw,
-                                      struct ipw_network *net,
-                                      dev_node_t *nodes);
+                                      struct ipw_network *net);
 void ipwireless_tty_free(struct ipw_tty *tty);
 void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
                              unsigned int length);
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index c31a0d913d37..308903ec8bf8 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -220,7 +220,6 @@ typedef struct _mgslpc_info {
 
         /* PCMCIA support */
         struct pcmcia_device    *p_dev;
-        dev_node_t            node;
         int                   stop;
 
         /* SPPP/Cisco HDLC device parts */
@@ -552,10 +551,6 @@ static int mgslpc_probe(struct pcmcia_device *link)
 
     /* Initialize the struct pcmcia_device structure */
 
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = NULL;
-
     link->conf.Attributes = 0;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -608,9 +603,7 @@ static int mgslpc_config(struct pcmcia_device *link)
     link->conf.ConfigIndex = 8;
     link->conf.Present = PRESENT_OPTION;
 
-    link->irq.Handler     = mgslpc_isr;
-
-    ret = pcmcia_request_irq(link, &link->irq);
+    ret = pcmcia_request_irq(link, mgslpc_isr);
     if (ret)
             goto failed;
     ret = pcmcia_request_configuration(link, &link->conf);
@@ -618,17 +611,12 @@ static int mgslpc_config(struct pcmcia_device *link)
             goto failed;
 
     info->io_base = link->io.BasePort1;
-    info->irq_level = link->irq.AssignedIRQ;
-
-    /* add to linked list of devices */
-    sprintf(info->node.dev_name, "mgslpc0");
-    info->node.major = info->node.minor = 0;
-    link->dev_node = &info->node;
+    info->irq_level = link->irq;
 
-    printk(KERN_INFO "%s: index 0x%02x:",
-           info->node.dev_name, link->conf.ConfigIndex);
+    dev_info(&link->dev, "index 0x%02x:",
+            link->conf.ConfigIndex);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
-            printk(", irq %d", link->irq.AssignedIRQ);
+            printk(", irq %d", link->irq);
     if (link->io.NumPorts1)
             printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                    link->io.BasePort1+link->io.NumPorts1-1);
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 0a8d1e56c993..b02332a5412f 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -909,6 +909,7 @@ static int rc_open(struct tty_struct *tty, struct file *filp)
         if (error)
                 return error;
 
+        tty->driver_data = port;
         return tty_port_open(&port->port, tty, filp);
 }
 
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 8dfd24721a82..78a62ebe75c7 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -627,7 +627,6 @@ static irqreturn_t cd2401_rx_interrupt(int irq, void *dev_id)
         char data;
         int char_count;
         int save_cnt;
-        int len;
 
         /* determine the channel and change to that context */
         channel = (u_short) (base_addr[CyLICR] >> 2);
@@ -1528,7 +1527,6 @@ static int
 cy_ioctl(struct tty_struct *tty, struct file *file,
          unsigned int cmd, unsigned long arg)
 {
-        unsigned long val;
         struct cyclades_port *info = tty->driver_data;
         int ret_val = 0;
         void __user *argp = (void __user *)arg;
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 0e511d61f544..6049fd731924 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -724,7 +724,6 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 {
         struct stlport  *portp;
         struct stlbrd   *brdp;
-        struct tty_port *port;
         unsigned int    minordev, brdnr, panelnr;
         int             portnr;
 
@@ -754,7 +753,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
         portp = brdp->panels[panelnr]->ports[portnr];
         if (portp == NULL)
                 return -ENODEV;
-        port = &portp->port;
+
+        tty->driver_data = portp;
         return tty_port_open(&portp->port, tty, filp);
 
 }
@@ -841,7 +841,8 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
         pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
 
         portp = tty->driver_data;
-        BUG_ON(portp == NULL);
+        if(portp == NULL)
+                return;
         tty_port_close(&portp->port, tty, filp);
 }
 
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 59de2525d303..d4e8b213a462 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -289,7 +289,7 @@ static struct sysrq_key_op sysrq_showstate_blocked_op = {
 
 static void sysrq_ftrace_dump(int key, struct tty_struct *tty)
 {
-        ftrace_dump();
+        ftrace_dump(DUMP_ALL);
 }
 static struct sysrq_key_op sysrq_ftrace_dump_op = {
         .handler        = sysrq_ftrace_dump,
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f5fc64f89c5c..4dc338f3d1aa 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -17,14 +17,16 @@ menuconfig TCG_TPM
           obtained at: <http://sourceforge.net/projects/trousers>.  To 
           compile this driver as a module, choose M here; the module 
           will be called tpm. If unsure, say N.
-          Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
+          Notes:
+          1) For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
+          2) Without ACPI enabled, the BIOS event log won't be accessible,
+          which is required to validate the PCR 0-7 values.
 
 if TCG_TPM
 
 config TCG_TIS
         tristate "TPM Interface Specification 1.2 Interface"
-        depends on PNP
         ---help---
           If you have a TPM security chip that is compliant with the
           TCG TIS 1.2 TPM specification say Yes and it will be accessible
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 068c816e6942..05ad4a17a28f 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1068,6 +1068,27 @@ void tpm_remove_hardware(struct device *dev)
 }
 EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 
+#define TPM_ORD_SAVESTATE cpu_to_be32(152)
+#define SAVESTATE_RESULT_SIZE 10
+
+static struct tpm_input_header savestate_header = {
+        .tag = TPM_TAG_RQU_COMMAND,
+        .length = cpu_to_be32(10),
+        .ordinal = TPM_ORD_SAVESTATE
+};
+
+/* Bug workaround - some TPM's don't flush the most
+ * recently changed pcr on suspend, so force the flush
+ * with an extend to the selected _unused_ non-volatile pcr.
+ */
+static int tpm_suspend_pcr;
+static int __init tpm_suspend_setup(char *str)
+{
+        get_option(&str, &tpm_suspend_pcr);
+        return 1;
+}
+__setup("tpm_suspend_pcr=", tpm_suspend_setup);
+
 /*
  * We are about to suspend. Save the TPM state
  * so that it can be restored.
@@ -1075,17 +1096,29 @@ EXPORT_SYMBOL_GPL(tpm_remove_hardware);
 int tpm_pm_suspend(struct device *dev, pm_message_t pm_state)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
-        u8 savestate[] = {
-                0, 193,         /* TPM_TAG_RQU_COMMAND */
-                0, 0, 0, 10,    /* blob length (in bytes) */
-                0, 0, 0, 152    /* TPM_ORD_SaveState */
-        };
+        struct tpm_cmd_t cmd;
+        int rc;
+
+        u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
 
         if (chip == NULL)
                 return -ENODEV;
 
-        tpm_transmit(chip, savestate, sizeof(savestate));
-        return 0;
+        /* for buggy tpm, flush pcrs with extend to selected dummy */
+        if (tpm_suspend_pcr) {
+                cmd.header.in = pcrextend_header;
+                cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
+                memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
+                       TPM_DIGEST_SIZE);
+                rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
+                                  "extending dummy pcr before suspend");
+        }
+
+        /* now do the actual savestate */
+        cmd.header.in = savestate_header;
+        rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
+                          "sending savestate before suspend");
+        return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_pm_suspend);
 
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 94345994f8a6..24314a9cffe8 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -598,7 +598,7 @@ out_err:
         tpm_remove_hardware(chip->dev);
         return rc;
 }
-
+#ifdef CONFIG_PNP
 static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
                                       const struct pnp_device_id *pnp_id)
 {
@@ -663,7 +663,7 @@ static struct pnp_driver tis_pnp_driver = {
 module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
                     sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
 MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
-
+#endif
 static int tpm_tis_suspend(struct platform_device *dev, pm_message_t msg)
 {
         return tpm_pm_suspend(&dev->dev, msg);
@@ -690,21 +690,21 @@ MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
 static int __init init_tis(void)
 {
         int rc;
+#ifdef CONFIG_PNP
+        if (!force)
+                return pnp_register_driver(&tis_pnp_driver);
+#endif
 
-        if (force) {
-                rc = platform_driver_register(&tis_drv);
-                if (rc < 0)
-                        return rc;
-                if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
-                        return PTR_ERR(pdev);
-                if((rc=tpm_tis_init(&pdev->dev, TIS_MEM_BASE, TIS_MEM_LEN, 0)) != 0) {
-                        platform_device_unregister(pdev);
-                        platform_driver_unregister(&tis_drv);
-                }
+        rc = platform_driver_register(&tis_drv);
+        if (rc < 0)
                 return rc;
+        if (IS_ERR(pdev=platform_device_register_simple("tpm_tis", -1, NULL, 0)))
+                return PTR_ERR(pdev);
+        if((rc=tpm_tis_init(&pdev->dev, TIS_MEM_BASE, TIS_MEM_LEN, 0)) != 0) {
+                platform_device_unregister(pdev);
+                platform_driver_unregister(&tis_drv);
         }
-
-        return pnp_register_driver(&tis_pnp_driver);
+        return rc;
 }
 
 static void __exit cleanup_tis(void)
@@ -728,12 +728,14 @@ static void __exit cleanup_tis(void)
                 list_del(&i->list);
         }
         spin_unlock(&tis_lock);
-
-        if (force) {
-                platform_device_unregister(pdev);
-                platform_driver_unregister(&tis_drv);
-        } else
+#ifdef CONFIG_PNP
+        if (!force) {
                 pnp_unregister_driver(&tis_pnp_driver);
+                return;
+        }
+#endif
+        platform_device_unregister(pdev);
+        platform_driver_unregister(&tis_drv);
 }
 
 module_init(init_tis);
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 6da962c9b21c..d71f0fc34b46 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1875,6 +1875,7 @@ got_driver:
                  */
                 if (filp->f_op == &hung_up_tty_fops)
                         filp->f_op = &tty_fops;
+                unlock_kernel();
                 goto retry_open;
         }
         unlock_kernel();
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index b314a999aabe..d7be69f13154 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -154,14 +154,14 @@ static int __init cs5535_mfgpt_init(void)
         if (cs5535_mfgpt_setup_irq(timer, MFGPT_CMP2, &timer_irq)) {
                 printk(KERN_ERR DRV_NAME ": Could not set up IRQ %d\n",
                                 timer_irq);
-                return -EIO;
+                goto err_timer;
         }
 
         /* And register it with the kernel */
         ret = setup_irq(timer_irq, &mfgptirq);
         if (ret) {
                 printk(KERN_ERR DRV_NAME ": Unable to set up the interrupt.\n");
-                goto err;
+                goto err_irq;
         }
 
         /* Set the clock scale and enable the event mode for CMP2 */
@@ -184,8 +184,10 @@ static int __init cs5535_mfgpt_init(void)
 
         return 0;
 
-err:
+err_irq:
         cs5535_mfgpt_release_irq(cs5535_event_clock, MFGPT_CMP2, &timer_irq);
+err_timer:
+        cs5535_mfgpt_free_timer(cs5535_event_clock);
         printk(KERN_ERR DRV_NAME ": Unable to set up the MFGPT clock source\n");
         return -EIO;
 }
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 744f748cc84b..f6677cb19789 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -150,13 +150,12 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
 
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_cmt: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -279,7 +278,7 @@ static void sh_cmt_clock_event_program_verify(struct sh_cmt_priv *p,
                         delay = 1;
 
                 if (!delay)
-                        pr_warning("sh_cmt: too long delay\n");
+                        dev_warn(&p->pdev->dev, "too long delay\n");
 
         } while (delay);
 }
@@ -289,7 +288,7 @@ static void sh_cmt_set_next(struct sh_cmt_priv *p, unsigned long delta)
         unsigned long flags;
 
         if (delta > p->max_match_value)
-                pr_warning("sh_cmt: delta out of range\n");
+                dev_warn(&p->pdev->dev, "delta out of range\n");
 
         spin_lock_irqsave(&p->lock, flags);
         p->next_match_value = delta;
@@ -451,7 +450,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_priv *p,
         cs->resume = sh_cmt_clocksource_resume;
         cs->mask = CLOCKSOURCE_MASK(sizeof(unsigned long) * 8);
         cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
-        pr_info("sh_cmt: %s used as clock source\n", cs->name);
+        dev_info(&p->pdev->dev, "used as clock source\n");
         clocksource_register(cs);
         return 0;
 }
@@ -497,13 +496,11 @@ static void sh_cmt_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_cmt: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_cmt_clock_event_start(p, 1);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
-                pr_info("sh_cmt: %s used for oneshot clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for oneshot clock events\n");
                 sh_cmt_clock_event_start(p, 0);
                 break;
         case CLOCK_EVT_MODE_SHUTDOWN:
@@ -544,7 +541,7 @@ static void sh_cmt_register_clockevent(struct sh_cmt_priv *p,
         ced->set_next_event = sh_cmt_clock_event_next;
         ced->set_mode = sh_cmt_clock_event_mode;
 
-        pr_info("sh_cmt: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 }
 
@@ -601,22 +598,27 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_cmt: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* request irq using setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_cmt_interrupt;
         p->irqaction.dev_id = p;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "cmt_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_cmt: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
         if (resource_size(res) == 6) {
@@ -629,17 +631,17 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
                 p->clear_bits = ~0xc000;
         }
 
-        ret = sh_cmt_register(p, cfg->name,
+        ret = sh_cmt_register(p, (char *)dev_name(&p->pdev->dev),
                               cfg->clockevent_rating,
                               cfg->clocksource_rating);
         if (ret) {
-                pr_err("sh_cmt: registration failed\n");
+                dev_err(&p->pdev->dev, "registration failed\n");
                 goto err1;
         }
 
         ret = setup_irq(irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_cmt: failed to request irq %d\n", irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n", irq);
                 goto err1;
         }
 
@@ -654,11 +656,10 @@ err0:
 static int __devinit sh_cmt_probe(struct platform_device *pdev)
 {
         struct sh_cmt_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_cmt: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 5fb78bfd73bb..ef7a5be8a09f 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -119,13 +119,12 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
 
 static int sh_mtu2_enable(struct sh_mtu2_priv *p)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_mtu2: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -194,8 +193,7 @@ static void sh_mtu2_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_mtu2: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_mtu2_enable(p);
                 break;
         case CLOCK_EVT_MODE_UNUSED:
@@ -222,13 +220,13 @@ static void sh_mtu2_register_clockevent(struct sh_mtu2_priv *p,
         ced->cpumask = cpumask_of(0);
         ced->set_mode = sh_mtu2_clock_event_mode;
 
-        pr_info("sh_mtu2: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_mtu2: failed to request irq %d\n",
-                       p->irqaction.irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n",
+                        p->irqaction.irq);
                 return;
         }
 }
@@ -274,26 +272,32 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_mtu2: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* setup data for setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_mtu2_interrupt;
         p->irqaction.dev_id = p;
         p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "mtu2_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_mtu2: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
-        return sh_mtu2_register(p, cfg->name, cfg->clockevent_rating);
+        return sh_mtu2_register(p, (char *)dev_name(&p->pdev->dev),
+                                cfg->clockevent_rating);
  err1:
         iounmap(p->mapbase);
  err0:
@@ -303,11 +307,10 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
 static int __devinit sh_mtu2_probe(struct platform_device *pdev)
 {
         struct sh_mtu2_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_mtu2: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index fc9ff1e5b770..8e44e14ec4c2 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -107,13 +107,12 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
 
 static int sh_tmu_enable(struct sh_tmu_priv *p)
 {
-        struct sh_timer_config *cfg = p->pdev->dev.platform_data;
         int ret;
 
         /* enable clock */
         ret = clk_enable(p->clk);
         if (ret) {
-                pr_err("sh_tmu: cannot enable clock \"%s\"\n", cfg->clk);
+                dev_err(&p->pdev->dev, "cannot enable clock\n");
                 return ret;
         }
 
@@ -229,7 +228,7 @@ static int sh_tmu_register_clocksource(struct sh_tmu_priv *p,
         cs->disable = sh_tmu_clocksource_disable;
         cs->mask = CLOCKSOURCE_MASK(32);
         cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
-        pr_info("sh_tmu: %s used as clock source\n", cs->name);
+        dev_info(&p->pdev->dev, "used as clock source\n");
         clocksource_register(cs);
         return 0;
 }
@@ -277,13 +276,11 @@ static void sh_tmu_clock_event_mode(enum clock_event_mode mode,
 
         switch (mode) {
         case CLOCK_EVT_MODE_PERIODIC:
-                pr_info("sh_tmu: %s used for periodic clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for periodic clock events\n");
                 sh_tmu_clock_event_start(p, 1);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
-                pr_info("sh_tmu: %s used for oneshot clock events\n",
-                        ced->name);
+                dev_info(&p->pdev->dev, "used for oneshot clock events\n");
                 sh_tmu_clock_event_start(p, 0);
                 break;
         case CLOCK_EVT_MODE_UNUSED:
@@ -324,13 +321,13 @@ static void sh_tmu_register_clockevent(struct sh_tmu_priv *p,
         ced->set_next_event = sh_tmu_clock_event_next;
         ced->set_mode = sh_tmu_clock_event_mode;
 
-        pr_info("sh_tmu: %s used for clock events\n", ced->name);
+        dev_info(&p->pdev->dev, "used for clock events\n");
         clockevents_register_device(ced);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
-                pr_err("sh_tmu: failed to request irq %d\n",
-                       p->irqaction.irq);
+                dev_err(&p->pdev->dev, "failed to request irq %d\n",
+                        p->irqaction.irq);
                 return;
         }
 }
@@ -379,26 +376,31 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
         /* map memory, let mapbase point to our channel */
         p->mapbase = ioremap_nocache(res->start, resource_size(res));
         if (p->mapbase == NULL) {
-                pr_err("sh_tmu: failed to remap I/O memory\n");
+                dev_err(&p->pdev->dev, "failed to remap I/O memory\n");
                 goto err0;
         }
 
         /* setup data for setup_irq() (too early for request_irq()) */
-        p->irqaction.name = cfg->name;
+        p->irqaction.name = dev_name(&p->pdev->dev);
         p->irqaction.handler = sh_tmu_interrupt;
         p->irqaction.dev_id = p;
         p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL;
+        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
 
         /* get hold of clock */
-        p->clk = clk_get(&p->pdev->dev, cfg->clk);
+        p->clk = clk_get(&p->pdev->dev, "tmu_fck");
         if (IS_ERR(p->clk)) {
-                pr_err("sh_tmu: cannot get clock \"%s\"\n", cfg->clk);
-                ret = PTR_ERR(p->clk);
-                goto err1;
+                dev_warn(&p->pdev->dev, "using deprecated clock lookup\n");
+                p->clk = clk_get(&p->pdev->dev, cfg->clk);
+                if (IS_ERR(p->clk)) {
+                        dev_err(&p->pdev->dev, "cannot get clock\n");
+                        ret = PTR_ERR(p->clk);
+                        goto err1;
+                }
         }
 
-        return sh_tmu_register(p, cfg->name,
+        return sh_tmu_register(p, (char *)dev_name(&p->pdev->dev),
                                cfg->clockevent_rating,
                                cfg->clocksource_rating);
  err1:
@@ -410,11 +412,10 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
 static int __devinit sh_tmu_probe(struct platform_device *pdev)
 {
         struct sh_tmu_priv *p = platform_get_drvdata(pdev);
-        struct sh_timer_config *cfg = pdev->dev.platform_data;
         int ret;
 
         if (p) {
-                pr_info("sh_tmu: %s kept as earlytimer\n", cfg->name);
+                dev_info(&pdev->dev, "kept as earlytimer\n");
                 return 0;
         }
 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 2d5d575e889d..063b2184caf5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -662,32 +662,20 @@ static ssize_t show_bios_limit(struct cpufreq_policy *policy, char *buf)
         return sprintf(buf, "%u\n", policy->cpuinfo.max_freq);
 }
 
-#define define_one_ro(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-#define define_one_ro0400(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0400, show_##_name, NULL)
-
-#define define_one_rw(_name) \
-static struct freq_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_ro0400(cpuinfo_cur_freq);
-define_one_ro(cpuinfo_min_freq);
-define_one_ro(cpuinfo_max_freq);
-define_one_ro(cpuinfo_transition_latency);
-define_one_ro(scaling_available_governors);
-define_one_ro(scaling_driver);
-define_one_ro(scaling_cur_freq);
-define_one_ro(bios_limit);
-define_one_ro(related_cpus);
-define_one_ro(affected_cpus);
-define_one_rw(scaling_min_freq);
-define_one_rw(scaling_max_freq);
-define_one_rw(scaling_governor);
-define_one_rw(scaling_setspeed);
+cpufreq_freq_attr_ro_perm(cpuinfo_cur_freq, 0400);
+cpufreq_freq_attr_ro(cpuinfo_min_freq);
+cpufreq_freq_attr_ro(cpuinfo_max_freq);
+cpufreq_freq_attr_ro(cpuinfo_transition_latency);
+cpufreq_freq_attr_ro(scaling_available_governors);
+cpufreq_freq_attr_ro(scaling_driver);
+cpufreq_freq_attr_ro(scaling_cur_freq);
+cpufreq_freq_attr_ro(bios_limit);
+cpufreq_freq_attr_ro(related_cpus);
+cpufreq_freq_attr_ro(affected_cpus);
+cpufreq_freq_attr_rw(scaling_min_freq);
+cpufreq_freq_attr_rw(scaling_max_freq);
+cpufreq_freq_attr_rw(scaling_governor);
+cpufreq_freq_attr_rw(scaling_setspeed);
 
 static struct attribute *default_attrs[] = {
         &cpuinfo_min_freq.attr,
@@ -1113,6 +1101,8 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
         unsigned int cpu = sys_dev->id;
         unsigned long flags;
         struct cpufreq_policy *data;
+        struct kobject *kobj;
+        struct completion *cmp;
 #ifdef CONFIG_SMP
         struct sys_device *cpu_sys_dev;
         unsigned int j;
@@ -1141,10 +1131,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                 dprintk("removing link\n");
                 cpumask_clear_cpu(cpu, data->cpus);
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                sysfs_remove_link(&sys_dev->kobj, "cpufreq");
+                kobj = &sys_dev->kobj;
                 cpufreq_cpu_put(data);
                 cpufreq_debug_enable_ratelimit();
                 unlock_policy_rwsem_write(cpu);
+                sysfs_remove_link(kobj, "cpufreq");
                 return 0;
         }
 #endif
@@ -1181,7 +1172,10 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                                 data->governor->name, CPUFREQ_NAME_LEN);
 #endif
                         cpu_sys_dev = get_cpu_sysdev(j);
-                        sysfs_remove_link(&cpu_sys_dev->kobj, "cpufreq");
+                        kobj = &cpu_sys_dev->kobj;
+                        unlock_policy_rwsem_write(cpu);
+                        sysfs_remove_link(kobj, "cpufreq");
+                        lock_policy_rwsem_write(cpu);
                         cpufreq_cpu_put(data);
                 }
         }
@@ -1192,19 +1186,22 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
         if (cpufreq_driver->target)
                 __cpufreq_governor(data, CPUFREQ_GOV_STOP);
 
-        kobject_put(&data->kobj);
+        kobj = &data->kobj;
+        cmp = &data->kobj_unregister;
+        unlock_policy_rwsem_write(cpu);
+        kobject_put(kobj);
 
         /* we need to make sure that the underlying kobj is actually
          * not referenced anymore by anybody before we proceed with
          * unloading.
          */
         dprintk("waiting for dropping of refcount\n");
-        wait_for_completion(&data->kobj_unregister);
+        wait_for_completion(cmp);
         dprintk("wait complete\n");
 
+        lock_policy_rwsem_write(cpu);
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(data);
-
         unlock_policy_rwsem_write(cpu);
 
         free_cpumask_var(data->related_cpus);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 599a40b25cb0..526bfbf69611 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -178,12 +178,8 @@ static ssize_t show_sampling_rate_min(struct kobject *kobj,
         return sprintf(buf, "%u\n", min_sampling_rate);
 }
 
-#define define_one_ro(_name)            \
-static struct global_attr _name =       \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-define_one_ro(sampling_rate_max);
-define_one_ro(sampling_rate_min);
+define_one_global_ro(sampling_rate_max);
+define_one_global_ro(sampling_rate_min);
 
 /* cpufreq_conservative Governor Tunables */
 #define show_one(file_name, object)                                     \
@@ -221,12 +217,8 @@ show_one_old(freq_step);
 show_one_old(sampling_rate_min);
 show_one_old(sampling_rate_max);
 
-#define define_one_ro_old(object, _name)        \
-static struct freq_attr object =                \
-__ATTR(_name, 0444, show_##_name##_old, NULL)
-
-define_one_ro_old(sampling_rate_min_old, sampling_rate_min);
-define_one_ro_old(sampling_rate_max_old, sampling_rate_max);
+cpufreq_freq_attr_ro_old(sampling_rate_min);
+cpufreq_freq_attr_ro_old(sampling_rate_max);
 
 /*** delete after deprecation time ***/
 
@@ -364,16 +356,12 @@ static ssize_t store_freq_step(struct kobject *a, struct attribute *b,
         return count;
 }
 
-#define define_one_rw(_name) \
-static struct global_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_rw(sampling_rate);
-define_one_rw(sampling_down_factor);
-define_one_rw(up_threshold);
-define_one_rw(down_threshold);
-define_one_rw(ignore_nice_load);
-define_one_rw(freq_step);
+define_one_global_rw(sampling_rate);
+define_one_global_rw(sampling_down_factor);
+define_one_global_rw(up_threshold);
+define_one_global_rw(down_threshold);
+define_one_global_rw(ignore_nice_load);
+define_one_global_rw(freq_step);
 
 static struct attribute *dbs_attributes[] = {
         &sampling_rate_max.attr,
@@ -409,16 +397,12 @@ write_one_old(down_threshold);
 write_one_old(ignore_nice_load);
 write_one_old(freq_step);
 
-#define define_one_rw_old(object, _name)        \
-static struct freq_attr object =                \
-__ATTR(_name, 0644, show_##_name##_old, store_##_name##_old)
-
-define_one_rw_old(sampling_rate_old, sampling_rate);
-define_one_rw_old(sampling_down_factor_old, sampling_down_factor);
-define_one_rw_old(up_threshold_old, up_threshold);
-define_one_rw_old(down_threshold_old, down_threshold);
-define_one_rw_old(ignore_nice_load_old, ignore_nice_load);
-define_one_rw_old(freq_step_old, freq_step);
+cpufreq_freq_attr_rw_old(sampling_rate);
+cpufreq_freq_attr_rw_old(sampling_down_factor);
+cpufreq_freq_attr_rw_old(up_threshold);
+cpufreq_freq_attr_rw_old(down_threshold);
+cpufreq_freq_attr_rw_old(ignore_nice_load);
+cpufreq_freq_attr_rw_old(freq_step);
 
 static struct attribute *dbs_attributes_old[] = {
         &sampling_rate_max_old.attr,
@@ -444,6 +428,7 @@ static struct attribute_group dbs_attr_group_old = {
 static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 {
         unsigned int load = 0;
+        unsigned int max_load = 0;
         unsigned int freq_target;
 
         struct cpufreq_policy *policy;
@@ -501,6 +486,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                         continue;
 
                 load = 100 * (wall_time - idle_time) / wall_time;
+
+                if (load > max_load)
+                        max_load = load;
         }
 
         /*
@@ -511,7 +499,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                 return;
 
         /* Check for frequency increase */
-        if (load > dbs_tuners_ins.up_threshold) {
+        if (max_load > dbs_tuners_ins.up_threshold) {
                 this_dbs_info->down_skip = 0;
 
                 /* if we are already at full speed then break out early */
@@ -538,7 +526,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
          * can support the current CPU usage without triggering the up
          * policy. To be safe, we focus 10 points under the threshold.
          */
-        if (load < (dbs_tuners_ins.down_threshold - 10)) {
+        if (max_load < (dbs_tuners_ins.down_threshold - 10)) {
                 freq_target = (dbs_tuners_ins.freq_step * policy->max) / 100;
 
                 this_dbs_info->requested_freq -= freq_target;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index bd444dc93cf2..e1314212d8d4 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -73,6 +73,7 @@ enum {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
 
 struct cpu_dbs_info_s {
         cputime64_t prev_cpu_idle;
+        cputime64_t prev_cpu_iowait;
         cputime64_t prev_cpu_wall;
         cputime64_t prev_cpu_nice;
         struct cpufreq_policy *cur_policy;
@@ -108,6 +109,7 @@ static struct dbs_tuners {
         unsigned int down_differential;
         unsigned int ignore_nice;
         unsigned int powersave_bias;
+        unsigned int io_is_busy;
 } dbs_tuners_ins = {
         .up_threshold = DEF_FREQUENCY_UP_THRESHOLD,
         .down_differential = DEF_FREQUENCY_DOWN_DIFFERENTIAL,
@@ -148,6 +150,16 @@ static inline cputime64_t get_cpu_idle_time(unsigned int cpu, cputime64_t *wall)
         return idle_time;
 }
 
+static inline cputime64_t get_cpu_iowait_time(unsigned int cpu, cputime64_t *wall)
+{
+        u64 iowait_time = get_cpu_iowait_time_us(cpu, wall);
+
+        if (iowait_time == -1ULL)
+                return 0;
+
+        return iowait_time;
+}
+
 /*
  * Find right freq to be set now with powersave_bias on.
  * Returns the freq_hi to be used right now and will set freq_hi_jiffies,
@@ -234,12 +246,8 @@ static ssize_t show_sampling_rate_min(struct kobject *kobj,
         return sprintf(buf, "%u\n", min_sampling_rate);
 }
 
-#define define_one_ro(_name)            \
-static struct global_attr _name =       \
-__ATTR(_name, 0444, show_##_name, NULL)
-
-define_one_ro(sampling_rate_max);
-define_one_ro(sampling_rate_min);
+define_one_global_ro(sampling_rate_max);
+define_one_global_ro(sampling_rate_min);
 
 /* cpufreq_ondemand Governor Tunables */
 #define show_one(file_name, object)                                     \
@@ -249,6 +257,7 @@ static ssize_t show_##file_name						\
         return sprintf(buf, "%u\n", dbs_tuners_ins.object);             \
 }
 show_one(sampling_rate, sampling_rate);
+show_one(io_is_busy, io_is_busy);
 show_one(up_threshold, up_threshold);
 show_one(ignore_nice_load, ignore_nice);
 show_one(powersave_bias, powersave_bias);
@@ -274,12 +283,8 @@ show_one_old(powersave_bias);
 show_one_old(sampling_rate_min);
 show_one_old(sampling_rate_max);
 
-#define define_one_ro_old(object, _name)       \
-static struct freq_attr object =               \
-__ATTR(_name, 0444, show_##_name##_old, NULL)
-
-define_one_ro_old(sampling_rate_min_old, sampling_rate_min);
-define_one_ro_old(sampling_rate_max_old, sampling_rate_max);
+cpufreq_freq_attr_ro_old(sampling_rate_min);
+cpufreq_freq_attr_ro_old(sampling_rate_max);
 
 /*** delete after deprecation time ***/
 
@@ -299,6 +304,23 @@ static ssize_t store_sampling_rate(struct kobject *a, struct attribute *b,
         return count;
 }
 
+static ssize_t store_io_is_busy(struct kobject *a, struct attribute *b,
+                                   const char *buf, size_t count)
+{
+        unsigned int input;
+        int ret;
+
+        ret = sscanf(buf, "%u", &input);
+        if (ret != 1)
+                return -EINVAL;
+
+        mutex_lock(&dbs_mutex);
+        dbs_tuners_ins.io_is_busy = !!input;
+        mutex_unlock(&dbs_mutex);
+
+        return count;
+}
+
 static ssize_t store_up_threshold(struct kobject *a, struct attribute *b,
                                   const char *buf, size_t count)
 {
@@ -376,14 +398,11 @@ static ssize_t store_powersave_bias(struct kobject *a, struct attribute *b,
         return count;
 }
 
-#define define_one_rw(_name) \
-static struct global_attr _name = \
-__ATTR(_name, 0644, show_##_name, store_##_name)
-
-define_one_rw(sampling_rate);
-define_one_rw(up_threshold);
-define_one_rw(ignore_nice_load);
-define_one_rw(powersave_bias);
+define_one_global_rw(sampling_rate);
+define_one_global_rw(io_is_busy);
+define_one_global_rw(up_threshold);
+define_one_global_rw(ignore_nice_load);
+define_one_global_rw(powersave_bias);
 
 static struct attribute *dbs_attributes[] = {
         &sampling_rate_max.attr,
@@ -392,6 +411,7 @@ static struct attribute *dbs_attributes[] = {
         &up_threshold.attr,
         &ignore_nice_load.attr,
         &powersave_bias.attr,
+        &io_is_busy.attr,
         NULL
 };
 
@@ -415,14 +435,10 @@ write_one_old(up_threshold);
 write_one_old(ignore_nice_load);
 write_one_old(powersave_bias);
 
-#define define_one_rw_old(object, _name)       \
-static struct freq_attr object =               \
-__ATTR(_name, 0644, show_##_name##_old, store_##_name##_old)
-
-define_one_rw_old(sampling_rate_old, sampling_rate);
-define_one_rw_old(up_threshold_old, up_threshold);
-define_one_rw_old(ignore_nice_load_old, ignore_nice_load);
-define_one_rw_old(powersave_bias_old, powersave_bias);
+cpufreq_freq_attr_rw_old(sampling_rate);
+cpufreq_freq_attr_rw_old(up_threshold);
+cpufreq_freq_attr_rw_old(ignore_nice_load);
+cpufreq_freq_attr_rw_old(powersave_bias);
 
 static struct attribute *dbs_attributes_old[] = {
        &sampling_rate_max_old.attr,
@@ -470,14 +486,15 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 
         for_each_cpu(j, policy->cpus) {
                 struct cpu_dbs_info_s *j_dbs_info;
-                cputime64_t cur_wall_time, cur_idle_time;
-                unsigned int idle_time, wall_time;
+                cputime64_t cur_wall_time, cur_idle_time, cur_iowait_time;
+                unsigned int idle_time, wall_time, iowait_time;
                 unsigned int load, load_freq;
                 int freq_avg;
 
                 j_dbs_info = &per_cpu(od_cpu_dbs_info, j);
 
                 cur_idle_time = get_cpu_idle_time(j, &cur_wall_time);
+                cur_iowait_time = get_cpu_iowait_time(j, &cur_wall_time);
 
                 wall_time = (unsigned int) cputime64_sub(cur_wall_time,
                                 j_dbs_info->prev_cpu_wall);
@@ -487,6 +504,10 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                 j_dbs_info->prev_cpu_idle);
                 j_dbs_info->prev_cpu_idle = cur_idle_time;
 
+                iowait_time = (unsigned int) cputime64_sub(cur_iowait_time,
+                                j_dbs_info->prev_cpu_iowait);
+                j_dbs_info->prev_cpu_iowait = cur_iowait_time;
+
                 if (dbs_tuners_ins.ignore_nice) {
                         cputime64_t cur_nice;
                         unsigned long cur_nice_jiffies;
@@ -504,6 +525,16 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                         idle_time += jiffies_to_usecs(cur_nice_jiffies);
                 }
 
+                /*
+                 * For the purpose of ondemand, waiting for disk IO is an
+                 * indication that you're performance critical, and not that
+                 * the system is actually idle. So subtract the iowait time
+                 * from the cpu idle time.
+                 */
+
+                if (dbs_tuners_ins.io_is_busy && idle_time >= iowait_time)
+                        idle_time -= iowait_time;
+
                 if (unlikely(!wall_time || wall_time < idle_time))
                         continue;
 
@@ -617,6 +648,29 @@ static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
         cancel_delayed_work_sync(&dbs_info->work);
 }
 
+/*
+ * Not all CPUs want IO time to be accounted as busy; this dependson how
+ * efficient idling at a higher frequency/voltage is.
+ * Pavel Machek says this is not so for various generations of AMD and old
+ * Intel systems.
+ * Mike Chan (androidlcom) calis this is also not true for ARM.
+ * Because of this, whitelist specific known (series) of CPUs by default, and
+ * leave all others up to the user.
+ */
+static int should_io_be_busy(void)
+{
+#if defined(CONFIG_X86)
+        /*
+         * For Intel, Core 2 (model 15) andl later have an efficient idle.
+         */
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+            boot_cpu_data.x86 == 6 &&
+            boot_cpu_data.x86_model >= 15)
+                return 1;
+#endif
+        return 0;
+}
+
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                    unsigned int event)
 {
@@ -679,6 +733,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                         dbs_tuners_ins.sampling_rate =
                                 max(min_sampling_rate,
                                     latency * LATENCY_MULTIPLIER);
+                        dbs_tuners_ins.io_is_busy = should_io_be_busy();
                 }
                 mutex_unlock(&dbs_mutex);
 
diff --git a/drivers/cpuidle/governors/ladder.c b/drivers/cpuidle/governors/ladder.c
index 1c1ceb4f218f..12c98900dcf8 100644
--- a/drivers/cpuidle/governors/ladder.c
+++ b/drivers/cpuidle/governors/ladder.c
@@ -67,7 +67,7 @@ static int ladder_select_state(struct cpuidle_device *dev)
         struct ladder_device *ldev = &__get_cpu_var(ladder_devices);
         struct ladder_device_state *last_state;
         int last_residency, last_idx = ldev->last_state_idx;
-        int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
+        int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
 
         /* Special case when user has set very strict latency requirement */
         if (unlikely(latency_req == 0)) {
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 1aea7157d8ff..b81ad9c731ae 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -100,7 +100,6 @@ struct menu_device {
         int             needs_update;
 
         unsigned int    expected_us;
-        unsigned int    measured_us;
         u64             predicted_us;
         unsigned int    exit_us;
         unsigned int    bucket;
@@ -183,18 +182,18 @@ static u64 div_round64(u64 dividend, u32 divisor)
 static int menu_select(struct cpuidle_device *dev)
 {
         struct menu_device *data = &__get_cpu_var(menu_devices);
-        int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
+        int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
         int i;
         int multiplier;
 
-        data->last_state_idx = 0;
-        data->exit_us = 0;
-
         if (data->needs_update) {
                 menu_update(dev);
                 data->needs_update = 0;
         }
 
+        data->last_state_idx = 0;
+        data->exit_us = 0;
+
         /* Special case when user has set very strict latency requirement */
         if (unlikely(latency_req == 0))
                 return 0;
@@ -294,7 +293,7 @@ static void menu_update(struct cpuidle_device *dev)
         new_factor = data->correction_factor[data->bucket]
                         * (DECAY - 1) / DECAY;
 
-        if (data->expected_us > 0 && data->measured_us < MAX_INTERESTING)
+        if (data->expected_us > 0 && measured_us < MAX_INTERESTING)
                 new_factor += RESOLUTION * measured_us / data->expected_us;
         else
                 /*
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index 7cc31b3f40d8..323afef77802 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -26,8 +26,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
-
-#include <asm/dmaengine.h>
+#include <linux/sh_dma.h>
 
 #include "shdma.h"
 
@@ -45,7 +44,7 @@ enum sh_dmae_desc_status {
 #define LOG2_DEFAULT_XFER_SIZE  2
 
 /* A bitmask with bits enough for enum sh_dmae_slave_chan_id */
-static unsigned long sh_dmae_slave_used[BITS_TO_LONGS(SHDMA_SLAVE_NUMBER)];
+static unsigned long sh_dmae_slave_used[BITS_TO_LONGS(SH_DMA_SLAVE_NUMBER)];
 
 static void sh_dmae_chan_ld_cleanup(struct sh_dmae_chan *sh_chan, bool all);
 
@@ -190,7 +189,7 @@ static int dmae_set_dmars(struct sh_dmae_chan *sh_chan, u16 val)
         struct sh_dmae_device *shdev = container_of(sh_chan->common.device,
                                                 struct sh_dmae_device, common);
         struct sh_dmae_pdata *pdata = shdev->pdata;
-        struct sh_dmae_channel *chan_pdata = &pdata->channel[sh_chan->id];
+        const struct sh_dmae_channel *chan_pdata = &pdata->channel[sh_chan->id];
         u16 __iomem *addr = shdev->dmars + chan_pdata->dmars / sizeof(u16);
         int shift = chan_pdata->dmars_bit;
 
@@ -266,8 +265,8 @@ static struct sh_desc *sh_dmae_get_desc(struct sh_dmae_chan *sh_chan)
         return NULL;
 }
 
-static struct sh_dmae_slave_config *sh_dmae_find_slave(
-        struct sh_dmae_chan *sh_chan, enum sh_dmae_slave_chan_id slave_id)
+static const struct sh_dmae_slave_config *sh_dmae_find_slave(
+        struct sh_dmae_chan *sh_chan, struct sh_dmae_slave *param)
 {
         struct dma_device *dma_dev = sh_chan->common.device;
         struct sh_dmae_device *shdev = container_of(dma_dev,
@@ -275,11 +274,11 @@ static struct sh_dmae_slave_config *sh_dmae_find_slave(
         struct sh_dmae_pdata *pdata = shdev->pdata;
         int i;
 
-        if ((unsigned)slave_id >= SHDMA_SLAVE_NUMBER)
+        if (param->slave_id >= SH_DMA_SLAVE_NUMBER)
                 return NULL;
 
         for (i = 0; i < pdata->slave_num; i++)
-                if (pdata->slave[i].slave_id == slave_id)
+                if (pdata->slave[i].slave_id == param->slave_id)
                         return pdata->slave + i;
 
         return NULL;
@@ -290,6 +289,7 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
         struct sh_dmae_chan *sh_chan = to_sh_chan(chan);
         struct sh_desc *desc;
         struct sh_dmae_slave *param = chan->private;
+        int ret;
 
         pm_runtime_get_sync(sh_chan->dev);
 
@@ -298,14 +298,18 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
          * never runs concurrently with itself or free_chan_resources.
          */
         if (param) {
-                struct sh_dmae_slave_config *cfg;
+                const struct sh_dmae_slave_config *cfg;
 
-                cfg = sh_dmae_find_slave(sh_chan, param->slave_id);
-                if (!cfg)
-                        return -EINVAL;
+                cfg = sh_dmae_find_slave(sh_chan, param);
+                if (!cfg) {
+                        ret = -EINVAL;
+                        goto efindslave;
+                }
 
-                if (test_and_set_bit(param->slave_id, sh_dmae_slave_used))
-                        return -EBUSY;
+                if (test_and_set_bit(param->slave_id, sh_dmae_slave_used)) {
+                        ret = -EBUSY;
+                        goto etestused;
+                }
 
                 param->config = cfg;
 
@@ -334,10 +338,20 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
         }
         spin_unlock_bh(&sh_chan->desc_lock);
 
-        if (!sh_chan->descs_allocated)
-                pm_runtime_put(sh_chan->dev);
+        if (!sh_chan->descs_allocated) {
+                ret = -ENOMEM;
+                goto edescalloc;
+        }
 
         return sh_chan->descs_allocated;
+
+edescalloc:
+        if (param)
+                clear_bit(param->slave_id, sh_dmae_slave_used);
+etestused:
+efindslave:
+        pm_runtime_put(sh_chan->dev);
+        return ret;
 }
 
 /*
@@ -559,12 +573,14 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
 {
         struct sh_dmae_slave *param;
         struct sh_dmae_chan *sh_chan;
+        dma_addr_t slave_addr;
 
         if (!chan)
                 return NULL;
 
         sh_chan = to_sh_chan(chan);
         param = chan->private;
+        slave_addr = param->config->addr;
 
         /* Someone calling slave DMA on a public channel? */
         if (!param || !sg_len) {
@@ -577,7 +593,7 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
          * if (param != NULL), this is a successfully requested slave channel,
          * therefore param->config != NULL too.
          */
-        return sh_dmae_prep_sg(sh_chan, sgl, sg_len, &param->config->addr,
+        return sh_dmae_prep_sg(sh_chan, sgl, sg_len, &slave_addr,
                                direction, flags);
 }
 
@@ -858,7 +874,7 @@ static int __devinit sh_dmae_chan_probe(struct sh_dmae_device *shdev, int id,
                                         int irq, unsigned long flags)
 {
         int err;
-        struct sh_dmae_channel *chan_pdata = &shdev->pdata->channel[id];
+        const struct sh_dmae_channel *chan_pdata = &shdev->pdata->channel[id];
         struct platform_device *pdev = to_platform_device(shdev->common.dev);
         struct sh_dmae_chan *new_sh_chan;
 
diff --git a/drivers/dma/shdma.h b/drivers/dma/shdma.h
index 153609a1e96c..4021275a0a43 100644
--- a/drivers/dma/shdma.h
+++ b/drivers/dma/shdma.h
@@ -17,8 +17,8 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 
-#include <asm/dmaengine.h>
-
+#define SH_DMAC_MAX_CHANNELS 6
+#define SH_DMA_SLAVE_NUMBER 256
 #define SH_DMA_TCR_MAX 0x00FFFFFF       /* 16MB */
 
 struct device;
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index 3ebc61067e54..75fcf1ac8bb7 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -1359,3 +1359,5 @@ module_exit(txx9dmac_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TXx9 DMA Controller driver");
 MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
+MODULE_ALIAS("platform:txx9dmac");
+MODULE_ALIAS("platform:txx9dmac-chan");
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index f5b6d9fe4def..97e64bcdbc06 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -294,7 +294,6 @@ wrong_ls_mce:
 void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
 {
         u32 ec  = ERROR_CODE(regs->nbsl);
-        u32 xec = EXT_ERROR_CODE(regs->nbsl);
 
         if (!handle_errors)
                 return;
@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
                 pr_cont("\n");
         }
 
-        pr_emerg("%s.\n", EXT_ERR_MSG(xec));
+        pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
 
         if (BUS_ERROR(ec) && nb_bus_decoder)
                 nb_bus_decoder(node_id, regs);
@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
                  ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
 
         /* do the two bits[14:13] together */
-        ecc = m->status & (3ULL << 45);
+        ecc = (m->status >> 45) & 0x3;
         if (ecc)
                 pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
 
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 3784a47865b7..8f5aebfb29df 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -190,7 +190,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
         for (try = 0; try < 5; try++) {
                 new = allocate ? old - bandwidth : old + bandwidth;
                 if (new < 0 || new > BANDWIDTH_AVAILABLE_INITIAL)
-                        break;
+                        return -EBUSY;
 
                 data[0] = cpu_to_be32(old);
                 data[1] = cpu_to_be32(new);
@@ -218,7 +218,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                 u32 channels_mask, u64 offset, bool allocate, __be32 data[2])
 {
         __be32 c, all, old;
-        int i, retry = 5;
+        int i, ret = -EIO, retry = 5;
 
         old = all = allocate ? cpu_to_be32(~0) : 0;
 
@@ -226,6 +226,8 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                 if (!(channels_mask & 1 << i))
                         continue;
 
+                ret = -EBUSY;
+
                 c = cpu_to_be32(1 << (31 - i));
                 if ((old & c) != (all & c))
                         continue;
@@ -251,12 +253,16 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
 
                         /* 1394-1995 IRM, fall through to retry. */
                 default:
-                        if (retry--)
+                        if (retry) {
+                                retry--;
                                 i--;
+                        } else {
+                                ret = -EIO;
+                        }
                 }
         }
 
-        return -EIO;
+        return ret;
 }
 
 static void deallocate_channel(struct fw_card *card, int irm_id,
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index c9388fbb3bcc..a3b083a7403a 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1158,7 +1158,7 @@ static void handle_local_lock(struct fw_ohci *ohci,
                               struct fw_packet *packet, u32 csr)
 {
         struct fw_packet response;
-        int tcode, length, ext_tcode, sel;
+        int tcode, length, ext_tcode, sel, try;
         __be32 *payload, lock_old;
         u32 lock_arg, lock_data;
 
@@ -1185,21 +1185,26 @@ static void handle_local_lock(struct fw_ohci *ohci,
         reg_write(ohci, OHCI1394_CSRCompareData, lock_arg);
         reg_write(ohci, OHCI1394_CSRControl, sel);
 
-        if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000)
-                lock_old = cpu_to_be32(reg_read(ohci, OHCI1394_CSRData));
-        else
-                fw_notify("swap not done yet\n");
+        for (try = 0; try < 20; try++)
+                if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000) {
+                        lock_old = cpu_to_be32(reg_read(ohci,
+                                                        OHCI1394_CSRData));
+                        fw_fill_response(&response, packet->header,
+                                         RCODE_COMPLETE,
+                                         &lock_old, sizeof(lock_old));
+                        goto out;
+                }
+
+        fw_error("swap not done (CSR lock timeout)\n");
+        fw_fill_response(&response, packet->header, RCODE_BUSY, NULL, 0);
 
-        fw_fill_response(&response, packet->header,
-                         RCODE_COMPLETE, &lock_old, sizeof(lock_old));
  out:
         fw_core_handle_response(&ohci->card, &response);
 }
 
 static void handle_local_request(struct context *ctx, struct fw_packet *packet)
 {
-        u64 offset;
-        u32 csr;
+        u64 offset, csr;
 
         if (ctx == &ctx->ohci->at_request_ctx) {
                 packet->ack = ACK_PENDING;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 76be229c814d..eb0c3fe44b29 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -416,7 +416,8 @@ static int gpio_setup_irq(struct gpio_desc *desc, struct device *dev,
         return 0;
 
 free_sd:
-        sysfs_put(pdesc->value_sd);
+        if (pdesc)
+                sysfs_put(pdesc->value_sd);
 free_id:
         idr_remove(&pdesc_idr, id);
         desc->flags &= GPIO_FLAGS_MASK;
diff --git a/drivers/gpio/it8761e_gpio.c b/drivers/gpio/it8761e_gpio.c
index 753219cf993a..41a9388f2fde 100644
--- a/drivers/gpio/it8761e_gpio.c
+++ b/drivers/gpio/it8761e_gpio.c
@@ -80,8 +80,8 @@ static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
         u16 reg;
         u8 bit;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         return !!(inb(reg) & (1 << bit));
 }
@@ -91,8 +91,8 @@ static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
         u8 curr_dirs;
         u8 io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         spin_lock(&sio_lock);
 
@@ -116,8 +116,8 @@ static void it8761e_gpio_set(struct gpio_chip *gc,
         u8 curr_vals, bit;
         u16 reg;
 
-        bit = gpio_num % 7;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        bit = gpio_num % 8;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
 
         spin_lock(&sio_lock);
 
@@ -135,8 +135,8 @@ static int it8761e_gpio_direction_out(struct gpio_chip *gc,
 {
         u8 curr_dirs, io_reg, bit;
 
-        bit = gpio_num % 7;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        bit = gpio_num % 8;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
 
         it8761e_gpio_set(gc, gpio_num, val);
 
@@ -200,7 +200,7 @@ static int __init it8761e_gpio_init(void)
                 return -EBUSY;
 
         it8761e_gpio_chip.base = -1;
-        it8761e_gpio_chip.ngpio = 14;
+        it8761e_gpio_chip.ngpio = 16;
 
         err = gpiochip_add(&it8761e_gpio_chip);
         if (err < 0)
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 7d521e1d17e1..b827c976dc62 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -252,6 +252,18 @@ static void pca953x_irq_bus_lock(unsigned int irq)
 static void pca953x_irq_bus_sync_unlock(unsigned int irq)
 {
         struct pca953x_chip *chip = get_irq_chip_data(irq);
+        uint16_t new_irqs;
+        uint16_t level;
+
+        /* Look for any newly setup interrupt */
+        new_irqs = chip->irq_trig_fall | chip->irq_trig_raise;
+        new_irqs &= ~chip->reg_direction;
+
+        while (new_irqs) {
+                level = __ffs(new_irqs);
+                pca953x_gpio_direction_input(&chip->gpio_chip, level);
+                new_irqs &= ~(1 << level);
+        }
 
         mutex_unlock(&chip->irq_lock);
 }
@@ -278,7 +290,7 @@ static int pca953x_irq_set_type(unsigned int irq, unsigned int type)
         else
                 chip->irq_trig_raise &= ~mask;
 
-        return pca953x_gpio_direction_input(&chip->gpio_chip, level);
+        return 0;
 }
 
 static struct irq_chip pca953x_irq_chip = {
diff --git a/drivers/gpio/pl061.c b/drivers/gpio/pl061.c
index 5ad8f778ced4..105701a1f05b 100644
--- a/drivers/gpio/pl061.c
+++ b/drivers/gpio/pl061.c
@@ -91,6 +91,12 @@ static int pl061_direction_output(struct gpio_chip *gc, unsigned offset,
         gpiodir = readb(chip->base + GPIODIR);
         gpiodir |= 1 << offset;
         writeb(gpiodir, chip->base + GPIODIR);
+
+        /*
+         * gpio value is set again, because pl061 doesn't allow to set value of
+         * a gpio pin before configuring it in OUT mode.
+         */
+        writeb(!!value << offset, chip->base + (1 << (offset + 2)));
         spin_unlock_irqrestore(&chip->lock, flags);
 
         return 0;
@@ -183,7 +189,7 @@ static int pl061_irq_type(unsigned irq, unsigned trigger)
                 gpioibe &= ~(1 << offset);
                 if (trigger & IRQ_TYPE_EDGE_RISING)
                         gpioiev |= 1 << offset;
-                else
+                else if (trigger & IRQ_TYPE_EDGE_FALLING)
                         gpioiev &= ~(1 << offset);
         }
         writeb(gpioibe, chip->base + GPIOIBE);
@@ -204,7 +210,7 @@ static struct irq_chip pl061_irqchip = {
 
 static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
 {
-        struct list_head *chip_list = get_irq_chip_data(irq);
+        struct list_head *chip_list = get_irq_data(irq);
         struct list_head *ptr;
         struct pl061_gpio *chip;
 
@@ -297,9 +303,9 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
                         goto iounmap;
                 }
                 INIT_LIST_HEAD(chip_list);
-                set_irq_chip_data(irq, chip_list);
+                set_irq_data(irq, chip_list);
         } else
-                chip_list = get_irq_chip_data(irq);
+                chip_list = get_irq_data(irq);
         list_add(&chip->list, chip_list);
 
         for (i = 0; i < PL061_GPIO_NR; i++) {
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3bd872761567..a263b7070fc6 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -476,6 +476,7 @@ void drm_vblank_off(struct drm_device *dev, int crtc)
         unsigned long irqflags;
 
         spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        dev->driver->disable_vblank(dev, crtc);
         DRM_WAKEUP(&dev->vbl_queue[crtc]);
         dev->vblank_enabled[crtc] = 0;
         dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index e4865f99989c..7732268eced2 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -77,7 +77,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
                     && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
                     (offset + size))
                         break;
-        if (!agpmem)
+        if (&agpmem->head == &dev->agp->memory)
                 return NULL;
 
         /*
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 1a1825b29f5f..25bbd30ed7af 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -354,7 +354,10 @@ static struct bin_attribute edid_attr = {
 int drm_sysfs_connector_add(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        int ret = 0, i, j;
+        int attr_cnt = 0;
+        int opt_cnt = 0;
+        int i;
+        int ret = 0;
 
         /* We shouldn't get called more than once for the same connector */
         BUG_ON(device_is_registered(&connector->kdev));
@@ -377,8 +380,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
 
         /* Standard attributes */
 
-        for (i = 0; i < ARRAY_SIZE(connector_attrs); i++) {
-                ret = device_create_file(&connector->kdev, &connector_attrs[i]);
+        for (attr_cnt = 0; attr_cnt < ARRAY_SIZE(connector_attrs); attr_cnt++) {
+                ret = device_create_file(&connector->kdev, &connector_attrs[attr_cnt]);
                 if (ret)
                         goto err_out_files;
         }
@@ -394,8 +397,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
                 case DRM_MODE_CONNECTOR_SVIDEO:
                 case DRM_MODE_CONNECTOR_Component:
                 case DRM_MODE_CONNECTOR_TV:
-                        for (i = 0; i < ARRAY_SIZE(connector_attrs_opt1); i++) {
-                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[i]);
+                        for (opt_cnt = 0; opt_cnt < ARRAY_SIZE(connector_attrs_opt1); opt_cnt++) {
+                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[opt_cnt]);
                                 if (ret)
                                         goto err_out_files;
                         }
@@ -414,10 +417,10 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
         return 0;
 
 err_out_files:
-        if (i > 0)
-                for (j = 0; j < i; j++)
-                        device_remove_file(&connector->kdev,
-                                           &connector_attrs[i]);
+        for (i = 0; i < opt_cnt; i++)
+                device_remove_file(&connector->kdev, &connector_attrs_opt1[i]);
+        for (i = 0; i < attr_cnt; i++)
+                device_remove_file(&connector->kdev, &connector_attrs[i]);
         device_unregister(&connector->kdev);
 
 out:
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 2dc93939507d..c3cfafcbfe7d 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1357,6 +1357,8 @@ static void i915_setup_compression(struct drm_device *dev, int size)
 
         dev_priv->cfb_size = size;
 
+        dev_priv->compressed_fb = compressed_fb;
+
         if (IS_GM45(dev)) {
                 g4x_disable_fbc(dev);
                 I915_WRITE(DPFC_CB_BASE, compressed_fb->start);
@@ -1364,12 +1366,22 @@ static void i915_setup_compression(struct drm_device *dev, int size)
                 i8xx_disable_fbc(dev);
                 I915_WRITE(FBC_CFB_BASE, cfb_base);
                 I915_WRITE(FBC_LL_BASE, ll_base);
+                dev_priv->compressed_llb = compressed_llb;
         }
 
         DRM_DEBUG("FBC base 0x%08lx, ll base 0x%08lx, size %dM\n", cfb_base,
                   ll_base, size >> 20);
 }
 
+static void i915_cleanup_compression(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        drm_mm_put_block(dev_priv->compressed_fb);
+        if (!IS_GM45(dev))
+                drm_mm_put_block(dev_priv->compressed_llb);
+}
+
 /* true = enable decode, false = disable decoder */
 static unsigned int i915_vga_set_decode(void *cookie, bool state)
 {
@@ -1787,6 +1799,8 @@ int i915_driver_unload(struct drm_device *dev)
                 mutex_lock(&dev->struct_mutex);
                 i915_gem_cleanup_ringbuffer(dev);
                 mutex_unlock(&dev->struct_mutex);
+                if (I915_HAS_FBC(dev) && i915_powersave)
+                        i915_cleanup_compression(dev);
                 drm_mm_takedown(&dev_priv->vram);
                 i915_gem_lastclose(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 0af3dcc85ce9..cc03537bb883 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -69,7 +69,8 @@ const static struct intel_device_info intel_845g_info = {
 };
 
 const static struct intel_device_info intel_i85x_info = {
-        .is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1,
+        .is_i8xx = 1, .is_i85x = 1, .is_mobile = 1,
+        .cursor_needs_physical = 1,
 };
 
 const static struct intel_device_info intel_i865g_info = {
@@ -151,7 +152,7 @@ const static struct pci_device_id pciidlist[] = {
         INTEL_VGA_DEVICE(0x3577, &intel_i830_info),
         INTEL_VGA_DEVICE(0x2562, &intel_845g_info),
         INTEL_VGA_DEVICE(0x3582, &intel_i85x_info),
-        INTEL_VGA_DEVICE(0x35e8, &intel_i85x_info),
+        INTEL_VGA_DEVICE(0x358e, &intel_i85x_info),
         INTEL_VGA_DEVICE(0x2572, &intel_i865g_info),
         INTEL_VGA_DEVICE(0x2582, &intel_i915g_info),
         INTEL_VGA_DEVICE(0x258a, &intel_i915g_info),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 6960849522f8..6e4790065d9e 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -195,6 +195,7 @@ struct intel_overlay;
 struct intel_device_info {
         u8 is_mobile : 1;
         u8 is_i8xx : 1;
+        u8 is_i85x : 1;
         u8 is_i915g : 1;
         u8 is_i9xx : 1;
         u8 is_i945gm : 1;
@@ -235,11 +236,14 @@ typedef struct drm_i915_private {
 
         drm_dma_handle_t *status_page_dmah;
         void *hw_status_page;
+        void *seqno_page;
         dma_addr_t dma_status_page;
         uint32_t counter;
         unsigned int status_gfx_addr;
+        unsigned int seqno_gfx_addr;
         drm_local_map_t hws_map;
         struct drm_gem_object *hws_obj;
+        struct drm_gem_object *seqno_obj;
         struct drm_gem_object *pwrctx;
 
         struct resource mch_res;
@@ -630,6 +634,9 @@ typedef struct drm_i915_private {
         u8 max_delay;
 
         enum no_fbc_reason no_fbc_reason;
+
+        struct drm_mm_node *compressed_fb;
+        struct drm_mm_node *compressed_llb;
 } drm_i915_private_t;
 
 /** driver private structure attached to each drm_gem_object */
@@ -1070,7 +1077,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 
 #define IS_I830(dev)            ((dev)->pci_device == 0x3577)
 #define IS_845G(dev)            ((dev)->pci_device == 0x2562)
-#define IS_I85X(dev)            ((dev)->pci_device == 0x3582)
+#define IS_I85X(dev)            (INTEL_INFO(dev)->is_i85x)
 #define IS_I865G(dev)           ((dev)->pci_device == 0x2572)
 #define IS_GEN2(dev)            (INTEL_INFO(dev)->is_i8xx)
 #define IS_I915G(dev)           (INTEL_INFO(dev)->is_i915g)
@@ -1135,6 +1142,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 
 #define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) || \
                             IS_GEN6(dev))
+#define HAS_PIPE_CONTROL(dev) (IS_IRONLAKE(dev) || IS_GEN6(dev))
 
 #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 80871c62a571..ef3d91dda71a 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1588,6 +1588,13 @@ i915_gem_process_flushing_list(struct drm_device *dev,
         }
 }
 
+#define PIPE_CONTROL_FLUSH(addr)                                        \
+        OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |          \
+                 PIPE_CONTROL_DEPTH_STALL);                             \
+        OUT_RING(addr | PIPE_CONTROL_GLOBAL_GTT);                       \
+        OUT_RING(0);                                                    \
+        OUT_RING(0);                                                    \
+
 /**
  * Creates a new sequence number, emitting a write of it to the status page
  * plus an interrupt, which will trigger i915_user_interrupt_handler.
@@ -1622,13 +1629,47 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
         if (dev_priv->mm.next_gem_seqno == 0)
                 dev_priv->mm.next_gem_seqno++;
 
-        BEGIN_LP_RING(4);
-        OUT_RING(MI_STORE_DWORD_INDEX);
-        OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        OUT_RING(seqno);
+        if (HAS_PIPE_CONTROL(dev)) {
+                u32 scratch_addr = dev_priv->seqno_gfx_addr + 128;
 
-        OUT_RING(MI_USER_INTERRUPT);
-        ADVANCE_LP_RING();
+                /*
+                 * Workaround qword write incoherence by flushing the
+                 * PIPE_NOTIFY buffers out to memory before requesting
+                 * an interrupt.
+                 */
+                BEGIN_LP_RING(32);
+                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
+                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
+                OUT_RING(seqno);
+                OUT_RING(0);
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128; /* write to separate cachelines */
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
+                         PIPE_CONTROL_NOTIFY);
+                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
+                OUT_RING(seqno);
+                OUT_RING(0);
+                ADVANCE_LP_RING();
+        } else {
+                BEGIN_LP_RING(4);
+                OUT_RING(MI_STORE_DWORD_INDEX);
+                OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+                OUT_RING(seqno);
+
+                OUT_RING(MI_USER_INTERRUPT);
+                ADVANCE_LP_RING();
+        }
 
         DRM_DEBUG_DRIVER("%d\n", seqno);
 
@@ -1752,7 +1793,10 @@ i915_get_gem_seqno(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
 
-        return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
+        if (HAS_PIPE_CONTROL(dev))
+                return ((volatile u32 *)(dev_priv->seqno_page))[0];
+        else
+                return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
 }
 
 /**
@@ -2362,6 +2406,12 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         pitch_val = obj_priv->stride / tile_width;
         pitch_val = ffs(pitch_val) - 1;
 
+        if (obj_priv->tiling_mode == I915_TILING_Y &&
+            HAS_128_BYTE_Y_TILING(dev))
+                WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
+        else
+                WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
+
         val = obj_priv->gtt_offset;
         if (obj_priv->tiling_mode == I915_TILING_Y)
                 val |= 1 << I830_FENCE_TILING_Y_SHIFT;
@@ -4546,6 +4596,49 @@ i915_gem_idle(struct drm_device *dev)
         return 0;
 }
 
+/*
+ * 965+ support PIPE_CONTROL commands, which provide finer grained control
+ * over cache flushing.
+ */
+static int
+i915_gem_init_pipe_control(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj_priv;
+        int ret;
+
+        obj = drm_gem_object_alloc(dev, 4096);
+        if (obj == NULL) {
+                DRM_ERROR("Failed to allocate seqno page\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        obj_priv = to_intel_bo(obj);
+        obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
+
+        ret = i915_gem_object_pin(obj, 4096);
+        if (ret)
+                goto err_unref;
+
+        dev_priv->seqno_gfx_addr = obj_priv->gtt_offset;
+        dev_priv->seqno_page =  kmap(obj_priv->pages[0]);
+        if (dev_priv->seqno_page == NULL)
+                goto err_unpin;
+
+        dev_priv->seqno_obj = obj;
+        memset(dev_priv->seqno_page, 0, PAGE_SIZE);
+
+        return 0;
+
+err_unpin:
+        i915_gem_object_unpin(obj);
+err_unref:
+        drm_gem_object_unreference(obj);
+err:
+        return ret;
+}
+
 static int
 i915_gem_init_hws(struct drm_device *dev)
 {
@@ -4563,7 +4656,8 @@ i915_gem_init_hws(struct drm_device *dev)
         obj = drm_gem_object_alloc(dev, 4096);
         if (obj == NULL) {
                 DRM_ERROR("Failed to allocate status page\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err;
         }
         obj_priv = to_intel_bo(obj);
         obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
@@ -4571,7 +4665,7 @@ i915_gem_init_hws(struct drm_device *dev)
         ret = i915_gem_object_pin(obj, 4096);
         if (ret != 0) {
                 drm_gem_object_unreference(obj);
-                return ret;
+                goto err_unref;
         }
 
         dev_priv->status_gfx_addr = obj_priv->gtt_offset;
@@ -4580,10 +4674,16 @@ i915_gem_init_hws(struct drm_device *dev)
         if (dev_priv->hw_status_page == NULL) {
                 DRM_ERROR("Failed to map status page.\n");
                 memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
-                i915_gem_object_unpin(obj);
-                drm_gem_object_unreference(obj);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_unpin;
         }
+
+        if (HAS_PIPE_CONTROL(dev)) {
+                ret = i915_gem_init_pipe_control(dev);
+                if (ret)
+                        goto err_unpin;
+        }
+
         dev_priv->hws_obj = obj;
         memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
         if (IS_GEN6(dev)) {
@@ -4596,6 +4696,30 @@ i915_gem_init_hws(struct drm_device *dev)
         DRM_DEBUG_DRIVER("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
 
         return 0;
+
+err_unpin:
+        i915_gem_object_unpin(obj);
+err_unref:
+        drm_gem_object_unreference(obj);
+err:
+        return 0;
+}
+
+static void
+i915_gem_cleanup_pipe_control(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj_priv;
+
+        obj = dev_priv->seqno_obj;
+        obj_priv = to_intel_bo(obj);
+        kunmap(obj_priv->pages[0]);
+        i915_gem_object_unpin(obj);
+        drm_gem_object_unreference(obj);
+        dev_priv->seqno_obj = NULL;
+
+        dev_priv->seqno_page = NULL;
 }
 
 static void
@@ -4619,6 +4743,9 @@ i915_gem_cleanup_hws(struct drm_device *dev)
         memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
         dev_priv->hw_status_page = NULL;
 
+        if (HAS_PIPE_CONTROL(dev))
+                i915_gem_cleanup_pipe_control(dev);
+
         /* Write high address into HWS_PGA when disabling. */
         I915_WRITE(HWS_PGA, 0x1ffff000);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 449157f71610..4bdccefcf2cf 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -202,21 +202,17 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
                  * reg, so dont bother to check the size */
                 if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
                         return false;
-        } else if (IS_I9XX(dev)) {
-                uint32_t pitch_val = ffs(stride / tile_width) - 1;
-
-                /* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
-                 * instead of 4 (2KB) on 945s.
-                 */
-                if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
-                    size > (I830_FENCE_MAX_SIZE_VAL << 20))
+        } else if (IS_GEN3(dev) || IS_GEN2(dev)) {
+                if (stride > 8192)
                         return false;
-        } else {
-                uint32_t pitch_val = ffs(stride / tile_width) - 1;
 
-                if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
-                    size > (I830_FENCE_MAX_SIZE_VAL << 19))
-                        return false;
+                if (IS_GEN3(dev)) {
+                        if (size > I830_FENCE_MAX_SIZE_VAL << 20)
+                                return false;
+                } else {
+                        if (size > I830_FENCE_MAX_SIZE_VAL << 19)
+                                return false;
+                }
         }
 
         /* 965+ just needs multiples of tile width */
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 6421481d6222..df6a9cd82c4d 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -349,7 +349,7 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
                                 READ_BREADCRUMB(dev_priv);
         }
 
-        if (gt_iir & GT_USER_INTERRUPT) {
+        if (gt_iir & GT_PIPE_NOTIFY) {
                 u32 seqno = i915_get_gem_seqno(dev);
                 dev_priv->mm.irq_gem_seqno = seqno;
                 trace_i915_gem_request_complete(dev, seqno);
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
 
         for (page = 0; page < page_count; page++) {
                 void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+                unsigned long flags;
+
                 if (d == NULL)
                         goto unwind;
-                s = kmap_atomic(src_priv->pages[page], KM_USER0);
+                local_irq_save(flags);
+                s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                 memcpy(d, s, PAGE_SIZE);
-                kunmap_atomic(s, KM_USER0);
+                kunmap_atomic(s, KM_IRQ0);
+                local_irq_restore(flags);
                 dst->pages[page] = d;
         }
         dst->page_count = page_count;
@@ -1005,7 +1009,7 @@ void i915_user_irq_get(struct drm_device *dev)
         spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
         if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
                 if (HAS_PCH_SPLIT(dev))
-                        ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+                        ironlake_enable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
                 else
                         i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
         }
@@ -1021,7 +1025,7 @@ void i915_user_irq_put(struct drm_device *dev)
         BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
         if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
                 if (HAS_PCH_SPLIT(dev))
-                        ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+                        ironlake_disable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
                 else
                         i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
         }
@@ -1305,7 +1309,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
         /* enable kind of interrupts always enabled */
         u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                            DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
-        u32 render_mask = GT_USER_INTERRUPT;
+        u32 render_mask = GT_PIPE_NOTIFY;
         u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                            SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
 
diff --git a/drivers/gpu/drm/i915/i915_opregion.c b/drivers/gpu/drm/i915/i915_opregion.c
index 7cc8410239cb..8fcc75c1aa28 100644
--- a/drivers/gpu/drm/i915/i915_opregion.c
+++ b/drivers/gpu/drm/i915/i915_opregion.c
@@ -382,8 +382,57 @@ static void intel_didl_outputs(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_opregion *opregion = &dev_priv->opregion;
         struct drm_connector *connector;
+        acpi_handle handle;
+        struct acpi_device *acpi_dev, *acpi_cdev, *acpi_video_bus = NULL;
+        unsigned long long device_id;
+        acpi_status status;
         int i = 0;
 
+        handle = DEVICE_ACPI_HANDLE(&dev->pdev->dev);
+        if (!handle || ACPI_FAILURE(acpi_bus_get_device(handle, &acpi_dev)))
+                return;
+
+        if (acpi_is_video_device(acpi_dev))
+                acpi_video_bus = acpi_dev;
+        else {
+                list_for_each_entry(acpi_cdev, &acpi_dev->children, node) {
+                        if (acpi_is_video_device(acpi_cdev)) {
+                                acpi_video_bus = acpi_cdev;
+                                break;
+                        }
+                }
+        }
+
+        if (!acpi_video_bus) {
+                printk(KERN_WARNING "No ACPI video bus found\n");
+                return;
+        }
+
+        list_for_each_entry(acpi_cdev, &acpi_video_bus->children, node) {
+                if (i >= 8) {
+                        dev_printk (KERN_ERR, &dev->pdev->dev,
+                                    "More than 8 outputs detected\n");
+                        return;
+                }
+                status =
+                        acpi_evaluate_integer(acpi_cdev->handle, "_ADR",
+                                                NULL, &device_id);
+                if (ACPI_SUCCESS(status)) {
+                        if (!device_id)
+                                goto blind_set;
+                        opregion->acpi->didl[i] = (u32)(device_id & 0x0f0f);
+                        i++;
+                }
+        }
+
+end:
+        /* If fewer than 8 outputs, the list must be null terminated */
+        if (i < 8)
+                opregion->acpi->didl[i] = 0;
+        return;
+
+blind_set:
+        i = 0;
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 int output_type = ACPI_OTHER_OUTPUT;
                 if (i >= 8) {
@@ -416,10 +465,7 @@ static void intel_didl_outputs(struct drm_device *dev)
                 opregion->acpi->didl[i] |= (1<<31) | output_type | i;
                 i++;
         }
-
-        /* If fewer than 8 outputs, the list must be null terminated */
-        if (i < 8)
-                opregion->acpi->didl[i] = 0;
+        goto end;
 }
 
 int intel_opregion_init(struct drm_device *dev, int resume)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index cbbf59f56dfa..4cbc5210fd30 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -230,6 +230,16 @@
 #define   ASYNC_FLIP                (1<<22)
 #define   DISPLAY_PLANE_A           (0<<20)
 #define   DISPLAY_PLANE_B           (1<<20)
+#define GFX_OP_PIPE_CONTROL     ((0x3<<29)|(0x3<<27)|(0x2<<24)|2)
+#define   PIPE_CONTROL_QW_WRITE (1<<14)
+#define   PIPE_CONTROL_DEPTH_STALL (1<<13)
+#define   PIPE_CONTROL_WC_FLUSH (1<<12)
+#define   PIPE_CONTROL_IS_FLUSH (1<<11) /* MBZ on Ironlake */
+#define   PIPE_CONTROL_TC_FLUSH (1<<10) /* GM45+ only */
+#define   PIPE_CONTROL_ISP_DIS  (1<<9)
+#define   PIPE_CONTROL_NOTIFY   (1<<8)
+#define   PIPE_CONTROL_GLOBAL_GTT (1<<2) /* in addr dword */
+#define   PIPE_CONTROL_STALL_EN (1<<1) /* in addr word, Ironlake+ only */
 
 /*
  * Fence registers
@@ -241,7 +251,7 @@
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
-#define   I915_FENCE_MAX_PITCH_VAL      0x10
+#define   I915_FENCE_MAX_PITCH_VAL      4
 #define   I830_FENCE_MAX_PITCH_VAL      6
 #define   I830_FENCE_MAX_SIZE_VAL       (1<<8)
 
@@ -2285,6 +2295,7 @@
 #define DEIER   0x4400c
 
 /* GT interrupt */
+#define GT_PIPE_NOTIFY          (1 << 4)
 #define GT_SYNC_STATUS          (1 << 2)
 #define GT_USER_INTERRUPT       (1 << 0)
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9c920396d702..f27e3703a716 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4853,17 +4853,18 @@ static void intel_init_display(struct drm_device *dev)
                 dev_priv->display.update_wm = g4x_update_wm;
         else if (IS_I965G(dev))
                 dev_priv->display.update_wm = i965_update_wm;
-        else if (IS_I9XX(dev) || IS_MOBILE(dev)) {
+        else if (IS_I9XX(dev)) {
                 dev_priv->display.update_wm = i9xx_update_wm;
                 dev_priv->display.get_fifo_size = i9xx_get_fifo_size;
+        } else if (IS_I85X(dev)) {
+                dev_priv->display.update_wm = i9xx_update_wm;
+                dev_priv->display.get_fifo_size = i85x_get_fifo_size;
         } else {
-                if (IS_I85X(dev))
-                        dev_priv->display.get_fifo_size = i85x_get_fifo_size;
-                else if (IS_845G(dev))
+                dev_priv->display.update_wm = i830_update_wm;
+                if (IS_845G(dev))
                         dev_priv->display.get_fifo_size = i845_get_fifo_size;
                 else
                         dev_priv->display.get_fifo_size = i830_get_fifo_size;
-                dev_priv->display.update_wm = i830_update_wm;
         }
 }
 
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index e91a815861f4..5319d9e2f7ba 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -2912,7 +2912,7 @@ typedef struct _ATOM_ANALOG_TV_INFO_V1_2
   UCHAR                    ucTV_BootUpDefaultStandard; 
   UCHAR                    ucExt_TV_ASIC_ID;
   UCHAR                    ucExt_TV_ASIC_SlaveAddr;
-  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING];
+  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING_V1_2];
 }ATOM_ANALOG_TV_INFO_V1_2;
 
 typedef struct _ATOM_DPCD_INFO
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index d7388fdb6d0b..cf60c0b3ef15 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2975,7 +2975,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 
         for (i = 0; i < track->num_cb; i++) {
                 if (track->cb[i].robj == NULL) {
-                        if (!(track->fastfill || track->color_channel_mask ||
+                        if (!(track->zb_cb_clear || track->color_channel_mask ||
                               track->blend_read_enable)) {
                                 continue;
                         }
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index fadfe68de9cc..f47cdca1c004 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -75,7 +75,7 @@ struct r100_cs_track {
         struct r100_cs_track_texture    textures[R300_TRACK_MAX_TEXTURE];
         bool                            z_enabled;
         bool                            separate_cube;
-        bool                            fastfill;
+        bool                            zb_cb_clear;
         bool                            blend_read_enable;
 };
 
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index bd75f99bd65e..a5ff8076b423 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -324,13 +324,12 @@ void r300_gpu_init(struct radeon_device *rdev)
         uint32_t gb_tile_config, tmp;
 
         r100_hdp_reset(rdev);
-        /* FIXME: rv380 one pipes ? */
         if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) ||
-            (rdev->family == CHIP_R350)) {
+            (rdev->family == CHIP_R350 && rdev->pdev->device != 0x4148)) {
                 /* r300,r350 */
                 rdev->num_gb_pipes = 2;
         } else {
-                /* rv350,rv370,rv380,r300 AD */
+                /* rv350,rv370,rv380,r300 AD, r350 AH */
                 rdev->num_gb_pipes = 1;
         }
         rdev->num_z_pipes = 1;
@@ -1045,7 +1044,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 break;
         case 0x4d1c:
                 /* ZB_BW_CNTL */
-                track->fastfill = !!(idx_value & (1 << 2));
+                track->zb_cb_clear = !!(idx_value & (1 << 5));
                 break;
         case 0x4e04:
                 /* RB3D_BLENDCNTL */
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index ea46d558e8f3..c5c2742e4140 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -921,7 +921,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
 
         ptr_addr = drm_buffer_read_object(cmdbuf->buffer,
                         sizeof(stack_ptr_addr), &stack_ptr_addr);
-        ref_age_base = (u32 *)(unsigned long)*ptr_addr;
+        ref_age_base = (u32 *)(unsigned long)get_unaligned(ptr_addr);
 
         for (i=0; i < header.scratch.n_bufs; i++) {
                 buf_idx = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3dc968c9f5a4..c2bda4ad62e7 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -59,6 +59,12 @@ void r420_pipes_init(struct radeon_device *rdev)
         /* get max number of pipes */
         gb_pipe_select = RREG32(0x402C);
         num_pipes = ((gb_pipe_select >> 12) & 3) + 1;
+
+        /* SE chips have 1 pipe */
+        if ((rdev->pdev->device == 0x5e4c) ||
+            (rdev->pdev->device == 0x5e4f))
+                num_pipes = 1;
+
         rdev->num_gb_pipes = num_pipes;
         tmp = 0;
         switch (num_pipes) {
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index c4457791dff1..28e473f1f56f 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -134,12 +134,10 @@ int radeon_agp_init(struct radeon_device *rdev)
         int ret;
 
         /* Acquire AGP. */
-        if (!rdev->ddev->agp->acquired) {
-                ret = drm_agp_acquire(rdev->ddev);
-                if (ret) {
-                        DRM_ERROR("Unable to acquire AGP: %d\n", ret);
-                        return ret;
-                }
+        ret = drm_agp_acquire(rdev->ddev);
+        if (ret) {
+                DRM_ERROR("Unable to acquire AGP: %d\n", ret);
+                return ret;
         }
 
         ret = drm_agp_info(rdev->ddev, &info);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 5673665ff216..9916d825401c 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1264,7 +1264,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
         switch (crev) {
         case 1:
                 tv_info = (ATOM_ANALOG_TV_INFO *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING)
+                if (index >= MAX_SUPPORTED_TV_TIMING)
                         return false;
 
                 mode->crtc_htotal = le16_to_cpu(tv_info->aModeTimings[index].usCRTC_H_Total);
@@ -1302,7 +1302,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
                 break;
         case 2:
                 tv_info_v1_2 = (ATOM_ANALOG_TV_INFO_V1_2 *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING_V1_2)
+                if (index >= MAX_SUPPORTED_TV_TIMING_V1_2)
                         return false;
 
                 dtd_timings = &tv_info_v1_2->aModeTimings[index];
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 1331351c5178..4559a53d5e57 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1316,6 +1316,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                         radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "DVI");
                         if (!radeon_connector->ddc_bus)
                                 goto failed;
+                }
+                if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                         radeon_connector->dac_load_detect = true;
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.load_detect_property,
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 419630dd2075..2f042a3c0e62 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -435,14 +435,19 @@ static void radeon_init_pipes(struct drm_device *dev)
         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                 gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
                 dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1;
+                /* SE cards have 1 pipe */
+                if ((dev->pdev->device == 0x5e4c) ||
+                    (dev->pdev->device == 0x5e4f))
+                        dev_priv->num_gb_pipes = 1;
         } else {
                 /* R3xx */
                 if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 &&
                      dev->pdev->device != 0x4144) ||
-                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) {
+                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350 &&
+                     dev->pdev->device != 0x4148)) {
                         dev_priv->num_gb_pipes = 2;
                 } else {
-                        /* RV3xx/R300 AD */
+                        /* RV3xx/R300 AD/R350 AH */
                         dev_priv->num_gb_pipes = 1;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index b8d672828246..bb1c122cad21 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -86,12 +86,12 @@ static void evergreen_crtc_load_lut(struct drm_crtc *crtc)
         WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_GREEN + radeon_crtc->crtc_offset, 0xffff);
         WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_RED + radeon_crtc->crtc_offset, 0xffff);
 
-        WREG32(EVERGREEN_DC_LUT_RW_MODE, radeon_crtc->crtc_id);
-        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK, 0x00000007);
+        WREG32(EVERGREEN_DC_LUT_RW_MODE + radeon_crtc->crtc_offset, 0);
+        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK + radeon_crtc->crtc_offset, 0x00000007);
 
-        WREG32(EVERGREEN_DC_LUT_RW_INDEX, 0);
+        WREG32(EVERGREEN_DC_LUT_RW_INDEX + radeon_crtc->crtc_offset, 0);
         for (i = 0; i < 256; i++) {
-                WREG32(EVERGREEN_DC_LUT_30_COLOR,
+                WREG32(EVERGREEN_DC_LUT_30_COLOR + radeon_crtc->crtc_offset,
                        (radeon_crtc->lut_r[i] << 20) |
                        (radeon_crtc->lut_g[i] << 10) |
                        (radeon_crtc->lut_b[i] << 0));
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 4b05563d99e1..b3749d47be7b 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -216,6 +216,7 @@ static struct drm_driver driver_old = {
                  .mmap = drm_mmap,
                  .poll = drm_poll,
                  .fasync = drm_fasync,
+                 .read = drm_read,
 #ifdef CONFIG_COMPAT
                  .compat_ioctl = radeon_compat_ioctl,
 #endif
@@ -304,6 +305,7 @@ static struct drm_driver kms_driver = {
                  .mmap = radeon_mmap,
                  .poll = drm_poll,
                  .fasync = drm_fasync,
+                 .read = drm_read,
 #ifdef CONFIG_COMPAT
                  .compat_ioctl = radeon_kms_compat_ioctl,
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 30293bec0801..c5ddaf58563a 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -254,6 +254,53 @@ radeon_get_atom_connector_priv_from_encoder(struct drm_encoder *encoder)
         return dig_connector;
 }
 
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode)
+{
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        unsigned hblank = native_mode->htotal - native_mode->hdisplay;
+        unsigned vblank = native_mode->vtotal - native_mode->vdisplay;
+        unsigned hover = native_mode->hsync_start - native_mode->hdisplay;
+        unsigned vover = native_mode->vsync_start - native_mode->vdisplay;
+        unsigned hsync_width = native_mode->hsync_end - native_mode->hsync_start;
+        unsigned vsync_width = native_mode->vsync_end - native_mode->vsync_start;
+
+        adjusted_mode->clock = native_mode->clock;
+        adjusted_mode->flags = native_mode->flags;
+
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->hdisplay = native_mode->hdisplay;
+                adjusted_mode->vdisplay = native_mode->vdisplay;
+        }
+
+        adjusted_mode->htotal = native_mode->hdisplay + hblank;
+        adjusted_mode->hsync_start = native_mode->hdisplay + hover;
+        adjusted_mode->hsync_end = adjusted_mode->hsync_start + hsync_width;
+
+        adjusted_mode->vtotal = native_mode->vdisplay + vblank;
+        adjusted_mode->vsync_start = native_mode->vdisplay + vover;
+        adjusted_mode->vsync_end = adjusted_mode->vsync_start + vsync_width;
+
+        drm_mode_set_crtcinfo(adjusted_mode, CRTC_INTERLACE_HALVE_V);
+
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->crtc_hdisplay = native_mode->hdisplay;
+                adjusted_mode->crtc_vdisplay = native_mode->vdisplay;
+        }
+
+        adjusted_mode->crtc_htotal = adjusted_mode->crtc_hdisplay + hblank;
+        adjusted_mode->crtc_hsync_start = adjusted_mode->crtc_hdisplay + hover;
+        adjusted_mode->crtc_hsync_end = adjusted_mode->crtc_hsync_start + hsync_width;
+
+        adjusted_mode->crtc_vtotal = adjusted_mode->crtc_vdisplay + vblank;
+        adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + vover;
+        adjusted_mode->crtc_vsync_end = adjusted_mode->crtc_vsync_start + vsync_width;
+
+}
+
 static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                                    struct drm_display_mode *mode,
                                    struct drm_display_mode *adjusted_mode)
@@ -275,18 +322,8 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                 adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
 
         /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                if (!ASIC_IS_AVIVO(rdev)) {
-                        adjusted_mode->hdisplay = mode->hdisplay;
-                        adjusted_mode->vdisplay = mode->vdisplay;
-                        adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                        adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                }
-                adjusted_mode->base.id = mode_id;
-        }
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
 
         /* get the native mode for TV */
         if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)) {
@@ -1326,7 +1363,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 
         radeon_encoder->pixel_clock = adjusted_mode->clock;
 
-        if (ASIC_IS_AVIVO(rdev)) {
+        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
                 if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
                         atombios_yuv_setup(encoder, true);
                 else
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index d3657dcfdd26..c633319f98ed 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -165,7 +165,7 @@ u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return -EINVAL;
         }
@@ -177,7 +177,7 @@ int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return -EINVAL;
         }
@@ -191,7 +191,7 @@ void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
         struct radeon_device *rdev = dev->dev_private;
 
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                 DRM_ERROR("Invalid crtc %d\n", crtc);
                 return;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2441cca7d775..0274abe17ad9 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -228,16 +228,8 @@ static bool radeon_legacy_mode_fixup(struct drm_encoder *encoder,
         drm_mode_set_crtcinfo(adjusted_mode, 0);
 
         /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                adjusted_mode->hdisplay = mode->hdisplay;
-                adjusted_mode->vdisplay = mode->vdisplay;
-                adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                adjusted_mode->base.id = mode_id;
-        }
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
 
         return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 0b8e32776b10..5413fcd63086 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -558,6 +558,8 @@ extern int radeon_static_clocks_init(struct drm_device *dev);
 bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
                                         struct drm_display_mode *mode,
                                         struct drm_display_mode *adjusted_mode);
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode);
 void atom_rv515_force_tv_scaler(struct radeon_device *rdev, struct radeon_crtc *radeon_crtc);
 
 /* legacy tv */
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 40ab6d9c3736..cc5316dcf580 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                 if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                     (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
-                        offset = *cmd << 10;
+                        offset = *cmd3 << 10;
                         if (radeon_check_and_fixup_offset
                             (dev_priv, file_priv, &offset)) {
                                 DRM_ERROR("Invalid second packet offset\n");
@@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                         return rv;
                 rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
                                                 cmdbuf->bufsz);
-                if (rv)
+                if (rv) {
+                        drm_buffer_free(cmdbuf->buffer);
                         return rv;
-        }
+                }
+        } else
+                goto done;
 
         orig_nbox = cmdbuf->nbox;
 
@@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 int temp;
                 temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
 
-                if (cmdbuf->bufsz != 0)
-                        drm_buffer_free(cmdbuf->buffer);
+                drm_buffer_free(cmdbuf->buffer);
 
                 return temp;
         }
@@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                 }
         }
 
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
 
+      done:
         DRM_DEBUG("DONE\n");
         COMMIT_RING();
         return 0;
 
       err:
-        if (cmdbuf->bufsz != 0)
-                drm_buffer_free(cmdbuf->buffer);
+        drm_buffer_free(cmdbuf->buffer);
         return -EINVAL;
 }
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index dd47b2a9a791..0e3754a3a303 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1716,40 +1716,12 @@ int ttm_bo_wait(struct ttm_buffer_object *bo,
 }
 EXPORT_SYMBOL(ttm_bo_wait);
 
-void ttm_bo_unblock_reservation(struct ttm_buffer_object *bo)
-{
-        atomic_set(&bo->reserved, 0);
-        wake_up_all(&bo->event_queue);
-}
-
-int ttm_bo_block_reservation(struct ttm_buffer_object *bo, bool interruptible,
-                             bool no_wait)
-{
-        int ret;
-
-        while (unlikely(atomic_cmpxchg(&bo->reserved, 0, 1) != 0)) {
-                if (no_wait)
-                        return -EBUSY;
-                else if (interruptible) {
-                        ret = wait_event_interruptible
-                            (bo->event_queue, atomic_read(&bo->reserved) == 0);
-                        if (unlikely(ret != 0))
-                                return ret;
-                } else {
-                        wait_event(bo->event_queue,
-                                   atomic_read(&bo->reserved) == 0);
-                }
-        }
-        return 0;
-}
-
 int ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait)
 {
         int ret = 0;
 
         /*
-         * Using ttm_bo_reserve instead of ttm_bo_block_reservation
-         * makes sure the lru lists are updated.
+         * Using ttm_bo_reserve makes sure the lru lists are updated.
          */
 
         ret = ttm_bo_reserve(bo, true, no_wait, false, 0);
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
index 3d172ef04ee1..de41e55a944a 100644
--- a/drivers/gpu/drm/ttm/ttm_lock.c
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -204,7 +204,6 @@ static int __ttm_vt_unlock(struct ttm_lock *lock)
         lock->flags &= ~TTM_VT_LOCK;
         wake_up_all(&lock->queue);
         spin_unlock(&lock->lock);
-        printk(KERN_INFO TTM_PFX "vt unlock.\n");
 
         return ret;
 }
@@ -265,10 +264,8 @@ int ttm_vt_lock(struct ttm_lock *lock,
                                    ttm_lock_type, &ttm_vt_lock_remove, NULL);
         if (ret)
                 (void)__ttm_vt_unlock(lock);
-        else {
+        else
                 lock->vt_holder = tfile;
-                printk(KERN_INFO TTM_PFX "vt lock.\n");
-        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/via/via_video.c b/drivers/gpu/drm/via/via_video.c
index 6ec04ac12459..6efac8117c93 100644
--- a/drivers/gpu/drm/via/via_video.c
+++ b/drivers/gpu/drm/via/via_video.c
@@ -75,7 +75,7 @@ int via_decoder_futex(struct drm_device *dev, void *data, struct drm_file *file_
 
         DRM_DEBUG("\n");
 
-        if (fx->lock > VIA_NR_XVMC_LOCKS)
+        if (fx->lock >= VIA_NR_XVMC_LOCKS)
                 return -EFAULT;
 
         lock = (volatile int *)XVMCLOCKPTR(sAPriv, fx->lock);
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index d6d1149d525d..c8768f38511e 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -276,8 +276,10 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
 
         mutex_lock(&vgasr_mutex);
 
-        if (!vgasr_priv.active)
-                return -EINVAL;
+        if (!vgasr_priv.active) {
+                cnt = -EINVAL;
+                goto out;
+        }
 
         /* pwr off the device not in use */
         if (strncmp(usercmd, "OFF", 3) == 0) {
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 7e597d7f770f..24663a8717b1 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -59,6 +59,7 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 
 static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2e2aa759d230..143e788b729b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1043,13 +1043,8 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
 
         if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
                 hid->hiddev_report_event(hid, report);
-        if (hid->claimed & HID_CLAIMED_HIDRAW) {
-                /* numbered reports need to be passed with the report num */
-                if (report_enum->numbered)
-                        hidraw_report_event(hid, data - 1, size + 1);
-                else
-                        hidraw_report_event(hid, data, size);
-        }
+        if (hid->claimed & HID_CLAIMED_HIDRAW)
+                hidraw_report_event(hid, data, size);
 
         for (a = 0; a < report->maxfield; a++)
                 hid_input_field(hid, report->field[a], cdata, interrupt);
@@ -1296,6 +1291,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 797e06470356..09d27649a0f7 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -131,6 +131,7 @@
 
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
+#define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR     0x0027
 
 #define USB_VENDOR_ID_CHIC              0x05fe
 #define USB_DEVICE_ID_CHIC_GAMEPAD      0x0014
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9b24fc510712..4777bbfa1cc2 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -1,8 +1,8 @@
 /*
  *  HID driver for N-Trig touchscreens
  *
- *  Copyright (c) 2008 Rafi Rubin
- *  Copyright (c) 2009 Stephane Chatty
+ *  Copyright (c) 2008-2010 Rafi Rubin
+ *  Copyright (c) 2009-2010 Stephane Chatty
  *
  */
 
@@ -15,6 +15,8 @@
 
 #include <linux/device.h>
 #include <linux/hid.h>
+#include <linux/usb.h>
+#include "usbhid/usbhid.h"
 #include <linux/module.h>
 #include <linux/slab.h>
 
@@ -22,17 +24,16 @@
 
 #define NTRIG_DUPLICATE_USAGES  0x001
 
-#define nt_map_key_clear(c)     hid_map_usage_clear(hi, usage, bit, max, \
-                                        EV_KEY, (c))
-
 struct ntrig_data {
         /* Incoming raw values for a single contact */
         __u16 x, y, w, h;
         __u16 id;
-        __u8 confidence;
+
+        bool tipswitch;
+        bool confidence;
+        bool first_contact_touch;
 
         bool reading_mt;
-        __u8 first_contact_confidence;
 
         __u8 mt_footer[4];
         __u8 mt_foot_count;
@@ -139,9 +140,10 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                 case 0xff000001:
                         /* Tag indicating the start of a multitouch group */
                         nd->reading_mt = 1;
-                        nd->first_contact_confidence = 0;
+                        nd->first_contact_touch = 0;
                         break;
                 case HID_DG_TIPSWITCH:
+                        nd->tipswitch = value;
                         /* Prevent emission of touch until validated */
                         return 1;
                 case HID_DG_CONFIDENCE:
@@ -169,8 +171,14 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                          * to emit a normal (X, Y) position
                          */
                         if (!nd->reading_mt) {
+                                /*
+                                 * TipSwitch indicates the presence of a
+                                 * finger in single touch mode.
+                                 */
+                                input_report_key(input, BTN_TOUCH,
+                                                 nd->tipswitch);
                                 input_report_key(input, BTN_TOOL_DOUBLETAP,
-                                                 (nd->confidence != 0));
+                                                 nd->tipswitch);
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -209,7 +217,13 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         /* emit a normal (X, Y) for the first point only */
                         if (nd->id == 0) {
-                                nd->first_contact_confidence = nd->confidence;
+                                /*
+                                 * TipSwitch is superfluous in multitouch
+                                 * mode.  The footer events tell us
+                                 * if there is a finger on the screen or
+                                 * not.
+                                 */
+                                nd->first_contact_touch = nd->confidence;
                                 input_event(input, EV_ABS, ABS_X, nd->x);
                                 input_event(input, EV_ABS, ABS_Y, nd->y);
                         }
@@ -239,30 +253,11 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
 
                         nd->reading_mt = 0;
 
-                        if (nd->first_contact_confidence) {
-                                switch (value) {
-                                case 0: /* for single touch devices */
-                                case 1:
-                                        input_report_key(input,
-                                                        BTN_TOOL_DOUBLETAP, 1);
-                                        break;
-                                case 2:
-                                        input_report_key(input,
-                                                        BTN_TOOL_TRIPLETAP, 1);
-                                        break;
-                                case 3:
-                                default:
-                                        input_report_key(input,
-                                                        BTN_TOOL_QUADTAP, 1);
-                                }
+                        if (nd->first_contact_touch) {
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 1);
                                 input_report_key(input, BTN_TOUCH, 1);
                         } else {
-                                input_report_key(input,
-                                                BTN_TOOL_DOUBLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_TRIPLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_QUADTAP, 0);
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 0);
                                 input_report_key(input, BTN_TOUCH, 0);
                         }
                         break;
@@ -286,6 +281,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
         struct ntrig_data *nd;
         struct hid_input *hidinput;
         struct input_dev *input;
+        struct hid_report *report;
 
         if (id->driver_data)
                 hdev->quirks |= HID_QUIRK_MULTI_INPUT;
@@ -327,13 +323,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                         __clear_bit(BTN_TOOL_PEN, input->keybit);
                         __clear_bit(BTN_TOOL_FINGER, input->keybit);
                         __clear_bit(BTN_0, input->keybit);
-                        /*
-                         * A little something special to enable
-                         * two and three finger taps.
-                         */
                         __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_QUADTAP, input->keybit);
                         /*
                          * The physical touchscreen (single touch)
                          * input has a value for physical, whereas
@@ -349,6 +339,12 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                 }
         }
 
+        /* This is needed for devices with more recent firmware versions */
+        report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0x0a];
+        if (report)
+                usbhid_submit_report(hdev, report, USB_DIR_OUT);
+
+
         return 0;
 err_free:
         kfree(nd);
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 7502a4b2fa86..402d5574b574 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -76,7 +76,7 @@ static int sony_set_operational_usb(struct hid_device *hdev)
 
 static int sony_set_operational_bt(struct hid_device *hdev)
 {
-        unsigned char buf[] = { 0x53, 0xf4,  0x42, 0x03, 0x00, 0x00 };
+        unsigned char buf[] = { 0xf4,  0x42, 0x03, 0x00, 0x00 };
         return hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
 }
 
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index f7700cf49721..f947d8337e21 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -277,7 +277,6 @@ static int __init wacom_init(void)
         ret = hid_register_driver(&wacom_driver);
         if (ret)
                 printk(KERN_ERR "can't register wacom driver\n");
-        printk(KERN_ERR "wacom driver registered\n");
         return ret;
 }
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 56d06cd8075b..7b85b696fdab 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -999,13 +999,6 @@ static int usbhid_start(struct hid_device *hid)
                 }
         }
 
-        init_waitqueue_head(&usbhid->wait);
-        INIT_WORK(&usbhid->reset_work, hid_reset);
-        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
-        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
-
-        spin_lock_init(&usbhid->lock);
-
         usbhid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
         if (!usbhid->urbctrl) {
                 ret = -ENOMEM;
@@ -1179,6 +1172,12 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
         usbhid->intf = intf;
         usbhid->ifnum = interface->desc.bInterfaceNumber;
 
+        init_waitqueue_head(&usbhid->wait);
+        INIT_WORK(&usbhid->reset_work, hid_reset);
+        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
+        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
+        spin_lock_init(&usbhid->lock);
+
         ret = hid_add_device(hid);
         if (ret) {
                 if (ret != -ENODEV)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0f28d91f29d8..f085c18d2905 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -195,6 +195,9 @@ static unsigned int applesmc_accelerometer;
 /* Indicates whether this computer has light sensors and keyboard backlight. */
 static unsigned int applesmc_light;
 
+/* The number of fans handled by the driver */
+static unsigned int fans_handled;
+
 /* Indicates which temperature sensors set to use. */
 static unsigned int applesmc_temperature_set;
 
@@ -1492,39 +1495,24 @@ static int __init applesmc_init(void)
 
         /* create fan files */
         count = applesmc_get_fan_count();
-        if (count < 0) {
+        if (count < 0)
                 printk(KERN_ERR "applesmc: Cannot get the number of fans.\n");
-        } else {
+        else
                 printk(KERN_INFO "applesmc: %d fans found.\n", count);
 
-                switch (count) {
-                default:
-                        printk(KERN_WARNING "applesmc: More than 4 fans found,"
-                                        " but at most 4 fans are supported"
-                                                " by the driver.\n");
-                case 4:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[3]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 3:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[2]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 2:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[1]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 1:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[0]);
-                        if (ret)
-                                goto out_fan_1;
-                case 0:
-                        ;
-                }
+        if (count > 4) {
+                count = 4;
+                printk(KERN_WARNING "applesmc: More than 4 fans found,"
+                       " but at most 4 fans are supported"
+                       " by the driver.\n");
+        }
+
+        while (fans_handled < count) {
+                ret = sysfs_create_group(&pdev->dev.kobj,
+                                         &fan_attribute_groups[fans_handled]);
+                if (ret)
+                        goto out_fans;
+                fans_handled++;
         }
 
         for (i = 0;
@@ -1593,10 +1581,10 @@ out_accelerometer:
                 applesmc_release_accelerometer();
 out_temperature:
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-out_fan_1:
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
-out_key_enumeration:
+out_fans:
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
 out_name:
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
@@ -1622,8 +1610,9 @@ static void __exit applesmc_exit(void)
         if (applesmc_accelerometer)
                 applesmc_release_accelerometer();
         sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
+        while (fans_handled)
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
         sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
         sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
         platform_device_unregister(pdev);
diff --git a/drivers/hwmon/asc7621.c b/drivers/hwmon/asc7621.c
index 7f948105d8ad..0f388adc6187 100644
--- a/drivers/hwmon/asc7621.c
+++ b/drivers/hwmon/asc7621.c
@@ -268,8 +268,11 @@ static ssize_t store_fan16(struct device *dev,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
+        /* If a minimum RPM of zero is requested, then we set the register to
+           0xffff. This value allows the fan to be stopped completely without
+           generating an alarm. */
         reqval =
-            (SENSORS_LIMIT((reqval) <= 0 ? 0 : 5400000 / (reqval), 0, 65534));
+            (reqval <= 0 ? 0xffff : SENSORS_LIMIT(5400000 / reqval, 0, 0xfffe));
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = (reqval >> 8) & 0xff;
@@ -285,8 +288,9 @@ static ssize_t store_fan16(struct device *dev,
  * Voltages are scaled in the device so that the nominal voltage
  * is 3/4ths of the 0-255 range (i.e. 192).
  * If all voltages are 'normal' then all voltage registers will
- * read 0xC0.  This doesn't help us if we don't have a point of refernce.
- * The data sheet however provides us with the full scale value for each
+ * read 0xC0.
+ *
+ * The data sheet provides us with the 3/4 scale value for each voltage
  * which is stored in in_scaling.  The sda->index parameter value provides
  * the index into in_scaling.
  *
@@ -295,7 +299,7 @@ static ssize_t store_fan16(struct device *dev,
  */
 
 static int asc7621_in_scaling[] = {
-        3320, 3000, 4380, 6640, 16000
+        2500, 2250, 3300, 5000, 12000
 };
 
 static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
@@ -306,19 +310,12 @@ static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
         u8 nr = sda->index;
 
         mutex_lock(&data->update_lock);
-        regval = (data->reg[param->msb[0]] * asc7621_in_scaling[nr]) / 256;
-
-        /* The LSB value is a 2-bit scaling of the MSB's LSbit value.
-         * I.E.  If the maximim voltage for this input is 6640 millivolts then
-         * a MSB register value of 0 = 0mv and 255 = 6640mv.
-         * A 1 step change therefore represents 25.9mv (6640 / 256).
-         * The extra 2-bits therefore represent increments of 6.48mv.
-         */
-        regval += ((asc7621_in_scaling[nr] / 256) / 4) *
-            (data->reg[param->lsb[0]] >> 6);
-
+        regval = (data->reg[param->msb[0]] << 8) | (data->reg[param->lsb[0]]);
         mutex_unlock(&data->update_lock);
 
+        /* The LSB value is a 2-bit scaling of the MSB's LSbit value. */
+        regval = (regval >> 6) * asc7621_in_scaling[nr] / (0xc0 << 2);
+
         return sprintf(buf, "%u\n", regval);
 }
 
@@ -331,7 +328,7 @@ static ssize_t show_in8(struct device *dev, struct device_attribute *attr,
 
         return sprintf(buf, "%u\n",
                        ((data->reg[param->msb[0]] *
-                         asc7621_in_scaling[nr]) / 256));
+                         asc7621_in_scaling[nr]) / 0xc0));
 }
 
 static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
@@ -344,9 +341,11 @@ static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
         if (strict_strtol(buf, 10, &reqval))
                 return -EINVAL;
 
-        reqval = SENSORS_LIMIT(reqval, 0, asc7621_in_scaling[nr]);
+        reqval = SENSORS_LIMIT(reqval, 0, 0xffff);
+
+        reqval = reqval * 0xc0 / asc7621_in_scaling[nr];
 
-        reqval = (reqval * 255 + 128) / asc7621_in_scaling[nr];
+        reqval = SENSORS_LIMIT(reqval, 0, 0xff);
 
         mutex_lock(&data->update_lock);
         data->reg[param->msb[0]] = reqval;
@@ -846,11 +845,11 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(in3_max, 3, PRI_LOW, 0x4b, 0, 0, 0, in8),
         PWRITE(in4_max, 4, PRI_LOW, 0x4d, 0, 0, 0, in8),
 
-        PREAD(in0_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 0, bitmask),
-        PREAD(in1_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 1, bitmask),
-        PREAD(in2_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 2, bitmask),
-        PREAD(in3_alarm, 3, PRI_LOW, 0x41, 0, 0x01, 3, bitmask),
-        PREAD(in4_alarm, 4, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
+        PREAD(in0_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 0, bitmask),
+        PREAD(in1_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 1, bitmask),
+        PREAD(in2_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 2, bitmask),
+        PREAD(in3_alarm, 3, PRI_HIGH, 0x41, 0, 0x01, 3, bitmask),
+        PREAD(in4_alarm, 4, PRI_HIGH, 0x42, 0, 0x01, 0, bitmask),
 
         PREAD(fan1_input, 0, PRI_HIGH, 0x29, 0x28, 0, 0, fan16),
         PREAD(fan2_input, 1, PRI_HIGH, 0x2b, 0x2a, 0, 0, fan16),
@@ -862,10 +861,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(fan3_min, 2, PRI_LOW, 0x59, 0x58, 0, 0, fan16),
         PWRITE(fan4_min, 3, PRI_LOW, 0x5b, 0x5a, 0, 0, fan16),
 
-        PREAD(fan1_alarm, 0, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
-        PREAD(fan2_alarm, 1, PRI_LOW, 0x42, 0, 0x01, 1, bitmask),
-        PREAD(fan3_alarm, 2, PRI_LOW, 0x42, 0, 0x01, 2, bitmask),
-        PREAD(fan4_alarm, 3, PRI_LOW, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan1_alarm, 0, PRI_HIGH, 0x42, 0, 0x01, 2, bitmask),
+        PREAD(fan2_alarm, 1, PRI_HIGH, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan3_alarm, 2, PRI_HIGH, 0x42, 0, 0x01, 4, bitmask),
+        PREAD(fan4_alarm, 3, PRI_HIGH, 0x42, 0, 0x01, 5, bitmask),
 
         PREAD(temp1_input, 0, PRI_HIGH, 0x25, 0x10, 0, 0, temp10),
         PREAD(temp2_input, 1, PRI_HIGH, 0x26, 0x15, 0, 0, temp10),
@@ -886,10 +885,10 @@ static struct asc7621_param asc7621_params[] = {
         PWRITE(temp3_max, 2, PRI_LOW, 0x53, 0, 0, 0, temp8),
         PWRITE(temp4_max, 3, PRI_LOW, 0x35, 0, 0, 0, temp8),
 
-        PREAD(temp1_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 4, bitmask),
-        PREAD(temp2_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 5, bitmask),
-        PREAD(temp3_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 6, bitmask),
-        PREAD(temp4_alarm, 3, PRI_LOW, 0x43, 0, 0x01, 0, bitmask),
+        PREAD(temp1_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 4, bitmask),
+        PREAD(temp2_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 5, bitmask),
+        PREAD(temp3_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 6, bitmask),
+        PREAD(temp4_alarm, 3, PRI_HIGH, 0x43, 0, 0x01, 0, bitmask),
 
         PWRITE(temp1_source, 0, PRI_LOW, 0x02, 0, 0x07, 4, bitmask),
         PWRITE(temp2_source, 1, PRI_LOW, 0x02, 0, 0x07, 0, bitmask),
@@ -898,7 +897,7 @@ static struct asc7621_param asc7621_params[] = {
 
         PWRITE(temp1_smoothing_enable, 0, PRI_LOW, 0x62, 0, 0x01, 3, bitmask),
         PWRITE(temp2_smoothing_enable, 1, PRI_LOW, 0x63, 0, 0x01, 7, bitmask),
-        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x64, 0, 0x01, 3, bitmask),
+        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x63, 0, 0x01, 3, bitmask),
         PWRITE(temp4_smoothing_enable, 3, PRI_LOW, 0x3c, 0, 0x01, 3, bitmask),
 
         PWRITE(temp1_smoothing_time, 0, PRI_LOW, 0x62, 0, 0x07, 0, temp_st),
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 75f3fa55663d..16c420240724 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -1169,15 +1169,19 @@ static int atk_create_files(struct atk_data *data)
         int err;
 
         list_for_each_entry(s, &data->sensor_list, list) {
+                sysfs_attr_init(&s->input_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->input_attr);
                 if (err)
                         return err;
+                sysfs_attr_init(&s->label_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->label_attr);
                 if (err)
                         return err;
+                sysfs_attr_init(&s->limit1_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->limit1_attr);
                 if (err)
                         return err;
+                sysfs_attr_init(&s->limit2_attr.attr);
                 err = device_create_file(data->hwmon_dev, &s->limit2_attr);
                 if (err)
                         return err;
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index be475e844c2a..7580f55e67e3 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -217,6 +217,10 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
         AXIS_DMI_MATCH("DV7", "HP Pavilion dv7", x_inverted),
         AXIS_DMI_MATCH("HP8710", "HP Compaq 8710", y_inverted),
         AXIS_DMI_MATCH("HDX18", "HP HDX 18", x_inverted),
+        AXIS_DMI_MATCH("HPB432x", "HP ProBook 432", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB442x", "HP ProBook 442", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB452x", "HP ProBook 452", y_inverted),
+        AXIS_DMI_MATCH("HPB522x", "HP ProBook 522", xy_swap),
         { NULL, }
 /* Laptop models without axis info (yet):
  * "NC6910" "HP Compaq 6910"
@@ -324,8 +328,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
         lis3lv02d_joystick_disable();
         lis3lv02d_poweroff(&lis3_dev);
 
-        flush_work(&hpled_led.work);
         led_classdev_unregister(&hpled_led.led_classdev);
+        flush_work(&hpled_led.work);
 
         return lis3lv02d_remove_fs(&lis3_dev);
 }
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 9c6170cd9aac..87ab0568bb0e 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -564,7 +564,7 @@ config I2C_STU300
 
 config I2C_VERSATILE
         tristate "ARM Versatile/Realview I2C bus support"
-        depends on ARCH_VERSATILE || ARCH_REALVIEW
+        depends on ARCH_VERSATILE || ARCH_REALVIEW || ARCH_VEXPRESS
         select I2C_ALGOBIT
         help
           Say yes if you want to support the I2C serial bus on ARMs Versatile
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index a2481f40ea1c..0e9f85d0a835 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -447,7 +447,7 @@ static struct i2c_adapter octeon_i2c_ops = {
 /**
  * octeon_i2c_setclock - Calculate and set clock divisors.
  */
-static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_setclock(struct octeon_i2c *i2c)
 {
         int tclk, thp_base, inc, thp_idx, mdiv_idx, ndiv_idx, foscl, diff;
         int thp = 0x18, mdiv = 2, ndiv = 0, delta_hz = 1000000;
@@ -490,7 +490,7 @@ static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
         return 0;
 }
 
-static int __init octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
 {
         u8 status;
         int tries;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 3202a86f420e..7c469a62c3c1 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -40,12 +40,11 @@
 #include "i2c-core.h"
 
 
-/* core_lock protects i2c_adapter_idr, userspace_devices, and guarantees
+/* core_lock protects i2c_adapter_idr, and guarantees
    that device detection, deletion of detected devices, and attach_adapter
    and detach_adapter calls are serialized */
 static DEFINE_MUTEX(core_lock);
 static DEFINE_IDR(i2c_adapter_idr);
-static LIST_HEAD(userspace_devices);
 
 static struct device_type i2c_client_type;
 static int i2c_check_addr(struct i2c_adapter *adapter, int addr);
@@ -117,8 +116,10 @@ static int i2c_device_probe(struct device *dev)
         dev_dbg(dev, "probe\n");
 
         status = driver->probe(client, i2c_match_id(driver->id_table, client));
-        if (status)
+        if (status) {
                 client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
         return status;
 }
 
@@ -139,8 +140,10 @@ static int i2c_device_remove(struct device *dev)
                 dev->driver = NULL;
                 status = 0;
         }
-        if (status == 0)
+        if (status == 0) {
                 client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
         return status;
 }
 
@@ -156,106 +159,130 @@ static void i2c_device_shutdown(struct device *dev)
                 driver->shutdown(client);
 }
 
-#ifdef CONFIG_SUSPEND
-static int i2c_device_pm_suspend(struct device *dev)
+#ifdef CONFIG_PM_SLEEP
+static int i2c_legacy_suspend(struct device *dev, pm_message_t mesg)
 {
-        const struct dev_pm_ops *pm;
+        struct i2c_client *client = i2c_verify_client(dev);
+        struct i2c_driver *driver;
 
-        if (!dev->driver)
+        if (!client || !dev->driver)
                 return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->suspend)
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->suspend)
                 return 0;
-        return pm->suspend(dev);
+        return driver->suspend(client, mesg);
 }
 
-static int i2c_device_pm_resume(struct device *dev)
+static int i2c_legacy_resume(struct device *dev)
 {
-        const struct dev_pm_ops *pm;
+        struct i2c_client *client = i2c_verify_client(dev);
+        struct i2c_driver *driver;
 
-        if (!dev->driver)
+        if (!client || !dev->driver)
                 return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->resume)
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->resume)
                 return 0;
-        return pm->resume(dev);
+        return driver->resume(client);
 }
-#else
-#define i2c_device_pm_suspend   NULL
-#define i2c_device_pm_resume    NULL
-#endif
 
-#ifdef CONFIG_PM_RUNTIME
-static int i2c_device_runtime_suspend(struct device *dev)
+static int i2c_device_pm_suspend(struct device *dev)
 {
-        const struct dev_pm_ops *pm;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!dev->driver)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->runtime_suspend)
-                return 0;
-        return pm->runtime_suspend(dev);
-}
 
-static int i2c_device_runtime_resume(struct device *dev)
-{
-        const struct dev_pm_ops *pm;
+        if (pm)
+                return pm->suspend ? pm->suspend(dev) : 0;
 
-        if (!dev->driver)
-                return 0;
-        pm = dev->driver->pm;
-        if (!pm || !pm->runtime_resume)
-                return 0;
-        return pm->runtime_resume(dev);
+        return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
 
-static int i2c_device_runtime_idle(struct device *dev)
+static int i2c_device_pm_resume(struct device *dev)
 {
-        const struct dev_pm_ops *pm = NULL;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int ret;
 
-        if (dev->driver)
-                pm = dev->driver->pm;
-        if (pm && pm->runtime_idle) {
-                ret = pm->runtime_idle(dev);
-                if (ret)
-                        return ret;
+        if (pm)
+                ret = pm->resume ? pm->resume(dev) : 0;
+        else
+                ret = i2c_legacy_resume(dev);
+
+        if (!ret) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
         }
 
-        return pm_runtime_suspend(dev);
+        return ret;
 }
-#else
-#define i2c_device_runtime_suspend      NULL
-#define i2c_device_runtime_resume       NULL
-#define i2c_device_runtime_idle         NULL
-#endif
 
-static int i2c_device_suspend(struct device *dev, pm_message_t mesg)
+static int i2c_device_pm_freeze(struct device *dev)
 {
-        struct i2c_client *client = i2c_verify_client(dev);
-        struct i2c_driver *driver;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!client || !dev->driver)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        driver = to_i2c_driver(dev->driver);
-        if (!driver->suspend)
-                return 0;
-        return driver->suspend(client, mesg);
+
+        if (pm)
+                return pm->freeze ? pm->freeze(dev) : 0;
+
+        return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
 
-static int i2c_device_resume(struct device *dev)
+static int i2c_device_pm_thaw(struct device *dev)
 {
-        struct i2c_client *client = i2c_verify_client(dev);
-        struct i2c_driver *driver;
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (!client || !dev->driver)
+        if (pm_runtime_suspended(dev))
                 return 0;
-        driver = to_i2c_driver(dev->driver);
-        if (!driver->resume)
+
+        if (pm)
+                return pm->thaw ? pm->thaw(dev) : 0;
+
+        return i2c_legacy_resume(dev);
+}
+
+static int i2c_device_pm_poweroff(struct device *dev)
+{
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+
+        if (pm_runtime_suspended(dev))
                 return 0;
-        return driver->resume(client);
+
+        if (pm)
+                return pm->poweroff ? pm->poweroff(dev) : 0;
+
+        return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
+}
+
+static int i2c_device_pm_restore(struct device *dev)
+{
+        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+        int ret;
+
+        if (pm)
+                ret = pm->restore ? pm->restore(dev) : 0;
+        else
+                ret = i2c_legacy_resume(dev);
+
+        if (!ret) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
+        }
+
+        return ret;
 }
+#else /* !CONFIG_PM_SLEEP */
+#define i2c_device_pm_suspend   NULL
+#define i2c_device_pm_resume    NULL
+#define i2c_device_pm_freeze    NULL
+#define i2c_device_pm_thaw      NULL
+#define i2c_device_pm_poweroff  NULL
+#define i2c_device_pm_restore   NULL
+#endif /* !CONFIG_PM_SLEEP */
 
 static void i2c_client_dev_release(struct device *dev)
 {
@@ -298,9 +325,15 @@ static const struct attribute_group *i2c_dev_attr_groups[] = {
 static const struct dev_pm_ops i2c_device_pm_ops = {
         .suspend = i2c_device_pm_suspend,
         .resume = i2c_device_pm_resume,
-        .runtime_suspend = i2c_device_runtime_suspend,
-        .runtime_resume = i2c_device_runtime_resume,
-        .runtime_idle = i2c_device_runtime_idle,
+        .freeze = i2c_device_pm_freeze,
+        .thaw = i2c_device_pm_thaw,
+        .poweroff = i2c_device_pm_poweroff,
+        .restore = i2c_device_pm_restore,
+        SET_RUNTIME_PM_OPS(
+                pm_generic_runtime_suspend,
+                pm_generic_runtime_resume,
+                pm_generic_runtime_idle
+        )
 };
 
 struct bus_type i2c_bus_type = {
@@ -309,8 +342,6 @@ struct bus_type i2c_bus_type = {
         .probe          = i2c_device_probe,
         .remove         = i2c_device_remove,
         .shutdown       = i2c_device_shutdown,
-        .suspend        = i2c_device_suspend,
-        .resume         = i2c_device_resume,
         .pm             = &i2c_device_pm_ops,
 };
 EXPORT_SYMBOL_GPL(i2c_bus_type);
@@ -538,9 +569,9 @@ i2c_sysfs_new_device(struct device *dev, struct device_attribute *attr,
                 return -EEXIST;
 
         /* Keep track of the added device */
-        mutex_lock(&core_lock);
-        list_add_tail(&client->detected, &userspace_devices);
-        mutex_unlock(&core_lock);
+        i2c_lock_adapter(adap);
+        list_add_tail(&client->detected, &adap->userspace_clients);
+        i2c_unlock_adapter(adap);
         dev_info(dev, "%s: Instantiated device %s at 0x%02hx\n", "new_device",
                  info.type, info.addr);
 
@@ -579,9 +610,10 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
 
         /* Make sure the device was added through sysfs */
         res = -ENOENT;
-        mutex_lock(&core_lock);
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
-                if (client->addr == addr && client->adapter == adap) {
+        i2c_lock_adapter(adap);
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
+                                 detected) {
+                if (client->addr == addr) {
                         dev_info(dev, "%s: Deleting device %s at 0x%02hx\n",
                                  "delete_device", client->name, client->addr);
 
@@ -591,7 +623,7 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
                         break;
                 }
         }
-        mutex_unlock(&core_lock);
+        i2c_unlock_adapter(adap);
 
         if (res < 0)
                 dev_err(dev, "%s: Can't find device in list\n",
@@ -673,6 +705,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
         }
 
         rt_mutex_init(&adap->bus_lock);
+        INIT_LIST_HEAD(&adap->userspace_clients);
 
         /* Set default timeout to 1 second if not already set */
         if (adap->timeout == 0)
@@ -875,14 +908,15 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                 return res;
 
         /* Remove devices instantiated from sysfs */
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
-                if (client->adapter == adap) {
-                        dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
-                                client->name, client->addr);
-                        list_del(&client->detected);
-                        i2c_unregister_device(client);
-                }
+        i2c_lock_adapter(adap);
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
+                                 detected) {
+                dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
+                        client->addr);
+                list_del(&client->detected);
+                i2c_unregister_device(client);
         }
+        i2c_unlock_adapter(adap);
 
         /* Detach any active clients. This can't fail, thus we do not
            checking the returned value. */
@@ -1260,12 +1294,23 @@ static int i2c_detect_address(struct i2c_client *temp_client,
                 return 0;
 
         /* Make sure there is something at this address */
-        if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0)
-                return 0;
+        if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
+                /* Special probe for FSC hwmon chips */
+                union i2c_smbus_data dummy;
 
-        /* Prevent 24RF08 corruption */
-        if ((addr & ~0x0f) == 0x50)
-                i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL);
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
+                                   I2C_SMBUS_BYTE_DATA, &dummy) < 0)
+                        return 0;
+        } else {
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                   I2C_SMBUS_QUICK, NULL) < 0)
+                        return 0;
+
+                /* Prevent 24RF08 corruption */
+                if ((addr & ~0x0f) == 0x50)
+                        i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                       I2C_SMBUS_QUICK, NULL);
+        }
 
         /* Finally call the custom detection function */
         memset(&info, 0, sizeof(struct i2c_board_info));
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index ab87e4f7cec9..0b7815d2581c 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -65,8 +65,7 @@ MODULE_LICENSE("Dual MPL/GPL");
 typedef struct ide_info_t {
         struct pcmcia_device    *p_dev;
         struct ide_host         *host;
-    int         ndev;
-    dev_node_t  node;
+        int                     ndev;
 } ide_info_t;
 
 static void ide_release(struct pcmcia_device *);
@@ -102,7 +101,6 @@ static int ide_probe(struct pcmcia_device *link)
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
     link->io.IOAddrLines = 3;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -285,8 +283,7 @@ static int ide_config(struct pcmcia_device *link)
     io_base = link->io.BasePort1;
     ctl_base = stk->ctl_base;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
@@ -299,24 +296,21 @@ static int ide_config(struct pcmcia_device *link)
     if (is_kme)
         outb(0x81, ctl_base+1);
 
-     host = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link);
+     host = idecs_register(io_base, ctl_base, link->irq, link);
      if (host == NULL && link->io.NumPorts1 == 0x20) {
             outb(0x02, ctl_base + 0x10);
             host = idecs_register(io_base + 0x10, ctl_base + 0x10,
-                                  link->irq.AssignedIRQ, link);
+                                  link->irq, link);
     }
 
     if (host == NULL)
         goto failed;
 
     info->ndev = 1;
-    sprintf(info->node.dev_name, "hd%c", 'a' + host->ports[0]->index * 2);
-    info->node.major = host->ports[0]->major;
-    info->node.minor = 0;
     info->host = host;
-    link->dev_node = &info->node;
-    printk(KERN_INFO "ide-cs: %s: Vpp = %d.%d\n",
-           info->node.dev_name, link->conf.Vpp / 10, link->conf.Vpp % 10);
+    dev_info(&link->dev, "ide-cs: hd%c: Vpp = %d.%d\n",
+            'a' + host->ports[0]->index * 2,
+            link->conf.Vpp / 10, link->conf.Vpp % 10);
 
     kfree(stk);
     return 0;
@@ -409,6 +403,8 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
         PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
         PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
         PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
         PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
@@ -429,6 +425,8 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
         PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
         PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
         PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 975adce5f40c..330d2a423362 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -46,6 +46,7 @@ source "drivers/infiniband/hw/ipath/Kconfig"
 source "drivers/infiniband/hw/ehca/Kconfig"
 source "drivers/infiniband/hw/amso1100/Kconfig"
 source "drivers/infiniband/hw/cxgb3/Kconfig"
+source "drivers/infiniband/hw/cxgb4/Kconfig"
 source "drivers/infiniband/hw/mlx4/Kconfig"
 source "drivers/infiniband/hw/nes/Kconfig"
 
diff --git a/drivers/infiniband/Makefile b/drivers/infiniband/Makefile
index ed35e4496241..0c4e589d746e 100644
--- a/drivers/infiniband/Makefile
+++ b/drivers/infiniband/Makefile
@@ -4,6 +4,7 @@ obj-$(CONFIG_INFINIBAND_IPATH)		+= hw/ipath/
 obj-$(CONFIG_INFINIBAND_EHCA)           += hw/ehca/
 obj-$(CONFIG_INFINIBAND_AMSO1100)       += hw/amso1100/
 obj-$(CONFIG_INFINIBAND_CXGB3)          += hw/cxgb3/
+obj-$(CONFIG_INFINIBAND_CXGB4)          += hw/cxgb4/
 obj-$(CONFIG_MLX4_INFINIBAND)           += hw/mlx4/
 obj-$(CONFIG_INFINIBAND_NES)            += hw/nes/
 obj-$(CONFIG_INFINIBAND_IPOIB)          += ulp/ipoib/
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 6d777069d86d..b930b8110a63 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -79,7 +79,6 @@ static DEFINE_IDR(sdp_ps);
 static DEFINE_IDR(tcp_ps);
 static DEFINE_IDR(udp_ps);
 static DEFINE_IDR(ipoib_ps);
-static int next_port;
 
 struct cma_device {
         struct list_head        list;
@@ -1677,13 +1676,13 @@ int rdma_set_ib_paths(struct rdma_cm_id *id,
         if (!cma_comp_exch(id_priv, CMA_ADDR_RESOLVED, CMA_ROUTE_RESOLVED))
                 return -EINVAL;
 
-        id->route.path_rec = kmalloc(sizeof *path_rec * num_paths, GFP_KERNEL);
+        id->route.path_rec = kmemdup(path_rec, sizeof *path_rec * num_paths,
+                                     GFP_KERNEL);
         if (!id->route.path_rec) {
                 ret = -ENOMEM;
                 goto err;
         }
 
-        memcpy(id->route.path_rec, path_rec, sizeof *path_rec * num_paths);
         id->route.num_paths = num_paths;
         return 0;
 err:
@@ -1970,47 +1969,33 @@ err1:
 
 static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
 {
-        struct rdma_bind_list *bind_list;
-        int port, ret, low, high;
-
-        bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
-        if (!bind_list)
-                return -ENOMEM;
-
-retry:
-        /* FIXME: add proper port randomization per like inet_csk_get_port */
-        do {
-                ret = idr_get_new_above(ps, bind_list, next_port, &port);
-        } while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
-
-        if (ret)
-                goto err1;
+        static unsigned int last_used_port;
+        int low, high, remaining;
+        unsigned int rover;
 
         inet_get_local_port_range(&low, &high);
-        if (port > high) {
-                if (next_port != low) {
-                        idr_remove(ps, port);
-                        next_port = low;
-                        goto retry;
-                }
-                ret = -EADDRNOTAVAIL;
-                goto err2;
+        remaining = (high - low) + 1;
+        rover = net_random() % remaining + low;
+retry:
+        if (last_used_port != rover &&
+            !idr_find(ps, (unsigned short) rover)) {
+                int ret = cma_alloc_port(ps, id_priv, rover);
+                /*
+                 * Remember previously used port number in order to avoid
+                 * re-using same port immediately after it is closed.
+                 */
+                if (!ret)
+                        last_used_port = rover;
+                if (ret != -EADDRNOTAVAIL)
+                        return ret;
         }
-
-        if (port == high)
-                next_port = low;
-        else
-                next_port = port + 1;
-
-        bind_list->ps = ps;
-        bind_list->port = (unsigned short) port;
-        cma_bind_port(bind_list, id_priv);
-        return 0;
-err2:
-        idr_remove(ps, port);
-err1:
-        kfree(bind_list);
-        return ret;
+        if (--remaining) {
+                rover++;
+                if ((rover < low) || (rover > high))
+                        rover = low;
+                goto retry;
+        }
+        return -EADDRNOTAVAIL;
 }
 
 static int cma_use_port(struct idr *ps, struct rdma_id_private *id_priv)
@@ -2995,12 +2980,7 @@ static void cma_remove_one(struct ib_device *device)
 
 static int __init cma_init(void)
 {
-        int ret, low, high, remaining;
-
-        get_random_bytes(&next_port, sizeof next_port);
-        inet_get_local_port_range(&low, &high);
-        remaining = (high - low) + 1;
-        next_port = ((unsigned int) next_port % remaining) + low;
+        int ret;
 
         cma_wq = create_singlethread_workqueue("rdma_cm");
         if (!cma_wq)
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 1df1194aeba4..6dc7b77d5d29 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -291,13 +291,11 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         }
 
         if (mad_reg_req) {
-                reg_req = kmalloc(sizeof *reg_req, GFP_KERNEL);
+                reg_req = kmemdup(mad_reg_req, sizeof *reg_req, GFP_KERNEL);
                 if (!reg_req) {
                         ret = ERR_PTR(-ENOMEM);
                         goto error3;
                 }
-                /* Make a copy of the MAD registration request */
-                memcpy(reg_req, mad_reg_req, sizeof *reg_req);
         }
 
         /* Now, fill in the various structures */
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 512b1c43460c..46474842cfe9 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1181,7 +1181,7 @@ static int ib_ucm_open(struct inode *inode, struct file *filp)
         file->filp = filp;
         file->device = container_of(inode->i_cdev, struct ib_ucm_device, cdev);
 
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int ib_ucm_close(struct inode *inode, struct file *filp)
@@ -1229,6 +1229,7 @@ static const struct file_operations ucm_fops = {
         .release = ib_ucm_close,
         .write   = ib_ucm_write,
         .poll    = ib_ucm_poll,
+        .llseek  = no_llseek,
 };
 
 static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 46185084121e..ac7edc24165c 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1220,7 +1220,8 @@ static int ucma_open(struct inode *inode, struct file *filp)
 
         filp->private_data = file;
         file->filp = filp;
-        return 0;
+
+        return nonseekable_open(inode, filp);
 }
 
 static int ucma_close(struct inode *inode, struct file *filp)
@@ -1250,6 +1251,7 @@ static const struct file_operations ucma_fops = {
         .release = ucma_close,
         .write   = ucma_write,
         .poll    = ucma_poll,
+        .llseek  = no_llseek,
 };
 
 static struct miscdevice ucma_misc = {
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index e7db054fb1c8..6babb72b39fc 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -781,7 +781,7 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
 {
         struct ib_umad_port *port;
         struct ib_umad_file *file;
-        int ret = 0;
+        int ret;
 
         port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
         if (port)
@@ -814,6 +814,8 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
 
         list_add_tail(&file->port_list, &port->file_list);
 
+        ret = nonseekable_open(inode, filp);
+
 out:
         mutex_unlock(&port->file_mutex);
         return ret;
@@ -866,7 +868,8 @@ static const struct file_operations umad_fops = {
         .compat_ioctl   = ib_umad_compat_ioctl,
 #endif
         .open           = ib_umad_open,
-        .release        = ib_umad_close
+        .release        = ib_umad_close,
+        .llseek         = no_llseek,
 };
 
 static int ib_umad_sm_open(struct inode *inode, struct file *filp)
@@ -903,7 +906,7 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
 
         filp->private_data = port;
 
-        return 0;
+        return nonseekable_open(inode, filp);
 
 fail:
         kref_put(&port->umad_dev->ref, ib_umad_release_dev);
@@ -933,7 +936,8 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
 static const struct file_operations umad_sm_fops = {
         .owner   = THIS_MODULE,
         .open    = ib_umad_sm_open,
-        .release = ib_umad_sm_close
+        .release = ib_umad_sm_close,
+        .llseek  = no_llseek,
 };
 
 static struct ib_client umad_client = {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb3526254426..ec83e9fe387b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -369,7 +369,8 @@ static const struct file_operations uverbs_event_fops = {
         .read    = ib_uverbs_event_read,
         .poll    = ib_uverbs_event_poll,
         .release = ib_uverbs_event_close,
-        .fasync  = ib_uverbs_event_fasync
+        .fasync  = ib_uverbs_event_fasync,
+        .llseek  = no_llseek,
 };
 
 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context)
@@ -623,7 +624,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
 
         filp->private_data = file;
 
-        return 0;
+        return nonseekable_open(inode, filp);
 
 err_module:
         module_put(dev->ib_dev->owner);
@@ -651,7 +652,8 @@ static const struct file_operations uverbs_fops = {
         .owner   = THIS_MODULE,
         .write   = ib_uverbs_write,
         .open    = ib_uverbs_open,
-        .release = ib_uverbs_close
+        .release = ib_uverbs_close,
+        .llseek  = no_llseek,
 };
 
 static const struct file_operations uverbs_mmap_fops = {
@@ -659,7 +661,8 @@ static const struct file_operations uverbs_mmap_fops = {
         .write   = ib_uverbs_write,
         .mmap    = ib_uverbs_mmap,
         .open    = ib_uverbs_open,
-        .release = ib_uverbs_close
+        .release = ib_uverbs_close,
+        .llseek  = no_llseek,
 };
 
 static struct ib_client uverbs_client = {
diff --git a/drivers/infiniband/hw/amso1100/c2.h b/drivers/infiniband/hw/amso1100/c2.h
index f7ff66f98361..6ae698e68775 100644
--- a/drivers/infiniband/hw/amso1100/c2.h
+++ b/drivers/infiniband/hw/amso1100/c2.h
@@ -250,7 +250,7 @@ struct c2_array {
 struct sp_chunk {
         struct sp_chunk *next;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         u16 head;
         u16 shared_ptr[0];
 };
diff --git a/drivers/infiniband/hw/amso1100/c2_alloc.c b/drivers/infiniband/hw/amso1100/c2_alloc.c
index d4f5f5d42e90..78d247ec6961 100644
--- a/drivers/infiniband/hw/amso1100/c2_alloc.c
+++ b/drivers/infiniband/hw/amso1100/c2_alloc.c
@@ -49,7 +49,7 @@ static int c2_alloc_mqsp_chunk(struct c2_dev *c2dev, gfp_t gfp_mask,
                 return -ENOMEM;
 
         new_head->dma_addr = dma_addr;
-        pci_unmap_addr_set(new_head, mapping, new_head->dma_addr);
+        dma_unmap_addr_set(new_head, mapping, new_head->dma_addr);
 
         new_head->next = NULL;
         new_head->head = 0;
@@ -81,7 +81,7 @@ void c2_free_mqsp_pool(struct c2_dev *c2dev, struct sp_chunk *root)
         while (root) {
                 next = root->next;
                 dma_free_coherent(&c2dev->pcidev->dev, PAGE_SIZE, root,
-                                  pci_unmap_addr(root, mapping));
+                                  dma_unmap_addr(root, mapping));
                 root = next;
         }
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_cq.c b/drivers/infiniband/hw/amso1100/c2_cq.c
index f7b0fc23f413..49e0e8533f74 100644
--- a/drivers/infiniband/hw/amso1100/c2_cq.c
+++ b/drivers/infiniband/hw/amso1100/c2_cq.c
@@ -257,7 +257,7 @@ int c2_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags notify_flags)
 static void c2_free_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq)
 {
         dma_free_coherent(&c2dev->pcidev->dev, mq->q_size * mq->msg_size,
-                          mq->msg_pool.host, pci_unmap_addr(mq, mapping));
+                          mq->msg_pool.host, dma_unmap_addr(mq, mapping));
 }
 
 static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
@@ -278,7 +278,7 @@ static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                        NULL,    /* peer (currently unknown) */
                        C2_MQ_HOST_TARGET);
 
-        pci_unmap_addr_set(mq, mapping, mq->host_dma);
+        dma_unmap_addr_set(mq, mapping, mq->host_dma);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_mq.h b/drivers/infiniband/hw/amso1100/c2_mq.h
index acede007b94a..fc1b9a7cec4b 100644
--- a/drivers/infiniband/hw/amso1100/c2_mq.h
+++ b/drivers/infiniband/hw/amso1100/c2_mq.h
@@ -71,7 +71,7 @@ struct c2_mq {
                 u8 __iomem *adapter;
         } msg_pool;
         dma_addr_t host_dma;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         u16 hint_count;
         u16 priv;
         struct c2_mq_shared __iomem *peer;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.h b/drivers/infiniband/hw/amso1100/c2_provider.h
index 1076df2ee96a..bf189987711f 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.h
+++ b/drivers/infiniband/hw/amso1100/c2_provider.h
@@ -50,7 +50,7 @@
 
 struct c2_buf_list {
         void *buf;
-         DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
 
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index 78c4bcc6ef60..85cfae4cad71 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -524,7 +524,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
                 err = -ENOMEM;
                 goto bail1;
         }
-        pci_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
+        dma_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
         pr_debug("%s rep_vq va %p dma %llx\n", __func__, q1_pages,
                  (unsigned long long) c2dev->rep_vq.host_dma);
         c2_mq_rep_init(&c2dev->rep_vq,
@@ -545,7 +545,7 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
                 err = -ENOMEM;
                 goto bail2;
         }
-        pci_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
+        dma_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
         pr_debug("%s aeq va %p dma %llx\n", __func__, q2_pages,
                  (unsigned long long) c2dev->aeq.host_dma);
         c2_mq_rep_init(&c2dev->aeq,
@@ -596,11 +596,11 @@ int __devinit c2_rnic_init(struct c2_dev *c2dev)
       bail3:
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                          q2_pages, pci_unmap_addr(&c2dev->aeq, mapping));
+                          q2_pages, dma_unmap_addr(&c2dev->aeq, mapping));
       bail2:
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                          q1_pages, pci_unmap_addr(&c2dev->rep_vq, mapping));
+                          q1_pages, dma_unmap_addr(&c2dev->rep_vq, mapping));
       bail1:
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
       bail0:
@@ -637,13 +637,13 @@ void __devexit c2_rnic_term(struct c2_dev *c2dev)
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->aeq.q_size * c2dev->aeq.msg_size,
                           c2dev->aeq.msg_pool.host,
-                          pci_unmap_addr(&c2dev->aeq, mapping));
+                          dma_unmap_addr(&c2dev->aeq, mapping));
 
         /* Free the verbs reply queue */
         dma_free_coherent(&c2dev->pcidev->dev,
                           c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
                           c2dev->rep_vq.msg_pool.host,
-                          pci_unmap_addr(&c2dev->rep_vq, mapping));
+                          dma_unmap_addr(&c2dev->rep_vq, mapping));
 
         /* Free the MQ shared pointer pool */
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 35f286f1ad1e..005b7b52bc1e 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -174,7 +174,7 @@ int cxio_create_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq, int kernel)
                 kfree(cq->sw_queue);
                 return -ENOMEM;
         }
-        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        dma_unmap_addr_set(cq, mapping, cq->dma_addr);
         memset(cq->queue, 0, size);
         setup.id = cq->cqid;
         setup.base_addr = (u64) (cq->dma_addr);
@@ -297,7 +297,7 @@ int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
                 goto err4;
 
         memset(wq->queue, 0, depth * sizeof(union t3_wr));
-        pci_unmap_addr_set(wq, mapping, wq->dma_addr);
+        dma_unmap_addr_set(wq, mapping, wq->dma_addr);
         wq->doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
         if (!kernel_domain)
                 wq->udb = (u64)rdev_p->rnic_info.udbell_physbase +
@@ -325,7 +325,7 @@ int cxio_destroy_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << (cq->size_log2))
                           * sizeof(struct t3_cqe), cq->queue,
-                          pci_unmap_addr(cq, mapping));
+                          dma_unmap_addr(cq, mapping));
         cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
         return err;
 }
@@ -336,7 +336,7 @@ int cxio_destroy_qp(struct cxio_rdev *rdev_p, struct t3_wq *wq,
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << (wq->size_log2))
                           * sizeof(union t3_wr), wq->queue,
-                          pci_unmap_addr(wq, mapping));
+                          dma_unmap_addr(wq, mapping));
         kfree(wq->sq);
         cxio_hal_rqtpool_free(rdev_p, wq->rq_addr, (1UL << wq->rq_size_log2));
         kfree(wq->rq);
@@ -537,7 +537,7 @@ static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
                 err = -ENOMEM;
                 goto err;
         }
-        pci_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
+        dma_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
                            rdev_p->ctrl_qp.dma_addr);
         rdev_p->ctrl_qp.doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
         memset(rdev_p->ctrl_qp.workq, 0,
@@ -583,7 +583,7 @@ static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
         dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
                           (1UL << T3_CTRL_QP_SIZE_LOG2)
                           * sizeof(union t3_wr), rdev_p->ctrl_qp.workq,
-                          pci_unmap_addr(&rdev_p->ctrl_qp, mapping));
+                          dma_unmap_addr(&rdev_p->ctrl_qp, mapping));
         return cxio_hal_clear_qp_ctx(rdev_p, T3_CTRL_QP_ID);
 }
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index 073373c2c560..8f0caf7d4482 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -71,7 +71,7 @@ struct cxio_hal_ctrl_qp {
         wait_queue_head_t waitq;/* wait for RspQ/CQE msg */
         union t3_wr *workq;     /* the work request queue */
         dma_addr_t dma_addr;    /* pci bus address of the workq */
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         void __iomem *doorbell;
 };
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
index 15073b2da1c5..e5ddb63e7d23 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_wr.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -691,7 +691,7 @@ struct t3_swrq {
 struct t3_wq {
         union t3_wr *queue;             /* DMA accessable memory */
         dma_addr_t dma_addr;            /* DMA address for HW */
-        DECLARE_PCI_UNMAP_ADDR(mapping) /* unmap kruft */
+        DEFINE_DMA_UNMAP_ADDR(mapping); /* unmap kruft */
         u32 error;                      /* 1 once we go to ERROR */
         u32 qpid;
         u32 wptr;                       /* idx to next available WR slot */
@@ -718,7 +718,7 @@ struct t3_cq {
         u32 wptr;
         u32 size_log2;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t3_cqe *queue;
         struct t3_cqe *sw_queue;
         u32 sw_rptr;
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
index 63f975f3e30f..8e77dc543dd1 100644
--- a/drivers/infiniband/hw/cxgb3/iwch.c
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -47,8 +47,6 @@ MODULE_DESCRIPTION("Chelsio T3 RDMA Driver");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(DRV_VERSION);
 
-cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS];
-
 static void open_rnic_dev(struct t3cdev *);
 static void close_rnic_dev(struct t3cdev *);
 static void iwch_event_handler(struct t3cdev *, u32, u32);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 4fef03296276..ebfb117ba68b 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -102,12 +102,9 @@ static unsigned int cong_flavor = 1;
 module_param(cong_flavor, uint, 0644);
 MODULE_PARM_DESC(cong_flavor, "TCP Congestion control flavor (default=1)");
 
-static void process_work(struct work_struct *work);
 static struct workqueue_struct *workq;
-static DECLARE_WORK(skb_work, process_work);
 
 static struct sk_buff_head rxq;
-static cxgb3_cpl_handler_func work_handlers[NUM_CPL_CMDS];
 
 static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp);
 static void ep_timeout(unsigned long arg);
@@ -151,7 +148,7 @@ int iwch_l2t_send(struct t3cdev *tdev, struct sk_buff *skb, struct l2t_entry *l2
                 return -EIO;
         }
         error = l2t_send(tdev, skb, l2e);
-        if (error)
+        if (error < 0)
                 kfree_skb(skb);
         return error;
 }
@@ -167,7 +164,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
                 return -EIO;
         }
         error = cxgb3_ofld_send(tdev, skb);
-        if (error)
+        if (error < 0)
                 kfree_skb(skb);
         return error;
 }
@@ -302,27 +299,6 @@ static void release_ep_resources(struct iwch_ep *ep)
         put_ep(&ep->com);
 }
 
-static void process_work(struct work_struct *work)
-{
-        struct sk_buff *skb = NULL;
-        void *ep;
-        struct t3cdev *tdev;
-        int ret;
-
-        while ((skb = skb_dequeue(&rxq))) {
-                ep = *((void **) (skb->cb));
-                tdev = *((struct t3cdev **) (skb->cb + sizeof(void *)));
-                ret = work_handlers[G_OPCODE(ntohl((__force __be32)skb->csum))](tdev, skb, ep);
-                if (ret & CPL_RET_BUF_DONE)
-                        kfree_skb(skb);
-
-                /*
-                 * ep was referenced in sched(), and is freed here.
-                 */
-                put_ep((struct iwch_ep_common *)ep);
-        }
-}
-
 static int status2errno(int status)
 {
         switch (status) {
@@ -2157,7 +2133,49 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
 
 /*
  * All the CM events are handled on a work queue to have a safe context.
+ * These are the real handlers that are called from the work queue.
  */
+static const cxgb3_cpl_handler_func work_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH]     = act_establish,
+        [CPL_ACT_OPEN_RPL]      = act_open_rpl,
+        [CPL_RX_DATA]           = rx_data,
+        [CPL_TX_DMA_ACK]        = tx_ack,
+        [CPL_ABORT_RPL_RSS]     = abort_rpl,
+        [CPL_ABORT_RPL]         = abort_rpl,
+        [CPL_PASS_OPEN_RPL]     = pass_open_rpl,
+        [CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl,
+        [CPL_PASS_ACCEPT_REQ]   = pass_accept_req,
+        [CPL_PASS_ESTABLISH]    = pass_establish,
+        [CPL_PEER_CLOSE]        = peer_close,
+        [CPL_ABORT_REQ_RSS]     = peer_abort,
+        [CPL_CLOSE_CON_RPL]     = close_con_rpl,
+        [CPL_RDMA_TERMINATE]    = terminate,
+        [CPL_RDMA_EC_STATUS]    = ec_status,
+};
+
+static void process_work(struct work_struct *work)
+{
+        struct sk_buff *skb = NULL;
+        void *ep;
+        struct t3cdev *tdev;
+        int ret;
+
+        while ((skb = skb_dequeue(&rxq))) {
+                ep = *((void **) (skb->cb));
+                tdev = *((struct t3cdev **) (skb->cb + sizeof(void *)));
+                ret = work_handlers[G_OPCODE(ntohl((__force __be32)skb->csum))](tdev, skb, ep);
+                if (ret & CPL_RET_BUF_DONE)
+                        kfree_skb(skb);
+
+                /*
+                 * ep was referenced in sched(), and is freed here.
+                 */
+                put_ep((struct iwch_ep_common *)ep);
+        }
+}
+
+static DECLARE_WORK(skb_work, process_work);
+
 static int sched(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
 {
         struct iwch_ep_common *epc = ctx;
@@ -2189,6 +2207,29 @@ static int set_tcb_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         return CPL_RET_BUF_DONE;
 }
 
+/*
+ * All upcalls from the T3 Core go to sched() to schedule the
+ * processing on a work queue.
+ */
+cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH]     = sched,
+        [CPL_ACT_OPEN_RPL]      = sched,
+        [CPL_RX_DATA]           = sched,
+        [CPL_TX_DMA_ACK]        = sched,
+        [CPL_ABORT_RPL_RSS]     = sched,
+        [CPL_ABORT_RPL]         = sched,
+        [CPL_PASS_OPEN_RPL]     = sched,
+        [CPL_CLOSE_LISTSRV_RPL] = sched,
+        [CPL_PASS_ACCEPT_REQ]   = sched,
+        [CPL_PASS_ESTABLISH]    = sched,
+        [CPL_PEER_CLOSE]        = sched,
+        [CPL_CLOSE_CON_RPL]     = sched,
+        [CPL_ABORT_REQ_RSS]     = sched,
+        [CPL_RDMA_TERMINATE]    = sched,
+        [CPL_RDMA_EC_STATUS]    = sched,
+        [CPL_SET_TCB_RPL]       = set_tcb_rpl,
+};
+
 int __init iwch_cm_init(void)
 {
         skb_queue_head_init(&rxq);
@@ -2197,46 +2238,6 @@ int __init iwch_cm_init(void)
         if (!workq)
                 return -ENOMEM;
 
-        /*
-         * All upcalls from the T3 Core go to sched() to
-         * schedule the processing on a work queue.
-         */
-        t3c_handlers[CPL_ACT_ESTABLISH] = sched;
-        t3c_handlers[CPL_ACT_OPEN_RPL] = sched;
-        t3c_handlers[CPL_RX_DATA] = sched;
-        t3c_handlers[CPL_TX_DMA_ACK] = sched;
-        t3c_handlers[CPL_ABORT_RPL_RSS] = sched;
-        t3c_handlers[CPL_ABORT_RPL] = sched;
-        t3c_handlers[CPL_PASS_OPEN_RPL] = sched;
-        t3c_handlers[CPL_CLOSE_LISTSRV_RPL] = sched;
-        t3c_handlers[CPL_PASS_ACCEPT_REQ] = sched;
-        t3c_handlers[CPL_PASS_ESTABLISH] = sched;
-        t3c_handlers[CPL_PEER_CLOSE] = sched;
-        t3c_handlers[CPL_CLOSE_CON_RPL] = sched;
-        t3c_handlers[CPL_ABORT_REQ_RSS] = sched;
-        t3c_handlers[CPL_RDMA_TERMINATE] = sched;
-        t3c_handlers[CPL_RDMA_EC_STATUS] = sched;
-        t3c_handlers[CPL_SET_TCB_RPL] = set_tcb_rpl;
-
-        /*
-         * These are the real handlers that are called from a
-         * work queue.
-         */
-        work_handlers[CPL_ACT_ESTABLISH] = act_establish;
-        work_handlers[CPL_ACT_OPEN_RPL] = act_open_rpl;
-        work_handlers[CPL_RX_DATA] = rx_data;
-        work_handlers[CPL_TX_DMA_ACK] = tx_ack;
-        work_handlers[CPL_ABORT_RPL_RSS] = abort_rpl;
-        work_handlers[CPL_ABORT_RPL] = abort_rpl;
-        work_handlers[CPL_PASS_OPEN_RPL] = pass_open_rpl;
-        work_handlers[CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl;
-        work_handlers[CPL_PASS_ACCEPT_REQ] = pass_accept_req;
-        work_handlers[CPL_PASS_ESTABLISH] = pass_establish;
-        work_handlers[CPL_PEER_CLOSE] = peer_close;
-        work_handlers[CPL_ABORT_REQ_RSS] = peer_abort;
-        work_handlers[CPL_CLOSE_CON_RPL] = close_con_rpl;
-        work_handlers[CPL_RDMA_TERMINATE] = terminate;
-        work_handlers[CPL_RDMA_EC_STATUS] = ec_status;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/cxgb4/Kconfig b/drivers/infiniband/hw/cxgb4/Kconfig
new file mode 100644
index 000000000000..ccb85eaaad75
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/Kconfig
@@ -0,0 +1,18 @@
+config INFINIBAND_CXGB4
+        tristate "Chelsio T4 RDMA Driver"
+        depends on CHELSIO_T4 && INET
+        select GENERIC_ALLOCATOR
+        ---help---
+          This is an iWARP/RDMA driver for the Chelsio T4 1GbE and
+          10GbE adapters.
+
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
+
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.htm>.
+
+          Please send feedback to <linux-bugs@chelsio.com>.
+
+          To compile this driver as a module, choose M here: the module
+          will be called iw_cxgb4.
diff --git a/drivers/infiniband/hw/cxgb4/Makefile b/drivers/infiniband/hw/cxgb4/Makefile
new file mode 100644
index 000000000000..e31a499f0172
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/Makefile
@@ -0,0 +1,5 @@
+EXTRA_CFLAGS += -Idrivers/net/cxgb4
+
+obj-$(CONFIG_INFINIBAND_CXGB4) += iw_cxgb4.o
+
+iw_cxgb4-y :=  device.o cm.o provider.o mem.o cq.o qp.o resource.o ev.o
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
new file mode 100644
index 000000000000..30ce0a8eca09
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -0,0 +1,2374 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/workqueue.h>
+#include <linux/skbuff.h>
+#include <linux/timer.h>
+#include <linux/notifier.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <net/neighbour.h>
+#include <net/netevent.h>
+#include <net/route.h>
+
+#include "iw_cxgb4.h"
+
+static char *states[] = {
+        "idle",
+        "listen",
+        "connecting",
+        "mpa_wait_req",
+        "mpa_req_sent",
+        "mpa_req_rcvd",
+        "mpa_rep_sent",
+        "fpdu_mode",
+        "aborting",
+        "closing",
+        "moribund",
+        "dead",
+        NULL,
+};
+
+int c4iw_max_read_depth = 8;
+module_param(c4iw_max_read_depth, int, 0644);
+MODULE_PARM_DESC(c4iw_max_read_depth, "Per-connection max ORD/IRD (default=8)");
+
+static int enable_tcp_timestamps;
+module_param(enable_tcp_timestamps, int, 0644);
+MODULE_PARM_DESC(enable_tcp_timestamps, "Enable tcp timestamps (default=0)");
+
+static int enable_tcp_sack;
+module_param(enable_tcp_sack, int, 0644);
+MODULE_PARM_DESC(enable_tcp_sack, "Enable tcp SACK (default=0)");
+
+static int enable_tcp_window_scaling = 1;
+module_param(enable_tcp_window_scaling, int, 0644);
+MODULE_PARM_DESC(enable_tcp_window_scaling,
+                 "Enable tcp window scaling (default=1)");
+
+int c4iw_debug;
+module_param(c4iw_debug, int, 0644);
+MODULE_PARM_DESC(c4iw_debug, "Enable debug logging (default=0)");
+
+static int peer2peer;
+module_param(peer2peer, int, 0644);
+MODULE_PARM_DESC(peer2peer, "Support peer2peer ULPs (default=0)");
+
+static int p2p_type = FW_RI_INIT_P2PTYPE_READ_REQ;
+module_param(p2p_type, int, 0644);
+MODULE_PARM_DESC(p2p_type, "RDMAP opcode to use for the RTR message: "
+                           "1=RDMA_READ 0=RDMA_WRITE (default 1)");
+
+static int ep_timeout_secs = 60;
+module_param(ep_timeout_secs, int, 0644);
+MODULE_PARM_DESC(ep_timeout_secs, "CM Endpoint operation timeout "
+                                   "in seconds (default=60)");
+
+static int mpa_rev = 1;
+module_param(mpa_rev, int, 0644);
+MODULE_PARM_DESC(mpa_rev, "MPA Revision, 0 supports amso1100, "
+                 "1 is spec compliant. (default=1)");
+
+static int markers_enabled;
+module_param(markers_enabled, int, 0644);
+MODULE_PARM_DESC(markers_enabled, "Enable MPA MARKERS (default(0)=disabled)");
+
+static int crc_enabled = 1;
+module_param(crc_enabled, int, 0644);
+MODULE_PARM_DESC(crc_enabled, "Enable MPA CRC (default(1)=enabled)");
+
+static int rcv_win = 256 * 1024;
+module_param(rcv_win, int, 0644);
+MODULE_PARM_DESC(rcv_win, "TCP receive window in bytes (default=256KB)");
+
+static int snd_win = 32 * 1024;
+module_param(snd_win, int, 0644);
+MODULE_PARM_DESC(snd_win, "TCP send window in bytes (default=32KB)");
+
+static struct workqueue_struct *workq;
+
+static struct sk_buff_head rxq;
+
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp);
+static void ep_timeout(unsigned long arg);
+static void connect_reply_upcall(struct c4iw_ep *ep, int status);
+
+static LIST_HEAD(timeout_list);
+static spinlock_t timeout_lock;
+
+static void start_ep_timer(struct c4iw_ep *ep)
+{
+        PDBG("%s ep %p\n", __func__, ep);
+        if (timer_pending(&ep->timer)) {
+                PDBG("%s stopped / restarted timer ep %p\n", __func__, ep);
+                del_timer_sync(&ep->timer);
+        } else
+                c4iw_get_ep(&ep->com);
+        ep->timer.expires = jiffies + ep_timeout_secs * HZ;
+        ep->timer.data = (unsigned long)ep;
+        ep->timer.function = ep_timeout;
+        add_timer(&ep->timer);
+}
+
+static void stop_ep_timer(struct c4iw_ep *ep)
+{
+        PDBG("%s ep %p\n", __func__, ep);
+        if (!timer_pending(&ep->timer)) {
+                printk(KERN_ERR "%s timer stopped when its not running! "
+                       "ep %p state %u\n", __func__, ep, ep->com.state);
+                WARN_ON(1);
+                return;
+        }
+        del_timer_sync(&ep->timer);
+        c4iw_put_ep(&ep->com);
+}
+
+static int c4iw_l2t_send(struct c4iw_rdev *rdev, struct sk_buff *skb,
+                  struct l2t_entry *l2e)
+{
+        int     error = 0;
+
+        if (c4iw_fatal_error(rdev)) {
+                kfree_skb(skb);
+                PDBG("%s - device in error state - dropping\n", __func__);
+                return -EIO;
+        }
+        error = cxgb4_l2t_send(rdev->lldi.ports[0], skb, l2e);
+        if (error < 0)
+                kfree_skb(skb);
+        return error;
+}
+
+int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb)
+{
+        int     error = 0;
+
+        if (c4iw_fatal_error(rdev)) {
+                kfree_skb(skb);
+                PDBG("%s - device in error state - dropping\n", __func__);
+                return -EIO;
+        }
+        error = cxgb4_ofld_send(rdev->lldi.ports[0], skb);
+        if (error < 0)
+                kfree_skb(skb);
+        return error;
+}
+
+static void release_tid(struct c4iw_rdev *rdev, u32 hwtid, struct sk_buff *skb)
+{
+        struct cpl_tid_release *req;
+
+        skb = get_skb(skb, sizeof *req, GFP_KERNEL);
+        if (!skb)
+                return;
+        req = (struct cpl_tid_release *) skb_put(skb, sizeof(*req));
+        INIT_TP_WR(req, hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_TID_RELEASE, hwtid));
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, 0);
+        c4iw_ofld_send(rdev, skb);
+        return;
+}
+
+static void set_emss(struct c4iw_ep *ep, u16 opt)
+{
+        ep->emss = ep->com.dev->rdev.lldi.mtus[GET_TCPOPT_MSS(opt)] - 40;
+        ep->mss = ep->emss;
+        if (GET_TCPOPT_TSTAMP(opt))
+                ep->emss -= 12;
+        if (ep->emss < 128)
+                ep->emss = 128;
+        PDBG("%s mss_idx %u mss %u emss=%u\n", __func__, GET_TCPOPT_MSS(opt),
+             ep->mss, ep->emss);
+}
+
+static enum c4iw_ep_state state_read(struct c4iw_ep_common *epc)
+{
+        unsigned long flags;
+        enum c4iw_ep_state state;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        state = epc->state;
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return state;
+}
+
+static void __state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
+{
+        epc->state = new;
+}
+
+static void state_set(struct c4iw_ep_common *epc, enum c4iw_ep_state new)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        PDBG("%s - %s -> %s\n", __func__, states[epc->state], states[new]);
+        __state_set(epc, new);
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return;
+}
+
+static void *alloc_ep(int size, gfp_t gfp)
+{
+        struct c4iw_ep_common *epc;
+
+        epc = kzalloc(size, gfp);
+        if (epc) {
+                kref_init(&epc->kref);
+                spin_lock_init(&epc->lock);
+                init_waitqueue_head(&epc->waitq);
+        }
+        PDBG("%s alloc ep %p\n", __func__, epc);
+        return epc;
+}
+
+void _c4iw_free_ep(struct kref *kref)
+{
+        struct c4iw_ep *ep;
+
+        ep = container_of(kref, struct c4iw_ep, com.kref);
+        PDBG("%s ep %p state %s\n", __func__, ep, states[state_read(&ep->com)]);
+        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
+                cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, ep->hwtid);
+                dst_release(ep->dst);
+                cxgb4_l2t_release(ep->l2t);
+        }
+        kfree(ep);
+}
+
+static void release_ep_resources(struct c4iw_ep *ep)
+{
+        set_bit(RELEASE_RESOURCES, &ep->com.flags);
+        c4iw_put_ep(&ep->com);
+}
+
+static int status2errno(int status)
+{
+        switch (status) {
+        case CPL_ERR_NONE:
+                return 0;
+        case CPL_ERR_CONN_RESET:
+                return -ECONNRESET;
+        case CPL_ERR_ARP_MISS:
+                return -EHOSTUNREACH;
+        case CPL_ERR_CONN_TIMEDOUT:
+                return -ETIMEDOUT;
+        case CPL_ERR_TCAM_FULL:
+                return -ENOMEM;
+        case CPL_ERR_CONN_EXIST:
+                return -EADDRINUSE;
+        default:
+                return -EIO;
+        }
+}
+
+/*
+ * Try and reuse skbs already allocated...
+ */
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
+{
+        if (skb && !skb_is_nonlinear(skb) && !skb_cloned(skb)) {
+                skb_trim(skb, 0);
+                skb_get(skb);
+                skb_reset_transport_header(skb);
+        } else {
+                skb = alloc_skb(len, gfp);
+        }
+        return skb;
+}
+
+static struct rtable *find_route(struct c4iw_dev *dev, __be32 local_ip,
+                                 __be32 peer_ip, __be16 local_port,
+                                 __be16 peer_port, u8 tos)
+{
+        struct rtable *rt;
+        struct flowi fl = {
+                .oif = 0,
+                .nl_u = {
+                         .ip4_u = {
+                                   .daddr = peer_ip,
+                                   .saddr = local_ip,
+                                   .tos = tos}
+                         },
+                .proto = IPPROTO_TCP,
+                .uli_u = {
+                          .ports = {
+                                    .sport = local_port,
+                                    .dport = peer_port}
+                          }
+        };
+
+        if (ip_route_output_flow(&init_net, &rt, &fl, NULL, 0))
+                return NULL;
+        return rt;
+}
+
+static void arp_failure_discard(void *handle, struct sk_buff *skb)
+{
+        PDBG("%s c4iw_dev %p\n", __func__, handle);
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for an active open.
+ */
+static void act_open_req_arp_failure(void *handle, struct sk_buff *skb)
+{
+        printk(KERN_ERR MOD "ARP failure duing connect\n");
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for a CPL_ABORT_REQ.  Change it into a no RST variant
+ * and send it along.
+ */
+static void abort_arp_failure(void *handle, struct sk_buff *skb)
+{
+        struct c4iw_rdev *rdev = handle;
+        struct cpl_abort_req *req = cplhdr(skb);
+
+        PDBG("%s rdev %p\n", __func__, rdev);
+        req->cmd = CPL_ABORT_NO_RST;
+        c4iw_ofld_send(rdev, skb);
+}
+
+static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        unsigned int flowclen = 80;
+        struct fw_flowc_wr *flowc;
+        int i;
+
+        skb = get_skb(skb, flowclen, GFP_KERNEL);
+        flowc = (struct fw_flowc_wr *)__skb_put(skb, flowclen);
+
+        flowc->op_to_nparams = cpu_to_be32(FW_WR_OP(FW_FLOWC_WR) |
+                                           FW_FLOWC_WR_NPARAMS(8));
+        flowc->flowid_len16 = cpu_to_be32(FW_WR_LEN16(DIV_ROUND_UP(flowclen,
+                                          16)) | FW_WR_FLOWID(ep->hwtid));
+
+        flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
+        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
+        flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
+        flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
+        flowc->mnemval[2].val = cpu_to_be32(ep->tx_chan);
+        flowc->mnemval[3].mnemonic = FW_FLOWC_MNEM_IQID;
+        flowc->mnemval[3].val = cpu_to_be32(ep->rss_qid);
+        flowc->mnemval[4].mnemonic = FW_FLOWC_MNEM_SNDNXT;
+        flowc->mnemval[4].val = cpu_to_be32(ep->snd_seq);
+        flowc->mnemval[5].mnemonic = FW_FLOWC_MNEM_RCVNXT;
+        flowc->mnemval[5].val = cpu_to_be32(ep->rcv_seq);
+        flowc->mnemval[6].mnemonic = FW_FLOWC_MNEM_SNDBUF;
+        flowc->mnemval[6].val = cpu_to_be32(snd_win);
+        flowc->mnemval[7].mnemonic = FW_FLOWC_MNEM_MSS;
+        flowc->mnemval[7].val = cpu_to_be32(ep->emss);
+        /* Pad WR to 16 byte boundary */
+        flowc->mnemval[8].mnemonic = 0;
+        flowc->mnemval[8].val = 0;
+        for (i = 0; i < 9; i++) {
+                flowc->mnemval[i].r4[0] = 0;
+                flowc->mnemval[i].r4[1] = 0;
+                flowc->mnemval[i].r4[2] = 0;
+        }
+
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        c4iw_ofld_send(&ep->com.dev->rdev, skb);
+}
+
+static int send_halfclose(struct c4iw_ep *ep, gfp_t gfp)
+{
+        struct cpl_close_con_req *req;
+        struct sk_buff *skb;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb = get_skb(NULL, wrlen, gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        req = (struct cpl_close_con_req *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_CLOSE_CON_REQ,
+                                                    ep->hwtid));
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_abort(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        struct cpl_abort_req *req;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb = get_skb(skb, wrlen, gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, &ep->com.dev->rdev, abort_arp_failure);
+        req = (struct cpl_abort_req *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid));
+        req->cmd = CPL_ABORT_SEND_RST;
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_connect(struct c4iw_ep *ep)
+{
+        struct cpl_act_open_req *req;
+        struct sk_buff *skb;
+        u64 opt0;
+        u32 opt2;
+        unsigned int mtu_idx;
+        int wscale;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p atid %u\n", __func__, ep, ep->atid);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, ep->txq_idx);
+
+        cxgb4_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx);
+        wscale = compute_wscale(rcv_win);
+        opt0 = KEEP_ALIVE(1) |
+               WND_SCALE(wscale) |
+               MSS_IDX(mtu_idx) |
+               L2T_IDX(ep->l2t->idx) |
+               TX_CHAN(ep->tx_chan) |
+               SMAC_SEL(ep->smac_idx) |
+               DSCP(ep->tos) |
+               RCV_BUFSIZ(rcv_win>>10);
+        opt2 = RX_CHANNEL(0) |
+               RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
+        if (enable_tcp_timestamps)
+                opt2 |= TSTAMPS_EN(1);
+        if (enable_tcp_sack)
+                opt2 |= SACK_EN(1);
+        if (wscale && enable_tcp_window_scaling)
+                opt2 |= WND_SCALE_EN(1);
+        t4_set_arp_err_handler(skb, NULL, act_open_req_arp_failure);
+
+        req = (struct cpl_act_open_req *) skb_put(skb, wrlen);
+        INIT_TP_WR(req, 0);
+        OPCODE_TID(req) = cpu_to_be32(
+                MK_OPCODE_TID(CPL_ACT_OPEN_REQ, ((ep->rss_qid<<14)|ep->atid)));
+        req->local_port = ep->com.local_addr.sin_port;
+        req->peer_port = ep->com.remote_addr.sin_port;
+        req->local_ip = ep->com.local_addr.sin_addr.s_addr;
+        req->peer_ip = ep->com.remote_addr.sin_addr.s_addr;
+        req->opt0 = cpu_to_be64(opt0);
+        req->params = 0;
+        req->opt2 = cpu_to_be32(opt2);
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static void send_mpa_req(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        BUG_ON(skb_cloned(skb));
+
+        mpalen = sizeof(*mpa) + ep->plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+        skb = get_skb(skb, wrlen, GFP_KERNEL);
+        if (!skb) {
+                connect_reply_upcall(ep, -ENOMEM);
+                return;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *)skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memcpy(mpa->key, MPA_KEY_REQ, sizeof(mpa->key));
+        mpa->flags = (crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->private_data_size = htons(ep->plen);
+        mpa->revision = mpa_rev;
+
+        if (ep->plen)
+                memcpy(mpa->private_data, ep->mpa_pkt + sizeof(*mpa), ep->plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+        start_ep_timer(ep);
+        state_set(&ep->com, MPA_REQ_SENT);
+        ep->mpa_attr.initiator = 1;
+        return;
+}
+
+static int send_mpa_reject(struct c4iw_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        mpalen = sizeof(*mpa) + plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *)skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = MPA_REJECT;
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb again.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int send_mpa_reply(struct c4iw_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen, wrlen;
+        struct fw_ofld_tx_data_wr *req;
+        struct mpa_message *mpa;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p tid %u pd_len %d\n", __func__, ep, ep->hwtid, ep->plen);
+
+        mpalen = sizeof(*mpa) + plen;
+        wrlen = roundup(mpalen + sizeof *req, 16);
+
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+
+        req = (struct fw_ofld_tx_data_wr *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        req->op_to_immdlen = cpu_to_be32(
+                FW_WR_OP(FW_OFLD_TX_DATA_WR) |
+                FW_WR_COMPL(1) |
+                FW_WR_IMMDLEN(mpalen));
+        req->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(ep->hwtid) |
+                FW_WR_LEN16(wrlen >> 4));
+        req->plen = cpu_to_be32(mpalen);
+        req->tunnel_to_proxy = cpu_to_be32(
+                FW_OFLD_TX_DATA_WR_FLUSH(1) |
+                FW_OFLD_TX_DATA_WR_SHOVE(1));
+
+        mpa = (struct mpa_message *)(req + 1);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = (ep->mpa_attr.crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function fw4_ack() will deref it.
+         */
+        skb_get(skb);
+        t4_set_arp_err_handler(skb, NULL, arp_failure_discard);
+        ep->mpa_skb = skb;
+        state_set(&ep->com, MPA_REP_SENT);
+        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+}
+
+static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_act_establish *req = cplhdr(skb);
+        unsigned int tid = GET_TID(req);
+        unsigned int atid = GET_TID_TID(ntohl(req->tos_atid));
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_atid(t, atid);
+
+        PDBG("%s ep %p tid %u snd_isn %u rcv_isn %u\n", __func__, ep, tid,
+             be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn));
+
+        dst_confirm(ep->dst);
+
+        /* setup the hwtid for this connection */
+        ep->hwtid = tid;
+        cxgb4_insert_tid(t, ep, tid);
+
+        ep->snd_seq = be32_to_cpu(req->snd_isn);
+        ep->rcv_seq = be32_to_cpu(req->rcv_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        /* dealloc the atid */
+        cxgb4_free_atid(t, atid);
+
+        /* start MPA negotiation */
+        send_flowc(ep, NULL);
+        send_mpa_req(ep, skb);
+
+        return 0;
+}
+
+static void close_complete_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        if (ep->com.cm_id) {
+                PDBG("close complete delivered ep %p cm_id %p tid %u\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static int abort_connection(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        close_complete_upcall(ep);
+        state_set(&ep->com, ABORTING);
+        return send_abort(ep, skb, gfp);
+}
+
+static void peer_close_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_DISCONNECT;
+        if (ep->com.cm_id) {
+                PDBG("peer close delivered ep %p cm_id %p tid %u\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static void peer_abort_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        event.status = -ECONNRESET;
+        if (ep->com.cm_id) {
+                PDBG("abort delivered ep %p cm_id %p tid %u\n", ep,
+                     ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_reply_upcall(struct c4iw_ep *ep, int status)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u status %d\n", __func__, ep, ep->hwtid, status);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REPLY;
+        event.status = status;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+
+        if ((status == 0) || (status == -ECONNREFUSED)) {
+                event.private_data_len = ep->plen;
+                event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        }
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %u status %d\n", __func__, ep,
+                     ep->hwtid, status);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+        if (status < 0) {
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_request_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REQUEST;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+        event.private_data_len = ep->plen;
+        event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        event.provider_data = ep;
+        if (state_read(&ep->parent_ep->com) != DEAD) {
+                c4iw_get_ep(&ep->com);
+                ep->parent_ep->com.cm_id->event_handler(
+                                                ep->parent_ep->com.cm_id,
+                                                &event);
+        }
+        c4iw_put_ep(&ep->parent_ep->com);
+        ep->parent_ep = NULL;
+}
+
+static void established_upcall(struct c4iw_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_ESTABLISHED;
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static int update_rx_credits(struct c4iw_ep *ep, u32 credits)
+{
+        struct cpl_rx_data_ack *req;
+        struct sk_buff *skb;
+        int wrlen = roundup(sizeof *req, 16);
+
+        PDBG("%s ep %p tid %u credits %u\n", __func__, ep, ep->hwtid, credits);
+        skb = get_skb(NULL, wrlen, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "update_rx_credits - cannot alloc skb!\n");
+                return 0;
+        }
+
+        req = (struct cpl_rx_data_ack *) skb_put(skb, wrlen);
+        memset(req, 0, wrlen);
+        INIT_TP_WR(req, ep->hwtid);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_RX_DATA_ACK,
+                                                    ep->hwtid));
+        req->credit_dack = cpu_to_be32(credits);
+        set_wr_txq(skb, CPL_PRIORITY_ACK, ep->txq_idx);
+        c4iw_ofld_send(&ep->com.dev->rdev, skb);
+        return credits;
+}
+
+static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+        struct c4iw_qp_attributes attrs;
+        enum c4iw_qp_attr_mask mask;
+        int err;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        /*
+         * Stop mpa timer.  If it expired, then the state has
+         * changed and we bail since ep_timeout already aborted
+         * the connection.
+         */
+        stop_ep_timer(ep);
+        if (state_read(&ep->com) != MPA_REQ_SENT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                err = -EINVAL;
+                goto err;
+        }
+
+        /*
+         * copy the new data into our accumulation buffer.
+         */
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * if we don't even have the mpa message, then bail.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /* Validate MPA header. */
+        if (mpa->revision != mpa_rev) {
+                err = -EPROTO;
+                goto err;
+        }
+        if (memcmp(mpa->key, MPA_KEY_REP, sizeof(mpa->key))) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        if (mpa->flags & MPA_REJECT) {
+                err = -ECONNREFUSED;
+                goto err;
+        }
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data. And
+         * the MPA header is valid.
+         */
+        state_set(&ep->com, FPDU_MODE);
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        ep->mpa_attr.p2p_type = peer2peer ? p2p_type :
+                                            FW_RI_INIT_P2PTYPE_DISABLED;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d\n", __func__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version);
+
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ird;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = C4IW_QP_STATE_RTS;
+
+        mask = C4IW_QP_ATTR_NEXT_STATE |
+            C4IW_QP_ATTR_LLP_STREAM_HANDLE | C4IW_QP_ATTR_MPA_ATTR |
+            C4IW_QP_ATTR_MAX_IRD | C4IW_QP_ATTR_MAX_ORD;
+
+        /* bind QP and TID with INIT_WR */
+        err = c4iw_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+        if (err)
+                goto err;
+        goto out;
+err:
+        abort_connection(ep, skb, GFP_KERNEL);
+out:
+        connect_reply_upcall(ep, err);
+        return;
+}
+
+static void process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        if (state_read(&ep->com) != MPA_REQ_WAIT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                stop_ep_timer(ep);
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        PDBG("%s enter (%s line %u)\n", __func__, __FILE__, __LINE__);
+
+        /*
+         * Copy the new data into our accumulation buffer.
+         */
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * If we don't even have the mpa message, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+
+        PDBG("%s enter (%s line %u)\n", __func__, __FILE__, __LINE__);
+        stop_ep_timer(ep);
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /*
+         * Validate MPA Header.
+         */
+        if (mpa->revision != mpa_rev) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data.
+         */
+        ep->mpa_attr.initiator = 0;
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        ep->mpa_attr.p2p_type = peer2peer ? p2p_type :
+                                            FW_RI_INIT_P2PTYPE_DISABLED;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d p2p_type=%d\n", __func__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version,
+             ep->mpa_attr.p2p_type);
+
+        state_set(&ep->com, MPA_REQ_RCVD);
+
+        /* drive upcall */
+        connect_request_upcall(ep);
+        return;
+}
+
+static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_rx_data *hdr = cplhdr(skb);
+        unsigned int dlen = ntohs(hdr->len);
+        unsigned int tid = GET_TID(hdr);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u dlen %u\n", __func__, ep, ep->hwtid, dlen);
+        skb_pull(skb, sizeof(*hdr));
+        skb_trim(skb, dlen);
+
+        ep->rcv_seq += dlen;
+        BUG_ON(ep->rcv_seq != (ntohl(hdr->seq) + dlen));
+
+        /* update RX credits */
+        update_rx_credits(ep, dlen);
+
+        switch (state_read(&ep->com)) {
+        case MPA_REQ_SENT:
+                process_mpa_reply(ep, skb);
+                break;
+        case MPA_REQ_WAIT:
+                process_mpa_request(ep, skb);
+                break;
+        case MPA_REP_SENT:
+                break;
+        default:
+                printk(KERN_ERR MOD "%s Unexpected streaming data."
+                       " ep %p state %d tid %u\n",
+                       __func__, ep, state_read(&ep->com), ep->hwtid);
+
+                /*
+                 * The ep will timeout and inform the ULP of the failure.
+                 * See ep_timeout().
+                 */
+                break;
+        }
+        return 0;
+}
+
+static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_abort_rpl_rss *rpl = cplhdr(skb);
+        unsigned long flags;
+        int release = 0;
+        unsigned int tid = GET_TID(rpl);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(!ep);
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case ABORTING:
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                break;
+        default:
+                printk(KERN_ERR "%s ep %p state %d\n",
+                     __func__, ep, ep->com.state);
+                break;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+/*
+ * Return whether a failed active open has allocated a TID
+ */
+static inline int act_open_has_tid(int status)
+{
+        return status != CPL_ERR_TCAM_FULL && status != CPL_ERR_CONN_EXIST &&
+               status != CPL_ERR_ARP_MISS;
+}
+
+static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_act_open_rpl *rpl = cplhdr(skb);
+        unsigned int atid = GET_TID_TID(GET_AOPEN_ATID(
+                                        ntohl(rpl->atid_status)));
+        struct tid_info *t = dev->rdev.lldi.tids;
+        int status = GET_AOPEN_STATUS(ntohl(rpl->atid_status));
+
+        ep = lookup_atid(t, atid);
+
+        PDBG("%s ep %p atid %u status %u errno %d\n", __func__, ep, atid,
+             status, status2errno(status));
+
+        if (status == CPL_ERR_RTX_NEG_ADVICE) {
+                printk(KERN_WARNING MOD "Connection problems for atid %u\n",
+                        atid);
+                return 0;
+        }
+
+        connect_reply_upcall(ep, status2errno(status));
+        state_set(&ep->com, DEAD);
+
+        if (status && act_open_has_tid(status))
+                cxgb4_remove_tid(ep->com.dev->rdev.lldi.tids, 0, GET_TID(rpl));
+
+        cxgb4_free_atid(t, atid);
+        dst_release(ep->dst);
+        cxgb4_l2t_release(ep->l2t);
+        c4iw_put_ep(&ep->com);
+
+        return 0;
+}
+
+static int pass_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_pass_open_rpl *rpl = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int stid = GET_TID(rpl);
+        struct c4iw_listen_ep *ep = lookup_stid(t, stid);
+
+        if (!ep) {
+                printk(KERN_ERR MOD "stid %d lookup failure!\n", stid);
+                return 0;
+        }
+        PDBG("%s ep %p status %d error %d\n", __func__, ep,
+             rpl->status, status2errno(rpl->status));
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+
+        return 0;
+}
+
+static int listen_stop(struct c4iw_listen_ep *ep)
+{
+        struct sk_buff *skb;
+        struct cpl_close_listsvr_req *req;
+
+        PDBG("%s ep %p\n", __func__, ep);
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __func__);
+                return -ENOMEM;
+        }
+        req = (struct cpl_close_listsvr_req *) skb_put(skb, sizeof(*req));
+        INIT_TP_WR(req, 0);
+        OPCODE_TID(req) = cpu_to_be32(MK_OPCODE_TID(CPL_CLOSE_LISTSRV_REQ,
+                                                    ep->stid));
+        req->reply_ctrl = cpu_to_be16(
+                          QUEUENO(ep->com.dev->rdev.lldi.rxq_ids[0]));
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, 0);
+        return c4iw_ofld_send(&ep->com.dev->rdev, skb);
+}
+
+static int close_listsrv_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_close_listsvr_rpl *rpl = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int stid = GET_TID(rpl);
+        struct c4iw_listen_ep *ep = lookup_stid(t, stid);
+
+        PDBG("%s ep %p\n", __func__, ep);
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+        return 0;
+}
+
+static void accept_cr(struct c4iw_ep *ep, __be32 peer_ip, struct sk_buff *skb,
+                      struct cpl_pass_accept_req *req)
+{
+        struct cpl_pass_accept_rpl *rpl;
+        unsigned int mtu_idx;
+        u64 opt0;
+        u32 opt2;
+        int wscale;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(*rpl));
+        skb_get(skb);
+        cxgb4_best_mtu(ep->com.dev->rdev.lldi.mtus, ep->mtu, &mtu_idx);
+        wscale = compute_wscale(rcv_win);
+        opt0 = KEEP_ALIVE(1) |
+               WND_SCALE(wscale) |
+               MSS_IDX(mtu_idx) |
+               L2T_IDX(ep->l2t->idx) |
+               TX_CHAN(ep->tx_chan) |
+               SMAC_SEL(ep->smac_idx) |
+               DSCP(ep->tos) |
+               RCV_BUFSIZ(rcv_win>>10);
+        opt2 = RX_CHANNEL(0) |
+               RSS_QUEUE_VALID | RSS_QUEUE(ep->rss_qid);
+
+        if (enable_tcp_timestamps && req->tcpopt.tstamp)
+                opt2 |= TSTAMPS_EN(1);
+        if (enable_tcp_sack && req->tcpopt.sack)
+                opt2 |= SACK_EN(1);
+        if (wscale && enable_tcp_window_scaling)
+                opt2 |= WND_SCALE_EN(1);
+
+        rpl = cplhdr(skb);
+        INIT_TP_WR(rpl, ep->hwtid);
+        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
+                                      ep->hwtid));
+        rpl->opt0 = cpu_to_be64(opt0);
+        rpl->opt2 = cpu_to_be32(opt2);
+        set_wr_txq(skb, CPL_PRIORITY_SETUP, ep->txq_idx);
+        c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
+
+        return;
+}
+
+static void reject_cr(struct c4iw_dev *dev, u32 hwtid, __be32 peer_ip,
+                      struct sk_buff *skb)
+{
+        PDBG("%s c4iw_dev %p tid %u peer_ip %x\n", __func__, dev, hwtid,
+             peer_ip);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(struct cpl_tid_release));
+        skb_get(skb);
+        release_tid(&dev->rdev, hwtid, skb);
+        return;
+}
+
+static void get_4tuple(struct cpl_pass_accept_req *req,
+                       __be32 *local_ip, __be32 *peer_ip,
+                       __be16 *local_port, __be16 *peer_port)
+{
+        int eth_len = G_ETH_HDR_LEN(be32_to_cpu(req->hdr_len));
+        int ip_len = G_IP_HDR_LEN(be32_to_cpu(req->hdr_len));
+        struct iphdr *ip = (struct iphdr *)((u8 *)(req + 1) + eth_len);
+        struct tcphdr *tcp = (struct tcphdr *)
+                             ((u8 *)(req + 1) + eth_len + ip_len);
+
+        PDBG("%s saddr 0x%x daddr 0x%x sport %u dport %u\n", __func__,
+             ntohl(ip->saddr), ntohl(ip->daddr), ntohs(tcp->source),
+             ntohs(tcp->dest));
+
+        *peer_ip = ip->saddr;
+        *local_ip = ip->daddr;
+        *peer_port = tcp->source;
+        *local_port = tcp->dest;
+
+        return;
+}
+
+static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *child_ep, *parent_ep;
+        struct cpl_pass_accept_req *req = cplhdr(skb);
+        unsigned int stid = GET_POPEN_TID(ntohl(req->tos_stid));
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int hwtid = GET_TID(req);
+        struct dst_entry *dst;
+        struct l2t_entry *l2t;
+        struct rtable *rt;
+        __be32 local_ip, peer_ip;
+        __be16 local_port, peer_port;
+        struct net_device *pdev;
+        u32 tx_chan, smac_idx;
+        u16 rss_qid;
+        u32 mtu;
+        int step;
+        int txq_idx;
+
+        parent_ep = lookup_stid(t, stid);
+        PDBG("%s parent ep %p tid %u\n", __func__, parent_ep, hwtid);
+
+        get_4tuple(req, &local_ip, &peer_ip, &local_port, &peer_port);
+
+        if (state_read(&parent_ep->com) != LISTEN) {
+                printk(KERN_ERR "%s - listening ep not in LISTEN\n",
+                       __func__);
+                goto reject;
+        }
+
+        /* Find output route */
+        rt = find_route(dev, local_ip, peer_ip, local_port, peer_port,
+                        GET_POPEN_TOS(ntohl(req->tos_stid)));
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - failed to find dst entry!\n",
+                       __func__);
+                goto reject;
+        }
+        dst = &rt->u.dst;
+        if (dst->neighbour->dev->flags & IFF_LOOPBACK) {
+                pdev = ip_dev_find(&init_net, peer_ip);
+                BUG_ON(!pdev);
+                l2t = cxgb4_l2t_get(dev->rdev.lldi.l2t, dst->neighbour,
+                                    pdev, 0);
+                mtu = pdev->mtu;
+                tx_chan = cxgb4_port_chan(pdev);
+                smac_idx = tx_chan << 1;
+                step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
+                txq_idx = cxgb4_port_idx(pdev) * step;
+                step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
+                rss_qid = dev->rdev.lldi.rxq_ids[cxgb4_port_idx(pdev) * step];
+                dev_put(pdev);
+        } else {
+                l2t = cxgb4_l2t_get(dev->rdev.lldi.l2t, dst->neighbour,
+                                        dst->neighbour->dev, 0);
+                mtu = dst_mtu(dst);
+                tx_chan = cxgb4_port_chan(dst->neighbour->dev);
+                smac_idx = tx_chan << 1;
+                step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
+                txq_idx = cxgb4_port_idx(dst->neighbour->dev) * step;
+                step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
+                rss_qid = dev->rdev.lldi.rxq_ids[
+                          cxgb4_port_idx(dst->neighbour->dev) * step];
+        }
+        if (!l2t) {
+                printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n",
+                       __func__);
+                dst_release(dst);
+                goto reject;
+        }
+
+        child_ep = alloc_ep(sizeof(*child_ep), GFP_KERNEL);
+        if (!child_ep) {
+                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
+                       __func__);
+                cxgb4_l2t_release(l2t);
+                dst_release(dst);
+                goto reject;
+        }
+        state_set(&child_ep->com, CONNECTING);
+        child_ep->com.dev = dev;
+        child_ep->com.cm_id = NULL;
+        child_ep->com.local_addr.sin_family = PF_INET;
+        child_ep->com.local_addr.sin_port = local_port;
+        child_ep->com.local_addr.sin_addr.s_addr = local_ip;
+        child_ep->com.remote_addr.sin_family = PF_INET;
+        child_ep->com.remote_addr.sin_port = peer_port;
+        child_ep->com.remote_addr.sin_addr.s_addr = peer_ip;
+        c4iw_get_ep(&parent_ep->com);
+        child_ep->parent_ep = parent_ep;
+        child_ep->tos = GET_POPEN_TOS(ntohl(req->tos_stid));
+        child_ep->l2t = l2t;
+        child_ep->dst = dst;
+        child_ep->hwtid = hwtid;
+        child_ep->tx_chan = tx_chan;
+        child_ep->smac_idx = smac_idx;
+        child_ep->rss_qid = rss_qid;
+        child_ep->mtu = mtu;
+        child_ep->txq_idx = txq_idx;
+
+        PDBG("%s tx_chan %u smac_idx %u rss_qid %u\n", __func__,
+             tx_chan, smac_idx, rss_qid);
+
+        init_timer(&child_ep->timer);
+        cxgb4_insert_tid(t, child_ep, hwtid);
+        accept_cr(child_ep, peer_ip, skb, req);
+        goto out;
+reject:
+        reject_cr(dev, hwtid, peer_ip, skb);
+out:
+        return 0;
+}
+
+static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_pass_establish *req = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        ep->snd_seq = be32_to_cpu(req->snd_isn);
+        ep->rcv_seq = be32_to_cpu(req->rcv_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        dst_confirm(ep->dst);
+        state_set(&ep->com, MPA_REQ_WAIT);
+        start_ep_timer(ep);
+        send_flowc(ep, skb);
+
+        return 0;
+}
+
+static int peer_close(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_peer_close *hdr = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attrs;
+        unsigned long flags;
+        int disconnect = 1;
+        int release = 0;
+        int closing = 0;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(hdr);
+        int start_timer = 0;
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        dst_confirm(ep->dst);
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+                __state_set(&ep->com, CLOSING);
+                break;
+        case MPA_REQ_SENT:
+                __state_set(&ep->com, CLOSING);
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see c4iw_accept_cr()).
+                 */
+                __state_set(&ep->com, CLOSING);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case MPA_REP_SENT:
+                __state_set(&ep->com, CLOSING);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case FPDU_MODE:
+                start_timer = 1;
+                __state_set(&ep->com, CLOSING);
+                closing = 1;
+                peer_close_upcall(ep);
+                break;
+        case ABORTING:
+                disconnect = 0;
+                break;
+        case CLOSING:
+                __state_set(&ep->com, MORIBUND);
+                disconnect = 0;
+                break;
+        case MORIBUND:
+                stop_timer = 1;
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_IDLE;
+                        c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                                       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                disconnect = 0;
+                break;
+        case DEAD:
+                disconnect = 0;
+                break;
+        default:
+                BUG_ON(1);
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (closing) {
+                attrs.next_state = C4IW_QP_STATE_CLOSING;
+                c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                               C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
+        }
+        if (start_timer)
+                start_ep_timer(ep);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (disconnect)
+                c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+/*
+ * Returns whether an ABORT_REQ_RSS message is a negative advice.
+ */
+static int is_neg_adv_abort(unsigned int status)
+{
+        return status == CPL_ERR_RTX_NEG_ADVICE ||
+               status == CPL_ERR_PERSIST_NEG_ADVICE;
+}
+
+static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_abort_req_rss *req = cplhdr(skb);
+        struct c4iw_ep *ep;
+        struct cpl_abort_rpl *rpl;
+        struct sk_buff *rpl_skb;
+        struct c4iw_qp_attributes attrs;
+        int ret;
+        int release = 0;
+        unsigned long flags;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(req);
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+        if (is_neg_adv_abort(req->status)) {
+                PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+                     ep->hwtid);
+                return 0;
+        }
+        spin_lock_irqsave(&ep->com.lock, flags);
+        PDBG("%s ep %p tid %u state %u\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+        switch (ep->com.state) {
+        case CONNECTING:
+                break;
+        case MPA_REQ_WAIT:
+                stop_timer = 1;
+                break;
+        case MPA_REQ_SENT:
+                stop_timer = 1;
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REP_SENT:
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR. Also wake up anyone waiting
+                 * in rdma connection migration (see c4iw_accept_cr()).
+                 */
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p tid %u\n", ep, ep->hwtid);
+                wake_up(&ep->com.waitq);
+                break;
+        case MORIBUND:
+        case CLOSING:
+                stop_timer = 1;
+                /*FALLTHROUGH*/
+        case FPDU_MODE:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_ERROR;
+                        ret = c4iw_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, C4IW_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                        if (ret)
+                                printk(KERN_ERR MOD
+                                       "%s - qp <- error failed!\n",
+                                       __func__);
+                }
+                peer_abort_upcall(ep);
+                break;
+        case ABORTING:
+                break;
+        case DEAD:
+                PDBG("%s PEER_ABORT IN DEAD STATE!!!!\n", __func__);
+                spin_unlock_irqrestore(&ep->com.lock, flags);
+                return 0;
+        default:
+                BUG_ON(1);
+                break;
+        }
+        dst_confirm(ep->dst);
+        if (ep->com.state != ABORTING) {
+                __state_set(&ep->com, DEAD);
+                release = 1;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+
+        rpl_skb = get_skb(skb, sizeof(*rpl), GFP_KERNEL);
+        if (!rpl_skb) {
+                printk(KERN_ERR MOD "%s - cannot allocate skb!\n",
+                       __func__);
+                release = 1;
+                goto out;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, ep->txq_idx);
+        rpl = (struct cpl_abort_rpl *) skb_put(rpl_skb, sizeof(*rpl));
+        INIT_TP_WR(rpl, ep->hwtid);
+        OPCODE_TID(rpl) = cpu_to_be32(MK_OPCODE_TID(CPL_ABORT_RPL, ep->hwtid));
+        rpl->cmd = CPL_ABORT_NO_RST;
+        c4iw_ofld_send(&ep->com.dev->rdev, rpl_skb);
+out:
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+static int close_con_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attrs;
+        struct cpl_close_con_rpl *rpl = cplhdr(skb);
+        unsigned long flags;
+        int release = 0;
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(rpl);
+        int stop_timer = 0;
+
+        ep = lookup_tid(t, tid);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        BUG_ON(!ep);
+
+        /* The cm_id may be null if we failed to connect */
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case CLOSING:
+                __state_set(&ep->com, MORIBUND);
+                break;
+        case MORIBUND:
+                stop_timer = 1;
+                if ((ep->com.cm_id) && (ep->com.qp)) {
+                        attrs.next_state = C4IW_QP_STATE_IDLE;
+                        c4iw_modify_qp(ep->com.qp->rhp,
+                                             ep->com.qp,
+                                             C4IW_QP_ATTR_NEXT_STATE,
+                                             &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                break;
+        case ABORTING:
+        case DEAD:
+                break;
+        default:
+                BUG_ON(1);
+                break;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (release)
+                release_ep_resources(ep);
+        return 0;
+}
+
+static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_rdma_terminate *term = cplhdr(skb);
+        struct tid_info *t = dev->rdev.lldi.tids;
+        unsigned int tid = GET_TID(term);
+
+        ep = lookup_tid(t, tid);
+
+        if (state_read(&ep->com) != FPDU_MODE)
+                return 0;
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        skb_pull(skb, sizeof *term);
+        PDBG("%s saving %d bytes of term msg\n", __func__, skb->len);
+        skb_copy_from_linear_data(skb, ep->com.qp->attr.terminate_buffer,
+                                  skb->len);
+        ep->com.qp->attr.terminate_msg_len = skb->len;
+        ep->com.qp->attr.is_terminate_local = 0;
+        return 0;
+}
+
+/*
+ * Upcall from the adapter indicating data has been transmitted.
+ * For us its just the single MPA request or reply.  We can now free
+ * the skb holding the mpa message.
+ */
+static int fw4_ack(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct c4iw_ep *ep;
+        struct cpl_fw4_ack *hdr = cplhdr(skb);
+        u8 credits = hdr->credits;
+        unsigned int tid = GET_TID(hdr);
+        struct tid_info *t = dev->rdev.lldi.tids;
+
+
+        ep = lookup_tid(t, tid);
+        PDBG("%s ep %p tid %u credits %u\n", __func__, ep, ep->hwtid, credits);
+        if (credits == 0) {
+                PDBG(KERN_ERR "%s 0 credit ack ep %p tid %u state %u\n",
+                        __func__, ep, ep->hwtid, state_read(&ep->com));
+                return 0;
+        }
+
+        dst_confirm(ep->dst);
+        if (ep->mpa_skb) {
+                PDBG("%s last streaming msg ack ep %p tid %u state %u "
+                     "initiator %u freeing skb\n", __func__, ep, ep->hwtid,
+                     state_read(&ep->com), ep->mpa_attr.initiator ? 1 : 0);
+                kfree_skb(ep->mpa_skb);
+                ep->mpa_skb = NULL;
+        }
+        return 0;
+}
+
+int c4iw_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
+{
+        int err;
+        struct c4iw_ep *ep = to_ep(cm_id);
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+
+        if (state_read(&ep->com) == DEAD) {
+                c4iw_put_ep(&ep->com);
+                return -ECONNRESET;
+        }
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        if (mpa_rev == 0)
+                abort_connection(ep, NULL, GFP_KERNEL);
+        else {
+                err = send_mpa_reject(ep, pdata, pdata_len);
+                err = c4iw_ep_disconnect(ep, 0, GFP_KERNEL);
+        }
+        c4iw_put_ep(&ep->com);
+        return 0;
+}
+
+int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err;
+        struct c4iw_qp_attributes attrs;
+        enum c4iw_qp_attr_mask mask;
+        struct c4iw_ep *ep = to_ep(cm_id);
+        struct c4iw_dev *h = to_c4iw_dev(cm_id->device);
+        struct c4iw_qp *qp = get_qhp(h, conn_param->qpn);
+
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
+        if (state_read(&ep->com) == DEAD) {
+                err = -ECONNRESET;
+                goto err;
+        }
+
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        BUG_ON(!qp);
+
+        if ((conn_param->ord > c4iw_max_read_depth) ||
+            (conn_param->ird > c4iw_max_read_depth)) {
+                abort_connection(ep, NULL, GFP_KERNEL);
+                err = -EINVAL;
+                goto err;
+        }
+
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.qp = qp;
+
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ird == 0)
+                ep->ird = 1;
+
+        PDBG("%s %d ird %d ord %d\n", __func__, __LINE__, ep->ird, ep->ord);
+
+        /* bind QP to EP and move to RTS */
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ird;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = C4IW_QP_STATE_RTS;
+
+        /* bind QP and TID with INIT_WR */
+        mask = C4IW_QP_ATTR_NEXT_STATE |
+                             C4IW_QP_ATTR_LLP_STREAM_HANDLE |
+                             C4IW_QP_ATTR_MPA_ATTR |
+                             C4IW_QP_ATTR_MAX_IRD |
+                             C4IW_QP_ATTR_MAX_ORD;
+
+        err = c4iw_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+        if (err)
+                goto err1;
+        err = send_mpa_reply(ep, conn_param->private_data,
+                             conn_param->private_data_len);
+        if (err)
+                goto err1;
+
+        state_set(&ep->com, FPDU_MODE);
+        established_upcall(ep);
+        c4iw_put_ep(&ep->com);
+        return 0;
+err1:
+        ep->com.cm_id = NULL;
+        ep->com.qp = NULL;
+        cm_id->rem_ref(cm_id);
+err:
+        c4iw_put_ep(&ep->com);
+        return err;
+}
+
+int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err = 0;
+        struct c4iw_dev *dev = to_c4iw_dev(cm_id->device);
+        struct c4iw_ep *ep;
+        struct rtable *rt;
+        struct net_device *pdev;
+        int step;
+
+        if ((conn_param->ord > c4iw_max_read_depth) ||
+            (conn_param->ird > c4iw_max_read_depth)) {
+                err = -EINVAL;
+                goto out;
+        }
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __func__);
+                err = -ENOMEM;
+                goto out;
+        }
+        init_timer(&ep->timer);
+        ep->plen = conn_param->private_data_len;
+        if (ep->plen)
+                memcpy(ep->mpa_pkt + sizeof(struct mpa_message),
+                       conn_param->private_data, ep->plen);
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+
+        if (peer2peer && ep->ord == 0)
+                ep->ord = 1;
+
+        cm_id->add_ref(cm_id);
+        ep->com.dev = dev;
+        ep->com.cm_id = cm_id;
+        ep->com.qp = get_qhp(dev, conn_param->qpn);
+        BUG_ON(!ep->com.qp);
+        PDBG("%s qpn 0x%x qp %p cm_id %p\n", __func__, conn_param->qpn,
+             ep->com.qp, cm_id);
+
+        /*
+         * Allocate an active TID to initiate a TCP connection.
+         */
+        ep->atid = cxgb4_alloc_atid(dev->rdev.lldi.tids, ep);
+        if (ep->atid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc atid.\n", __func__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        PDBG("%s saddr 0x%x sport 0x%x raddr 0x%x rport 0x%x\n", __func__,
+             ntohl(cm_id->local_addr.sin_addr.s_addr),
+             ntohs(cm_id->local_addr.sin_port),
+             ntohl(cm_id->remote_addr.sin_addr.s_addr),
+             ntohs(cm_id->remote_addr.sin_port));
+
+        /* find a route */
+        rt = find_route(dev,
+                        cm_id->local_addr.sin_addr.s_addr,
+                        cm_id->remote_addr.sin_addr.s_addr,
+                        cm_id->local_addr.sin_port,
+                        cm_id->remote_addr.sin_port, 0);
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - cannot find route.\n", __func__);
+                err = -EHOSTUNREACH;
+                goto fail3;
+        }
+        ep->dst = &rt->u.dst;
+
+        /* get a l2t entry */
+        if (ep->dst->neighbour->dev->flags & IFF_LOOPBACK) {
+                PDBG("%s LOOPBACK\n", __func__);
+                pdev = ip_dev_find(&init_net,
+                                   cm_id->remote_addr.sin_addr.s_addr);
+                ep->l2t = cxgb4_l2t_get(ep->com.dev->rdev.lldi.l2t,
+                                        ep->dst->neighbour,
+                                        pdev, 0);
+                ep->mtu = pdev->mtu;
+                ep->tx_chan = cxgb4_port_chan(pdev);
+                ep->smac_idx = ep->tx_chan << 1;
+                step = ep->com.dev->rdev.lldi.ntxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->txq_idx = cxgb4_port_idx(pdev) * step;
+                step = ep->com.dev->rdev.lldi.nrxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[
+                              cxgb4_port_idx(pdev) * step];
+                dev_put(pdev);
+        } else {
+                ep->l2t = cxgb4_l2t_get(ep->com.dev->rdev.lldi.l2t,
+                                        ep->dst->neighbour,
+                                        ep->dst->neighbour->dev, 0);
+                ep->mtu = dst_mtu(ep->dst);
+                ep->tx_chan = cxgb4_port_chan(ep->dst->neighbour->dev);
+                ep->smac_idx = ep->tx_chan << 1;
+                step = ep->com.dev->rdev.lldi.ntxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->txq_idx = cxgb4_port_idx(ep->dst->neighbour->dev) * step;
+                step = ep->com.dev->rdev.lldi.nrxq /
+                       ep->com.dev->rdev.lldi.nchan;
+                ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[
+                              cxgb4_port_idx(ep->dst->neighbour->dev) * step];
+        }
+        if (!ep->l2t) {
+                printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__);
+                err = -ENOMEM;
+                goto fail4;
+        }
+
+        PDBG("%s txq_idx %u tx_chan %u smac_idx %u rss_qid %u l2t_idx %u\n",
+                __func__, ep->txq_idx, ep->tx_chan, ep->smac_idx, ep->rss_qid,
+                ep->l2t->idx);
+
+        state_set(&ep->com, CONNECTING);
+        ep->tos = 0;
+        ep->com.local_addr = cm_id->local_addr;
+        ep->com.remote_addr = cm_id->remote_addr;
+
+        /* send connect request to rnic */
+        err = send_connect(ep);
+        if (!err)
+                goto out;
+
+        cxgb4_l2t_release(ep->l2t);
+fail4:
+        dst_release(ep->dst);
+fail3:
+        cxgb4_free_atid(ep->com.dev->rdev.lldi.tids, ep->atid);
+fail2:
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+out:
+        return err;
+}
+
+int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
+{
+        int err = 0;
+        struct c4iw_dev *dev = to_c4iw_dev(cm_id->device);
+        struct c4iw_listen_ep *ep;
+
+
+        might_sleep();
+
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __func__);
+                err = -ENOMEM;
+                goto fail1;
+        }
+        PDBG("%s ep %p\n", __func__, ep);
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.dev = dev;
+        ep->backlog = backlog;
+        ep->com.local_addr = cm_id->local_addr;
+
+        /*
+         * Allocate a server TID.
+         */
+        ep->stid = cxgb4_alloc_stid(dev->rdev.lldi.tids, PF_INET, ep);
+        if (ep->stid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc stid.\n", __func__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        state_set(&ep->com, LISTEN);
+        err = cxgb4_create_server(ep->com.dev->rdev.lldi.ports[0], ep->stid,
+                                  ep->com.local_addr.sin_addr.s_addr,
+                                  ep->com.local_addr.sin_port,
+                                  ep->com.dev->rdev.lldi.rxq_ids[0]);
+        if (err)
+                goto fail3;
+
+        /* wait for pass_open_rpl */
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        err = ep->com.rpl_err;
+        if (!err) {
+                cm_id->provider_data = ep;
+                goto out;
+        }
+fail3:
+        cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid, PF_INET);
+fail2:
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+fail1:
+out:
+        return err;
+}
+
+int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+{
+        int err;
+        struct c4iw_listen_ep *ep = to_listen_ep(cm_id);
+
+        PDBG("%s ep %p\n", __func__, ep);
+
+        might_sleep();
+        state_set(&ep->com, DEAD);
+        ep->com.rpl_done = 0;
+        ep->com.rpl_err = 0;
+        err = listen_stop(ep);
+        if (err)
+                goto done;
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        cxgb4_free_stid(ep->com.dev->rdev.lldi.tids, ep->stid, PF_INET);
+done:
+        err = ep->com.rpl_err;
+        cm_id->rem_ref(cm_id);
+        c4iw_put_ep(&ep->com);
+        return err;
+}
+
+int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp)
+{
+        int ret = 0;
+        unsigned long flags;
+        int close = 0;
+        int fatal = 0;
+        struct c4iw_rdev *rdev;
+        int start_timer = 0;
+        int stop_timer = 0;
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+
+        PDBG("%s ep %p state %s, abrupt %d\n", __func__, ep,
+             states[ep->com.state], abrupt);
+
+        rdev = &ep->com.dev->rdev;
+        if (c4iw_fatal_error(rdev)) {
+                fatal = 1;
+                close_complete_upcall(ep);
+                ep->com.state = DEAD;
+        }
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+        case MPA_REQ_SENT:
+        case MPA_REQ_RCVD:
+        case MPA_REP_SENT:
+        case FPDU_MODE:
+                close = 1;
+                if (abrupt)
+                        ep->com.state = ABORTING;
+                else {
+                        ep->com.state = CLOSING;
+                        start_timer = 1;
+                }
+                set_bit(CLOSE_SENT, &ep->com.flags);
+                break;
+        case CLOSING:
+                if (!test_and_set_bit(CLOSE_SENT, &ep->com.flags)) {
+                        close = 1;
+                        if (abrupt) {
+                                stop_timer = 1;
+                                ep->com.state = ABORTING;
+                        } else
+                                ep->com.state = MORIBUND;
+                }
+                break;
+        case MORIBUND:
+        case ABORTING:
+        case DEAD:
+                PDBG("%s ignoring disconnect ep %p state %u\n",
+                     __func__, ep, ep->com.state);
+                break;
+        default:
+                BUG();
+                break;
+        }
+
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (start_timer)
+                start_ep_timer(ep);
+        if (stop_timer)
+                stop_ep_timer(ep);
+        if (close) {
+                if (abrupt)
+                        ret = abort_connection(ep, NULL, gfp);
+                else
+                        ret = send_halfclose(ep, gfp);
+                if (ret)
+                        fatal = 1;
+        }
+        if (fatal)
+                release_ep_resources(ep);
+        return ret;
+}
+
+/*
+ * These are the real handlers that are called from a
+ * work queue.
+ */
+static c4iw_handler_func work_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH] = act_establish,
+        [CPL_ACT_OPEN_RPL] = act_open_rpl,
+        [CPL_RX_DATA] = rx_data,
+        [CPL_ABORT_RPL_RSS] = abort_rpl,
+        [CPL_ABORT_RPL] = abort_rpl,
+        [CPL_PASS_OPEN_RPL] = pass_open_rpl,
+        [CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl,
+        [CPL_PASS_ACCEPT_REQ] = pass_accept_req,
+        [CPL_PASS_ESTABLISH] = pass_establish,
+        [CPL_PEER_CLOSE] = peer_close,
+        [CPL_ABORT_REQ_RSS] = peer_abort,
+        [CPL_CLOSE_CON_RPL] = close_con_rpl,
+        [CPL_RDMA_TERMINATE] = terminate,
+        [CPL_FW4_ACK] = fw4_ack
+};
+
+static void process_timeout(struct c4iw_ep *ep)
+{
+        struct c4iw_qp_attributes attrs;
+        int abort = 1;
+
+        spin_lock_irq(&ep->com.lock);
+        PDBG("%s ep %p tid %u state %d\n", __func__, ep, ep->hwtid,
+             ep->com.state);
+        switch (ep->com.state) {
+        case MPA_REQ_SENT:
+                __state_set(&ep->com, ABORTING);
+                connect_reply_upcall(ep, -ETIMEDOUT);
+                break;
+        case MPA_REQ_WAIT:
+                __state_set(&ep->com, ABORTING);
+                break;
+        case CLOSING:
+        case MORIBUND:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = C4IW_QP_STATE_ERROR;
+                        c4iw_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, C4IW_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                }
+                __state_set(&ep->com, ABORTING);
+                break;
+        default:
+                printk(KERN_ERR "%s unexpected state ep %p tid %u state %u\n",
+                        __func__, ep, ep->hwtid, ep->com.state);
+                WARN_ON(1);
+                abort = 0;
+        }
+        spin_unlock_irq(&ep->com.lock);
+        if (abort)
+                abort_connection(ep, NULL, GFP_KERNEL);
+        c4iw_put_ep(&ep->com);
+}
+
+static void process_timedout_eps(void)
+{
+        struct c4iw_ep *ep;
+
+        spin_lock_irq(&timeout_lock);
+        while (!list_empty(&timeout_list)) {
+                struct list_head *tmp;
+
+                tmp = timeout_list.next;
+                list_del(tmp);
+                spin_unlock_irq(&timeout_lock);
+                ep = list_entry(tmp, struct c4iw_ep, entry);
+                process_timeout(ep);
+                spin_lock_irq(&timeout_lock);
+        }
+        spin_unlock_irq(&timeout_lock);
+}
+
+static void process_work(struct work_struct *work)
+{
+        struct sk_buff *skb = NULL;
+        struct c4iw_dev *dev;
+        struct cpl_act_establish *rpl = cplhdr(skb);
+        unsigned int opcode;
+        int ret;
+
+        while ((skb = skb_dequeue(&rxq))) {
+                rpl = cplhdr(skb);
+                dev = *((struct c4iw_dev **) (skb->cb + sizeof(void *)));
+                opcode = rpl->ot.opcode;
+
+                BUG_ON(!work_handlers[opcode]);
+                ret = work_handlers[opcode](dev, skb);
+                if (!ret)
+                        kfree_skb(skb);
+        }
+        process_timedout_eps();
+}
+
+static DECLARE_WORK(skb_work, process_work);
+
+static void ep_timeout(unsigned long arg)
+{
+        struct c4iw_ep *ep = (struct c4iw_ep *)arg;
+
+        spin_lock(&timeout_lock);
+        list_add_tail(&ep->entry, &timeout_list);
+        spin_unlock(&timeout_lock);
+        queue_work(workq, &skb_work);
+}
+
+/*
+ * All the CM events are handled on a work queue to have a safe context.
+ */
+static int sched(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+
+        /*
+         * Save dev in the skb->cb area.
+         */
+        *((struct c4iw_dev **) (skb->cb + sizeof(void *))) = dev;
+
+        /*
+         * Queue the skb and schedule the worker thread.
+         */
+        skb_queue_tail(&rxq, skb);
+        queue_work(workq, &skb_work);
+        return 0;
+}
+
+static int set_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_set_tcb_rpl *rpl = cplhdr(skb);
+
+        if (rpl->status != CPL_ERR_NONE) {
+                printk(KERN_ERR MOD "Unexpected SET_TCB_RPL status %u "
+                       "for tid %u\n", rpl->status, GET_TID(rpl));
+        }
+        return 0;
+}
+
+static int fw6_msg(struct c4iw_dev *dev, struct sk_buff *skb)
+{
+        struct cpl_fw6_msg *rpl = cplhdr(skb);
+        struct c4iw_wr_wait *wr_waitp;
+        int ret;
+
+        PDBG("%s type %u\n", __func__, rpl->type);
+
+        switch (rpl->type) {
+        case 1:
+                ret = (int)((be64_to_cpu(rpl->data[0]) >> 8) & 0xff);
+                wr_waitp = (__force struct c4iw_wr_wait *)rpl->data[1];
+                PDBG("%s wr_waitp %p ret %u\n", __func__, wr_waitp, ret);
+                if (wr_waitp) {
+                        wr_waitp->ret = ret;
+                        wr_waitp->done = 1;
+                        wake_up(&wr_waitp->wait);
+                }
+                break;
+        case 2:
+                c4iw_ev_dispatch(dev, (struct t4_cqe *)&rpl->data[0]);
+                break;
+        default:
+                printk(KERN_ERR MOD "%s unexpected fw6 msg type %u\n", __func__,
+                       rpl->type);
+                break;
+        }
+        return 0;
+}
+
+/*
+ * Most upcalls from the T4 Core go to sched() to
+ * schedule the processing on a work queue.
+ */
+c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS] = {
+        [CPL_ACT_ESTABLISH] = sched,
+        [CPL_ACT_OPEN_RPL] = sched,
+        [CPL_RX_DATA] = sched,
+        [CPL_ABORT_RPL_RSS] = sched,
+        [CPL_ABORT_RPL] = sched,
+        [CPL_PASS_OPEN_RPL] = sched,
+        [CPL_CLOSE_LISTSRV_RPL] = sched,
+        [CPL_PASS_ACCEPT_REQ] = sched,
+        [CPL_PASS_ESTABLISH] = sched,
+        [CPL_PEER_CLOSE] = sched,
+        [CPL_CLOSE_CON_RPL] = sched,
+        [CPL_ABORT_REQ_RSS] = sched,
+        [CPL_RDMA_TERMINATE] = sched,
+        [CPL_FW4_ACK] = sched,
+        [CPL_SET_TCB_RPL] = set_tcb_rpl,
+        [CPL_FW6_MSG] = fw6_msg
+};
+
+int __init c4iw_cm_init(void)
+{
+        spin_lock_init(&timeout_lock);
+        skb_queue_head_init(&rxq);
+
+        workq = create_singlethread_workqueue("iw_cxgb4");
+        if (!workq)
+                return -ENOMEM;
+
+        return 0;
+}
+
+void __exit c4iw_cm_term(void)
+{
+        WARN_ON(!list_empty(&timeout_list));
+        flush_workqueue(workq);
+        destroy_workqueue(workq);
+}
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
new file mode 100644
index 000000000000..fb1aafcc294f
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -0,0 +1,882 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "iw_cxgb4.h"
+
+static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+                      struct c4iw_dev_ucontext *uctx)
+{
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+        int ret;
+
+        wr_len = sizeof *res_wr + sizeof *res;
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(1) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.cq.restype = FW_RI_RES_TYPE_CQ;
+        res->u.cq.op = FW_RI_RES_OP_RESET;
+        res->u.cq.iqid = cpu_to_be32(cq->cqid);
+
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(rdev, skb);
+        if (!ret) {
+                wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+                if (!wr_wait.done) {
+                        printk(KERN_ERR MOD "Device %s not responding!\n",
+                               pci_name(rdev->lldi.pdev));
+                        rdev->flags = T4_FATAL_ERROR;
+                        ret = -EIO;
+                } else
+                        ret = wr_wait.ret;
+        }
+
+        kfree(cq->sw_queue);
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          cq->memsize, cq->queue,
+                          pci_unmap_addr(cq, mapping));
+        c4iw_put_cqid(rdev, cq->cqid, uctx);
+        return ret;
+}
+
+static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
+                     struct c4iw_dev_ucontext *uctx)
+{
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        int user = (uctx != &rdev->uctx);
+        struct c4iw_wr_wait wr_wait;
+        int ret;
+        struct sk_buff *skb;
+
+        cq->cqid = c4iw_get_cqid(rdev, uctx);
+        if (!cq->cqid) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+
+        if (!user) {
+                cq->sw_queue = kzalloc(cq->memsize, GFP_KERNEL);
+                if (!cq->sw_queue) {
+                        ret = -ENOMEM;
+                        goto err2;
+                }
+        }
+        cq->queue = dma_alloc_coherent(&rdev->lldi.pdev->dev, cq->memsize,
+                                       &cq->dma_addr, GFP_KERNEL);
+        if (!cq->queue) {
+                ret = -ENOMEM;
+                goto err3;
+        }
+        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        memset(cq->queue, 0, cq->memsize);
+
+        /* build fw_ri_res_wr */
+        wr_len = sizeof *res_wr + sizeof *res;
+
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto err4;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(1) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.cq.restype = FW_RI_RES_TYPE_CQ;
+        res->u.cq.op = FW_RI_RES_OP_WRITE;
+        res->u.cq.iqid = cpu_to_be32(cq->cqid);
+        res->u.cq.iqandst_to_iqandstindex = cpu_to_be32(
+                        V_FW_RI_RES_WR_IQANUS(0) |
+                        V_FW_RI_RES_WR_IQANUD(1) |
+                        F_FW_RI_RES_WR_IQANDST |
+                        V_FW_RI_RES_WR_IQANDSTINDEX(*rdev->lldi.rxq_ids));
+        res->u.cq.iqdroprss_to_iqesize = cpu_to_be16(
+                        F_FW_RI_RES_WR_IQDROPRSS |
+                        V_FW_RI_RES_WR_IQPCIECH(2) |
+                        V_FW_RI_RES_WR_IQINTCNTTHRESH(0) |
+                        F_FW_RI_RES_WR_IQO |
+                        V_FW_RI_RES_WR_IQESIZE(1));
+        res->u.cq.iqsize = cpu_to_be16(cq->size);
+        res->u.cq.iqaddr = cpu_to_be64(cq->dma_addr);
+
+        c4iw_init_wr_wait(&wr_wait);
+
+        ret = c4iw_ofld_send(rdev, skb);
+        if (ret)
+                goto err4;
+        PDBG("%s wait_event wr_wait %p\n", __func__, &wr_wait);
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        if (ret)
+                goto err4;
+
+        cq->gen = 1;
+        cq->gts = rdev->lldi.gts_reg;
+        cq->rdev = rdev;
+        if (user) {
+                cq->ugts = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (cq->cqid << rdev->cqshift);
+                cq->ugts &= PAGE_MASK;
+        }
+        return 0;
+err4:
+        dma_free_coherent(&rdev->lldi.pdev->dev, cq->memsize, cq->queue,
+                          pci_unmap_addr(cq, mapping));
+err3:
+        kfree(cq->sw_queue);
+err2:
+        c4iw_put_cqid(rdev, cq->cqid, uctx);
+err1:
+        return ret;
+}
+
+static void insert_recv_cqe(struct t4_wq *wq, struct t4_cq *cq)
+{
+        struct t4_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_cidx %u sw_pidx %u\n", __func__,
+             wq, cq, cq->sw_cidx, cq->sw_pidx);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(T4_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(FW_RI_SEND) |
+                                 V_CQE_TYPE(0) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->rq.qid));
+        cqe.bits_type_ts = cpu_to_be64(V_CQE_GENBIT((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+}
+
+int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count)
+{
+        int flushed = 0;
+        int in_use = wq->rq.in_use - count;
+
+        BUG_ON(in_use < 0);
+        PDBG("%s wq %p cq %p rq.in_use %u skip count %u\n", __func__,
+             wq, cq, wq->rq.in_use, count);
+        while (in_use--) {
+                insert_recv_cqe(wq, cq);
+                flushed++;
+        }
+        return flushed;
+}
+
+static void insert_sq_cqe(struct t4_wq *wq, struct t4_cq *cq,
+                          struct t4_swsqe *swcqe)
+{
+        struct t4_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_cidx %u sw_pidx %u\n", __func__,
+             wq, cq, cq->sw_cidx, cq->sw_pidx);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(T4_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(swcqe->opcode) |
+                                 V_CQE_TYPE(1) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->sq.qid));
+        CQE_WRID_SQ_IDX(&cqe) = swcqe->idx;
+        cqe.bits_type_ts = cpu_to_be64(V_CQE_GENBIT((u64)cq->gen));
+        cq->sw_queue[cq->sw_pidx] = cqe;
+        t4_swcq_produce(cq);
+}
+
+int c4iw_flush_sq(struct t4_wq *wq, struct t4_cq *cq, int count)
+{
+        int flushed = 0;
+        struct t4_swsqe *swsqe = &wq->sq.sw_sq[wq->sq.cidx + count];
+        int in_use = wq->sq.in_use - count;
+
+        BUG_ON(in_use < 0);
+        while (in_use--) {
+                swsqe->signaled = 0;
+                insert_sq_cqe(wq, cq, swsqe);
+                swsqe++;
+                if (swsqe == (wq->sq.sw_sq + wq->sq.size))
+                        swsqe = wq->sq.sw_sq;
+                flushed++;
+        }
+        return flushed;
+}
+
+/*
+ * Move all CQEs from the HWCQ into the SWCQ.
+ */
+void c4iw_flush_hw_cq(struct t4_cq *cq)
+{
+        struct t4_cqe *cqe = NULL, *swcqe;
+        int ret;
+
+        PDBG("%s cq %p cqid 0x%x\n", __func__, cq, cq->cqid);
+        ret = t4_next_hw_cqe(cq, &cqe);
+        while (!ret) {
+                PDBG("%s flushing hwcq cidx 0x%x swcq pidx 0x%x\n",
+                     __func__, cq->cidx, cq->sw_pidx);
+                swcqe = &cq->sw_queue[cq->sw_pidx];
+                *swcqe = *cqe;
+                swcqe->header |= cpu_to_be32(V_CQE_SWCQE(1));
+                t4_swcq_produce(cq);
+                t4_hwcq_consume(cq);
+                ret = t4_next_hw_cqe(cq, &cqe);
+        }
+}
+
+static int cqe_completes_wr(struct t4_cqe *cqe, struct t4_wq *wq)
+{
+        if (CQE_OPCODE(cqe) == FW_RI_TERMINATE)
+                return 0;
+
+        if ((CQE_OPCODE(cqe) == FW_RI_RDMA_WRITE) && RQ_TYPE(cqe))
+                return 0;
+
+        if ((CQE_OPCODE(cqe) == FW_RI_READ_RESP) && SQ_TYPE(cqe))
+                return 0;
+
+        if (CQE_SEND_OPCODE(cqe) && RQ_TYPE(cqe) && t4_rq_empty(wq))
+                return 0;
+        return 1;
+}
+
+void c4iw_count_scqes(struct t4_cq *cq, struct t4_wq *wq, int *count)
+{
+        struct t4_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        ptr = cq->sw_cidx;
+        while (ptr != cq->sw_pidx) {
+                cqe = &cq->sw_queue[ptr];
+                if ((SQ_TYPE(cqe) || ((CQE_OPCODE(cqe) == FW_RI_READ_RESP) &&
+                                      wq->sq.oldest_read)) &&
+                    (CQE_QPID(cqe) == wq->sq.qid))
+                        (*count)++;
+                if (++ptr == cq->size)
+                        ptr = 0;
+        }
+        PDBG("%s cq %p count %d\n", __func__, cq, *count);
+}
+
+void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count)
+{
+        struct t4_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        PDBG("%s count zero %d\n", __func__, *count);
+        ptr = cq->sw_cidx;
+        while (ptr != cq->sw_pidx) {
+                cqe = &cq->sw_queue[ptr];
+                if (RQ_TYPE(cqe) && (CQE_OPCODE(cqe) != FW_RI_READ_RESP) &&
+                    (CQE_QPID(cqe) == wq->rq.qid) && cqe_completes_wr(cqe, wq))
+                        (*count)++;
+                if (++ptr == cq->size)
+                        ptr = 0;
+        }
+        PDBG("%s cq %p count %d\n", __func__, cq, *count);
+}
+
+static void flush_completed_wrs(struct t4_wq *wq, struct t4_cq *cq)
+{
+        struct t4_swsqe *swsqe;
+        u16 ptr = wq->sq.cidx;
+        int count = wq->sq.in_use;
+        int unsignaled = 0;
+
+        swsqe = &wq->sq.sw_sq[ptr];
+        while (count--)
+                if (!swsqe->signaled) {
+                        if (++ptr == wq->sq.size)
+                                ptr = 0;
+                        swsqe = &wq->sq.sw_sq[ptr];
+                        unsignaled++;
+                } else if (swsqe->complete) {
+
+                        /*
+                         * Insert this completed cqe into the swcq.
+                         */
+                        PDBG("%s moving cqe into swcq sq idx %u cq idx %u\n",
+                             __func__, ptr, cq->sw_pidx);
+                        swsqe->cqe.header |= htonl(V_CQE_SWCQE(1));
+                        cq->sw_queue[cq->sw_pidx] = swsqe->cqe;
+                        t4_swcq_produce(cq);
+                        swsqe->signaled = 0;
+                        wq->sq.in_use -= unsignaled;
+                        break;
+                } else
+                        break;
+}
+
+static void create_read_req_cqe(struct t4_wq *wq, struct t4_cqe *hw_cqe,
+                                struct t4_cqe *read_cqe)
+{
+        read_cqe->u.scqe.cidx = wq->sq.oldest_read->idx;
+        read_cqe->len = cpu_to_be32(wq->sq.oldest_read->read_len);
+        read_cqe->header = htonl(V_CQE_QPID(CQE_QPID(hw_cqe)) |
+                                 V_CQE_SWCQE(SW_CQE(hw_cqe)) |
+                                 V_CQE_OPCODE(FW_RI_READ_REQ) |
+                                 V_CQE_TYPE(1));
+}
+
+/*
+ * Return a ptr to the next read wr in the SWSQ or NULL.
+ */
+static void advance_oldest_read(struct t4_wq *wq)
+{
+
+        u32 rptr = wq->sq.oldest_read - wq->sq.sw_sq + 1;
+
+        if (rptr == wq->sq.size)
+                rptr = 0;
+        while (rptr != wq->sq.pidx) {
+                wq->sq.oldest_read = &wq->sq.sw_sq[rptr];
+
+                if (wq->sq.oldest_read->opcode == FW_RI_READ_REQ)
+                        return;
+                if (++rptr == wq->sq.size)
+                        rptr = 0;
+        }
+        wq->sq.oldest_read = NULL;
+}
+
+/*
+ * poll_cq
+ *
+ * Caller must:
+ *     check the validity of the first CQE,
+ *     supply the wq assicated with the qpid.
+ *
+ * credit: cq credit to return to sge.
+ * cqe_flushed: 1 iff the CQE is flushed.
+ * cqe: copy of the polled CQE.
+ *
+ * return value:
+ *    0             CQE returned ok.
+ *    -EAGAIN       CQE skipped, try again.
+ *    -EOVERFLOW    CQ overflow detected.
+ */
+static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe,
+                   u8 *cqe_flushed, u64 *cookie, u32 *credit)
+{
+        int ret = 0;
+        struct t4_cqe *hw_cqe, read_cqe;
+
+        *cqe_flushed = 0;
+        *credit = 0;
+        ret = t4_next_cqe(cq, &hw_cqe);
+        if (ret)
+                return ret;
+
+        PDBG("%s CQE OVF %u qpid 0x%0x genbit %u type %u status 0x%0x"
+             " opcode 0x%0x len 0x%0x wrid_hi_stag 0x%x wrid_low_msn 0x%x\n",
+             __func__, CQE_OVFBIT(hw_cqe), CQE_QPID(hw_cqe),
+             CQE_GENBIT(hw_cqe), CQE_TYPE(hw_cqe), CQE_STATUS(hw_cqe),
+             CQE_OPCODE(hw_cqe), CQE_LEN(hw_cqe), CQE_WRID_HI(hw_cqe),
+             CQE_WRID_LOW(hw_cqe));
+
+        /*
+         * skip cqe's not affiliated with a QP.
+         */
+        if (wq == NULL) {
+                ret = -EAGAIN;
+                goto skip_cqe;
+        }
+
+        /*
+         * Gotta tweak READ completions:
+         *      1) the cqe doesn't contain the sq_wptr from the wr.
+         *      2) opcode not reflected from the wr.
+         *      3) read_len not reflected from the wr.
+         *      4) cq_type is RQ_TYPE not SQ_TYPE.
+         */
+        if (RQ_TYPE(hw_cqe) && (CQE_OPCODE(hw_cqe) == FW_RI_READ_RESP)) {
+
+                /*
+                 * If this is an unsolicited read response, then the read
+                 * was generated by the kernel driver as part of peer-2-peer
+                 * connection setup.  So ignore the completion.
+                 */
+                if (!wq->sq.oldest_read) {
+                        if (CQE_STATUS(hw_cqe))
+                                t4_set_wq_in_error(wq);
+                        ret = -EAGAIN;
+                        goto skip_cqe;
+                }
+
+                /*
+                 * Don't write to the HWCQ, so create a new read req CQE
+                 * in local memory.
+                 */
+                create_read_req_cqe(wq, hw_cqe, &read_cqe);
+                hw_cqe = &read_cqe;
+                advance_oldest_read(wq);
+        }
+
+        if (CQE_STATUS(hw_cqe) || t4_wq_in_error(wq)) {
+                *cqe_flushed = t4_wq_in_error(wq);
+                t4_set_wq_in_error(wq);
+                goto proc_cqe;
+        }
+
+        /*
+         * RECV completion.
+         */
+        if (RQ_TYPE(hw_cqe)) {
+
+                /*
+                 * HW only validates 4 bits of MSN.  So we must validate that
+                 * the MSN in the SEND is the next expected MSN.  If its not,
+                 * then we complete this with T4_ERR_MSN and mark the wq in
+                 * error.
+                 */
+
+                if (t4_rq_empty(wq)) {
+                        t4_set_wq_in_error(wq);
+                        ret = -EAGAIN;
+                        goto skip_cqe;
+                }
+                if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) {
+                        t4_set_wq_in_error(wq);
+                        hw_cqe->header |= htonl(V_CQE_STATUS(T4_ERR_MSN));
+                        goto proc_cqe;
+                }
+                goto proc_cqe;
+        }
+
+        /*
+         * If we get here its a send completion.
+         *
+         * Handle out of order completion. These get stuffed
+         * in the SW SQ. Then the SW SQ is walked to move any
+         * now in-order completions into the SW CQ.  This handles
+         * 2 cases:
+         *      1) reaping unsignaled WRs when the first subsequent
+         *         signaled WR is completed.
+         *      2) out of order read completions.
+         */
+        if (!SW_CQE(hw_cqe) && (CQE_WRID_SQ_IDX(hw_cqe) != wq->sq.cidx)) {
+                struct t4_swsqe *swsqe;
+
+                PDBG("%s out of order completion going in sw_sq at idx %u\n",
+                     __func__, CQE_WRID_SQ_IDX(hw_cqe));
+                swsqe = &wq->sq.sw_sq[CQE_WRID_SQ_IDX(hw_cqe)];
+                swsqe->cqe = *hw_cqe;
+                swsqe->complete = 1;
+                ret = -EAGAIN;
+                goto flush_wq;
+        }
+
+proc_cqe:
+        *cqe = *hw_cqe;
+
+        /*
+         * Reap the associated WR(s) that are freed up with this
+         * completion.
+         */
+        if (SQ_TYPE(hw_cqe)) {
+                wq->sq.cidx = CQE_WRID_SQ_IDX(hw_cqe);
+                PDBG("%s completing sq idx %u\n", __func__, wq->sq.cidx);
+                *cookie = wq->sq.sw_sq[wq->sq.cidx].wr_id;
+                t4_sq_consume(wq);
+        } else {
+                PDBG("%s completing rq idx %u\n", __func__, wq->rq.cidx);
+                *cookie = wq->rq.sw_rq[wq->rq.cidx].wr_id;
+                BUG_ON(t4_rq_empty(wq));
+                t4_rq_consume(wq);
+        }
+
+flush_wq:
+        /*
+         * Flush any completed cqes that are now in-order.
+         */
+        flush_completed_wrs(wq, cq);
+
+skip_cqe:
+        if (SW_CQE(hw_cqe)) {
+                PDBG("%s cq %p cqid 0x%x skip sw cqe cidx %u\n",
+                     __func__, cq, cq->cqid, cq->sw_cidx);
+                t4_swcq_consume(cq);
+        } else {
+                PDBG("%s cq %p cqid 0x%x skip hw cqe cidx %u\n",
+                     __func__, cq, cq->cqid, cq->cidx);
+                t4_hwcq_consume(cq);
+        }
+        return ret;
+}
+
+/*
+ * Get one cq entry from c4iw and map it to openib.
+ *
+ * Returns:
+ *      0                       cqe returned
+ *      -ENODATA                EMPTY;
+ *      -EAGAIN                 caller must try again
+ *      any other -errno        fatal error
+ */
+static int c4iw_poll_cq_one(struct c4iw_cq *chp, struct ib_wc *wc)
+{
+        struct c4iw_qp *qhp = NULL;
+        struct t4_cqe cqe = {0, 0}, *rd_cqe;
+        struct t4_wq *wq;
+        u32 credit = 0;
+        u8 cqe_flushed;
+        u64 cookie = 0;
+        int ret;
+
+        ret = t4_next_cqe(&chp->cq, &rd_cqe);
+
+        if (ret)
+                return ret;
+
+        qhp = get_qhp(chp->rhp, CQE_QPID(rd_cqe));
+        if (!qhp)
+                wq = NULL;
+        else {
+                spin_lock(&qhp->lock);
+                wq = &(qhp->wq);
+        }
+        ret = poll_cq(wq, &(chp->cq), &cqe, &cqe_flushed, &cookie, &credit);
+        if (ret)
+                goto out;
+
+        wc->wr_id = cookie;
+        wc->qp = &qhp->ibqp;
+        wc->vendor_err = CQE_STATUS(&cqe);
+        wc->wc_flags = 0;
+
+        PDBG("%s qpid 0x%x type %d opcode %d status 0x%x len %u wrid hi 0x%x "
+             "lo 0x%x cookie 0x%llx\n", __func__, CQE_QPID(&cqe),
+             CQE_TYPE(&cqe), CQE_OPCODE(&cqe), CQE_STATUS(&cqe), CQE_LEN(&cqe),
+             CQE_WRID_HI(&cqe), CQE_WRID_LOW(&cqe), (unsigned long long)cookie);
+
+        if (CQE_TYPE(&cqe) == 0) {
+                if (!CQE_STATUS(&cqe))
+                        wc->byte_len = CQE_LEN(&cqe);
+                else
+                        wc->byte_len = 0;
+                wc->opcode = IB_WC_RECV;
+                if (CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_INV ||
+                    CQE_OPCODE(&cqe) == FW_RI_SEND_WITH_SE_INV) {
+                        wc->ex.invalidate_rkey = CQE_WRID_STAG(&cqe);
+                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
+                }
+        } else {
+                switch (CQE_OPCODE(&cqe)) {
+                case FW_RI_RDMA_WRITE:
+                        wc->opcode = IB_WC_RDMA_WRITE;
+                        break;
+                case FW_RI_READ_REQ:
+                        wc->opcode = IB_WC_RDMA_READ;
+                        wc->byte_len = CQE_LEN(&cqe);
+                        break;
+                case FW_RI_SEND_WITH_INV:
+                case FW_RI_SEND_WITH_SE_INV:
+                        wc->opcode = IB_WC_SEND;
+                        wc->wc_flags |= IB_WC_WITH_INVALIDATE;
+                        break;
+                case FW_RI_SEND:
+                case FW_RI_SEND_WITH_SE:
+                        wc->opcode = IB_WC_SEND;
+                        break;
+                case FW_RI_BIND_MW:
+                        wc->opcode = IB_WC_BIND_MW;
+                        break;
+
+                case FW_RI_LOCAL_INV:
+                        wc->opcode = IB_WC_LOCAL_INV;
+                        break;
+                case FW_RI_FAST_REGISTER:
+                        wc->opcode = IB_WC_FAST_REG_MR;
+                        break;
+                default:
+                        printk(KERN_ERR MOD "Unexpected opcode %d "
+                               "in the CQE received for QPID=0x%0x\n",
+                               CQE_OPCODE(&cqe), CQE_QPID(&cqe));
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+        if (cqe_flushed)
+                wc->status = IB_WC_WR_FLUSH_ERR;
+        else {
+
+                switch (CQE_STATUS(&cqe)) {
+                case T4_ERR_SUCCESS:
+                        wc->status = IB_WC_SUCCESS;
+                        break;
+                case T4_ERR_STAG:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case T4_ERR_PDID:
+                        wc->status = IB_WC_LOC_PROT_ERR;
+                        break;
+                case T4_ERR_QPID:
+                case T4_ERR_ACCESS:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case T4_ERR_WRAP:
+                        wc->status = IB_WC_GENERAL_ERR;
+                        break;
+                case T4_ERR_BOUND:
+                        wc->status = IB_WC_LOC_LEN_ERR;
+                        break;
+                case T4_ERR_INVALIDATE_SHARED_MR:
+                case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                        wc->status = IB_WC_MW_BIND_ERR;
+                        break;
+                case T4_ERR_CRC:
+                case T4_ERR_MARKER:
+                case T4_ERR_PDU_LEN_ERR:
+                case T4_ERR_OUT_OF_RQE:
+                case T4_ERR_DDP_VERSION:
+                case T4_ERR_RDMA_VERSION:
+                case T4_ERR_DDP_QUEUE_NUM:
+                case T4_ERR_MSN:
+                case T4_ERR_TBIT:
+                case T4_ERR_MO:
+                case T4_ERR_MSN_RANGE:
+                case T4_ERR_IRD_OVERFLOW:
+                case T4_ERR_OPCODE:
+                        wc->status = IB_WC_FATAL_ERR;
+                        break;
+                case T4_ERR_SWFLUSH:
+                        wc->status = IB_WC_WR_FLUSH_ERR;
+                        break;
+                default:
+                        printk(KERN_ERR MOD
+                               "Unexpected cqe_status 0x%x for QPID=0x%0x\n",
+                               CQE_STATUS(&cqe), CQE_QPID(&cqe));
+                        ret = -EINVAL;
+                }
+        }
+out:
+        if (wq)
+                spin_unlock(&qhp->lock);
+        return ret;
+}
+
+int c4iw_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+{
+        struct c4iw_cq *chp;
+        unsigned long flags;
+        int npolled;
+        int err = 0;
+
+        chp = to_c4iw_cq(ibcq);
+
+        spin_lock_irqsave(&chp->lock, flags);
+        for (npolled = 0; npolled < num_entries; ++npolled) {
+                do {
+                        err = c4iw_poll_cq_one(chp, wc + npolled);
+                } while (err == -EAGAIN);
+                if (err)
+                        break;
+        }
+        spin_unlock_irqrestore(&chp->lock, flags);
+        return !err || err == -ENODATA ? npolled : err;
+}
+
+int c4iw_destroy_cq(struct ib_cq *ib_cq)
+{
+        struct c4iw_cq *chp;
+        struct c4iw_ucontext *ucontext;
+
+        PDBG("%s ib_cq %p\n", __func__, ib_cq);
+        chp = to_c4iw_cq(ib_cq);
+
+        remove_handle(chp->rhp, &chp->rhp->cqidr, chp->cq.cqid);
+        atomic_dec(&chp->refcnt);
+        wait_event(chp->wait, !atomic_read(&chp->refcnt));
+
+        ucontext = ib_cq->uobject ? to_c4iw_ucontext(ib_cq->uobject->context)
+                                  : NULL;
+        destroy_cq(&chp->rhp->rdev, &chp->cq,
+                   ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx);
+        kfree(chp);
+        return 0;
+}
+
+struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
+                             int vector, struct ib_ucontext *ib_context,
+                             struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_cq *chp;
+        struct c4iw_create_cq_resp uresp;
+        struct c4iw_ucontext *ucontext = NULL;
+        int ret;
+        size_t memsize;
+        struct c4iw_mm_entry *mm, *mm2;
+
+        PDBG("%s ib_dev %p entries %d\n", __func__, ibdev, entries);
+
+        rhp = to_c4iw_dev(ibdev);
+
+        chp = kzalloc(sizeof(*chp), GFP_KERNEL);
+        if (!chp)
+                return ERR_PTR(-ENOMEM);
+
+        if (ib_context)
+                ucontext = to_c4iw_ucontext(ib_context);
+
+        /* account for the status page. */
+        entries++;
+
+        /*
+         * entries must be multiple of 16 for HW.
+         */
+        entries = roundup(entries, 16);
+        memsize = entries * sizeof *chp->cq.queue;
+
+        /*
+         * memsize must be a multiple of the page size if its a user cq.
+         */
+        if (ucontext)
+                memsize = roundup(memsize, PAGE_SIZE);
+        chp->cq.size = entries;
+        chp->cq.memsize = memsize;
+
+        ret = create_cq(&rhp->rdev, &chp->cq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+        if (ret)
+                goto err1;
+
+        chp->rhp = rhp;
+        chp->cq.size--;                         /* status page */
+        chp->ibcq.cqe = chp->cq.size;
+        spin_lock_init(&chp->lock);
+        atomic_set(&chp->refcnt, 1);
+        init_waitqueue_head(&chp->wait);
+        ret = insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid);
+        if (ret)
+                goto err2;
+
+        if (ucontext) {
+                mm = kmalloc(sizeof *mm, GFP_KERNEL);
+                if (!mm)
+                        goto err3;
+                mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
+                if (!mm2)
+                        goto err4;
+
+                uresp.qid_mask = rhp->rdev.cqmask;
+                uresp.cqid = chp->cq.cqid;
+                uresp.size = chp->cq.size;
+                uresp.memsize = chp->cq.memsize;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
+                if (ret)
+                        goto err5;
+
+                mm->key = uresp.key;
+                mm->addr = virt_to_phys(chp->cq.queue);
+                mm->len = chp->cq.memsize;
+                insert_mmap(ucontext, mm);
+
+                mm2->key = uresp.gts_key;
+                mm2->addr = chp->cq.ugts;
+                mm2->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm2);
+        }
+        PDBG("%s cqid 0x%0x chp %p size %u memsize %zu, dma_addr 0x%0llx\n",
+             __func__, chp->cq.cqid, chp, chp->cq.size,
+             chp->cq.memsize,
+             (unsigned long long) chp->cq.dma_addr);
+        return &chp->ibcq;
+err5:
+        kfree(mm2);
+err4:
+        kfree(mm);
+err3:
+        remove_handle(rhp, &rhp->cqidr, chp->cq.cqid);
+err2:
+        destroy_cq(&chp->rhp->rdev, &chp->cq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+err1:
+        kfree(chp);
+        return ERR_PTR(ret);
+}
+
+int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
+{
+        return -ENOSYS;
+}
+
+int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
+{
+        struct c4iw_cq *chp;
+        int ret;
+        unsigned long flag;
+
+        chp = to_c4iw_cq(ibcq);
+        spin_lock_irqsave(&chp->lock, flag);
+        ret = t4_arm_cq(&chp->cq,
+                        (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        spin_unlock_irqrestore(&chp->lock, flag);
+        if (ret && !(flags & IB_CQ_REPORT_MISSED_EVENTS))
+                ret = 0;
+        return ret;
+}
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
new file mode 100644
index 000000000000..be23b5eab13b
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -0,0 +1,520 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/debugfs.h>
+
+#include <rdma/ib_verbs.h>
+
+#include "iw_cxgb4.h"
+
+#define DRV_VERSION "0.1"
+
+MODULE_AUTHOR("Steve Wise");
+MODULE_DESCRIPTION("Chelsio T4 RDMA Driver");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_VERSION(DRV_VERSION);
+
+static LIST_HEAD(dev_list);
+static DEFINE_MUTEX(dev_mutex);
+
+static struct dentry *c4iw_debugfs_root;
+
+struct debugfs_qp_data {
+        struct c4iw_dev *devp;
+        char *buf;
+        int bufsize;
+        int pos;
+};
+
+static int count_qps(int id, void *p, void *data)
+{
+        struct c4iw_qp *qp = p;
+        int *countp = data;
+
+        if (id != qp->wq.sq.qid)
+                return 0;
+
+        *countp = *countp + 1;
+        return 0;
+}
+
+static int dump_qps(int id, void *p, void *data)
+{
+        struct c4iw_qp *qp = p;
+        struct debugfs_qp_data *qpd = data;
+        int space;
+        int cc;
+
+        if (id != qp->wq.sq.qid)
+                return 0;
+
+        space = qpd->bufsize - qpd->pos - 1;
+        if (space == 0)
+                return 1;
+
+        if (qp->ep)
+                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u "
+                             "ep tid %u state %u %pI4:%u->%pI4:%u\n",
+                             qp->wq.sq.qid, (int)qp->attr.state,
+                             qp->ep->hwtid, (int)qp->ep->com.state,
+                             &qp->ep->com.local_addr.sin_addr.s_addr,
+                             ntohs(qp->ep->com.local_addr.sin_port),
+                             &qp->ep->com.remote_addr.sin_addr.s_addr,
+                             ntohs(qp->ep->com.remote_addr.sin_port));
+        else
+                cc = snprintf(qpd->buf + qpd->pos, space, "qp id %u state %u\n",
+                              qp->wq.sq.qid, (int)qp->attr.state);
+        if (cc < space)
+                qpd->pos += cc;
+        return 0;
+}
+
+static int qp_release(struct inode *inode, struct file *file)
+{
+        struct debugfs_qp_data *qpd = file->private_data;
+        if (!qpd) {
+                printk(KERN_INFO "%s null qpd?\n", __func__);
+                return 0;
+        }
+        kfree(qpd->buf);
+        kfree(qpd);
+        return 0;
+}
+
+static int qp_open(struct inode *inode, struct file *file)
+{
+        struct debugfs_qp_data *qpd;
+        int ret = 0;
+        int count = 1;
+
+        qpd = kmalloc(sizeof *qpd, GFP_KERNEL);
+        if (!qpd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        qpd->devp = inode->i_private;
+        qpd->pos = 0;
+
+        spin_lock_irq(&qpd->devp->lock);
+        idr_for_each(&qpd->devp->qpidr, count_qps, &count);
+        spin_unlock_irq(&qpd->devp->lock);
+
+        qpd->bufsize = count * 128;
+        qpd->buf = kmalloc(qpd->bufsize, GFP_KERNEL);
+        if (!qpd->buf) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+
+        spin_lock_irq(&qpd->devp->lock);
+        idr_for_each(&qpd->devp->qpidr, dump_qps, qpd);
+        spin_unlock_irq(&qpd->devp->lock);
+
+        qpd->buf[qpd->pos++] = 0;
+        file->private_data = qpd;
+        goto out;
+err1:
+        kfree(qpd);
+out:
+        return ret;
+}
+
+static ssize_t qp_read(struct file *file, char __user *buf, size_t count,
+                        loff_t *ppos)
+{
+        struct debugfs_qp_data *qpd = file->private_data;
+        loff_t pos = *ppos;
+        loff_t avail = qpd->pos;
+
+        if (pos < 0)
+                return -EINVAL;
+        if (pos >= avail)
+                return 0;
+        if (count > avail - pos)
+                count = avail - pos;
+
+        while (count) {
+                size_t len = 0;
+
+                len = min((int)count, (int)qpd->pos - (int)pos);
+                if (copy_to_user(buf, qpd->buf + pos, len))
+                        return -EFAULT;
+                if (len == 0)
+                        return -EINVAL;
+
+                buf += len;
+                pos += len;
+                count -= len;
+        }
+        count = pos - *ppos;
+        *ppos = pos;
+        return count;
+}
+
+static const struct file_operations qp_debugfs_fops = {
+        .owner   = THIS_MODULE,
+        .open    = qp_open,
+        .release = qp_release,
+        .read    = qp_read,
+};
+
+static int setup_debugfs(struct c4iw_dev *devp)
+{
+        struct dentry *de;
+
+        if (!devp->debugfs_root)
+                return -1;
+
+        de = debugfs_create_file("qps", S_IWUSR, devp->debugfs_root,
+                                 (void *)devp, &qp_debugfs_fops);
+        if (de && de->d_inode)
+                de->d_inode->i_size = 4096;
+        return 0;
+}
+
+void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
+                               struct c4iw_dev_ucontext *uctx)
+{
+        struct list_head *pos, *nxt;
+        struct c4iw_qid_list *entry;
+
+        mutex_lock(&uctx->lock);
+        list_for_each_safe(pos, nxt, &uctx->qpids) {
+                entry = list_entry(pos, struct c4iw_qid_list, entry);
+                list_del_init(&entry->entry);
+                if (!(entry->qid & rdev->qpmask))
+                        c4iw_put_resource(&rdev->resource.qid_fifo, entry->qid,
+                                          &rdev->resource.qid_fifo_lock);
+                kfree(entry);
+        }
+
+        list_for_each_safe(pos, nxt, &uctx->qpids) {
+                entry = list_entry(pos, struct c4iw_qid_list, entry);
+                list_del_init(&entry->entry);
+                kfree(entry);
+        }
+        mutex_unlock(&uctx->lock);
+}
+
+void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
+                            struct c4iw_dev_ucontext *uctx)
+{
+        INIT_LIST_HEAD(&uctx->qpids);
+        INIT_LIST_HEAD(&uctx->cqids);
+        mutex_init(&uctx->lock);
+}
+
+/* Caller takes care of locking if needed */
+static int c4iw_rdev_open(struct c4iw_rdev *rdev)
+{
+        int err;
+
+        c4iw_init_dev_ucontext(rdev, &rdev->uctx);
+
+        /*
+         * qpshift is the number of bits to shift the qpid left in order
+         * to get the correct address of the doorbell for that qp.
+         */
+        rdev->qpshift = PAGE_SHIFT - ilog2(rdev->lldi.udb_density);
+        rdev->qpmask = rdev->lldi.udb_density - 1;
+        rdev->cqshift = PAGE_SHIFT - ilog2(rdev->lldi.ucq_density);
+        rdev->cqmask = rdev->lldi.ucq_density - 1;
+        PDBG("%s dev %s stag start 0x%0x size 0x%0x num stags %d "
+             "pbl start 0x%0x size 0x%0x rq start 0x%0x size 0x%0x\n",
+             __func__, pci_name(rdev->lldi.pdev), rdev->lldi.vr->stag.start,
+             rdev->lldi.vr->stag.size, c4iw_num_stags(rdev),
+             rdev->lldi.vr->pbl.start,
+             rdev->lldi.vr->pbl.size, rdev->lldi.vr->rq.start,
+             rdev->lldi.vr->rq.size);
+        PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p qpshift %lu "
+             "qpmask 0x%x cqshift %lu cqmask 0x%x\n",
+             (unsigned)pci_resource_len(rdev->lldi.pdev, 2),
+             (void *)pci_resource_start(rdev->lldi.pdev, 2),
+             rdev->lldi.db_reg,
+             rdev->lldi.gts_reg,
+             rdev->qpshift, rdev->qpmask,
+             rdev->cqshift, rdev->cqmask);
+
+        if (c4iw_num_stags(rdev) == 0) {
+                err = -EINVAL;
+                goto err1;
+        }
+
+        err = c4iw_init_resource(rdev, c4iw_num_stags(rdev), T4_MAX_NUM_PD);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing resources\n", err);
+                goto err1;
+        }
+        err = c4iw_pblpool_create(rdev);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing pbl pool\n", err);
+                goto err2;
+        }
+        err = c4iw_rqtpool_create(rdev);
+        if (err) {
+                printk(KERN_ERR MOD "error %d initializing rqt pool\n", err);
+                goto err3;
+        }
+        return 0;
+err3:
+        c4iw_pblpool_destroy(rdev);
+err2:
+        c4iw_destroy_resource(&rdev->resource);
+err1:
+        return err;
+}
+
+static void c4iw_rdev_close(struct c4iw_rdev *rdev)
+{
+        c4iw_pblpool_destroy(rdev);
+        c4iw_rqtpool_destroy(rdev);
+        c4iw_destroy_resource(&rdev->resource);
+}
+
+static void c4iw_remove(struct c4iw_dev *dev)
+{
+        PDBG("%s c4iw_dev %p\n", __func__,  dev);
+        cancel_delayed_work_sync(&dev->db_drop_task);
+        list_del(&dev->entry);
+        c4iw_unregister_device(dev);
+        c4iw_rdev_close(&dev->rdev);
+        idr_destroy(&dev->cqidr);
+        idr_destroy(&dev->qpidr);
+        idr_destroy(&dev->mmidr);
+        ib_dealloc_device(&dev->ibdev);
+}
+
+static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
+{
+        struct c4iw_dev *devp;
+        int ret;
+
+        devp = (struct c4iw_dev *)ib_alloc_device(sizeof(*devp));
+        if (!devp) {
+                printk(KERN_ERR MOD "Cannot allocate ib device\n");
+                return NULL;
+        }
+        devp->rdev.lldi = *infop;
+
+        mutex_lock(&dev_mutex);
+
+        ret = c4iw_rdev_open(&devp->rdev);
+        if (ret) {
+                mutex_unlock(&dev_mutex);
+                printk(KERN_ERR MOD "Unable to open CXIO rdev err %d\n", ret);
+                ib_dealloc_device(&devp->ibdev);
+                return NULL;
+        }
+
+        idr_init(&devp->cqidr);
+        idr_init(&devp->qpidr);
+        idr_init(&devp->mmidr);
+        spin_lock_init(&devp->lock);
+        list_add_tail(&devp->entry, &dev_list);
+        mutex_unlock(&dev_mutex);
+
+        if (c4iw_register_device(devp)) {
+                printk(KERN_ERR MOD "Unable to register device\n");
+                mutex_lock(&dev_mutex);
+                c4iw_remove(devp);
+                mutex_unlock(&dev_mutex);
+        }
+        if (c4iw_debugfs_root) {
+                devp->debugfs_root = debugfs_create_dir(
+                                        pci_name(devp->rdev.lldi.pdev),
+                                        c4iw_debugfs_root);
+                setup_debugfs(devp);
+        }
+        return devp;
+}
+
+static void *c4iw_uld_add(const struct cxgb4_lld_info *infop)
+{
+        struct c4iw_dev *dev;
+        static int vers_printed;
+        int i;
+
+        if (!vers_printed++)
+                printk(KERN_INFO MOD "Chelsio T4 RDMA Driver - version %s\n",
+                       DRV_VERSION);
+
+        dev = c4iw_alloc(infop);
+        if (!dev)
+                goto out;
+
+        PDBG("%s found device %s nchan %u nrxq %u ntxq %u nports %u\n",
+             __func__, pci_name(dev->rdev.lldi.pdev),
+             dev->rdev.lldi.nchan, dev->rdev.lldi.nrxq,
+             dev->rdev.lldi.ntxq, dev->rdev.lldi.nports);
+
+        for (i = 0; i < dev->rdev.lldi.nrxq; i++)
+                PDBG("rxqid[%u] %u\n", i, dev->rdev.lldi.rxq_ids[i]);
+
+        printk(KERN_INFO MOD "Initialized device %s\n",
+               pci_name(dev->rdev.lldi.pdev));
+out:
+        return dev;
+}
+
+static struct sk_buff *t4_pktgl_to_skb(const struct pkt_gl *gl,
+                                       unsigned int skb_len,
+                                       unsigned int pull_len)
+{
+        struct sk_buff *skb;
+        struct skb_shared_info *ssi;
+
+        if (gl->tot_len <= 512) {
+                skb = alloc_skb(gl->tot_len, GFP_ATOMIC);
+                if (unlikely(!skb))
+                        goto out;
+                __skb_put(skb, gl->tot_len);
+                skb_copy_to_linear_data(skb, gl->va, gl->tot_len);
+        } else {
+                skb = alloc_skb(skb_len, GFP_ATOMIC);
+                if (unlikely(!skb))
+                        goto out;
+                __skb_put(skb, pull_len);
+                skb_copy_to_linear_data(skb, gl->va, pull_len);
+
+                ssi = skb_shinfo(skb);
+                ssi->frags[0].page = gl->frags[0].page;
+                ssi->frags[0].page_offset = gl->frags[0].page_offset + pull_len;
+                ssi->frags[0].size = gl->frags[0].size - pull_len;
+                if (gl->nfrags > 1)
+                        memcpy(&ssi->frags[1], &gl->frags[1],
+                               (gl->nfrags - 1) * sizeof(skb_frag_t));
+                ssi->nr_frags = gl->nfrags;
+
+                skb->len = gl->tot_len;
+                skb->data_len = skb->len - pull_len;
+                skb->truesize += skb->data_len;
+
+                /* Get a reference for the last page, we don't own it */
+                get_page(gl->frags[gl->nfrags - 1].page);
+        }
+out:
+        return skb;
+}
+
+static int c4iw_uld_rx_handler(void *handle, const __be64 *rsp,
+                        const struct pkt_gl *gl)
+{
+        struct c4iw_dev *dev = handle;
+        struct sk_buff *skb;
+        const struct cpl_act_establish *rpl;
+        unsigned int opcode;
+
+        if (gl == NULL) {
+                /* omit RSS and rsp_ctrl at end of descriptor */
+                unsigned int len = 64 - sizeof(struct rsp_ctrl) - 8;
+
+                skb = alloc_skb(256, GFP_ATOMIC);
+                if (!skb)
+                        goto nomem;
+                __skb_put(skb, len);
+                skb_copy_to_linear_data(skb, &rsp[1], len);
+        } else if (gl == CXGB4_MSG_AN) {
+                const struct rsp_ctrl *rc = (void *)rsp;
+
+                u32 qid = be32_to_cpu(rc->pldbuflen_qid);
+                c4iw_ev_handler(dev, qid);
+                return 0;
+        } else {
+                skb = t4_pktgl_to_skb(gl, 128, 128);
+                if (unlikely(!skb))
+                        goto nomem;
+        }
+
+        rpl = cplhdr(skb);
+        opcode = rpl->ot.opcode;
+
+        if (c4iw_handlers[opcode])
+                c4iw_handlers[opcode](dev, skb);
+        else
+                printk(KERN_INFO "%s no handler opcode 0x%x...\n", __func__,
+                       opcode);
+
+        return 0;
+nomem:
+        return -1;
+}
+
+static int c4iw_uld_state_change(void *handle, enum cxgb4_state new_state)
+{
+        PDBG("%s new_state %u\n", __func__, new_state);
+        return 0;
+}
+
+static struct cxgb4_uld_info c4iw_uld_info = {
+        .name = DRV_NAME,
+        .add = c4iw_uld_add,
+        .rx_handler = c4iw_uld_rx_handler,
+        .state_change = c4iw_uld_state_change,
+};
+
+static int __init c4iw_init_module(void)
+{
+        int err;
+
+        err = c4iw_cm_init();
+        if (err)
+                return err;
+
+        c4iw_debugfs_root = debugfs_create_dir(DRV_NAME, NULL);
+        if (!c4iw_debugfs_root)
+                printk(KERN_WARNING MOD
+                       "could not create debugfs entry, continuing\n");
+
+        cxgb4_register_uld(CXGB4_ULD_RDMA, &c4iw_uld_info);
+
+        return 0;
+}
+
+static void __exit c4iw_exit_module(void)
+{
+        struct c4iw_dev *dev, *tmp;
+
+        cxgb4_unregister_uld(CXGB4_ULD_RDMA);
+
+        mutex_lock(&dev_mutex);
+        list_for_each_entry_safe(dev, tmp, &dev_list, entry) {
+                c4iw_remove(dev);
+        }
+        mutex_unlock(&dev_mutex);
+
+        c4iw_cm_term();
+        debugfs_remove_recursive(c4iw_debugfs_root);
+}
+
+module_init(c4iw_init_module);
+module_exit(c4iw_exit_module);
diff --git a/drivers/infiniband/hw/cxgb4/ev.c b/drivers/infiniband/hw/cxgb4/ev.c
new file mode 100644
index 000000000000..491e76a0327f
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/ev.c
@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/slab.h>
+#include <linux/mman.h>
+#include <net/sock.h>
+
+#include "iw_cxgb4.h"
+
+static void post_qp_event(struct c4iw_dev *dev, struct c4iw_cq *chp,
+                          struct c4iw_qp *qhp,
+                          struct t4_cqe *err_cqe,
+                          enum ib_event_type ib_event)
+{
+        struct ib_event event;
+        struct c4iw_qp_attributes attrs;
+
+        if ((qhp->attr.state == C4IW_QP_STATE_ERROR) ||
+            (qhp->attr.state == C4IW_QP_STATE_TERMINATE)) {
+                PDBG("%s AE received after RTS - "
+                     "qp state %d qpid 0x%x status 0x%x\n", __func__,
+                     qhp->attr.state, qhp->wq.sq.qid, CQE_STATUS(err_cqe));
+                return;
+        }
+
+        printk(KERN_ERR MOD "AE qpid 0x%x opcode %d status 0x%x "
+               "type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+               CQE_QPID(err_cqe), CQE_OPCODE(err_cqe),
+               CQE_STATUS(err_cqe), CQE_TYPE(err_cqe),
+               CQE_WRID_HI(err_cqe), CQE_WRID_LOW(err_cqe));
+
+        if (qhp->attr.state == C4IW_QP_STATE_RTS) {
+                attrs.next_state = C4IW_QP_STATE_TERMINATE;
+                c4iw_modify_qp(qhp->rhp, qhp, C4IW_QP_ATTR_NEXT_STATE,
+                               &attrs, 1);
+        }
+
+        event.event = ib_event;
+        event.device = chp->ibcq.device;
+        if (ib_event == IB_EVENT_CQ_ERR)
+                event.element.cq = &chp->ibcq;
+        else
+                event.element.qp = &qhp->ibqp;
+        if (qhp->ibqp.event_handler)
+                (*qhp->ibqp.event_handler)(&event, qhp->ibqp.qp_context);
+
+        (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+}
+
+void c4iw_ev_dispatch(struct c4iw_dev *dev, struct t4_cqe *err_cqe)
+{
+        struct c4iw_cq *chp;
+        struct c4iw_qp *qhp;
+        u32 cqid;
+
+        spin_lock(&dev->lock);
+        qhp = get_qhp(dev, CQE_QPID(err_cqe));
+        if (!qhp) {
+                printk(KERN_ERR MOD "BAD AE qpid 0x%x opcode %d "
+                       "status 0x%x type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+                       CQE_QPID(err_cqe),
+                       CQE_OPCODE(err_cqe), CQE_STATUS(err_cqe),
+                       CQE_TYPE(err_cqe), CQE_WRID_HI(err_cqe),
+                       CQE_WRID_LOW(err_cqe));
+                spin_unlock(&dev->lock);
+                goto out;
+        }
+
+        if (SQ_TYPE(err_cqe))
+                cqid = qhp->attr.scq;
+        else
+                cqid = qhp->attr.rcq;
+        chp = get_chp(dev, cqid);
+        if (!chp) {
+                printk(KERN_ERR MOD "BAD AE cqid 0x%x qpid 0x%x opcode %d "
+                       "status 0x%x type %d wrid.hi 0x%x wrid.lo 0x%x\n",
+                       cqid, CQE_QPID(err_cqe),
+                       CQE_OPCODE(err_cqe), CQE_STATUS(err_cqe),
+                       CQE_TYPE(err_cqe), CQE_WRID_HI(err_cqe),
+                       CQE_WRID_LOW(err_cqe));
+                spin_unlock(&dev->lock);
+                goto out;
+        }
+
+        c4iw_qp_add_ref(&qhp->ibqp);
+        atomic_inc(&chp->refcnt);
+        spin_unlock(&dev->lock);
+
+        /* Bad incoming write */
+        if (RQ_TYPE(err_cqe) &&
+            (CQE_OPCODE(err_cqe) == FW_RI_RDMA_WRITE)) {
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_REQ_ERR);
+                goto done;
+        }
+
+        switch (CQE_STATUS(err_cqe)) {
+
+        /* Completion Events */
+        case T4_ERR_SUCCESS:
+                printk(KERN_ERR MOD "AE with status 0!\n");
+                break;
+
+        case T4_ERR_STAG:
+        case T4_ERR_PDID:
+        case T4_ERR_QPID:
+        case T4_ERR_ACCESS:
+        case T4_ERR_WRAP:
+        case T4_ERR_BOUND:
+        case T4_ERR_INVALIDATE_SHARED_MR:
+        case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_ACCESS_ERR);
+                break;
+
+        /* Device Fatal Errors */
+        case T4_ERR_ECC:
+        case T4_ERR_ECC_PSTAG:
+        case T4_ERR_INTERNAL_ERR:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_DEVICE_FATAL);
+                break;
+
+        /* QP Fatal Errors */
+        case T4_ERR_OUT_OF_RQE:
+        case T4_ERR_PBL_ADDR_BOUND:
+        case T4_ERR_CRC:
+        case T4_ERR_MARKER:
+        case T4_ERR_PDU_LEN_ERR:
+        case T4_ERR_DDP_VERSION:
+        case T4_ERR_RDMA_VERSION:
+        case T4_ERR_OPCODE:
+        case T4_ERR_DDP_QUEUE_NUM:
+        case T4_ERR_MSN:
+        case T4_ERR_TBIT:
+        case T4_ERR_MO:
+        case T4_ERR_MSN_GAP:
+        case T4_ERR_MSN_RANGE:
+        case T4_ERR_RQE_ADDR_BOUND:
+        case T4_ERR_IRD_OVERFLOW:
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_FATAL);
+                break;
+
+        default:
+                printk(KERN_ERR MOD "Unknown T4 status 0x%x QPID 0x%x\n",
+                       CQE_STATUS(err_cqe), qhp->wq.sq.qid);
+                post_qp_event(dev, chp, qhp, err_cqe, IB_EVENT_QP_FATAL);
+                break;
+        }
+done:
+        if (atomic_dec_and_test(&chp->refcnt))
+                wake_up(&chp->wait);
+        c4iw_qp_rem_ref(&qhp->ibqp);
+out:
+        return;
+}
+
+int c4iw_ev_handler(struct c4iw_dev *dev, u32 qid)
+{
+        struct c4iw_cq *chp;
+
+        chp = get_chp(dev, qid);
+        if (chp)
+                (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+        else
+                PDBG("%s unknown cqid 0x%x\n", __func__, qid);
+        return 0;
+}
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
new file mode 100644
index 000000000000..a6269981e815
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -0,0 +1,745 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __IW_CXGB4_H__
+#define __IW_CXGB4_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+#include <linux/workqueue.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/inet.h>
+#include <linux/wait.h>
+#include <linux/kref.h>
+#include <linux/timer.h>
+#include <linux/io.h>
+#include <linux/kfifo.h>
+
+#include <asm/byteorder.h>
+
+#include <net/net_namespace.h>
+
+#include <rdma/ib_verbs.h>
+#include <rdma/iw_cm.h>
+
+#include "cxgb4.h"
+#include "cxgb4_uld.h"
+#include "l2t.h"
+#include "user.h"
+
+#define DRV_NAME "iw_cxgb4"
+#define MOD DRV_NAME ":"
+
+extern int c4iw_debug;
+#define PDBG(fmt, args...) \
+do { \
+        if (c4iw_debug) \
+                printk(MOD fmt, ## args); \
+} while (0)
+
+#include "t4.h"
+
+#define PBL_OFF(rdev_p, a) ((a) - (rdev_p)->lldi.vr->pbl.start)
+#define RQT_OFF(rdev_p, a) ((a) - (rdev_p)->lldi.vr->rq.start)
+
+static inline void *cplhdr(struct sk_buff *skb)
+{
+        return skb->data;
+}
+
+#define C4IW_WR_TO (10*HZ)
+
+struct c4iw_wr_wait {
+        wait_queue_head_t wait;
+        int done;
+        int ret;
+};
+
+static inline void c4iw_init_wr_wait(struct c4iw_wr_wait *wr_waitp)
+{
+        wr_waitp->ret = 0;
+        wr_waitp->done = 0;
+        init_waitqueue_head(&wr_waitp->wait);
+}
+
+struct c4iw_resource {
+        struct kfifo tpt_fifo;
+        spinlock_t tpt_fifo_lock;
+        struct kfifo qid_fifo;
+        spinlock_t qid_fifo_lock;
+        struct kfifo pdid_fifo;
+        spinlock_t pdid_fifo_lock;
+};
+
+struct c4iw_qid_list {
+        struct list_head entry;
+        u32 qid;
+};
+
+struct c4iw_dev_ucontext {
+        struct list_head qpids;
+        struct list_head cqids;
+        struct mutex lock;
+};
+
+enum c4iw_rdev_flags {
+        T4_FATAL_ERROR = (1<<0),
+};
+
+struct c4iw_rdev {
+        struct c4iw_resource resource;
+        unsigned long qpshift;
+        u32 qpmask;
+        unsigned long cqshift;
+        u32 cqmask;
+        struct c4iw_dev_ucontext uctx;
+        struct gen_pool *pbl_pool;
+        struct gen_pool *rqt_pool;
+        u32 flags;
+        struct cxgb4_lld_info lldi;
+};
+
+static inline int c4iw_fatal_error(struct c4iw_rdev *rdev)
+{
+        return rdev->flags & T4_FATAL_ERROR;
+}
+
+static inline int c4iw_num_stags(struct c4iw_rdev *rdev)
+{
+        return min((int)T4_MAX_NUM_STAG, (int)(rdev->lldi.vr->stag.size >> 5));
+}
+
+struct c4iw_dev {
+        struct ib_device ibdev;
+        struct c4iw_rdev rdev;
+        u32 device_cap_flags;
+        struct idr cqidr;
+        struct idr qpidr;
+        struct idr mmidr;
+        spinlock_t lock;
+        struct list_head entry;
+        struct delayed_work db_drop_task;
+        struct dentry *debugfs_root;
+};
+
+static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
+{
+        return container_of(ibdev, struct c4iw_dev, ibdev);
+}
+
+static inline struct c4iw_dev *rdev_to_c4iw_dev(struct c4iw_rdev *rdev)
+{
+        return container_of(rdev, struct c4iw_dev, rdev);
+}
+
+static inline struct c4iw_cq *get_chp(struct c4iw_dev *rhp, u32 cqid)
+{
+        return idr_find(&rhp->cqidr, cqid);
+}
+
+static inline struct c4iw_qp *get_qhp(struct c4iw_dev *rhp, u32 qpid)
+{
+        return idr_find(&rhp->qpidr, qpid);
+}
+
+static inline struct c4iw_mr *get_mhp(struct c4iw_dev *rhp, u32 mmid)
+{
+        return idr_find(&rhp->mmidr, mmid);
+}
+
+static inline int insert_handle(struct c4iw_dev *rhp, struct idr *idr,
+                                void *handle, u32 id)
+{
+        int ret;
+        int newid;
+
+        do {
+                if (!idr_pre_get(idr, GFP_KERNEL))
+                        return -ENOMEM;
+                spin_lock_irq(&rhp->lock);
+                ret = idr_get_new_above(idr, handle, id, &newid);
+                BUG_ON(newid != id);
+                spin_unlock_irq(&rhp->lock);
+        } while (ret == -EAGAIN);
+
+        return ret;
+}
+
+static inline void remove_handle(struct c4iw_dev *rhp, struct idr *idr, u32 id)
+{
+        spin_lock_irq(&rhp->lock);
+        idr_remove(idr, id);
+        spin_unlock_irq(&rhp->lock);
+}
+
+struct c4iw_pd {
+        struct ib_pd ibpd;
+        u32 pdid;
+        struct c4iw_dev *rhp;
+};
+
+static inline struct c4iw_pd *to_c4iw_pd(struct ib_pd *ibpd)
+{
+        return container_of(ibpd, struct c4iw_pd, ibpd);
+}
+
+struct tpt_attributes {
+        u64 len;
+        u64 va_fbo;
+        enum fw_ri_mem_perms perms;
+        u32 stag;
+        u32 pdid;
+        u32 qpid;
+        u32 pbl_addr;
+        u32 pbl_size;
+        u32 state:1;
+        u32 type:2;
+        u32 rsvd:1;
+        u32 remote_invaliate_disable:1;
+        u32 zbva:1;
+        u32 mw_bind_enable:1;
+        u32 page_size:5;
+};
+
+struct c4iw_mr {
+        struct ib_mr ibmr;
+        struct ib_umem *umem;
+        struct c4iw_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+static inline struct c4iw_mr *to_c4iw_mr(struct ib_mr *ibmr)
+{
+        return container_of(ibmr, struct c4iw_mr, ibmr);
+}
+
+struct c4iw_mw {
+        struct ib_mw ibmw;
+        struct c4iw_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+static inline struct c4iw_mw *to_c4iw_mw(struct ib_mw *ibmw)
+{
+        return container_of(ibmw, struct c4iw_mw, ibmw);
+}
+
+struct c4iw_fr_page_list {
+        struct ib_fast_reg_page_list ibpl;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        dma_addr_t dma_addr;
+        struct c4iw_dev *dev;
+        int size;
+};
+
+static inline struct c4iw_fr_page_list *to_c4iw_fr_page_list(
+                                        struct ib_fast_reg_page_list *ibpl)
+{
+        return container_of(ibpl, struct c4iw_fr_page_list, ibpl);
+}
+
+struct c4iw_cq {
+        struct ib_cq ibcq;
+        struct c4iw_dev *rhp;
+        struct t4_cq cq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+};
+
+static inline struct c4iw_cq *to_c4iw_cq(struct ib_cq *ibcq)
+{
+        return container_of(ibcq, struct c4iw_cq, ibcq);
+}
+
+struct c4iw_mpa_attributes {
+        u8 initiator;
+        u8 recv_marker_enabled;
+        u8 xmit_marker_enabled;
+        u8 crc_enabled;
+        u8 version;
+        u8 p2p_type;
+};
+
+struct c4iw_qp_attributes {
+        u32 scq;
+        u32 rcq;
+        u32 sq_num_entries;
+        u32 rq_num_entries;
+        u32 sq_max_sges;
+        u32 sq_max_sges_rdma_write;
+        u32 rq_max_sges;
+        u32 state;
+        u8 enable_rdma_read;
+        u8 enable_rdma_write;
+        u8 enable_bind;
+        u8 enable_mmid0_fastreg;
+        u32 max_ord;
+        u32 max_ird;
+        u32 pd;
+        u32 next_state;
+        char terminate_buffer[52];
+        u32 terminate_msg_len;
+        u8 is_terminate_local;
+        struct c4iw_mpa_attributes mpa_attr;
+        struct c4iw_ep *llp_stream_handle;
+};
+
+struct c4iw_qp {
+        struct ib_qp ibqp;
+        struct c4iw_dev *rhp;
+        struct c4iw_ep *ep;
+        struct c4iw_qp_attributes attr;
+        struct t4_wq wq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+        struct timer_list timer;
+};
+
+static inline struct c4iw_qp *to_c4iw_qp(struct ib_qp *ibqp)
+{
+        return container_of(ibqp, struct c4iw_qp, ibqp);
+}
+
+struct c4iw_ucontext {
+        struct ib_ucontext ibucontext;
+        struct c4iw_dev_ucontext uctx;
+        u32 key;
+        spinlock_t mmap_lock;
+        struct list_head mmaps;
+};
+
+static inline struct c4iw_ucontext *to_c4iw_ucontext(struct ib_ucontext *c)
+{
+        return container_of(c, struct c4iw_ucontext, ibucontext);
+}
+
+struct c4iw_mm_entry {
+        struct list_head entry;
+        u64 addr;
+        u32 key;
+        unsigned len;
+};
+
+static inline struct c4iw_mm_entry *remove_mmap(struct c4iw_ucontext *ucontext,
+                                                u32 key, unsigned len)
+{
+        struct list_head *pos, *nxt;
+        struct c4iw_mm_entry *mm;
+
+        spin_lock(&ucontext->mmap_lock);
+        list_for_each_safe(pos, nxt, &ucontext->mmaps) {
+
+                mm = list_entry(pos, struct c4iw_mm_entry, entry);
+                if (mm->key == key && mm->len == len) {
+                        list_del_init(&mm->entry);
+                        spin_unlock(&ucontext->mmap_lock);
+                        PDBG("%s key 0x%x addr 0x%llx len %d\n", __func__,
+                             key, (unsigned long long) mm->addr, mm->len);
+                        return mm;
+                }
+        }
+        spin_unlock(&ucontext->mmap_lock);
+        return NULL;
+}
+
+static inline void insert_mmap(struct c4iw_ucontext *ucontext,
+                               struct c4iw_mm_entry *mm)
+{
+        spin_lock(&ucontext->mmap_lock);
+        PDBG("%s key 0x%x addr 0x%llx len %d\n", __func__,
+             mm->key, (unsigned long long) mm->addr, mm->len);
+        list_add_tail(&mm->entry, &ucontext->mmaps);
+        spin_unlock(&ucontext->mmap_lock);
+}
+
+enum c4iw_qp_attr_mask {
+        C4IW_QP_ATTR_NEXT_STATE = 1 << 0,
+        C4IW_QP_ATTR_ENABLE_RDMA_READ = 1 << 7,
+        C4IW_QP_ATTR_ENABLE_RDMA_WRITE = 1 << 8,
+        C4IW_QP_ATTR_ENABLE_RDMA_BIND = 1 << 9,
+        C4IW_QP_ATTR_MAX_ORD = 1 << 11,
+        C4IW_QP_ATTR_MAX_IRD = 1 << 12,
+        C4IW_QP_ATTR_LLP_STREAM_HANDLE = 1 << 22,
+        C4IW_QP_ATTR_STREAM_MSG_BUFFER = 1 << 23,
+        C4IW_QP_ATTR_MPA_ATTR = 1 << 24,
+        C4IW_QP_ATTR_QP_CONTEXT_ACTIVATE = 1 << 25,
+        C4IW_QP_ATTR_VALID_MODIFY = (C4IW_QP_ATTR_ENABLE_RDMA_READ |
+                                     C4IW_QP_ATTR_ENABLE_RDMA_WRITE |
+                                     C4IW_QP_ATTR_MAX_ORD |
+                                     C4IW_QP_ATTR_MAX_IRD |
+                                     C4IW_QP_ATTR_LLP_STREAM_HANDLE |
+                                     C4IW_QP_ATTR_STREAM_MSG_BUFFER |
+                                     C4IW_QP_ATTR_MPA_ATTR |
+                                     C4IW_QP_ATTR_QP_CONTEXT_ACTIVATE)
+};
+
+int c4iw_modify_qp(struct c4iw_dev *rhp,
+                                struct c4iw_qp *qhp,
+                                enum c4iw_qp_attr_mask mask,
+                                struct c4iw_qp_attributes *attrs,
+                                int internal);
+
+enum c4iw_qp_state {
+        C4IW_QP_STATE_IDLE,
+        C4IW_QP_STATE_RTS,
+        C4IW_QP_STATE_ERROR,
+        C4IW_QP_STATE_TERMINATE,
+        C4IW_QP_STATE_CLOSING,
+        C4IW_QP_STATE_TOT
+};
+
+static inline int c4iw_convert_state(enum ib_qp_state ib_state)
+{
+        switch (ib_state) {
+        case IB_QPS_RESET:
+        case IB_QPS_INIT:
+                return C4IW_QP_STATE_IDLE;
+        case IB_QPS_RTS:
+                return C4IW_QP_STATE_RTS;
+        case IB_QPS_SQD:
+                return C4IW_QP_STATE_CLOSING;
+        case IB_QPS_SQE:
+                return C4IW_QP_STATE_TERMINATE;
+        case IB_QPS_ERR:
+                return C4IW_QP_STATE_ERROR;
+        default:
+                return -1;
+        }
+}
+
+static inline u32 c4iw_ib_to_tpt_access(int a)
+{
+        return (a & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
+               (a & IB_ACCESS_REMOTE_READ ? FW_RI_MEM_ACCESS_REM_READ : 0) |
+               (a & IB_ACCESS_LOCAL_WRITE ? FW_RI_MEM_ACCESS_LOCAL_WRITE : 0) |
+               FW_RI_MEM_ACCESS_LOCAL_READ;
+}
+
+static inline u32 c4iw_ib_to_tpt_bind_access(int acc)
+{
+        return (acc & IB_ACCESS_REMOTE_WRITE ? FW_RI_MEM_ACCESS_REM_WRITE : 0) |
+               (acc & IB_ACCESS_REMOTE_READ ? FW_RI_MEM_ACCESS_REM_READ : 0);
+}
+
+enum c4iw_mmid_state {
+        C4IW_STAG_STATE_VALID,
+        C4IW_STAG_STATE_INVALID
+};
+
+#define C4IW_NODE_DESC "cxgb4 Chelsio Communications"
+
+#define MPA_KEY_REQ "MPA ID Req Frame"
+#define MPA_KEY_REP "MPA ID Rep Frame"
+
+#define MPA_MAX_PRIVATE_DATA    256
+#define MPA_REJECT              0x20
+#define MPA_CRC                 0x40
+#define MPA_MARKERS             0x80
+#define MPA_FLAGS_MASK          0xE0
+
+#define c4iw_put_ep(ep) { \
+        PDBG("put_ep (via %s:%u) ep %p refcnt %d\n", __func__, __LINE__,  \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        WARN_ON(atomic_read(&((ep)->kref.refcount)) < 1); \
+        kref_put(&((ep)->kref), _c4iw_free_ep); \
+}
+
+#define c4iw_get_ep(ep) { \
+        PDBG("get_ep (via %s:%u) ep %p, refcnt %d\n", __func__, __LINE__, \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        kref_get(&((ep)->kref));  \
+}
+void _c4iw_free_ep(struct kref *kref);
+
+struct mpa_message {
+        u8 key[16];
+        u8 flags;
+        u8 revision;
+        __be16 private_data_size;
+        u8 private_data[0];
+};
+
+struct terminate_message {
+        u8 layer_etype;
+        u8 ecode;
+        __be16 hdrct_rsvd;
+        u8 len_hdrs[0];
+};
+
+#define TERM_MAX_LENGTH (sizeof(struct terminate_message) + 2 + 18 + 28)
+
+enum c4iw_layers_types {
+        LAYER_RDMAP             = 0x00,
+        LAYER_DDP               = 0x10,
+        LAYER_MPA               = 0x20,
+        RDMAP_LOCAL_CATA        = 0x00,
+        RDMAP_REMOTE_PROT       = 0x01,
+        RDMAP_REMOTE_OP         = 0x02,
+        DDP_LOCAL_CATA          = 0x00,
+        DDP_TAGGED_ERR          = 0x01,
+        DDP_UNTAGGED_ERR        = 0x02,
+        DDP_LLP                 = 0x03
+};
+
+enum c4iw_rdma_ecodes {
+        RDMAP_INV_STAG          = 0x00,
+        RDMAP_BASE_BOUNDS       = 0x01,
+        RDMAP_ACC_VIOL          = 0x02,
+        RDMAP_STAG_NOT_ASSOC    = 0x03,
+        RDMAP_TO_WRAP           = 0x04,
+        RDMAP_INV_VERS          = 0x05,
+        RDMAP_INV_OPCODE        = 0x06,
+        RDMAP_STREAM_CATA       = 0x07,
+        RDMAP_GLOBAL_CATA       = 0x08,
+        RDMAP_CANT_INV_STAG     = 0x09,
+        RDMAP_UNSPECIFIED       = 0xff
+};
+
+enum c4iw_ddp_ecodes {
+        DDPT_INV_STAG           = 0x00,
+        DDPT_BASE_BOUNDS        = 0x01,
+        DDPT_STAG_NOT_ASSOC     = 0x02,
+        DDPT_TO_WRAP            = 0x03,
+        DDPT_INV_VERS           = 0x04,
+        DDPU_INV_QN             = 0x01,
+        DDPU_INV_MSN_NOBUF      = 0x02,
+        DDPU_INV_MSN_RANGE      = 0x03,
+        DDPU_INV_MO             = 0x04,
+        DDPU_MSG_TOOBIG         = 0x05,
+        DDPU_INV_VERS           = 0x06
+};
+
+enum c4iw_mpa_ecodes {
+        MPA_CRC_ERR             = 0x02,
+        MPA_MARKER_ERR          = 0x03
+};
+
+enum c4iw_ep_state {
+        IDLE = 0,
+        LISTEN,
+        CONNECTING,
+        MPA_REQ_WAIT,
+        MPA_REQ_SENT,
+        MPA_REQ_RCVD,
+        MPA_REP_SENT,
+        FPDU_MODE,
+        ABORTING,
+        CLOSING,
+        MORIBUND,
+        DEAD,
+};
+
+enum c4iw_ep_flags {
+        PEER_ABORT_IN_PROGRESS  = 0,
+        ABORT_REQ_IN_PROGRESS   = 1,
+        RELEASE_RESOURCES       = 2,
+        CLOSE_SENT              = 3,
+};
+
+struct c4iw_ep_common {
+        struct iw_cm_id *cm_id;
+        struct c4iw_qp *qp;
+        struct c4iw_dev *dev;
+        enum c4iw_ep_state state;
+        struct kref kref;
+        spinlock_t lock;
+        struct sockaddr_in local_addr;
+        struct sockaddr_in remote_addr;
+        wait_queue_head_t waitq;
+        int rpl_done;
+        int rpl_err;
+        unsigned long flags;
+};
+
+struct c4iw_listen_ep {
+        struct c4iw_ep_common com;
+        unsigned int stid;
+        int backlog;
+};
+
+struct c4iw_ep {
+        struct c4iw_ep_common com;
+        struct c4iw_ep *parent_ep;
+        struct timer_list timer;
+        struct list_head entry;
+        unsigned int atid;
+        u32 hwtid;
+        u32 snd_seq;
+        u32 rcv_seq;
+        struct l2t_entry *l2t;
+        struct dst_entry *dst;
+        struct sk_buff *mpa_skb;
+        struct c4iw_mpa_attributes mpa_attr;
+        u8 mpa_pkt[sizeof(struct mpa_message) + MPA_MAX_PRIVATE_DATA];
+        unsigned int mpa_pkt_len;
+        u32 ird;
+        u32 ord;
+        u32 smac_idx;
+        u32 tx_chan;
+        u32 mtu;
+        u16 mss;
+        u16 emss;
+        u16 plen;
+        u16 rss_qid;
+        u16 txq_idx;
+        u8 tos;
+};
+
+static inline struct c4iw_ep *to_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline struct c4iw_listen_ep *to_listen_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline int compute_wscale(int win)
+{
+        int wscale = 0;
+
+        while (wscale < 14 && (65535<<wscale) < win)
+                wscale++;
+        return wscale;
+}
+
+typedef int (*c4iw_handler_func)(struct c4iw_dev *dev, struct sk_buff *skb);
+
+int c4iw_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
+                     struct l2t_entry *l2t);
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qpid,
+                   struct c4iw_dev_ucontext *uctx);
+u32 c4iw_get_resource(struct kfifo *fifo, spinlock_t *lock);
+void c4iw_put_resource(struct kfifo *fifo, u32 entry, spinlock_t *lock);
+int c4iw_init_resource(struct c4iw_rdev *rdev, u32 nr_tpt, u32 nr_pdid);
+int c4iw_init_ctrl_qp(struct c4iw_rdev *rdev);
+int c4iw_pblpool_create(struct c4iw_rdev *rdev);
+int c4iw_rqtpool_create(struct c4iw_rdev *rdev);
+void c4iw_pblpool_destroy(struct c4iw_rdev *rdev);
+void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev);
+void c4iw_destroy_resource(struct c4iw_resource *rscp);
+int c4iw_destroy_ctrl_qp(struct c4iw_rdev *rdev);
+int c4iw_register_device(struct c4iw_dev *dev);
+void c4iw_unregister_device(struct c4iw_dev *dev);
+int __init c4iw_cm_init(void);
+void __exit c4iw_cm_term(void);
+void c4iw_release_dev_ucontext(struct c4iw_rdev *rdev,
+                               struct c4iw_dev_ucontext *uctx);
+void c4iw_init_dev_ucontext(struct c4iw_rdev *rdev,
+                            struct c4iw_dev_ucontext *uctx);
+int c4iw_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
+int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                      struct ib_send_wr **bad_wr);
+int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr);
+int c4iw_bind_mw(struct ib_qp *qp, struct ib_mw *mw,
+                 struct ib_mw_bind *mw_bind);
+int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog);
+int c4iw_destroy_listen(struct iw_cm_id *cm_id);
+int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int c4iw_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len);
+void c4iw_qp_add_ref(struct ib_qp *qp);
+void c4iw_qp_rem_ref(struct ib_qp *qp);
+void c4iw_free_fastreg_pbl(struct ib_fast_reg_page_list *page_list);
+struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(
+                                        struct ib_device *device,
+                                        int page_list_len);
+struct ib_mr *c4iw_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth);
+int c4iw_dealloc_mw(struct ib_mw *mw);
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd);
+struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start,
+                                           u64 length, u64 virt, int acc,
+                                           struct ib_udata *udata);
+struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc);
+struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
+                                        struct ib_phys_buf *buffer_list,
+                                        int num_phys_buf,
+                                        int acc,
+                                        u64 *iova_start);
+int c4iw_reregister_phys_mem(struct ib_mr *mr,
+                                     int mr_rereg_mask,
+                                     struct ib_pd *pd,
+                                     struct ib_phys_buf *buffer_list,
+                                     int num_phys_buf,
+                                     int acc, u64 *iova_start);
+int c4iw_dereg_mr(struct ib_mr *ib_mr);
+int c4iw_destroy_cq(struct ib_cq *ib_cq);
+struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
+                                        int vector,
+                                        struct ib_ucontext *ib_context,
+                                        struct ib_udata *udata);
+int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata);
+int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags);
+int c4iw_destroy_qp(struct ib_qp *ib_qp);
+struct ib_qp *c4iw_create_qp(struct ib_pd *pd,
+                             struct ib_qp_init_attr *attrs,
+                             struct ib_udata *udata);
+int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                                 int attr_mask, struct ib_udata *udata);
+struct ib_qp *c4iw_get_qp(struct ib_device *dev, int qpn);
+u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size);
+void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
+u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size);
+void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size);
+int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb);
+void c4iw_flush_hw_cq(struct t4_cq *cq);
+void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
+void c4iw_count_scqes(struct t4_cq *cq, struct t4_wq *wq, int *count);
+int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp);
+int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count);
+int c4iw_flush_sq(struct t4_wq *wq, struct t4_cq *cq, int count);
+int c4iw_ev_handler(struct c4iw_dev *rnicp, u32 qid);
+u16 c4iw_rqes_posted(struct c4iw_qp *qhp);
+int c4iw_post_zb_read(struct c4iw_qp *qhp);
+int c4iw_post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe);
+u32 c4iw_get_cqid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
+void c4iw_put_cqid(struct c4iw_rdev *rdev, u32 qid,
+                struct c4iw_dev_ucontext *uctx);
+u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx);
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qid,
+                struct c4iw_dev_ucontext *uctx);
+void c4iw_ev_dispatch(struct c4iw_dev *dev, struct t4_cqe *err_cqe);
+
+extern struct cxgb4_client t4c_client;
+extern c4iw_handler_func c4iw_handlers[NUM_CPL_CMDS];
+extern int c4iw_max_read_depth;
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
new file mode 100644
index 000000000000..e54ff6d25691
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -0,0 +1,811 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_umem.h>
+#include <asm/atomic.h>
+
+#include "iw_cxgb4.h"
+
+#define T4_ULPTX_MIN_IO 32
+#define C4IW_MAX_INLINE_SIZE 96
+
+static int write_adapter_mem(struct c4iw_rdev *rdev, u32 addr, u32 len,
+                             void *data)
+{
+        struct sk_buff *skb;
+        struct ulp_mem_io *req;
+        struct ulptx_idata *sc;
+        u8 wr_len, *to_dp, *from_dp;
+        int copy_len, num_wqe, i, ret = 0;
+        struct c4iw_wr_wait wr_wait;
+
+        addr &= 0x7FFFFFF;
+        PDBG("%s addr 0x%x len %u\n", __func__, addr, len);
+        num_wqe = DIV_ROUND_UP(len, C4IW_MAX_INLINE_SIZE);
+        c4iw_init_wr_wait(&wr_wait);
+        for (i = 0; i < num_wqe; i++) {
+
+                copy_len = len > C4IW_MAX_INLINE_SIZE ? C4IW_MAX_INLINE_SIZE :
+                           len;
+                wr_len = roundup(sizeof *req + sizeof *sc +
+                                 roundup(copy_len, T4_ULPTX_MIN_IO), 16);
+
+                skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+                if (!skb)
+                        return -ENOMEM;
+                set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+                req = (struct ulp_mem_io *)__skb_put(skb, wr_len);
+                memset(req, 0, wr_len);
+                INIT_ULPTX_WR(req, wr_len, 0, 0);
+
+                if (i == (num_wqe-1)) {
+                        req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR) |
+                                                    FW_WR_COMPL(1));
+                        req->wr.wr_lo = (__force __be64)&wr_wait;
+                } else
+                        req->wr.wr_hi = cpu_to_be32(FW_WR_OP(FW_ULPTX_WR));
+                req->wr.wr_mid = cpu_to_be32(
+                                       FW_WR_LEN16(DIV_ROUND_UP(wr_len, 16)));
+
+                req->cmd = cpu_to_be32(ULPTX_CMD(ULP_TX_MEM_WRITE) | (1<<23));
+                req->dlen = cpu_to_be32(ULP_MEMIO_DATA_LEN(
+                                DIV_ROUND_UP(copy_len, T4_ULPTX_MIN_IO)));
+                req->len16 = cpu_to_be32(DIV_ROUND_UP(wr_len-sizeof(req->wr),
+                                                      16));
+                req->lock_addr = cpu_to_be32(ULP_MEMIO_ADDR(addr + i * 3));
+
+                sc = (struct ulptx_idata *)(req + 1);
+                sc->cmd_more = cpu_to_be32(ULPTX_CMD(ULP_TX_SC_IMM));
+                sc->len = cpu_to_be32(roundup(copy_len, T4_ULPTX_MIN_IO));
+
+                to_dp = (u8 *)(sc + 1);
+                from_dp = (u8 *)data + i * C4IW_MAX_INLINE_SIZE;
+                if (data)
+                        memcpy(to_dp, from_dp, copy_len);
+                else
+                        memset(to_dp, 0, copy_len);
+                if (copy_len % T4_ULPTX_MIN_IO)
+                        memset(to_dp + copy_len, 0, T4_ULPTX_MIN_IO -
+                               (copy_len % T4_ULPTX_MIN_IO));
+                ret = c4iw_ofld_send(rdev, skb);
+                if (ret)
+                        return ret;
+                len -= C4IW_MAX_INLINE_SIZE;
+        }
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        return ret;
+}
+
+/*
+ * Build and write a TPT entry.
+ * IN: stag key, pdid, perm, bind_enabled, zbva, to, len, page_size,
+ *     pbl_size and pbl_addr
+ * OUT: stag index
+ */
+static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
+                           u32 *stag, u8 stag_state, u32 pdid,
+                           enum fw_ri_stag_type type, enum fw_ri_mem_perms perm,
+                           int bind_enabled, u32 zbva, u64 to,
+                           u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr)
+{
+        int err;
+        struct fw_ri_tpte tpt;
+        u32 stag_idx;
+        static atomic_t key;
+
+        if (c4iw_fatal_error(rdev))
+                return -EIO;
+
+        stag_state = stag_state > 0;
+        stag_idx = (*stag) >> 8;
+
+        if ((!reset_tpt_entry) && (*stag == T4_STAG_UNSET)) {
+                stag_idx = c4iw_get_resource(&rdev->resource.tpt_fifo,
+                                             &rdev->resource.tpt_fifo_lock);
+                if (!stag_idx)
+                        return -ENOMEM;
+                *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
+        }
+        PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
+             __func__, stag_state, type, pdid, stag_idx);
+
+        /* write TPT entry */
+        if (reset_tpt_entry)
+                memset(&tpt, 0, sizeof(tpt));
+        else {
+                tpt.valid_to_pdid = cpu_to_be32(F_FW_RI_TPTE_VALID |
+                        V_FW_RI_TPTE_STAGKEY((*stag & M_FW_RI_TPTE_STAGKEY)) |
+                        V_FW_RI_TPTE_STAGSTATE(stag_state) |
+                        V_FW_RI_TPTE_STAGTYPE(type) | V_FW_RI_TPTE_PDID(pdid));
+                tpt.locread_to_qpid = cpu_to_be32(V_FW_RI_TPTE_PERM(perm) |
+                        (bind_enabled ? F_FW_RI_TPTE_MWBINDEN : 0) |
+                        V_FW_RI_TPTE_ADDRTYPE((zbva ? FW_RI_ZERO_BASED_TO :
+                                                      FW_RI_VA_BASED_TO))|
+                        V_FW_RI_TPTE_PS(page_size));
+                tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+                        V_FW_RI_TPTE_PBLADDR(PBL_OFF(rdev, pbl_addr)>>3));
+                tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+                tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+                tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+                tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+                tpt.len_hi = cpu_to_be32((u32)(len >> 32));
+        }
+        err = write_adapter_mem(rdev, stag_idx +
+                                (rdev->lldi.vr->stag.start >> 5),
+                                sizeof(tpt), &tpt);
+
+        if (reset_tpt_entry)
+                c4iw_put_resource(&rdev->resource.tpt_fifo, stag_idx,
+                                  &rdev->resource.tpt_fifo_lock);
+        return err;
+}
+
+static int write_pbl(struct c4iw_rdev *rdev, __be64 *pbl,
+                     u32 pbl_addr, u32 pbl_size)
+{
+        int err;
+
+        PDBG("%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d\n",
+             __func__, pbl_addr, rdev->lldi.vr->pbl.start,
+             pbl_size);
+
+        err = write_adapter_mem(rdev, pbl_addr >> 5, pbl_size << 3, pbl);
+        return err;
+}
+
+static int dereg_mem(struct c4iw_rdev *rdev, u32 stag, u32 pbl_size,
+                     u32 pbl_addr)
+{
+        return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0,
+                               pbl_size, pbl_addr);
+}
+
+static int allocate_window(struct c4iw_rdev *rdev, u32 * stag, u32 pdid)
+{
+        *stag = T4_STAG_UNSET;
+        return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_MW, 0, 0, 0,
+                               0UL, 0, 0, 0, 0);
+}
+
+static int deallocate_window(struct c4iw_rdev *rdev, u32 stag)
+{
+        return write_tpt_entry(rdev, 1, &stag, 0, 0, 0, 0, 0, 0, 0UL, 0, 0, 0,
+                               0);
+}
+
+static int allocate_stag(struct c4iw_rdev *rdev, u32 *stag, u32 pdid,
+                         u32 pbl_size, u32 pbl_addr)
+{
+        *stag = T4_STAG_UNSET;
+        return write_tpt_entry(rdev, 0, stag, 0, pdid, FW_RI_STAG_NSMR, 0, 0, 0,
+                               0UL, 0, 0, pbl_size, pbl_addr);
+}
+
+static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag)
+{
+        u32 mmid;
+
+        mhp->attr.state = 1;
+        mhp->attr.stag = stag;
+        mmid = stag >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        PDBG("%s mmid 0x%x mhp %p\n", __func__, mmid, mhp);
+        return insert_handle(mhp->rhp, &mhp->rhp->mmidr, mhp, mmid);
+}
+
+static int register_mem(struct c4iw_dev *rhp, struct c4iw_pd *php,
+                      struct c4iw_mr *mhp, int shift)
+{
+        u32 stag = T4_STAG_UNSET;
+        int ret;
+
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, mhp->attr.pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, mhp->attr.zbva,
+                              mhp->attr.va_fbo, mhp->attr.len, shift - 12,
+                              mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                return ret;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        return ret;
+}
+
+static int reregister_mem(struct c4iw_dev *rhp, struct c4iw_pd *php,
+                          struct c4iw_mr *mhp, int shift, int npages)
+{
+        u32 stag;
+        int ret;
+
+        if (npages > mhp->attr.pbl_size)
+                return -ENOMEM;
+
+        stag = mhp->attr.stag;
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, mhp->attr.pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, mhp->attr.zbva,
+                              mhp->attr.va_fbo, mhp->attr.len, shift - 12,
+                              mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                return ret;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+
+        return ret;
+}
+
+static int alloc_pbl(struct c4iw_mr *mhp, int npages)
+{
+        mhp->attr.pbl_addr = c4iw_pblpool_alloc(&mhp->rhp->rdev,
+                                                    npages << 3);
+
+        if (!mhp->attr.pbl_addr)
+                return -ENOMEM;
+
+        mhp->attr.pbl_size = npages;
+
+        return 0;
+}
+
+static int build_phys_page_list(struct ib_phys_buf *buffer_list,
+                                int num_phys_buf, u64 *iova_start,
+                                u64 *total_size, int *npages,
+                                int *shift, __be64 **page_list)
+{
+        u64 mask;
+        int i, j, n;
+
+        mask = 0;
+        *total_size = 0;
+        for (i = 0; i < num_phys_buf; ++i) {
+                if (i != 0 && buffer_list[i].addr & ~PAGE_MASK)
+                        return -EINVAL;
+                if (i != 0 && i != num_phys_buf - 1 &&
+                    (buffer_list[i].size & ~PAGE_MASK))
+                        return -EINVAL;
+                *total_size += buffer_list[i].size;
+                if (i > 0)
+                        mask |= buffer_list[i].addr;
+                else
+                        mask |= buffer_list[i].addr & PAGE_MASK;
+                if (i != num_phys_buf - 1)
+                        mask |= buffer_list[i].addr + buffer_list[i].size;
+                else
+                        mask |= (buffer_list[i].addr + buffer_list[i].size +
+                                PAGE_SIZE - 1) & PAGE_MASK;
+        }
+
+        if (*total_size > 0xFFFFFFFFULL)
+                return -ENOMEM;
+
+        /* Find largest page shift we can use to cover buffers */
+        for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
+                if ((1ULL << *shift) & mask)
+                        break;
+
+        buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
+        buffer_list[0].addr &= ~0ull << *shift;
+
+        *npages = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                *npages += (buffer_list[i].size +
+                        (1ULL << *shift) - 1) >> *shift;
+
+        if (!*npages)
+                return -EINVAL;
+
+        *page_list = kmalloc(sizeof(u64) * *npages, GFP_KERNEL);
+        if (!*page_list)
+                return -ENOMEM;
+
+        n = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                for (j = 0;
+                     j < (buffer_list[i].size + (1ULL << *shift) - 1) >> *shift;
+                     ++j)
+                        (*page_list)[n++] = cpu_to_be64(buffer_list[i].addr +
+                            ((u64) j << *shift));
+
+        PDBG("%s va 0x%llx mask 0x%llx shift %d len %lld pbl_size %d\n",
+             __func__, (unsigned long long)*iova_start,
+             (unsigned long long)mask, *shift, (unsigned long long)*total_size,
+             *npages);
+
+        return 0;
+
+}
+
+int c4iw_reregister_phys_mem(struct ib_mr *mr, int mr_rereg_mask,
+                             struct ib_pd *pd, struct ib_phys_buf *buffer_list,
+                             int num_phys_buf, int acc, u64 *iova_start)
+{
+
+        struct c4iw_mr mh, *mhp;
+        struct c4iw_pd *php;
+        struct c4iw_dev *rhp;
+        __be64 *page_list = NULL;
+        int shift = 0;
+        u64 total_size;
+        int npages;
+        int ret;
+
+        PDBG("%s ib_mr %p ib_pd %p\n", __func__, mr, pd);
+
+        /* There can be no memory windows */
+        if (atomic_read(&mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_c4iw_mr(mr);
+        rhp = mhp->rhp;
+        php = to_c4iw_pd(mr->pd);
+
+        /* make sure we are on the same adapter */
+        if (rhp != php->rhp)
+                return -EINVAL;
+
+        memcpy(&mh, mhp, sizeof *mhp);
+
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                php = to_c4iw_pd(pd);
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS) {
+                mh.attr.perms = c4iw_ib_to_tpt_access(acc);
+                mh.attr.mw_bind_enable = (acc & IB_ACCESS_MW_BIND) ==
+                                         IB_ACCESS_MW_BIND;
+        }
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
+                ret = build_phys_page_list(buffer_list, num_phys_buf,
+                                                iova_start,
+                                                &total_size, &npages,
+                                                &shift, &page_list);
+                if (ret)
+                        return ret;
+        }
+
+        ret = reregister_mem(rhp, php, &mh, shift, npages);
+        kfree(page_list);
+        if (ret)
+                return ret;
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                mhp->attr.pdid = php->pdid;
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
+                mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
+                mhp->attr.zbva = 0;
+                mhp->attr.va_fbo = *iova_start;
+                mhp->attr.page_size = shift - 12;
+                mhp->attr.len = (u32) total_size;
+                mhp->attr.pbl_size = npages;
+        }
+
+        return 0;
+}
+
+struct ib_mr *c4iw_register_phys_mem(struct ib_pd *pd,
+                                     struct ib_phys_buf *buffer_list,
+                                     int num_phys_buf, int acc, u64 *iova_start)
+{
+        __be64 *page_list;
+        int shift;
+        u64 total_size;
+        int npages;
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        int ret;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+
+        /* First check that we have enough alignment */
+        if ((*iova_start & ~PAGE_MASK) != (buffer_list[0].addr & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (num_phys_buf > 1 &&
+            ((buffer_list[0].addr + buffer_list[0].size) & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        ret = build_phys_page_list(buffer_list, num_phys_buf, iova_start,
+                                        &total_size, &npages, &shift,
+                                        &page_list);
+        if (ret)
+                goto err;
+
+        ret = alloc_pbl(mhp, npages);
+        if (ret) {
+                kfree(page_list);
+                goto err_pbl;
+        }
+
+        ret = write_pbl(&mhp->rhp->rdev, page_list, mhp->attr.pbl_addr,
+                             npages);
+        kfree(page_list);
+        if (ret)
+                goto err_pbl;
+
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.va_fbo = *iova_start;
+        mhp->attr.page_size = shift - 12;
+
+        mhp->attr.len = (u32) total_size;
+        mhp->attr.pbl_size = npages;
+        ret = register_mem(rhp, php, mhp, shift);
+        if (ret)
+                goto err_pbl;
+
+        return &mhp->ibmr;
+
+err_pbl:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+
+err:
+        kfree(mhp);
+        return ERR_PTR(ret);
+
+}
+
+struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        int ret;
+        u32 stag = T4_STAG_UNSET;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.mw_bind_enable = (acc&IB_ACCESS_MW_BIND) == IB_ACCESS_MW_BIND;
+        mhp->attr.zbva = 0;
+        mhp->attr.va_fbo = 0;
+        mhp->attr.page_size = 0;
+        mhp->attr.len = ~0UL;
+        mhp->attr.pbl_size = 0;
+
+        ret = write_tpt_entry(&rhp->rdev, 0, &stag, 1, php->pdid,
+                              FW_RI_STAG_NSMR, mhp->attr.perms,
+                              mhp->attr.mw_bind_enable, 0, 0, ~0UL, 0, 0, 0);
+        if (ret)
+                goto err1;
+
+        ret = finish_mem_reg(mhp, stag);
+        if (ret)
+                goto err2;
+        return &mhp->ibmr;
+err2:
+        dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                  mhp->attr.pbl_addr);
+err1:
+        kfree(mhp);
+        return ERR_PTR(ret);
+}
+
+struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+                               u64 virt, int acc, struct ib_udata *udata)
+{
+        __be64 *pages;
+        int shift, n, len;
+        int i, j, k;
+        int err = 0;
+        struct ib_umem_chunk *chunk;
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+
+        if (length == ~0ULL)
+                return ERR_PTR(-EINVAL);
+
+        if ((length + start) < start)
+                return ERR_PTR(-EINVAL);
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        mhp->rhp = rhp;
+
+        mhp->umem = ib_umem_get(pd->uobject->context, start, length, acc, 0);
+        if (IS_ERR(mhp->umem)) {
+                err = PTR_ERR(mhp->umem);
+                kfree(mhp);
+                return ERR_PTR(err);
+        }
+
+        shift = ffs(mhp->umem->page_size) - 1;
+
+        n = 0;
+        list_for_each_entry(chunk, &mhp->umem->chunk_list, list)
+                n += chunk->nents;
+
+        err = alloc_pbl(mhp, n);
+        if (err)
+                goto err;
+
+        pages = (__be64 *) __get_free_page(GFP_KERNEL);
+        if (!pages) {
+                err = -ENOMEM;
+                goto err_pbl;
+        }
+
+        i = n = 0;
+
+        list_for_each_entry(chunk, &mhp->umem->chunk_list, list)
+                for (j = 0; j < chunk->nmap; ++j) {
+                        len = sg_dma_len(&chunk->page_list[j]) >> shift;
+                        for (k = 0; k < len; ++k) {
+                                pages[i++] = cpu_to_be64(sg_dma_address(
+                                        &chunk->page_list[j]) +
+                                        mhp->umem->page_size * k);
+                                if (i == PAGE_SIZE / sizeof *pages) {
+                                        err = write_pbl(&mhp->rhp->rdev,
+                                              pages,
+                                              mhp->attr.pbl_addr + (n << 3), i);
+                                        if (err)
+                                                goto pbl_done;
+                                        n += i;
+                                        i = 0;
+                                }
+                        }
+                }
+
+        if (i)
+                err = write_pbl(&mhp->rhp->rdev, pages,
+                                     mhp->attr.pbl_addr + (n << 3), i);
+
+pbl_done:
+        free_page((unsigned long) pages);
+        if (err)
+                goto err_pbl;
+
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+        mhp->attr.perms = c4iw_ib_to_tpt_access(acc);
+        mhp->attr.va_fbo = virt;
+        mhp->attr.page_size = shift - 12;
+        mhp->attr.len = (u32) length;
+
+        err = register_mem(rhp, php, mhp, shift);
+        if (err)
+                goto err_pbl;
+
+        return &mhp->ibmr;
+
+err_pbl:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+
+err:
+        ib_umem_release(mhp->umem);
+        kfree(mhp);
+        return ERR_PTR(err);
+}
+
+struct ib_mw *c4iw_alloc_mw(struct ib_pd *pd)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mw *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+        ret = allocate_window(&rhp->rdev, &stag, php->pdid);
+        if (ret) {
+                kfree(mhp);
+                return ERR_PTR(ret);
+        }
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = FW_RI_STAG_MW;
+        mhp->attr.stag = stag;
+        mmid = (stag) >> 8;
+        mhp->ibmw.rkey = stag;
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid)) {
+                deallocate_window(&rhp->rdev, mhp->attr.stag);
+                kfree(mhp);
+                return ERR_PTR(-ENOMEM);
+        }
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
+        return &(mhp->ibmw);
+}
+
+int c4iw_dealloc_mw(struct ib_mw *mw)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_mw *mhp;
+        u32 mmid;
+
+        mhp = to_c4iw_mw(mw);
+        rhp = mhp->rhp;
+        mmid = (mw->rkey) >> 8;
+        deallocate_window(&rhp->rdev, mhp->attr.stag);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        kfree(mhp);
+        PDBG("%s ib_mw %p mmid 0x%x ptr %p\n", __func__, mw, mmid, mhp);
+        return 0;
+}
+
+struct ib_mr *c4iw_alloc_fast_reg_mr(struct ib_pd *pd, int pbl_depth)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+        struct c4iw_mr *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret = 0;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                goto err;
+
+        mhp->rhp = rhp;
+        ret = alloc_pbl(mhp, pbl_depth);
+        if (ret)
+                goto err1;
+        mhp->attr.pbl_size = pbl_depth;
+        ret = allocate_stag(&rhp->rdev, &stag, php->pdid,
+                                 mhp->attr.pbl_size, mhp->attr.pbl_addr);
+        if (ret)
+                goto err2;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = FW_RI_STAG_NSMR;
+        mhp->attr.stag = stag;
+        mhp->attr.state = 1;
+        mmid = (stag) >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid))
+                goto err3;
+
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
+        return &(mhp->ibmr);
+err3:
+        dereg_mem(&rhp->rdev, stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+err2:
+        c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                              mhp->attr.pbl_size << 3);
+err1:
+        kfree(mhp);
+err:
+        return ERR_PTR(ret);
+}
+
+struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(struct ib_device *device,
+                                                     int page_list_len)
+{
+        struct c4iw_fr_page_list *c4pl;
+        struct c4iw_dev *dev = to_c4iw_dev(device);
+        dma_addr_t dma_addr;
+        int size = sizeof *c4pl + page_list_len * sizeof(u64);
+
+        if (page_list_len > T4_MAX_FR_DEPTH)
+                return ERR_PTR(-EINVAL);
+
+        c4pl = dma_alloc_coherent(&dev->rdev.lldi.pdev->dev, size,
+                                  &dma_addr, GFP_KERNEL);
+        if (!c4pl)
+                return ERR_PTR(-ENOMEM);
+
+        pci_unmap_addr_set(c4pl, mapping, dma_addr);
+        c4pl->dma_addr = dma_addr;
+        c4pl->dev = dev;
+        c4pl->size = size;
+        c4pl->ibpl.page_list = (u64 *)(c4pl + 1);
+        c4pl->ibpl.max_page_list_len = page_list_len;
+
+        return &c4pl->ibpl;
+}
+
+void c4iw_free_fastreg_pbl(struct ib_fast_reg_page_list *ibpl)
+{
+        struct c4iw_fr_page_list *c4pl = to_c4iw_fr_page_list(ibpl);
+
+        dma_free_coherent(&c4pl->dev->rdev.lldi.pdev->dev, c4pl->size,
+                          c4pl, pci_unmap_addr(c4pl, mapping));
+}
+
+int c4iw_dereg_mr(struct ib_mr *ib_mr)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_mr *mhp;
+        u32 mmid;
+
+        PDBG("%s ib_mr %p\n", __func__, ib_mr);
+        /* There can be no memory windows */
+        if (atomic_read(&ib_mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_c4iw_mr(ib_mr);
+        rhp = mhp->rhp;
+        mmid = mhp->attr.stag >> 8;
+        dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        if (mhp->attr.pbl_size)
+                c4iw_pblpool_free(&mhp->rhp->rdev, mhp->attr.pbl_addr,
+                                  mhp->attr.pbl_size << 3);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        if (mhp->kva)
+                kfree((void *) (unsigned long) mhp->kva);
+        if (mhp->umem)
+                ib_umem_release(mhp->umem);
+        PDBG("%s mmid 0x%x ptr %p\n", __func__, mmid, mhp);
+        kfree(mhp);
+        return 0;
+}
diff --git a/drivers/infiniband/hw/cxgb4/provider.c b/drivers/infiniband/hw/cxgb4/provider.c
new file mode 100644
index 000000000000..dfc49020bb9c
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/provider.c
@@ -0,0 +1,518 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/rtnetlink.h>
+#include <linux/inetdevice.h>
+#include <linux/io.h>
+
+#include <asm/irq.h>
+#include <asm/byteorder.h>
+
+#include <rdma/iw_cm.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_smi.h>
+#include <rdma/ib_umem.h>
+#include <rdma/ib_user_verbs.h>
+
+#include "iw_cxgb4.h"
+
+static int fastreg_support;
+module_param(fastreg_support, int, 0644);
+MODULE_PARM_DESC(fastreg_support, "Advertise fastreg support (default=0)");
+
+static int c4iw_modify_port(struct ib_device *ibdev,
+                            u8 port, int port_modify_mask,
+                            struct ib_port_modify *props)
+{
+        return -ENOSYS;
+}
+
+static struct ib_ah *c4iw_ah_create(struct ib_pd *pd,
+                                    struct ib_ah_attr *ah_attr)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
+static int c4iw_ah_destroy(struct ib_ah *ah)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_process_mad(struct ib_device *ibdev, int mad_flags,
+                            u8 port_num, struct ib_wc *in_wc,
+                            struct ib_grh *in_grh, struct ib_mad *in_mad,
+                            struct ib_mad *out_mad)
+{
+        return -ENOSYS;
+}
+
+static int c4iw_dealloc_ucontext(struct ib_ucontext *context)
+{
+        struct c4iw_dev *rhp = to_c4iw_dev(context->device);
+        struct c4iw_ucontext *ucontext = to_c4iw_ucontext(context);
+        struct c4iw_mm_entry *mm, *tmp;
+
+        PDBG("%s context %p\n", __func__, context);
+        list_for_each_entry_safe(mm, tmp, &ucontext->mmaps, entry)
+                kfree(mm);
+        c4iw_release_dev_ucontext(&rhp->rdev, &ucontext->uctx);
+        kfree(ucontext);
+        return 0;
+}
+
+static struct ib_ucontext *c4iw_alloc_ucontext(struct ib_device *ibdev,
+                                               struct ib_udata *udata)
+{
+        struct c4iw_ucontext *context;
+        struct c4iw_dev *rhp = to_c4iw_dev(ibdev);
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        context = kzalloc(sizeof(*context), GFP_KERNEL);
+        if (!context)
+                return ERR_PTR(-ENOMEM);
+        c4iw_init_dev_ucontext(&rhp->rdev, &context->uctx);
+        INIT_LIST_HEAD(&context->mmaps);
+        spin_lock_init(&context->mmap_lock);
+        return &context->ibucontext;
+}
+
+static int c4iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+{
+        int len = vma->vm_end - vma->vm_start;
+        u32 key = vma->vm_pgoff << PAGE_SHIFT;
+        struct c4iw_rdev *rdev;
+        int ret = 0;
+        struct c4iw_mm_entry *mm;
+        struct c4iw_ucontext *ucontext;
+        u64 addr;
+
+        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __func__, vma->vm_pgoff,
+             key, len);
+
+        if (vma->vm_start & (PAGE_SIZE-1))
+                return -EINVAL;
+
+        rdev = &(to_c4iw_dev(context->device)->rdev);
+        ucontext = to_c4iw_ucontext(context);
+
+        mm = remove_mmap(ucontext, key, len);
+        if (!mm)
+                return -EINVAL;
+        addr = mm->addr;
+        kfree(mm);
+
+        if ((addr >= pci_resource_start(rdev->lldi.pdev, 2)) &&
+            (addr < (pci_resource_start(rdev->lldi.pdev, 2) +
+                       pci_resource_len(rdev->lldi.pdev, 2)))) {
+
+                /*
+                 * Map T4 DB register.
+                 */
+                if (vma->vm_flags & VM_READ)
+                        return -EPERM;
+
+                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
+                vma->vm_flags &= ~VM_MAYREAD;
+                ret = io_remap_pfn_range(vma, vma->vm_start,
+                                         addr >> PAGE_SHIFT,
+                                         len, vma->vm_page_prot);
+        } else {
+
+                /*
+                 * Map WQ or CQ contig dma memory...
+                 */
+                ret = remap_pfn_range(vma, vma->vm_start,
+                                      addr >> PAGE_SHIFT,
+                                      len, vma->vm_page_prot);
+        }
+
+        return ret;
+}
+
+static int c4iw_deallocate_pd(struct ib_pd *pd)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_pd *php;
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        PDBG("%s ibpd %p pdid 0x%x\n", __func__, pd, php->pdid);
+        c4iw_put_resource(&rhp->rdev.resource.pdid_fifo, php->pdid,
+                          &rhp->rdev.resource.pdid_fifo_lock);
+        kfree(php);
+        return 0;
+}
+
+static struct ib_pd *c4iw_allocate_pd(struct ib_device *ibdev,
+                                      struct ib_ucontext *context,
+                                      struct ib_udata *udata)
+{
+        struct c4iw_pd *php;
+        u32 pdid;
+        struct c4iw_dev *rhp;
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        rhp = (struct c4iw_dev *) ibdev;
+        pdid =  c4iw_get_resource(&rhp->rdev.resource.pdid_fifo,
+                                  &rhp->rdev.resource.pdid_fifo_lock);
+        if (!pdid)
+                return ERR_PTR(-EINVAL);
+        php = kzalloc(sizeof(*php), GFP_KERNEL);
+        if (!php) {
+                c4iw_put_resource(&rhp->rdev.resource.pdid_fifo, pdid,
+                                  &rhp->rdev.resource.pdid_fifo_lock);
+                return ERR_PTR(-ENOMEM);
+        }
+        php->pdid = pdid;
+        php->rhp = rhp;
+        if (context) {
+                if (ib_copy_to_udata(udata, &php->pdid, sizeof(u32))) {
+                        c4iw_deallocate_pd(&php->ibpd);
+                        return ERR_PTR(-EFAULT);
+                }
+        }
+        PDBG("%s pdid 0x%0x ptr 0x%p\n", __func__, pdid, php);
+        return &php->ibpd;
+}
+
+static int c4iw_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+                           u16 *pkey)
+{
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+        *pkey = 0;
+        return 0;
+}
+
+static int c4iw_query_gid(struct ib_device *ibdev, u8 port, int index,
+                          union ib_gid *gid)
+{
+        struct c4iw_dev *dev;
+
+        PDBG("%s ibdev %p, port %d, index %d, gid %p\n",
+               __func__, ibdev, port, index, gid);
+        dev = to_c4iw_dev(ibdev);
+        BUG_ON(port == 0);
+        memset(&(gid->raw[0]), 0, sizeof(gid->raw));
+        memcpy(&(gid->raw[0]), dev->rdev.lldi.ports[port-1]->dev_addr, 6);
+        return 0;
+}
+
+static int c4iw_query_device(struct ib_device *ibdev,
+                             struct ib_device_attr *props)
+{
+
+        struct c4iw_dev *dev;
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+
+        dev = to_c4iw_dev(ibdev);
+        memset(props, 0, sizeof *props);
+        memcpy(&props->sys_image_guid, dev->rdev.lldi.ports[0]->dev_addr, 6);
+        props->hw_ver = dev->rdev.lldi.adapter_type;
+        props->fw_ver = dev->rdev.lldi.fw_vers;
+        props->device_cap_flags = dev->device_cap_flags;
+        props->page_size_cap = T4_PAGESIZE_MASK;
+        props->vendor_id = (u32)dev->rdev.lldi.pdev->vendor;
+        props->vendor_part_id = (u32)dev->rdev.lldi.pdev->device;
+        props->max_mr_size = T4_MAX_MR_SIZE;
+        props->max_qp = T4_MAX_NUM_QP;
+        props->max_qp_wr = T4_MAX_QP_DEPTH;
+        props->max_sge = T4_MAX_RECV_SGE;
+        props->max_sge_rd = 1;
+        props->max_qp_rd_atom = c4iw_max_read_depth;
+        props->max_qp_init_rd_atom = c4iw_max_read_depth;
+        props->max_cq = T4_MAX_NUM_CQ;
+        props->max_cqe = T4_MAX_CQ_DEPTH;
+        props->max_mr = c4iw_num_stags(&dev->rdev);
+        props->max_pd = T4_MAX_NUM_PD;
+        props->local_ca_ack_delay = 0;
+        props->max_fast_reg_page_list_len = T4_MAX_FR_DEPTH;
+
+        return 0;
+}
+
+static int c4iw_query_port(struct ib_device *ibdev, u8 port,
+                           struct ib_port_attr *props)
+{
+        struct c4iw_dev *dev;
+        struct net_device *netdev;
+        struct in_device *inetdev;
+
+        PDBG("%s ibdev %p\n", __func__, ibdev);
+
+        dev = to_c4iw_dev(ibdev);
+        netdev = dev->rdev.lldi.ports[port-1];
+
+        memset(props, 0, sizeof(struct ib_port_attr));
+        props->max_mtu = IB_MTU_4096;
+        if (netdev->mtu >= 4096)
+                props->active_mtu = IB_MTU_4096;
+        else if (netdev->mtu >= 2048)
+                props->active_mtu = IB_MTU_2048;
+        else if (netdev->mtu >= 1024)
+                props->active_mtu = IB_MTU_1024;
+        else if (netdev->mtu >= 512)
+                props->active_mtu = IB_MTU_512;
+        else
+                props->active_mtu = IB_MTU_256;
+
+        if (!netif_carrier_ok(netdev))
+                props->state = IB_PORT_DOWN;
+        else {
+                inetdev = in_dev_get(netdev);
+                if (inetdev) {
+                        if (inetdev->ifa_list)
+                                props->state = IB_PORT_ACTIVE;
+                        else
+                                props->state = IB_PORT_INIT;
+                        in_dev_put(inetdev);
+                } else
+                        props->state = IB_PORT_INIT;
+        }
+
+        props->port_cap_flags =
+            IB_PORT_CM_SUP |
+            IB_PORT_SNMP_TUNNEL_SUP |
+            IB_PORT_REINIT_SUP |
+            IB_PORT_DEVICE_MGMT_SUP |
+            IB_PORT_VENDOR_CLASS_SUP | IB_PORT_BOOT_MGMT_SUP;
+        props->gid_tbl_len = 1;
+        props->pkey_tbl_len = 1;
+        props->active_width = 2;
+        props->active_speed = 2;
+        props->max_msg_sz = -1;
+
+        return 0;
+}
+
+static ssize_t show_rev(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        return sprintf(buf, "%d\n", c4iw_dev->rdev.lldi.adapter_type);
+}
+
+static ssize_t show_fw_ver(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+
+        return sprintf(buf, "%u.%u.%u.%u\n",
+                        FW_HDR_FW_VER_MAJOR_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_MINOR_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_MICRO_GET(c4iw_dev->rdev.lldi.fw_vers),
+                        FW_HDR_FW_VER_BUILD_GET(c4iw_dev->rdev.lldi.fw_vers));
+}
+
+static ssize_t show_hca(struct device *dev, struct device_attribute *attr,
+                        char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = c4iw_dev->rdev.lldi.ports[0];
+
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        return sprintf(buf, "%s\n", info.driver);
+}
+
+static ssize_t show_board(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct c4iw_dev *c4iw_dev = container_of(dev, struct c4iw_dev,
+                                                 ibdev.dev);
+        PDBG("%s dev 0x%p\n", __func__, dev);
+        return sprintf(buf, "%x.%x\n", c4iw_dev->rdev.lldi.pdev->vendor,
+                       c4iw_dev->rdev.lldi.pdev->device);
+}
+
+static int c4iw_get_mib(struct ib_device *ibdev,
+                        union rdma_protocol_stats *stats)
+{
+        return -ENOSYS;
+}
+
+static DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
+static DEVICE_ATTR(fw_ver, S_IRUGO, show_fw_ver, NULL);
+static DEVICE_ATTR(hca_type, S_IRUGO, show_hca, NULL);
+static DEVICE_ATTR(board_id, S_IRUGO, show_board, NULL);
+
+static struct device_attribute *c4iw_class_attributes[] = {
+        &dev_attr_hw_rev,
+        &dev_attr_fw_ver,
+        &dev_attr_hca_type,
+        &dev_attr_board_id,
+};
+
+int c4iw_register_device(struct c4iw_dev *dev)
+{
+        int ret;
+        int i;
+
+        PDBG("%s c4iw_dev %p\n", __func__, dev);
+        BUG_ON(!dev->rdev.lldi.ports[0]);
+        strlcpy(dev->ibdev.name, "cxgb4_%d", IB_DEVICE_NAME_MAX);
+        memset(&dev->ibdev.node_guid, 0, sizeof(dev->ibdev.node_guid));
+        memcpy(&dev->ibdev.node_guid, dev->rdev.lldi.ports[0]->dev_addr, 6);
+        dev->ibdev.owner = THIS_MODULE;
+        dev->device_cap_flags = IB_DEVICE_LOCAL_DMA_LKEY | IB_DEVICE_MEM_WINDOW;
+        if (fastreg_support)
+                dev->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS;
+        dev->ibdev.local_dma_lkey = 0;
+        dev->ibdev.uverbs_cmd_mask =
+            (1ull << IB_USER_VERBS_CMD_GET_CONTEXT) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_DEVICE) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_PORT) |
+            (1ull << IB_USER_VERBS_CMD_ALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_DEALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_REG_MR) |
+            (1ull << IB_USER_VERBS_CMD_DEREG_MR) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_REQ_NOTIFY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_QP) |
+            (1ull << IB_USER_VERBS_CMD_MODIFY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POLL_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POST_SEND) |
+            (1ull << IB_USER_VERBS_CMD_POST_RECV);
+        dev->ibdev.node_type = RDMA_NODE_RNIC;
+        memcpy(dev->ibdev.node_desc, C4IW_NODE_DESC, sizeof(C4IW_NODE_DESC));
+        dev->ibdev.phys_port_cnt = dev->rdev.lldi.nports;
+        dev->ibdev.num_comp_vectors = 1;
+        dev->ibdev.dma_device = &(dev->rdev.lldi.pdev->dev);
+        dev->ibdev.query_device = c4iw_query_device;
+        dev->ibdev.query_port = c4iw_query_port;
+        dev->ibdev.modify_port = c4iw_modify_port;
+        dev->ibdev.query_pkey = c4iw_query_pkey;
+        dev->ibdev.query_gid = c4iw_query_gid;
+        dev->ibdev.alloc_ucontext = c4iw_alloc_ucontext;
+        dev->ibdev.dealloc_ucontext = c4iw_dealloc_ucontext;
+        dev->ibdev.mmap = c4iw_mmap;
+        dev->ibdev.alloc_pd = c4iw_allocate_pd;
+        dev->ibdev.dealloc_pd = c4iw_deallocate_pd;
+        dev->ibdev.create_ah = c4iw_ah_create;
+        dev->ibdev.destroy_ah = c4iw_ah_destroy;
+        dev->ibdev.create_qp = c4iw_create_qp;
+        dev->ibdev.modify_qp = c4iw_ib_modify_qp;
+        dev->ibdev.destroy_qp = c4iw_destroy_qp;
+        dev->ibdev.create_cq = c4iw_create_cq;
+        dev->ibdev.destroy_cq = c4iw_destroy_cq;
+        dev->ibdev.resize_cq = c4iw_resize_cq;
+        dev->ibdev.poll_cq = c4iw_poll_cq;
+        dev->ibdev.get_dma_mr = c4iw_get_dma_mr;
+        dev->ibdev.reg_phys_mr = c4iw_register_phys_mem;
+        dev->ibdev.rereg_phys_mr = c4iw_reregister_phys_mem;
+        dev->ibdev.reg_user_mr = c4iw_reg_user_mr;
+        dev->ibdev.dereg_mr = c4iw_dereg_mr;
+        dev->ibdev.alloc_mw = c4iw_alloc_mw;
+        dev->ibdev.bind_mw = c4iw_bind_mw;
+        dev->ibdev.dealloc_mw = c4iw_dealloc_mw;
+        dev->ibdev.alloc_fast_reg_mr = c4iw_alloc_fast_reg_mr;
+        dev->ibdev.alloc_fast_reg_page_list = c4iw_alloc_fastreg_pbl;
+        dev->ibdev.free_fast_reg_page_list = c4iw_free_fastreg_pbl;
+        dev->ibdev.attach_mcast = c4iw_multicast_attach;
+        dev->ibdev.detach_mcast = c4iw_multicast_detach;
+        dev->ibdev.process_mad = c4iw_process_mad;
+        dev->ibdev.req_notify_cq = c4iw_arm_cq;
+        dev->ibdev.post_send = c4iw_post_send;
+        dev->ibdev.post_recv = c4iw_post_receive;
+        dev->ibdev.get_protocol_stats = c4iw_get_mib;
+
+        dev->ibdev.iwcm = kmalloc(sizeof(struct iw_cm_verbs), GFP_KERNEL);
+        if (!dev->ibdev.iwcm)
+                return -ENOMEM;
+
+        dev->ibdev.iwcm->connect = c4iw_connect;
+        dev->ibdev.iwcm->accept = c4iw_accept_cr;
+        dev->ibdev.iwcm->reject = c4iw_reject_cr;
+        dev->ibdev.iwcm->create_listen = c4iw_create_listen;
+        dev->ibdev.iwcm->destroy_listen = c4iw_destroy_listen;
+        dev->ibdev.iwcm->add_ref = c4iw_qp_add_ref;
+        dev->ibdev.iwcm->rem_ref = c4iw_qp_rem_ref;
+        dev->ibdev.iwcm->get_qp = c4iw_get_qp;
+
+        ret = ib_register_device(&dev->ibdev);
+        if (ret)
+                goto bail1;
+
+        for (i = 0; i < ARRAY_SIZE(c4iw_class_attributes); ++i) {
+                ret = device_create_file(&dev->ibdev.dev,
+                                         c4iw_class_attributes[i]);
+                if (ret)
+                        goto bail2;
+        }
+        return 0;
+bail2:
+        ib_unregister_device(&dev->ibdev);
+bail1:
+        kfree(dev->ibdev.iwcm);
+        return ret;
+}
+
+void c4iw_unregister_device(struct c4iw_dev *dev)
+{
+        int i;
+
+        PDBG("%s c4iw_dev %p\n", __func__, dev);
+        for (i = 0; i < ARRAY_SIZE(c4iw_class_attributes); ++i)
+                device_remove_file(&dev->ibdev.dev,
+                                   c4iw_class_attributes[i]);
+        ib_unregister_device(&dev->ibdev);
+        kfree(dev->ibdev.iwcm);
+        return;
+}
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
new file mode 100644
index 000000000000..83a01dc0c4c1
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -0,0 +1,1577 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include "iw_cxgb4.h"
+
+static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+                      struct c4iw_dev_ucontext *uctx)
+{
+        /*
+         * uP clears EQ contexts when the connection exits rdma mode,
+         * so no need to post a RESET WR for these EQs.
+         */
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->rq.memsize, wq->rq.queue,
+                          pci_unmap_addr(&wq->rq, mapping));
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->sq.memsize, wq->sq.queue,
+                          pci_unmap_addr(&wq->sq, mapping));
+        c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
+        kfree(wq->rq.sw_rq);
+        kfree(wq->sq.sw_sq);
+        c4iw_put_qpid(rdev, wq->rq.qid, uctx);
+        c4iw_put_qpid(rdev, wq->sq.qid, uctx);
+        return 0;
+}
+
+static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+                     struct t4_cq *rcq, struct t4_cq *scq,
+                     struct c4iw_dev_ucontext *uctx)
+{
+        int user = (uctx != &rdev->uctx);
+        struct fw_ri_res_wr *res_wr;
+        struct fw_ri_res *res;
+        int wr_len;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+        int ret;
+        int eqsize;
+
+        wq->sq.qid = c4iw_get_qpid(rdev, uctx);
+        if (!wq->sq.qid)
+                return -ENOMEM;
+
+        wq->rq.qid = c4iw_get_qpid(rdev, uctx);
+        if (!wq->rq.qid)
+                goto err1;
+
+        if (!user) {
+                wq->sq.sw_sq = kzalloc(wq->sq.size * sizeof *wq->sq.sw_sq,
+                                 GFP_KERNEL);
+                if (!wq->sq.sw_sq)
+                        goto err2;
+
+                wq->rq.sw_rq = kzalloc(wq->rq.size * sizeof *wq->rq.sw_rq,
+                                 GFP_KERNEL);
+                if (!wq->rq.sw_rq)
+                        goto err3;
+        }
+
+        /*
+         * RQT must be a power of 2.
+         */
+        wq->rq.rqt_size = roundup_pow_of_two(wq->rq.size);
+        wq->rq.rqt_hwaddr = c4iw_rqtpool_alloc(rdev, wq->rq.rqt_size);
+        if (!wq->rq.rqt_hwaddr)
+                goto err4;
+
+        wq->sq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
+                                          wq->sq.memsize, &(wq->sq.dma_addr),
+                                          GFP_KERNEL);
+        if (!wq->sq.queue)
+                goto err5;
+        memset(wq->sq.queue, 0, wq->sq.memsize);
+        pci_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
+
+        wq->rq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
+                                          wq->rq.memsize, &(wq->rq.dma_addr),
+                                          GFP_KERNEL);
+        if (!wq->rq.queue)
+                goto err6;
+        PDBG("%s sq base va 0x%p pa 0x%llx rq base va 0x%p pa 0x%llx\n",
+                __func__, wq->sq.queue,
+                (unsigned long long)virt_to_phys(wq->sq.queue),
+                wq->rq.queue,
+                (unsigned long long)virt_to_phys(wq->rq.queue));
+        memset(wq->rq.queue, 0, wq->rq.memsize);
+        pci_unmap_addr_set(&wq->rq, mapping, wq->rq.dma_addr);
+
+        wq->db = rdev->lldi.db_reg;
+        wq->gts = rdev->lldi.gts_reg;
+        if (user) {
+                wq->sq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (wq->sq.qid << rdev->qpshift);
+                wq->sq.udb &= PAGE_MASK;
+                wq->rq.udb = (u64)pci_resource_start(rdev->lldi.pdev, 2) +
+                                        (wq->rq.qid << rdev->qpshift);
+                wq->rq.udb &= PAGE_MASK;
+        }
+        wq->rdev = rdev;
+        wq->rq.msn = 1;
+
+        /* build fw_ri_res_wr */
+        wr_len = sizeof *res_wr + 2 * sizeof *res;
+
+        skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto err7;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
+
+        res_wr = (struct fw_ri_res_wr *)__skb_put(skb, wr_len);
+        memset(res_wr, 0, wr_len);
+        res_wr->op_nres = cpu_to_be32(
+                        FW_WR_OP(FW_RI_RES_WR) |
+                        V_FW_RI_RES_WR_NRES(2) |
+                        FW_WR_COMPL(1));
+        res_wr->len16_pkd = cpu_to_be32(DIV_ROUND_UP(wr_len, 16));
+        res_wr->cookie = (u64)&wr_wait;
+        res = res_wr->res;
+        res->u.sqrq.restype = FW_RI_RES_TYPE_SQ;
+        res->u.sqrq.op = FW_RI_RES_OP_WRITE;
+
+        /*
+         * eqsize is the number of 64B entries plus the status page size.
+         */
+        eqsize = wq->sq.size * T4_SQ_NUM_SLOTS + T4_EQ_STATUS_ENTRIES;
+
+        res->u.sqrq.fetchszm_to_iqid = cpu_to_be32(
+                V_FW_RI_RES_WR_HOSTFCMODE(0) |  /* no host cidx updates */
+                V_FW_RI_RES_WR_CPRIO(0) |       /* don't keep in chip cache */
+                V_FW_RI_RES_WR_PCIECHN(0) |     /* set by uP at ri_init time */
+                V_FW_RI_RES_WR_IQID(scq->cqid));
+        res->u.sqrq.dcaen_to_eqsize = cpu_to_be32(
+                V_FW_RI_RES_WR_DCAEN(0) |
+                V_FW_RI_RES_WR_DCACPU(0) |
+                V_FW_RI_RES_WR_FBMIN(3) |
+                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+                V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+                V_FW_RI_RES_WR_EQSIZE(eqsize));
+        res->u.sqrq.eqid = cpu_to_be32(wq->sq.qid);
+        res->u.sqrq.eqaddr = cpu_to_be64(wq->sq.dma_addr);
+        res++;
+        res->u.sqrq.restype = FW_RI_RES_TYPE_RQ;
+        res->u.sqrq.op = FW_RI_RES_OP_WRITE;
+
+        /*
+         * eqsize is the number of 64B entries plus the status page size.
+         */
+        eqsize = wq->rq.size * T4_RQ_NUM_SLOTS + T4_EQ_STATUS_ENTRIES;
+        res->u.sqrq.fetchszm_to_iqid = cpu_to_be32(
+                V_FW_RI_RES_WR_HOSTFCMODE(0) |  /* no host cidx updates */
+                V_FW_RI_RES_WR_CPRIO(0) |       /* don't keep in chip cache */
+                V_FW_RI_RES_WR_PCIECHN(0) |     /* set by uP at ri_init time */
+                V_FW_RI_RES_WR_IQID(rcq->cqid));
+        res->u.sqrq.dcaen_to_eqsize = cpu_to_be32(
+                V_FW_RI_RES_WR_DCAEN(0) |
+                V_FW_RI_RES_WR_DCACPU(0) |
+                V_FW_RI_RES_WR_FBMIN(3) |
+                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+                V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+                V_FW_RI_RES_WR_EQSIZE(eqsize));
+        res->u.sqrq.eqid = cpu_to_be32(wq->rq.qid);
+        res->u.sqrq.eqaddr = cpu_to_be64(wq->rq.dma_addr);
+
+        c4iw_init_wr_wait(&wr_wait);
+
+        ret = c4iw_ofld_send(rdev, skb);
+        if (ret)
+                goto err7;
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rdev->lldi.pdev));
+                rdev->flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+        if (ret)
+                goto err7;
+
+        PDBG("%s sqid 0x%x rqid 0x%x kdb 0x%p squdb 0x%llx rqudb 0x%llx\n",
+             __func__, wq->sq.qid, wq->rq.qid, wq->db,
+             (unsigned long long)wq->sq.udb, (unsigned long long)wq->rq.udb);
+
+        return 0;
+err7:
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->rq.memsize, wq->rq.queue,
+                          pci_unmap_addr(&wq->rq, mapping));
+err6:
+        dma_free_coherent(&(rdev->lldi.pdev->dev),
+                          wq->sq.memsize, wq->sq.queue,
+                          pci_unmap_addr(&wq->sq, mapping));
+err5:
+        c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
+err4:
+        kfree(wq->rq.sw_rq);
+err3:
+        kfree(wq->sq.sw_sq);
+err2:
+        c4iw_put_qpid(rdev, wq->rq.qid, uctx);
+err1:
+        c4iw_put_qpid(rdev, wq->sq.qid, uctx);
+        return -ENOMEM;
+}
+
+static int build_rdma_send(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        int i;
+        u32 plen;
+        int size;
+        u8 *datap;
+
+        if (wr->num_sge > T4_MAX_SEND_SGE)
+                return -EINVAL;
+        switch (wr->opcode) {
+        case IB_WR_SEND:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_SE));
+                else
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND));
+                wqe->send.stag_inv = 0;
+                break;
+        case IB_WR_SEND_WITH_INV:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_SE_INV));
+                else
+                        wqe->send.sendop_pkd = cpu_to_be32(
+                                V_FW_RI_SEND_WR_SENDOP(FW_RI_SEND_WITH_INV));
+                wqe->send.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+        plen = 0;
+        if (wr->num_sge) {
+                if (wr->send_flags & IB_SEND_INLINE) {
+                        datap = (u8 *)wqe->send.u.immd_src[0].data;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) >
+                                    T4_MAX_SEND_INLINE) {
+                                        return -EMSGSIZE;
+                                }
+                                plen += wr->sg_list[i].length;
+                                memcpy(datap,
+                                     (void *)(unsigned long)wr->sg_list[i].addr,
+                                     wr->sg_list[i].length);
+                                datap += wr->sg_list[i].length;
+                        }
+                        wqe->send.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                        wqe->send.u.immd_src[0].r1 = 0;
+                        wqe->send.u.immd_src[0].r2 = 0;
+                        wqe->send.u.immd_src[0].immdlen = cpu_to_be32(plen);
+                        size = sizeof wqe->send + sizeof(struct fw_ri_immd) +
+                               plen;
+                } else {
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) < plen)
+                                        return -EMSGSIZE;
+                                plen += wr->sg_list[i].length;
+                                wqe->send.u.isgl_src[0].sge[i].stag =
+                                        cpu_to_be32(wr->sg_list[i].lkey);
+                                wqe->send.u.isgl_src[0].sge[i].len =
+                                        cpu_to_be32(wr->sg_list[i].length);
+                                wqe->send.u.isgl_src[0].sge[i].to =
+                                        cpu_to_be64(wr->sg_list[i].addr);
+                        }
+                        wqe->send.u.isgl_src[0].op = FW_RI_DATA_ISGL;
+                        wqe->send.u.isgl_src[0].r1 = 0;
+                        wqe->send.u.isgl_src[0].nsge = cpu_to_be16(wr->num_sge);
+                        wqe->send.u.isgl_src[0].r2 = 0;
+                        size = sizeof wqe->send + sizeof(struct fw_ri_isgl) +
+                               wr->num_sge * sizeof(struct fw_ri_sge);
+                }
+        } else {
+                wqe->send.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                wqe->send.u.immd_src[0].r1 = 0;
+                wqe->send.u.immd_src[0].r2 = 0;
+                wqe->send.u.immd_src[0].immdlen = 0;
+                size = sizeof wqe->send + sizeof(struct fw_ri_immd);
+        }
+        *len16 = DIV_ROUND_UP(size, 16);
+        wqe->send.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static int build_rdma_write(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        int i;
+        u32 plen;
+        int size;
+        u8 *datap;
+
+        if (wr->num_sge > T4_MAX_WRITE_SGE)
+                return -EINVAL;
+        wqe->write.r2 = 0;
+        wqe->write.stag_sink = cpu_to_be32(wr->wr.rdma.rkey);
+        wqe->write.to_sink = cpu_to_be64(wr->wr.rdma.remote_addr);
+        plen = 0;
+        if (wr->num_sge) {
+                if (wr->send_flags & IB_SEND_INLINE) {
+                        datap = (u8 *)wqe->write.u.immd_src[0].data;
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) >
+                                    T4_MAX_WRITE_INLINE) {
+                                        return -EMSGSIZE;
+                                }
+                                plen += wr->sg_list[i].length;
+                                memcpy(datap,
+                                     (void *)(unsigned long)wr->sg_list[i].addr,
+                                     wr->sg_list[i].length);
+                                datap += wr->sg_list[i].length;
+                        }
+                        wqe->write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                        wqe->write.u.immd_src[0].r1 = 0;
+                        wqe->write.u.immd_src[0].r2 = 0;
+                        wqe->write.u.immd_src[0].immdlen = cpu_to_be32(plen);
+                        size = sizeof wqe->write + sizeof(struct fw_ri_immd) +
+                               plen;
+                } else {
+                        for (i = 0; i < wr->num_sge; i++) {
+                                if ((plen + wr->sg_list[i].length) < plen)
+                                        return -EMSGSIZE;
+                                plen += wr->sg_list[i].length;
+                                wqe->write.u.isgl_src[0].sge[i].stag =
+                                        cpu_to_be32(wr->sg_list[i].lkey);
+                                wqe->write.u.isgl_src[0].sge[i].len =
+                                        cpu_to_be32(wr->sg_list[i].length);
+                                wqe->write.u.isgl_src[0].sge[i].to =
+                                        cpu_to_be64(wr->sg_list[i].addr);
+                        }
+                        wqe->write.u.isgl_src[0].op = FW_RI_DATA_ISGL;
+                        wqe->write.u.isgl_src[0].r1 = 0;
+                        wqe->write.u.isgl_src[0].nsge =
+                                                       cpu_to_be16(wr->num_sge);
+                        wqe->write.u.isgl_src[0].r2 = 0;
+                        size = sizeof wqe->write + sizeof(struct fw_ri_isgl) +
+                               wr->num_sge * sizeof(struct fw_ri_sge);
+                }
+        } else {
+                wqe->write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                wqe->write.u.immd_src[0].r1 = 0;
+                wqe->write.u.immd_src[0].r2 = 0;
+                wqe->write.u.immd_src[0].immdlen = 0;
+                size = sizeof wqe->write + sizeof(struct fw_ri_immd);
+        }
+        *len16 = DIV_ROUND_UP(size, 16);
+        wqe->write.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static int build_rdma_read(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+        if (wr->num_sge > 1)
+                return -EINVAL;
+        if (wr->num_sge) {
+                wqe->read.stag_src = cpu_to_be32(wr->wr.rdma.rkey);
+                wqe->read.to_src_hi = cpu_to_be32((u32)(wr->wr.rdma.remote_addr
+                                                        >> 32));
+                wqe->read.to_src_lo = cpu_to_be32((u32)wr->wr.rdma.remote_addr);
+                wqe->read.stag_sink = cpu_to_be32(wr->sg_list[0].lkey);
+                wqe->read.plen = cpu_to_be32(wr->sg_list[0].length);
+                wqe->read.to_sink_hi = cpu_to_be32((u32)(wr->sg_list[0].addr
+                                                         >> 32));
+                wqe->read.to_sink_lo = cpu_to_be32((u32)(wr->sg_list[0].addr));
+        } else {
+                wqe->read.stag_src = cpu_to_be32(2);
+                wqe->read.to_src_hi = 0;
+                wqe->read.to_src_lo = 0;
+                wqe->read.stag_sink = cpu_to_be32(2);
+                wqe->read.plen = 0;
+                wqe->read.to_sink_hi = 0;
+                wqe->read.to_sink_lo = 0;
+        }
+        wqe->read.r2 = 0;
+        wqe->read.r5 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->read, 16);
+        return 0;
+}
+
+static int build_rdma_recv(struct c4iw_qp *qhp, union t4_recv_wr *wqe,
+                           struct ib_recv_wr *wr, u8 *len16)
+{
+        int i;
+        int plen = 0;
+
+        for (i = 0; i < wr->num_sge; i++) {
+                if ((plen + wr->sg_list[i].length) < plen)
+                        return -EMSGSIZE;
+                plen += wr->sg_list[i].length;
+                wqe->recv.isgl.sge[i].stag =
+                        cpu_to_be32(wr->sg_list[i].lkey);
+                wqe->recv.isgl.sge[i].len =
+                        cpu_to_be32(wr->sg_list[i].length);
+                wqe->recv.isgl.sge[i].to =
+                        cpu_to_be64(wr->sg_list[i].addr);
+        }
+        for (; i < T4_MAX_RECV_SGE; i++) {
+                wqe->recv.isgl.sge[i].stag = 0;
+                wqe->recv.isgl.sge[i].len = 0;
+                wqe->recv.isgl.sge[i].to = 0;
+        }
+        wqe->recv.isgl.op = FW_RI_DATA_ISGL;
+        wqe->recv.isgl.r1 = 0;
+        wqe->recv.isgl.nsge = cpu_to_be16(wr->num_sge);
+        wqe->recv.isgl.r2 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->recv +
+                              wr->num_sge * sizeof(struct fw_ri_sge), 16);
+        return 0;
+}
+
+static int build_fastreg(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
+{
+
+        struct fw_ri_immd *imdp;
+        __be64 *p;
+        int i;
+        int pbllen = roundup(wr->wr.fast_reg.page_list_len * sizeof(u64), 32);
+
+        if (wr->wr.fast_reg.page_list_len > T4_MAX_FR_DEPTH)
+                return -EINVAL;
+
+        wqe->fr.qpbinde_to_dcacpu = 0;
+        wqe->fr.pgsz_shift = wr->wr.fast_reg.page_shift - 12;
+        wqe->fr.addr_type = FW_RI_VA_BASED_TO;
+        wqe->fr.mem_perms = c4iw_ib_to_tpt_access(wr->wr.fast_reg.access_flags);
+        wqe->fr.len_hi = 0;
+        wqe->fr.len_lo = cpu_to_be32(wr->wr.fast_reg.length);
+        wqe->fr.stag = cpu_to_be32(wr->wr.fast_reg.rkey);
+        wqe->fr.va_hi = cpu_to_be32(wr->wr.fast_reg.iova_start >> 32);
+        wqe->fr.va_lo_fbo = cpu_to_be32(wr->wr.fast_reg.iova_start &
+                                        0xffffffff);
+        if (pbllen > T4_MAX_FR_IMMD) {
+                struct c4iw_fr_page_list *c4pl =
+                                to_c4iw_fr_page_list(wr->wr.fast_reg.page_list);
+                struct fw_ri_dsgl *sglp;
+
+                sglp = (struct fw_ri_dsgl *)(&wqe->fr + 1);
+                sglp->op = FW_RI_DATA_DSGL;
+                sglp->r1 = 0;
+                sglp->nsge = cpu_to_be16(1);
+                sglp->addr0 = cpu_to_be64(c4pl->dma_addr);
+                sglp->len0 = cpu_to_be32(pbllen);
+
+                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *sglp, 16);
+        } else {
+                imdp = (struct fw_ri_immd *)(&wqe->fr + 1);
+                imdp->op = FW_RI_DATA_IMMD;
+                imdp->r1 = 0;
+                imdp->r2 = 0;
+                imdp->immdlen = cpu_to_be32(pbllen);
+                p = (__be64 *)(imdp + 1);
+                for (i = 0; i < wr->wr.fast_reg.page_list_len; i++, p++)
+                        *p = cpu_to_be64(
+                                (u64)wr->wr.fast_reg.page_list->page_list[i]);
+                *len16 = DIV_ROUND_UP(sizeof wqe->fr + sizeof *imdp + pbllen,
+                                      16);
+        }
+        return 0;
+}
+
+static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
+                          u8 *len16)
+{
+        wqe->inv.stag_inv = cpu_to_be32(wr->ex.invalidate_rkey);
+        wqe->inv.r2 = 0;
+        *len16 = DIV_ROUND_UP(sizeof wqe->inv, 16);
+        return 0;
+}
+
+void c4iw_qp_add_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __func__, qp);
+        atomic_inc(&(to_c4iw_qp(qp)->refcnt));
+}
+
+void c4iw_qp_rem_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __func__, qp);
+        if (atomic_dec_and_test(&(to_c4iw_qp(qp)->refcnt)))
+                wake_up(&(to_c4iw_qp(qp)->wait));
+}
+
+int c4iw_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                   struct ib_send_wr **bad_wr)
+{
+        int err = 0;
+        u8 len16 = 0;
+        enum fw_wr_opcodes fw_opcode = 0;
+        enum fw_ri_wr_flags fw_flags;
+        struct c4iw_qp *qhp;
+        union t4_wr *wqe;
+        u32 num_wrs;
+        struct t4_swsqe *swsqe;
+        unsigned long flag;
+        u16 idx = 0;
+
+        qhp = to_c4iw_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (t4_wq_in_error(&qhp->wq)) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = t4_sq_avail(&qhp->wq);
+        if (num_wrs == 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        while (wr) {
+                if (num_wrs == 0) {
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        break;
+                }
+                wqe = &qhp->wq.sq.queue[qhp->wq.sq.pidx];
+                fw_flags = 0;
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        fw_flags |= FW_RI_SOLICITED_EVENT_FLAG;
+                if (wr->send_flags & IB_SEND_SIGNALED)
+                        fw_flags |= FW_RI_COMPLETION_FLAG;
+                swsqe = &qhp->wq.sq.sw_sq[qhp->wq.sq.pidx];
+                switch (wr->opcode) {
+                case IB_WR_SEND_WITH_INV:
+                case IB_WR_SEND:
+                        if (wr->send_flags & IB_SEND_FENCE)
+                                fw_flags |= FW_RI_READ_FENCE_FLAG;
+                        fw_opcode = FW_RI_SEND_WR;
+                        if (wr->opcode == IB_WR_SEND)
+                                swsqe->opcode = FW_RI_SEND;
+                        else
+                                swsqe->opcode = FW_RI_SEND_WITH_INV;
+                        err = build_rdma_send(wqe, wr, &len16);
+                        break;
+                case IB_WR_RDMA_WRITE:
+                        fw_opcode = FW_RI_RDMA_WRITE_WR;
+                        swsqe->opcode = FW_RI_RDMA_WRITE;
+                        err = build_rdma_write(wqe, wr, &len16);
+                        break;
+                case IB_WR_RDMA_READ:
+                        fw_opcode = FW_RI_RDMA_READ_WR;
+                        swsqe->opcode = FW_RI_READ_REQ;
+                        fw_flags = 0;
+                        err = build_rdma_read(wqe, wr, &len16);
+                        if (err)
+                                break;
+                        swsqe->read_len = wr->sg_list[0].length;
+                        if (!qhp->wq.sq.oldest_read)
+                                qhp->wq.sq.oldest_read = swsqe;
+                        break;
+                case IB_WR_FAST_REG_MR:
+                        fw_opcode = FW_RI_FR_NSMR_WR;
+                        swsqe->opcode = FW_RI_FAST_REGISTER;
+                        err = build_fastreg(wqe, wr, &len16);
+                        break;
+                case IB_WR_LOCAL_INV:
+                        fw_opcode = FW_RI_INV_LSTAG_WR;
+                        swsqe->opcode = FW_RI_LOCAL_INV;
+                        err = build_inv_stag(wqe, wr, &len16);
+                        break;
+                default:
+                        PDBG("%s post of type=%d TBD!\n", __func__,
+                             wr->opcode);
+                        err = -EINVAL;
+                }
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+                swsqe->idx = qhp->wq.sq.pidx;
+                swsqe->complete = 0;
+                swsqe->signaled = (wr->send_flags & IB_SEND_SIGNALED);
+                swsqe->wr_id = wr->wr_id;
+
+                init_wr_hdr(wqe, qhp->wq.sq.pidx, fw_opcode, fw_flags, len16);
+
+                PDBG("%s cookie 0x%llx pidx 0x%x opcode 0x%x read_len %u\n",
+                     __func__, (unsigned long long)wr->wr_id, qhp->wq.sq.pidx,
+                     swsqe->opcode, swsqe->read_len);
+                wr = wr->next;
+                num_wrs--;
+                t4_sq_produce(&qhp->wq);
+                idx++;
+        }
+        if (t4_wq_db_enabled(&qhp->wq))
+                t4_ring_sq_db(&qhp->wq, idx);
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        return err;
+}
+
+int c4iw_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr)
+{
+        int err = 0;
+        struct c4iw_qp *qhp;
+        union t4_recv_wr *wqe;
+        u32 num_wrs;
+        u8 len16 = 0;
+        unsigned long flag;
+        u16 idx = 0;
+
+        qhp = to_c4iw_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (t4_wq_in_error(&qhp->wq)) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = t4_rq_avail(&qhp->wq);
+        if (num_wrs == 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        while (wr) {
+                if (wr->num_sge > T4_MAX_RECV_SGE) {
+                        err = -EINVAL;
+                        *bad_wr = wr;
+                        break;
+                }
+                wqe = &qhp->wq.rq.queue[qhp->wq.rq.pidx];
+                if (num_wrs)
+                        err = build_rdma_recv(qhp, wqe, wr, &len16);
+                else
+                        err = -ENOMEM;
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+
+                qhp->wq.rq.sw_rq[qhp->wq.rq.pidx].wr_id = wr->wr_id;
+
+                wqe->recv.opcode = FW_RI_RECV_WR;
+                wqe->recv.r1 = 0;
+                wqe->recv.wrid = qhp->wq.rq.pidx;
+                wqe->recv.r2[0] = 0;
+                wqe->recv.r2[1] = 0;
+                wqe->recv.r2[2] = 0;
+                wqe->recv.len16 = len16;
+                if (len16 < 5)
+                        wqe->flits[8] = 0;
+
+                PDBG("%s cookie 0x%llx pidx %u\n", __func__,
+                     (unsigned long long) wr->wr_id, qhp->wq.rq.pidx);
+                t4_rq_produce(&qhp->wq);
+                wr = wr->next;
+                num_wrs--;
+                idx++;
+        }
+        if (t4_wq_db_enabled(&qhp->wq))
+                t4_ring_rq_db(&qhp->wq, idx);
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        return err;
+}
+
+int c4iw_bind_mw(struct ib_qp *qp, struct ib_mw *mw, struct ib_mw_bind *mw_bind)
+{
+        return -ENOSYS;
+}
+
+static inline void build_term_codes(struct t4_cqe *err_cqe, u8 *layer_type,
+                                    u8 *ecode)
+{
+        int status;
+        int tagged;
+        int opcode;
+        int rqtype;
+        int send_inv;
+
+        if (!err_cqe) {
+                *layer_type = LAYER_RDMAP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                return;
+        }
+
+        status = CQE_STATUS(err_cqe);
+        opcode = CQE_OPCODE(err_cqe);
+        rqtype = RQ_TYPE(err_cqe);
+        send_inv = (opcode == FW_RI_SEND_WITH_INV) ||
+                   (opcode == FW_RI_SEND_WITH_SE_INV);
+        tagged = (opcode == FW_RI_RDMA_WRITE) ||
+                 (rqtype && (opcode == FW_RI_READ_RESP));
+
+        switch (status) {
+        case T4_ERR_STAG:
+                if (send_inv) {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                        *ecode = RDMAP_CANT_INV_STAG;
+                } else {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_INV_STAG;
+                }
+                break;
+        case T4_ERR_PDID:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                if ((opcode == FW_RI_SEND_WITH_INV) ||
+                    (opcode == FW_RI_SEND_WITH_SE_INV))
+                        *ecode = RDMAP_CANT_INV_STAG;
+                else
+                        *ecode = RDMAP_STAG_NOT_ASSOC;
+                break;
+        case T4_ERR_QPID:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_STAG_NOT_ASSOC;
+                break;
+        case T4_ERR_ACCESS:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_ACC_VIOL;
+                break;
+        case T4_ERR_WRAP:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_TO_WRAP;
+                break;
+        case T4_ERR_BOUND:
+                if (tagged) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_BASE_BOUNDS;
+                } else {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_BASE_BOUNDS;
+                }
+                break;
+        case T4_ERR_INVALIDATE_SHARED_MR:
+        case T4_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_CANT_INV_STAG;
+                break;
+        case T4_ERR_ECC:
+        case T4_ERR_ECC_PSTAG:
+        case T4_ERR_INTERNAL_ERR:
+                *layer_type = LAYER_RDMAP|RDMAP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case T4_ERR_OUT_OF_RQE:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_NOBUF;
+                break;
+        case T4_ERR_PBL_ADDR_BOUND:
+                *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                *ecode = DDPT_BASE_BOUNDS;
+                break;
+        case T4_ERR_CRC:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_CRC_ERR;
+                break;
+        case T4_ERR_MARKER:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_MARKER_ERR;
+                break;
+        case T4_ERR_PDU_LEN_ERR:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_MSG_TOOBIG;
+                break;
+        case T4_ERR_DDP_VERSION:
+                if (tagged) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_INV_VERS;
+                } else {
+                        *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                        *ecode = DDPU_INV_VERS;
+                }
+                break;
+        case T4_ERR_RDMA_VERSION:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_VERS;
+                break;
+        case T4_ERR_OPCODE:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_OPCODE;
+                break;
+        case T4_ERR_DDP_QUEUE_NUM:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_QN;
+                break;
+        case T4_ERR_MSN:
+        case T4_ERR_MSN_GAP:
+        case T4_ERR_MSN_RANGE:
+        case T4_ERR_IRD_OVERFLOW:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_RANGE;
+                break;
+        case T4_ERR_TBIT:
+                *layer_type = LAYER_DDP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case T4_ERR_MO:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MO;
+                break;
+        default:
+                *layer_type = LAYER_RDMAP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        }
+}
+
+int c4iw_post_zb_read(struct c4iw_qp *qhp)
+{
+        union t4_wr *wqe;
+        struct sk_buff *skb;
+        u8 len16;
+
+        PDBG("%s enter\n", __func__);
+        skb = alloc_skb(40, GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR "%s cannot send zb_read!!\n", __func__);
+                return -ENOMEM;
+        }
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (union t4_wr *)skb_put(skb, sizeof wqe->read);
+        memset(wqe, 0, sizeof wqe->read);
+        wqe->read.r2 = cpu_to_be64(0);
+        wqe->read.stag_sink = cpu_to_be32(1);
+        wqe->read.to_sink_hi = cpu_to_be32(0);
+        wqe->read.to_sink_lo = cpu_to_be32(1);
+        wqe->read.stag_src = cpu_to_be32(1);
+        wqe->read.plen = cpu_to_be32(0);
+        wqe->read.to_src_hi = cpu_to_be32(0);
+        wqe->read.to_src_lo = cpu_to_be32(1);
+        len16 = DIV_ROUND_UP(sizeof wqe->read, 16);
+        init_wr_hdr(wqe, 0, FW_RI_RDMA_READ_WR, FW_RI_COMPLETION_FLAG, len16);
+
+        return c4iw_ofld_send(&qhp->rhp->rdev, skb);
+}
+
+static void post_terminate(struct c4iw_qp *qhp, struct t4_cqe *err_cqe,
+                           gfp_t gfp)
+{
+        struct fw_ri_wr *wqe;
+        struct sk_buff *skb;
+        struct terminate_message *term;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, gfp);
+        if (!skb)
+                return;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(FW_WR_OP(FW_RI_INIT_WR));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+
+        wqe->u.terminate.type = FW_RI_TYPE_TERMINATE;
+        wqe->u.terminate.immdlen = cpu_to_be32(sizeof *term);
+        term = (struct terminate_message *)wqe->u.terminate.termmsg;
+        build_term_codes(err_cqe, &term->layer_etype, &term->ecode);
+        c4iw_ofld_send(&qhp->rhp->rdev, skb);
+}
+
+/*
+ * Assumes qhp lock is held.
+ */
+static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp,
+                       struct c4iw_cq *schp, unsigned long *flag)
+{
+        int count;
+        int flushed;
+
+        PDBG("%s qhp %p rchp %p schp %p\n", __func__, qhp, rchp, schp);
+        /* take a ref on the qhp since we must release the lock */
+        atomic_inc(&qhp->refcnt);
+        spin_unlock_irqrestore(&qhp->lock, *flag);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&rchp->lock, *flag);
+        spin_lock(&qhp->lock);
+        c4iw_flush_hw_cq(&rchp->cq);
+        c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count);
+        flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&rchp->lock, *flag);
+        if (flushed)
+                (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&schp->lock, *flag);
+        spin_lock(&qhp->lock);
+        c4iw_flush_hw_cq(&schp->cq);
+        c4iw_count_scqes(&schp->cq, &qhp->wq, &count);
+        flushed = c4iw_flush_sq(&qhp->wq, &schp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&schp->lock, *flag);
+        if (flushed)
+                (*schp->ibcq.comp_handler)(&schp->ibcq, schp->ibcq.cq_context);
+
+        /* deref */
+        if (atomic_dec_and_test(&qhp->refcnt))
+                wake_up(&qhp->wait);
+
+        spin_lock_irqsave(&qhp->lock, *flag);
+}
+
+static void flush_qp(struct c4iw_qp *qhp, unsigned long *flag)
+{
+        struct c4iw_cq *rchp, *schp;
+
+        rchp = get_chp(qhp->rhp, qhp->attr.rcq);
+        schp = get_chp(qhp->rhp, qhp->attr.scq);
+
+        if (qhp->ibqp.uobject) {
+                t4_set_wq_in_error(&qhp->wq);
+                t4_set_cq_in_error(&rchp->cq);
+                if (schp != rchp)
+                        t4_set_cq_in_error(&schp->cq);
+                return;
+        }
+        __flush_qp(qhp, rchp, schp, flag);
+}
+
+static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
+{
+        struct fw_ri_wr *wqe;
+        int ret;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(
+                FW_WR_OP(FW_RI_INIT_WR) |
+                FW_WR_COMPL(1));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+        wqe->cookie = (u64)&wr_wait;
+
+        wqe->u.fini.type = FW_RI_TYPE_FINI;
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(&rhp->rdev, skb);
+        if (ret)
+                goto out;
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rhp->rdev.lldi.pdev));
+                rhp->rdev.flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else {
+                ret = wr_wait.ret;
+                if (ret)
+                        printk(KERN_WARNING MOD
+                               "%s: Abnormal close qpid %d ret %u\n",
+                               pci_name(rhp->rdev.lldi.pdev), qhp->wq.sq.qid,
+                               ret);
+        }
+out:
+        PDBG("%s ret %d\n", __func__, ret);
+        return ret;
+}
+
+static void build_rtr_msg(u8 p2p_type, struct fw_ri_init *init)
+{
+        memset(&init->u, 0, sizeof init->u);
+        switch (p2p_type) {
+        case FW_RI_INIT_P2PTYPE_RDMA_WRITE:
+                init->u.write.opcode = FW_RI_RDMA_WRITE_WR;
+                init->u.write.stag_sink = cpu_to_be32(1);
+                init->u.write.to_sink = cpu_to_be64(1);
+                init->u.write.u.immd_src[0].op = FW_RI_DATA_IMMD;
+                init->u.write.len16 = DIV_ROUND_UP(sizeof init->u.write +
+                                                   sizeof(struct fw_ri_immd),
+                                                   16);
+                break;
+        case FW_RI_INIT_P2PTYPE_READ_REQ:
+                init->u.write.opcode = FW_RI_RDMA_READ_WR;
+                init->u.read.stag_src = cpu_to_be32(1);
+                init->u.read.to_src_lo = cpu_to_be32(1);
+                init->u.read.stag_sink = cpu_to_be32(1);
+                init->u.read.to_sink_lo = cpu_to_be32(1);
+                init->u.read.len16 = DIV_ROUND_UP(sizeof init->u.read, 16);
+                break;
+        }
+}
+
+static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
+{
+        struct fw_ri_wr *wqe;
+        int ret;
+        struct c4iw_wr_wait wr_wait;
+        struct sk_buff *skb;
+
+        PDBG("%s qhp %p qid 0x%x tid %u\n", __func__, qhp, qhp->wq.sq.qid,
+             qhp->ep->hwtid);
+
+        skb = alloc_skb(sizeof *wqe, GFP_KERNEL | __GFP_NOFAIL);
+        if (!skb)
+                return -ENOMEM;
+        set_wr_txq(skb, CPL_PRIORITY_DATA, qhp->ep->txq_idx);
+
+        wqe = (struct fw_ri_wr *)__skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof *wqe);
+        wqe->op_compl = cpu_to_be32(
+                FW_WR_OP(FW_RI_INIT_WR) |
+                FW_WR_COMPL(1));
+        wqe->flowid_len16 = cpu_to_be32(
+                FW_WR_FLOWID(qhp->ep->hwtid) |
+                FW_WR_LEN16(DIV_ROUND_UP(sizeof *wqe, 16)));
+
+        wqe->cookie = (u64)&wr_wait;
+
+        wqe->u.init.type = FW_RI_TYPE_INIT;
+        wqe->u.init.mpareqbit_p2ptype =
+                V_FW_RI_WR_MPAREQBIT(qhp->attr.mpa_attr.initiator) |
+                V_FW_RI_WR_P2PTYPE(qhp->attr.mpa_attr.p2p_type);
+        wqe->u.init.mpa_attrs = FW_RI_MPA_IETF_ENABLE;
+        if (qhp->attr.mpa_attr.recv_marker_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_RX_MARKER_ENABLE;
+        if (qhp->attr.mpa_attr.xmit_marker_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_TX_MARKER_ENABLE;
+        if (qhp->attr.mpa_attr.crc_enabled)
+                wqe->u.init.mpa_attrs |= FW_RI_MPA_CRC_ENABLE;
+
+        wqe->u.init.qp_caps = FW_RI_QP_RDMA_READ_ENABLE |
+                            FW_RI_QP_RDMA_WRITE_ENABLE |
+                            FW_RI_QP_BIND_ENABLE;
+        if (!qhp->ibqp.uobject)
+                wqe->u.init.qp_caps |= FW_RI_QP_FAST_REGISTER_ENABLE |
+                                     FW_RI_QP_STAG0_ENABLE;
+        wqe->u.init.nrqe = cpu_to_be16(t4_rqes_posted(&qhp->wq));
+        wqe->u.init.pdid = cpu_to_be32(qhp->attr.pd);
+        wqe->u.init.qpid = cpu_to_be32(qhp->wq.sq.qid);
+        wqe->u.init.sq_eqid = cpu_to_be32(qhp->wq.sq.qid);
+        wqe->u.init.rq_eqid = cpu_to_be32(qhp->wq.rq.qid);
+        wqe->u.init.scqid = cpu_to_be32(qhp->attr.scq);
+        wqe->u.init.rcqid = cpu_to_be32(qhp->attr.rcq);
+        wqe->u.init.ord_max = cpu_to_be32(qhp->attr.max_ord);
+        wqe->u.init.ird_max = cpu_to_be32(qhp->attr.max_ird);
+        wqe->u.init.iss = cpu_to_be32(qhp->ep->snd_seq);
+        wqe->u.init.irs = cpu_to_be32(qhp->ep->rcv_seq);
+        wqe->u.init.hwrqsize = cpu_to_be32(qhp->wq.rq.rqt_size);
+        wqe->u.init.hwrqaddr = cpu_to_be32(qhp->wq.rq.rqt_hwaddr -
+                                         rhp->rdev.lldi.vr->rq.start);
+        if (qhp->attr.mpa_attr.initiator)
+                build_rtr_msg(qhp->attr.mpa_attr.p2p_type, &wqe->u.init);
+
+        c4iw_init_wr_wait(&wr_wait);
+        ret = c4iw_ofld_send(&rhp->rdev, skb);
+        if (ret)
+                goto out;
+
+        wait_event_timeout(wr_wait.wait, wr_wait.done, C4IW_WR_TO);
+        if (!wr_wait.done) {
+                printk(KERN_ERR MOD "Device %s not responding!\n",
+                       pci_name(rhp->rdev.lldi.pdev));
+                rhp->rdev.flags = T4_FATAL_ERROR;
+                ret = -EIO;
+        } else
+                ret = wr_wait.ret;
+out:
+        PDBG("%s ret %d\n", __func__, ret);
+        return ret;
+}
+
+int c4iw_modify_qp(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
+                   enum c4iw_qp_attr_mask mask,
+                   struct c4iw_qp_attributes *attrs,
+                   int internal)
+{
+        int ret = 0;
+        struct c4iw_qp_attributes newattr = qhp->attr;
+        unsigned long flag;
+        int disconnect = 0;
+        int terminate = 0;
+        int abort = 0;
+        int free = 0;
+        struct c4iw_ep *ep = NULL;
+
+        PDBG("%s qhp %p sqid 0x%x rqid 0x%x ep %p state %d -> %d\n", __func__,
+             qhp, qhp->wq.sq.qid, qhp->wq.rq.qid, qhp->ep, qhp->attr.state,
+             (mask & C4IW_QP_ATTR_NEXT_STATE) ? attrs->next_state : -1);
+
+        spin_lock_irqsave(&qhp->lock, flag);
+
+        /* Process attr changes if in IDLE */
+        if (mask & C4IW_QP_ATTR_VALID_MODIFY) {
+                if (qhp->attr.state != C4IW_QP_STATE_IDLE) {
+                        ret = -EIO;
+                        goto out;
+                }
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_READ)
+                        newattr.enable_rdma_read = attrs->enable_rdma_read;
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_WRITE)
+                        newattr.enable_rdma_write = attrs->enable_rdma_write;
+                if (mask & C4IW_QP_ATTR_ENABLE_RDMA_BIND)
+                        newattr.enable_bind = attrs->enable_bind;
+                if (mask & C4IW_QP_ATTR_MAX_ORD) {
+                        if (attrs->max_ord > c4iw_max_read_depth) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ord = attrs->max_ord;
+                }
+                if (mask & C4IW_QP_ATTR_MAX_IRD) {
+                        if (attrs->max_ird > c4iw_max_read_depth) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ird = attrs->max_ird;
+                }
+                qhp->attr = newattr;
+        }
+
+        if (!(mask & C4IW_QP_ATTR_NEXT_STATE))
+                goto out;
+        if (qhp->attr.state == attrs->next_state)
+                goto out;
+
+        switch (qhp->attr.state) {
+        case C4IW_QP_STATE_IDLE:
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_RTS:
+                        if (!(mask & C4IW_QP_ATTR_LLP_STREAM_HANDLE)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        if (!(mask & C4IW_QP_ATTR_MPA_ATTR)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        qhp->attr.mpa_attr = attrs->mpa_attr;
+                        qhp->attr.llp_stream_handle = attrs->llp_stream_handle;
+                        qhp->ep = qhp->attr.llp_stream_handle;
+                        qhp->attr.state = C4IW_QP_STATE_RTS;
+
+                        /*
+                         * Ref the endpoint here and deref when we
+                         * disassociate the endpoint from the QP.  This
+                         * happens in CLOSING->IDLE transition or *->ERROR
+                         * transition.
+                         */
+                        c4iw_get_ep(&qhp->ep->com);
+                        spin_unlock_irqrestore(&qhp->lock, flag);
+                        ret = rdma_init(rhp, qhp);
+                        spin_lock_irqsave(&qhp->lock, flag);
+                        if (ret)
+                                goto err;
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        qhp->attr.state = C4IW_QP_STATE_ERROR;
+                        flush_qp(qhp, &flag);
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case C4IW_QP_STATE_RTS:
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_CLOSING:
+                        BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
+                        qhp->attr.state = C4IW_QP_STATE_CLOSING;
+                        if (!internal) {
+                                abort = 0;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                        }
+                        spin_unlock_irqrestore(&qhp->lock, flag);
+                        ret = rdma_fini(rhp, qhp);
+                        spin_lock_irqsave(&qhp->lock, flag);
+                        if (ret) {
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                                disconnect = abort = 1;
+                                goto err;
+                        }
+                        break;
+                case C4IW_QP_STATE_TERMINATE:
+                        qhp->attr.state = C4IW_QP_STATE_TERMINATE;
+                        if (qhp->ibqp.uobject)
+                                t4_set_wq_in_error(&qhp->wq);
+                        ep = qhp->ep;
+                        c4iw_get_ep(&ep->com);
+                        terminate = 1;
+                        disconnect = 1;
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        qhp->attr.state = C4IW_QP_STATE_ERROR;
+                        if (!internal) {
+                                abort = 1;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                                c4iw_get_ep(&ep->com);
+                        }
+                        goto err;
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case C4IW_QP_STATE_CLOSING:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                switch (attrs->next_state) {
+                case C4IW_QP_STATE_IDLE:
+                        flush_qp(qhp, &flag);
+                        qhp->attr.state = C4IW_QP_STATE_IDLE;
+                        qhp->attr.llp_stream_handle = NULL;
+                        c4iw_put_ep(&qhp->ep->com);
+                        qhp->ep = NULL;
+                        wake_up(&qhp->wait);
+                        break;
+                case C4IW_QP_STATE_ERROR:
+                        goto err;
+                default:
+                        ret = -EINVAL;
+                        goto err;
+                }
+                break;
+        case C4IW_QP_STATE_ERROR:
+                if (attrs->next_state != C4IW_QP_STATE_IDLE) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                if (!t4_sq_empty(&qhp->wq) || !t4_rq_empty(&qhp->wq)) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                qhp->attr.state = C4IW_QP_STATE_IDLE;
+                break;
+        case C4IW_QP_STATE_TERMINATE:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                goto err;
+                break;
+        default:
+                printk(KERN_ERR "%s in a bad state %d\n",
+                       __func__, qhp->attr.state);
+                ret = -EINVAL;
+                goto err;
+                break;
+        }
+        goto out;
+err:
+        PDBG("%s disassociating ep %p qpid 0x%x\n", __func__, qhp->ep,
+             qhp->wq.sq.qid);
+
+        /* disassociate the LLP connection */
+        qhp->attr.llp_stream_handle = NULL;
+        ep = qhp->ep;
+        qhp->ep = NULL;
+        qhp->attr.state = C4IW_QP_STATE_ERROR;
+        free = 1;
+        wake_up(&qhp->wait);
+        BUG_ON(!ep);
+        flush_qp(qhp, &flag);
+out:
+        spin_unlock_irqrestore(&qhp->lock, flag);
+
+        if (terminate)
+                post_terminate(qhp, NULL, internal ? GFP_ATOMIC : GFP_KERNEL);
+
+        /*
+         * If disconnect is 1, then we need to initiate a disconnect
+         * on the EP.  This can be a normal close (RTS->CLOSING) or
+         * an abnormal close (RTS/CLOSING->ERROR).
+         */
+        if (disconnect) {
+                c4iw_ep_disconnect(ep, abort, internal ? GFP_ATOMIC :
+                                                         GFP_KERNEL);
+                c4iw_put_ep(&ep->com);
+        }
+
+        /*
+         * If free is 1, then we've disassociated the EP from the QP
+         * and we need to dereference the EP.
+         */
+        if (free)
+                c4iw_put_ep(&ep->com);
+
+        PDBG("%s exit state %d\n", __func__, qhp->attr.state);
+        return ret;
+}
+
+int c4iw_destroy_qp(struct ib_qp *ib_qp)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        struct c4iw_qp_attributes attrs;
+        struct c4iw_ucontext *ucontext;
+
+        qhp = to_c4iw_qp(ib_qp);
+        rhp = qhp->rhp;
+
+        attrs.next_state = C4IW_QP_STATE_ERROR;
+        c4iw_modify_qp(rhp, qhp, C4IW_QP_ATTR_NEXT_STATE, &attrs, 0);
+        wait_event(qhp->wait, !qhp->ep);
+
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
+        atomic_dec(&qhp->refcnt);
+        wait_event(qhp->wait, !atomic_read(&qhp->refcnt));
+
+        ucontext = ib_qp->uobject ?
+                   to_c4iw_ucontext(ib_qp->uobject->context) : NULL;
+        destroy_qp(&rhp->rdev, &qhp->wq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+
+        PDBG("%s ib_qp %p qpid 0x%0x\n", __func__, ib_qp, qhp->wq.sq.qid);
+        kfree(qhp);
+        return 0;
+}
+
+struct ib_qp *c4iw_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attrs,
+                             struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        struct c4iw_pd *php;
+        struct c4iw_cq *schp;
+        struct c4iw_cq *rchp;
+        struct c4iw_create_qp_resp uresp;
+        int sqsize, rqsize;
+        struct c4iw_ucontext *ucontext;
+        int ret;
+        struct c4iw_mm_entry *mm1, *mm2, *mm3, *mm4;
+
+        PDBG("%s ib_pd %p\n", __func__, pd);
+
+        if (attrs->qp_type != IB_QPT_RC)
+                return ERR_PTR(-EINVAL);
+
+        php = to_c4iw_pd(pd);
+        rhp = php->rhp;
+        schp = get_chp(rhp, ((struct c4iw_cq *)attrs->send_cq)->cq.cqid);
+        rchp = get_chp(rhp, ((struct c4iw_cq *)attrs->recv_cq)->cq.cqid);
+        if (!schp || !rchp)
+                return ERR_PTR(-EINVAL);
+
+        if (attrs->cap.max_inline_data > T4_MAX_SEND_INLINE)
+                return ERR_PTR(-EINVAL);
+
+        rqsize = roundup(attrs->cap.max_recv_wr + 1, 16);
+        if (rqsize > T4_MAX_RQ_SIZE)
+                return ERR_PTR(-E2BIG);
+
+        sqsize = roundup(attrs->cap.max_send_wr + 1, 16);
+        if (sqsize > T4_MAX_SQ_SIZE)
+                return ERR_PTR(-E2BIG);
+
+        ucontext = pd->uobject ? to_c4iw_ucontext(pd->uobject->context) : NULL;
+
+
+        qhp = kzalloc(sizeof(*qhp), GFP_KERNEL);
+        if (!qhp)
+                return ERR_PTR(-ENOMEM);
+        qhp->wq.sq.size = sqsize;
+        qhp->wq.sq.memsize = (sqsize + 1) * sizeof *qhp->wq.sq.queue;
+        qhp->wq.rq.size = rqsize;
+        qhp->wq.rq.memsize = (rqsize + 1) * sizeof *qhp->wq.rq.queue;
+
+        if (ucontext) {
+                qhp->wq.sq.memsize = roundup(qhp->wq.sq.memsize, PAGE_SIZE);
+                qhp->wq.rq.memsize = roundup(qhp->wq.rq.memsize, PAGE_SIZE);
+        }
+
+        PDBG("%s sqsize %u sqmemsize %zu rqsize %u rqmemsize %zu\n",
+             __func__, sqsize, qhp->wq.sq.memsize, rqsize, qhp->wq.rq.memsize);
+
+        ret = create_qp(&rhp->rdev, &qhp->wq, &schp->cq, &rchp->cq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+        if (ret)
+                goto err1;
+
+        attrs->cap.max_recv_wr = rqsize - 1;
+        attrs->cap.max_send_wr = sqsize - 1;
+        attrs->cap.max_inline_data = T4_MAX_SEND_INLINE;
+
+        qhp->rhp = rhp;
+        qhp->attr.pd = php->pdid;
+        qhp->attr.scq = ((struct c4iw_cq *) attrs->send_cq)->cq.cqid;
+        qhp->attr.rcq = ((struct c4iw_cq *) attrs->recv_cq)->cq.cqid;
+        qhp->attr.sq_num_entries = attrs->cap.max_send_wr;
+        qhp->attr.rq_num_entries = attrs->cap.max_recv_wr;
+        qhp->attr.sq_max_sges = attrs->cap.max_send_sge;
+        qhp->attr.sq_max_sges_rdma_write = attrs->cap.max_send_sge;
+        qhp->attr.rq_max_sges = attrs->cap.max_recv_sge;
+        qhp->attr.state = C4IW_QP_STATE_IDLE;
+        qhp->attr.next_state = C4IW_QP_STATE_IDLE;
+        qhp->attr.enable_rdma_read = 1;
+        qhp->attr.enable_rdma_write = 1;
+        qhp->attr.enable_bind = 1;
+        qhp->attr.max_ord = 1;
+        qhp->attr.max_ird = 1;
+        spin_lock_init(&qhp->lock);
+        init_waitqueue_head(&qhp->wait);
+        atomic_set(&qhp->refcnt, 1);
+
+        ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.sq.qid);
+        if (ret)
+                goto err2;
+
+        ret = insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.rq.qid);
+        if (ret)
+                goto err3;
+
+        if (udata) {
+                mm1 = kmalloc(sizeof *mm1, GFP_KERNEL);
+                if (!mm1) {
+                        ret = -ENOMEM;
+                        goto err4;
+                }
+                mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
+                if (!mm2) {
+                        ret = -ENOMEM;
+                        goto err5;
+                }
+                mm3 = kmalloc(sizeof *mm3, GFP_KERNEL);
+                if (!mm3) {
+                        ret = -ENOMEM;
+                        goto err6;
+                }
+                mm4 = kmalloc(sizeof *mm4, GFP_KERNEL);
+                if (!mm4) {
+                        ret = -ENOMEM;
+                        goto err7;
+                }
+
+                uresp.qid_mask = rhp->rdev.qpmask;
+                uresp.sqid = qhp->wq.sq.qid;
+                uresp.sq_size = qhp->wq.sq.size;
+                uresp.sq_memsize = qhp->wq.sq.memsize;
+                uresp.rqid = qhp->wq.rq.qid;
+                uresp.rq_size = qhp->wq.rq.size;
+                uresp.rq_memsize = qhp->wq.rq.memsize;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.sq_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.rq_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.sq_db_gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.rq_db_gts_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                ret = ib_copy_to_udata(udata, &uresp, sizeof uresp);
+                if (ret)
+                        goto err8;
+                mm1->key = uresp.sq_key;
+                mm1->addr = virt_to_phys(qhp->wq.sq.queue);
+                mm1->len = PAGE_ALIGN(qhp->wq.sq.memsize);
+                insert_mmap(ucontext, mm1);
+                mm2->key = uresp.rq_key;
+                mm2->addr = virt_to_phys(qhp->wq.rq.queue);
+                mm2->len = PAGE_ALIGN(qhp->wq.rq.memsize);
+                insert_mmap(ucontext, mm2);
+                mm3->key = uresp.sq_db_gts_key;
+                mm3->addr = qhp->wq.sq.udb;
+                mm3->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm3);
+                mm4->key = uresp.rq_db_gts_key;
+                mm4->addr = qhp->wq.rq.udb;
+                mm4->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm4);
+        }
+        qhp->ibqp.qp_num = qhp->wq.sq.qid;
+        init_timer(&(qhp->timer));
+        PDBG("%s qhp %p sq_num_entries %d, rq_num_entries %d qpid 0x%0x\n",
+             __func__, qhp, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
+             qhp->wq.sq.qid);
+        return &qhp->ibqp;
+err8:
+        kfree(mm4);
+err7:
+        kfree(mm3);
+err6:
+        kfree(mm2);
+err5:
+        kfree(mm1);
+err4:
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.rq.qid);
+err3:
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.sq.qid);
+err2:
+        destroy_qp(&rhp->rdev, &qhp->wq,
+                   ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+err1:
+        kfree(qhp);
+        return ERR_PTR(ret);
+}
+
+int c4iw_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                      int attr_mask, struct ib_udata *udata)
+{
+        struct c4iw_dev *rhp;
+        struct c4iw_qp *qhp;
+        enum c4iw_qp_attr_mask mask = 0;
+        struct c4iw_qp_attributes attrs;
+
+        PDBG("%s ib_qp %p\n", __func__, ibqp);
+
+        /* iwarp does not support the RTR state */
+        if ((attr_mask & IB_QP_STATE) && (attr->qp_state == IB_QPS_RTR))
+                attr_mask &= ~IB_QP_STATE;
+
+        /* Make sure we still have something left to do */
+        if (!attr_mask)
+                return 0;
+
+        memset(&attrs, 0, sizeof attrs);
+        qhp = to_c4iw_qp(ibqp);
+        rhp = qhp->rhp;
+
+        attrs.next_state = c4iw_convert_state(attr->qp_state);
+        attrs.enable_rdma_read = (attr->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ) ?  1 : 0;
+        attrs.enable_rdma_write = (attr->qp_access_flags &
+                                IB_ACCESS_REMOTE_WRITE) ? 1 : 0;
+        attrs.enable_bind = (attr->qp_access_flags & IB_ACCESS_MW_BIND) ? 1 : 0;
+
+
+        mask |= (attr_mask & IB_QP_STATE) ? C4IW_QP_ATTR_NEXT_STATE : 0;
+        mask |= (attr_mask & IB_QP_ACCESS_FLAGS) ?
+                        (C4IW_QP_ATTR_ENABLE_RDMA_READ |
+                         C4IW_QP_ATTR_ENABLE_RDMA_WRITE |
+                         C4IW_QP_ATTR_ENABLE_RDMA_BIND) : 0;
+
+        return c4iw_modify_qp(rhp, qhp, mask, &attrs, 0);
+}
+
+struct ib_qp *c4iw_get_qp(struct ib_device *dev, int qpn)
+{
+        PDBG("%s ib_dev %p qpn 0x%x\n", __func__, dev, qpn);
+        return (struct ib_qp *)get_qhp(to_c4iw_dev(dev), qpn);
+}
diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c
new file mode 100644
index 000000000000..fb195d1d9015
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/resource.c
@@ -0,0 +1,417 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+/* Crude resource management */
+#include <linux/kernel.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/kfifo.h>
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/genalloc.h>
+#include "iw_cxgb4.h"
+
+#define RANDOM_SIZE 16
+
+static int __c4iw_init_resource_fifo(struct kfifo *fifo,
+                                   spinlock_t *fifo_lock,
+                                   u32 nr, u32 skip_low,
+                                   u32 skip_high,
+                                   int random)
+{
+        u32 i, j, entry = 0, idx;
+        u32 random_bytes;
+        u32 rarray[16];
+        spin_lock_init(fifo_lock);
+
+        if (kfifo_alloc(fifo, nr * sizeof(u32), GFP_KERNEL))
+                return -ENOMEM;
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                kfifo_in(fifo, (unsigned char *) &entry, sizeof(u32));
+        if (random) {
+                j = 0;
+                random_bytes = random32();
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        rarray[i] = i + skip_low;
+                for (i = skip_low + RANDOM_SIZE; i < nr - skip_high; i++) {
+                        if (j >= RANDOM_SIZE) {
+                                j = 0;
+                                random_bytes = random32();
+                        }
+                        idx = (random_bytes >> (j * 2)) & 0xF;
+                        kfifo_in(fifo,
+                                (unsigned char *) &rarray[idx],
+                                sizeof(u32));
+                        rarray[idx] = i;
+                        j++;
+                }
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        kfifo_in(fifo,
+                                (unsigned char *) &rarray[i],
+                                sizeof(u32));
+        } else
+                for (i = skip_low; i < nr - skip_high; i++)
+                        kfifo_in(fifo, (unsigned char *) &i, sizeof(u32));
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                if (kfifo_out_locked(fifo, (unsigned char *) &entry,
+                                     sizeof(u32), fifo_lock))
+                        break;
+        return 0;
+}
+
+static int c4iw_init_resource_fifo(struct kfifo *fifo, spinlock_t * fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+        return __c4iw_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 0);
+}
+
+static int c4iw_init_resource_fifo_random(struct kfifo *fifo,
+                                   spinlock_t *fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+        return __c4iw_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 1);
+}
+
+static int c4iw_init_qid_fifo(struct c4iw_rdev *rdev)
+{
+        u32 i;
+
+        spin_lock_init(&rdev->resource.qid_fifo_lock);
+
+        if (kfifo_alloc(&rdev->resource.qid_fifo, T4_MAX_QIDS * sizeof(u32),
+                        GFP_KERNEL))
+                return -ENOMEM;
+
+        for (i = T4_QID_BASE; i < T4_QID_BASE + T4_MAX_QIDS; i++)
+                if (!(i & rdev->qpmask))
+                        kfifo_in(&rdev->resource.qid_fifo,
+                                    (unsigned char *) &i, sizeof(u32));
+        return 0;
+}
+
+/* nr_* must be power of 2 */
+int c4iw_init_resource(struct c4iw_rdev *rdev, u32 nr_tpt, u32 nr_pdid)
+{
+        int err = 0;
+        err = c4iw_init_resource_fifo_random(&rdev->resource.tpt_fifo,
+                                             &rdev->resource.tpt_fifo_lock,
+                                             nr_tpt, 1, 0);
+        if (err)
+                goto tpt_err;
+        err = c4iw_init_qid_fifo(rdev);
+        if (err)
+                goto qid_err;
+        err = c4iw_init_resource_fifo(&rdev->resource.pdid_fifo,
+                                      &rdev->resource.pdid_fifo_lock,
+                                      nr_pdid, 1, 0);
+        if (err)
+                goto pdid_err;
+        return 0;
+pdid_err:
+        kfifo_free(&rdev->resource.qid_fifo);
+qid_err:
+        kfifo_free(&rdev->resource.tpt_fifo);
+tpt_err:
+        return -ENOMEM;
+}
+
+/*
+ * returns 0 if no resource available
+ */
+u32 c4iw_get_resource(struct kfifo *fifo, spinlock_t *lock)
+{
+        u32 entry;
+        if (kfifo_out_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock))
+                return entry;
+        else
+                return 0;
+}
+
+void c4iw_put_resource(struct kfifo *fifo, u32 entry, spinlock_t *lock)
+{
+        PDBG("%s entry 0x%x\n", __func__, entry);
+        kfifo_in_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock);
+}
+
+u32 c4iw_get_cqid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+        u32 qid;
+        int i;
+
+        mutex_lock(&uctx->lock);
+        if (!list_empty(&uctx->cqids)) {
+                entry = list_entry(uctx->cqids.next, struct c4iw_qid_list,
+                                   entry);
+                list_del(&entry->entry);
+                qid = entry->qid;
+                kfree(entry);
+        } else {
+                qid = c4iw_get_resource(&rdev->resource.qid_fifo,
+                                        &rdev->resource.qid_fifo_lock);
+                if (!qid)
+                        goto out;
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->cqids);
+                }
+
+                /*
+                 * now put the same ids on the qp list since they all
+                 * map to the same db/gts page.
+                 */
+                entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                if (!entry)
+                        goto out;
+                entry->qid = qid;
+                list_add_tail(&entry->entry, &uctx->qpids);
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->qpids);
+                }
+        }
+out:
+        mutex_unlock(&uctx->lock);
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        return qid;
+}
+
+void c4iw_put_cqid(struct c4iw_rdev *rdev, u32 qid,
+                   struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+
+        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+        if (!entry)
+                return;
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        entry->qid = qid;
+        mutex_lock(&uctx->lock);
+        list_add_tail(&entry->entry, &uctx->cqids);
+        mutex_unlock(&uctx->lock);
+}
+
+u32 c4iw_get_qpid(struct c4iw_rdev *rdev, struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+        u32 qid;
+        int i;
+
+        mutex_lock(&uctx->lock);
+        if (!list_empty(&uctx->qpids)) {
+                entry = list_entry(uctx->qpids.next, struct c4iw_qid_list,
+                                   entry);
+                list_del(&entry->entry);
+                qid = entry->qid;
+                kfree(entry);
+        } else {
+                qid = c4iw_get_resource(&rdev->resource.qid_fifo,
+                                        &rdev->resource.qid_fifo_lock);
+                if (!qid)
+                        goto out;
+                for (i = qid+1; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->qpids);
+                }
+
+                /*
+                 * now put the same ids on the cq list since they all
+                 * map to the same db/gts page.
+                 */
+                entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                if (!entry)
+                        goto out;
+                entry->qid = qid;
+                list_add_tail(&entry->entry, &uctx->cqids);
+                for (i = qid; i & rdev->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                goto out;
+                        entry->qid = i;
+                        list_add_tail(&entry->entry, &uctx->cqids);
+                }
+        }
+out:
+        mutex_unlock(&uctx->lock);
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        return qid;
+}
+
+void c4iw_put_qpid(struct c4iw_rdev *rdev, u32 qid,
+                   struct c4iw_dev_ucontext *uctx)
+{
+        struct c4iw_qid_list *entry;
+
+        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+        if (!entry)
+                return;
+        PDBG("%s qid 0x%x\n", __func__, qid);
+        entry->qid = qid;
+        mutex_lock(&uctx->lock);
+        list_add_tail(&entry->entry, &uctx->qpids);
+        mutex_unlock(&uctx->lock);
+}
+
+void c4iw_destroy_resource(struct c4iw_resource *rscp)
+{
+        kfifo_free(&rscp->tpt_fifo);
+        kfifo_free(&rscp->qid_fifo);
+        kfifo_free(&rscp->pdid_fifo);
+}
+
+/*
+ * PBL Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_PBL_SHIFT 8                 /* 256B == min PBL size (32 entries) */
+
+u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev->pbl_pool, size);
+        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size);
+        return (u32)addr;
+}
+
+void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __func__, addr, size);
+        gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size);
+}
+
+int c4iw_pblpool_create(struct c4iw_rdev *rdev)
+{
+        unsigned pbl_start, pbl_chunk, pbl_top;
+
+        rdev->pbl_pool = gen_pool_create(MIN_PBL_SHIFT, -1);
+        if (!rdev->pbl_pool)
+                return -ENOMEM;
+
+        pbl_start = rdev->lldi.vr->pbl.start;
+        pbl_chunk = rdev->lldi.vr->pbl.size;
+        pbl_top = pbl_start + pbl_chunk;
+
+        while (pbl_start < pbl_top) {
+                pbl_chunk = min(pbl_top - pbl_start + 1, pbl_chunk);
+                if (gen_pool_add(rdev->pbl_pool, pbl_start, pbl_chunk, -1)) {
+                        PDBG("%s failed to add PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        if (pbl_chunk <= 1024 << MIN_PBL_SHIFT) {
+                                printk(KERN_WARNING MOD
+                                       "Failed to add all PBL chunks (%x/%x)\n",
+                                       pbl_start,
+                                       pbl_top - pbl_start);
+                                return 0;
+                        }
+                        pbl_chunk >>= 1;
+                } else {
+                        PDBG("%s added PBL chunk (%x/%x)\n",
+                             __func__, pbl_start, pbl_chunk);
+                        pbl_start += pbl_chunk;
+                }
+        }
+
+        return 0;
+}
+
+void c4iw_pblpool_destroy(struct c4iw_rdev *rdev)
+{
+        gen_pool_destroy(rdev->pbl_pool);
+}
+
+/*
+ * RQT Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_RQT_SHIFT 10        /* 1KB == min RQT size (16 entries) */
+
+u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev->rqt_pool, size << 6);
+        PDBG("%s addr 0x%x size %d\n", __func__, (u32)addr, size << 6);
+        return (u32)addr;
+}
+
+void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __func__, addr, size << 6);
+        gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6);
+}
+
+int c4iw_rqtpool_create(struct c4iw_rdev *rdev)
+{
+        unsigned rqt_start, rqt_chunk, rqt_top;
+
+        rdev->rqt_pool = gen_pool_create(MIN_RQT_SHIFT, -1);
+        if (!rdev->rqt_pool)
+                return -ENOMEM;
+
+        rqt_start = rdev->lldi.vr->rq.start;
+        rqt_chunk = rdev->lldi.vr->rq.size;
+        rqt_top = rqt_start + rqt_chunk;
+
+        while (rqt_start < rqt_top) {
+                rqt_chunk = min(rqt_top - rqt_start + 1, rqt_chunk);
+                if (gen_pool_add(rdev->rqt_pool, rqt_start, rqt_chunk, -1)) {
+                        PDBG("%s failed to add RQT chunk (%x/%x)\n",
+                             __func__, rqt_start, rqt_chunk);
+                        if (rqt_chunk <= 1024 << MIN_RQT_SHIFT) {
+                                printk(KERN_WARNING MOD
+                                       "Failed to add all RQT chunks (%x/%x)\n",
+                                       rqt_start, rqt_top - rqt_start);
+                                return 0;
+                        }
+                        rqt_chunk >>= 1;
+                } else {
+                        PDBG("%s added RQT chunk (%x/%x)\n",
+                             __func__, rqt_start, rqt_chunk);
+                        rqt_start += rqt_chunk;
+                }
+        }
+        return 0;
+}
+
+void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev)
+{
+        gen_pool_destroy(rdev->rqt_pool);
+}
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
new file mode 100644
index 000000000000..d0e8af352408
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -0,0 +1,550 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __T4_H__
+#define __T4_H__
+
+#include "t4_hw.h"
+#include "t4_regs.h"
+#include "t4_msg.h"
+#include "t4fw_ri_api.h"
+
+#define T4_QID_BASE 1024
+#define T4_MAX_QIDS 256
+#define T4_MAX_NUM_QP (1<<16)
+#define T4_MAX_NUM_CQ (1<<15)
+#define T4_MAX_NUM_PD (1<<15)
+#define T4_MAX_PBL_SIZE 256
+#define T4_MAX_RQ_SIZE 1024
+#define T4_MAX_SQ_SIZE 1024
+#define T4_MAX_QP_DEPTH (T4_MAX_RQ_SIZE-1)
+#define T4_MAX_CQ_DEPTH 8192
+#define T4_MAX_NUM_STAG (1<<15)
+#define T4_MAX_MR_SIZE (~0ULL - 1)
+#define T4_PAGESIZE_MASK 0xffff000  /* 4KB-128MB */
+#define T4_STAG_UNSET 0xffffffff
+#define T4_FW_MAJ 0
+#define T4_EQ_STATUS_ENTRIES (L1_CACHE_BYTES > 64 ? 2 : 1)
+
+struct t4_status_page {
+        __be32 rsvd1;   /* flit 0 - hw owns */
+        __be16 rsvd2;
+        __be16 qid;
+        __be16 cidx;
+        __be16 pidx;
+        u8 qp_err;      /* flit 1 - sw owns */
+        u8 db_off;
+};
+
+#define T4_EQ_SIZE 64
+
+#define T4_SQ_NUM_SLOTS 4
+#define T4_SQ_NUM_BYTES (T4_EQ_SIZE * T4_SQ_NUM_SLOTS)
+#define T4_MAX_SEND_SGE ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_send_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+#define T4_MAX_SEND_INLINE ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_send_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_WRITE_INLINE ((T4_SQ_NUM_BYTES - \
+                        sizeof(struct fw_ri_rdma_write_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_WRITE_SGE ((T4_SQ_NUM_BYTES - \
+                        sizeof(struct fw_ri_rdma_write_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+#define T4_MAX_FR_IMMD ((T4_SQ_NUM_BYTES - sizeof(struct fw_ri_fr_nsmr_wr) - \
+                        sizeof(struct fw_ri_immd)))
+#define T4_MAX_FR_DEPTH 255
+
+#define T4_RQ_NUM_SLOTS 2
+#define T4_RQ_NUM_BYTES (T4_EQ_SIZE * T4_RQ_NUM_SLOTS)
+#define T4_MAX_RECV_SGE ((T4_RQ_NUM_BYTES - sizeof(struct fw_ri_recv_wr) - \
+                        sizeof(struct fw_ri_isgl)) / sizeof(struct fw_ri_sge))
+
+union t4_wr {
+        struct fw_ri_res_wr res;
+        struct fw_ri_wr ri;
+        struct fw_ri_rdma_write_wr write;
+        struct fw_ri_send_wr send;
+        struct fw_ri_rdma_read_wr read;
+        struct fw_ri_bind_mw_wr bind;
+        struct fw_ri_fr_nsmr_wr fr;
+        struct fw_ri_inv_lstag_wr inv;
+        struct t4_status_page status;
+        __be64 flits[T4_EQ_SIZE / sizeof(__be64) * T4_SQ_NUM_SLOTS];
+};
+
+union t4_recv_wr {
+        struct fw_ri_recv_wr recv;
+        struct t4_status_page status;
+        __be64 flits[T4_EQ_SIZE / sizeof(__be64) * T4_RQ_NUM_SLOTS];
+};
+
+static inline void init_wr_hdr(union t4_wr *wqe, u16 wrid,
+                               enum fw_wr_opcodes opcode, u8 flags, u8 len16)
+{
+        int slots_used;
+
+        wqe->send.opcode = (u8)opcode;
+        wqe->send.flags = flags;
+        wqe->send.wrid = wrid;
+        wqe->send.r1[0] = 0;
+        wqe->send.r1[1] = 0;
+        wqe->send.r1[2] = 0;
+        wqe->send.len16 = len16;
+
+        slots_used = DIV_ROUND_UP(len16*16, T4_EQ_SIZE);
+        while (slots_used < T4_SQ_NUM_SLOTS) {
+                wqe->flits[slots_used * T4_EQ_SIZE / sizeof(__be64)] = 0;
+                slots_used++;
+        }
+}
+
+/* CQE/AE status codes */
+#define T4_ERR_SUCCESS                     0x0
+#define T4_ERR_STAG                        0x1  /* STAG invalid: either the */
+                                                /* STAG is offlimt, being 0, */
+                                                /* or STAG_key mismatch */
+#define T4_ERR_PDID                        0x2  /* PDID mismatch */
+#define T4_ERR_QPID                        0x3  /* QPID mismatch */
+#define T4_ERR_ACCESS                      0x4  /* Invalid access right */
+#define T4_ERR_WRAP                        0x5  /* Wrap error */
+#define T4_ERR_BOUND                       0x6  /* base and bounds voilation */
+#define T4_ERR_INVALIDATE_SHARED_MR        0x7  /* attempt to invalidate a  */
+                                                /* shared memory region */
+#define T4_ERR_INVALIDATE_MR_WITH_MW_BOUND 0x8  /* attempt to invalidate a  */
+                                                /* shared memory region */
+#define T4_ERR_ECC                         0x9  /* ECC error detected */
+#define T4_ERR_ECC_PSTAG                   0xA  /* ECC error detected when  */
+                                                /* reading PSTAG for a MW  */
+                                                /* Invalidate */
+#define T4_ERR_PBL_ADDR_BOUND              0xB  /* pbl addr out of bounds:  */
+                                                /* software error */
+#define T4_ERR_SWFLUSH                     0xC  /* SW FLUSHED */
+#define T4_ERR_CRC                         0x10 /* CRC error */
+#define T4_ERR_MARKER                      0x11 /* Marker error */
+#define T4_ERR_PDU_LEN_ERR                 0x12 /* invalid PDU length */
+#define T4_ERR_OUT_OF_RQE                  0x13 /* out of RQE */
+#define T4_ERR_DDP_VERSION                 0x14 /* wrong DDP version */
+#define T4_ERR_RDMA_VERSION                0x15 /* wrong RDMA version */
+#define T4_ERR_OPCODE                      0x16 /* invalid rdma opcode */
+#define T4_ERR_DDP_QUEUE_NUM               0x17 /* invalid ddp queue number */
+#define T4_ERR_MSN                         0x18 /* MSN error */
+#define T4_ERR_TBIT                        0x19 /* tag bit not set correctly */
+#define T4_ERR_MO                          0x1A /* MO not 0 for TERMINATE  */
+                                                /* or READ_REQ */
+#define T4_ERR_MSN_GAP                     0x1B
+#define T4_ERR_MSN_RANGE                   0x1C
+#define T4_ERR_IRD_OVERFLOW                0x1D
+#define T4_ERR_RQE_ADDR_BOUND              0x1E /* RQE addr out of bounds:  */
+                                                /* software error */
+#define T4_ERR_INTERNAL_ERR                0x1F /* internal error (opcode  */
+                                                /* mismatch) */
+/*
+ * CQE defs
+ */
+struct t4_cqe {
+        __be32 header;
+        __be32 len;
+        union {
+                struct {
+                        __be32 stag;
+                        __be32 msn;
+                } rcqe;
+                struct {
+                        u32 nada1;
+                        u16 nada2;
+                        u16 cidx;
+                } scqe;
+                struct {
+                        __be32 wrid_hi;
+                        __be32 wrid_low;
+                } gen;
+        } u;
+        __be64 reserved;
+        __be64 bits_type_ts;
+};
+
+/* macros for flit 0 of the cqe */
+
+#define S_CQE_QPID        12
+#define M_CQE_QPID        0xFFFFF
+#define G_CQE_QPID(x)     ((((x) >> S_CQE_QPID)) & M_CQE_QPID)
+#define V_CQE_QPID(x)     ((x)<<S_CQE_QPID)
+
+#define S_CQE_SWCQE       11
+#define M_CQE_SWCQE       0x1
+#define G_CQE_SWCQE(x)    ((((x) >> S_CQE_SWCQE)) & M_CQE_SWCQE)
+#define V_CQE_SWCQE(x)    ((x)<<S_CQE_SWCQE)
+
+#define S_CQE_STATUS      5
+#define M_CQE_STATUS      0x1F
+#define G_CQE_STATUS(x)   ((((x) >> S_CQE_STATUS)) & M_CQE_STATUS)
+#define V_CQE_STATUS(x)   ((x)<<S_CQE_STATUS)
+
+#define S_CQE_TYPE        4
+#define M_CQE_TYPE        0x1
+#define G_CQE_TYPE(x)     ((((x) >> S_CQE_TYPE)) & M_CQE_TYPE)
+#define V_CQE_TYPE(x)     ((x)<<S_CQE_TYPE)
+
+#define S_CQE_OPCODE      0
+#define M_CQE_OPCODE      0xF
+#define G_CQE_OPCODE(x)   ((((x) >> S_CQE_OPCODE)) & M_CQE_OPCODE)
+#define V_CQE_OPCODE(x)   ((x)<<S_CQE_OPCODE)
+
+#define SW_CQE(x)         (G_CQE_SWCQE(be32_to_cpu((x)->header)))
+#define CQE_QPID(x)       (G_CQE_QPID(be32_to_cpu((x)->header)))
+#define CQE_TYPE(x)       (G_CQE_TYPE(be32_to_cpu((x)->header)))
+#define SQ_TYPE(x)        (CQE_TYPE((x)))
+#define RQ_TYPE(x)        (!CQE_TYPE((x)))
+#define CQE_STATUS(x)     (G_CQE_STATUS(be32_to_cpu((x)->header)))
+#define CQE_OPCODE(x)     (G_CQE_OPCODE(be32_to_cpu((x)->header)))
+
+#define CQE_SEND_OPCODE(x)( \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_SE) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_INV) || \
+        (G_CQE_OPCODE(be32_to_cpu((x)->header)) == FW_RI_SEND_WITH_SE_INV))
+
+#define CQE_LEN(x)        (be32_to_cpu((x)->len))
+
+/* used for RQ completion processing */
+#define CQE_WRID_STAG(x)  (be32_to_cpu((x)->u.rcqe.stag))
+#define CQE_WRID_MSN(x)   (be32_to_cpu((x)->u.rcqe.msn))
+
+/* used for SQ completion processing */
+#define CQE_WRID_SQ_IDX(x)      ((x)->u.scqe.cidx)
+
+/* generic accessor macros */
+#define CQE_WRID_HI(x)          ((x)->u.gen.wrid_hi)
+#define CQE_WRID_LOW(x)         ((x)->u.gen.wrid_low)
+
+/* macros for flit 3 of the cqe */
+#define S_CQE_GENBIT    63
+#define M_CQE_GENBIT    0x1
+#define G_CQE_GENBIT(x) (((x) >> S_CQE_GENBIT) & M_CQE_GENBIT)
+#define V_CQE_GENBIT(x) ((x)<<S_CQE_GENBIT)
+
+#define S_CQE_OVFBIT    62
+#define M_CQE_OVFBIT    0x1
+#define G_CQE_OVFBIT(x) ((((x) >> S_CQE_OVFBIT)) & M_CQE_OVFBIT)
+
+#define S_CQE_IQTYPE    60
+#define M_CQE_IQTYPE    0x3
+#define G_CQE_IQTYPE(x) ((((x) >> S_CQE_IQTYPE)) & M_CQE_IQTYPE)
+
+#define M_CQE_TS        0x0fffffffffffffffULL
+#define G_CQE_TS(x)     ((x) & M_CQE_TS)
+
+#define CQE_OVFBIT(x)   ((unsigned)G_CQE_OVFBIT(be64_to_cpu((x)->bits_type_ts)))
+#define CQE_GENBIT(x)   ((unsigned)G_CQE_GENBIT(be64_to_cpu((x)->bits_type_ts)))
+#define CQE_TS(x)       (G_CQE_TS(be64_to_cpu((x)->bits_type_ts)))
+
+struct t4_swsqe {
+        u64                     wr_id;
+        struct t4_cqe           cqe;
+        int                     read_len;
+        int                     opcode;
+        int                     complete;
+        int                     signaled;
+        u16                     idx;
+};
+
+struct t4_sq {
+        union t4_wr *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_swsqe *sw_sq;
+        struct t4_swsqe *oldest_read;
+        u64 udb;
+        size_t memsize;
+        u32 qid;
+        u16 in_use;
+        u16 size;
+        u16 cidx;
+        u16 pidx;
+};
+
+struct t4_swrqe {
+        u64 wr_id;
+};
+
+struct t4_rq {
+        union  t4_recv_wr *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_swrqe *sw_rq;
+        u64 udb;
+        size_t memsize;
+        u32 qid;
+        u32 msn;
+        u32 rqt_hwaddr;
+        u16 rqt_size;
+        u16 in_use;
+        u16 size;
+        u16 cidx;
+        u16 pidx;
+};
+
+struct t4_wq {
+        struct t4_sq sq;
+        struct t4_rq rq;
+        void __iomem *db;
+        void __iomem *gts;
+        struct c4iw_rdev *rdev;
+};
+
+static inline int t4_rqes_posted(struct t4_wq *wq)
+{
+        return wq->rq.in_use;
+}
+
+static inline int t4_rq_empty(struct t4_wq *wq)
+{
+        return wq->rq.in_use == 0;
+}
+
+static inline int t4_rq_full(struct t4_wq *wq)
+{
+        return wq->rq.in_use == (wq->rq.size - 1);
+}
+
+static inline u32 t4_rq_avail(struct t4_wq *wq)
+{
+        return wq->rq.size - 1 - wq->rq.in_use;
+}
+
+static inline void t4_rq_produce(struct t4_wq *wq)
+{
+        wq->rq.in_use++;
+        if (++wq->rq.pidx == wq->rq.size)
+                wq->rq.pidx = 0;
+}
+
+static inline void t4_rq_consume(struct t4_wq *wq)
+{
+        wq->rq.in_use--;
+        wq->rq.msn++;
+        if (++wq->rq.cidx == wq->rq.size)
+                wq->rq.cidx = 0;
+}
+
+static inline int t4_sq_empty(struct t4_wq *wq)
+{
+        return wq->sq.in_use == 0;
+}
+
+static inline int t4_sq_full(struct t4_wq *wq)
+{
+        return wq->sq.in_use == (wq->sq.size - 1);
+}
+
+static inline u32 t4_sq_avail(struct t4_wq *wq)
+{
+        return wq->sq.size - 1 - wq->sq.in_use;
+}
+
+static inline void t4_sq_produce(struct t4_wq *wq)
+{
+        wq->sq.in_use++;
+        if (++wq->sq.pidx == wq->sq.size)
+                wq->sq.pidx = 0;
+}
+
+static inline void t4_sq_consume(struct t4_wq *wq)
+{
+        wq->sq.in_use--;
+        if (++wq->sq.cidx == wq->sq.size)
+                wq->sq.cidx = 0;
+}
+
+static inline void t4_ring_sq_db(struct t4_wq *wq, u16 inc)
+{
+        inc *= T4_SQ_NUM_SLOTS;
+        wmb();
+        writel(QID(wq->sq.qid) | PIDX(inc), wq->db);
+}
+
+static inline void t4_ring_rq_db(struct t4_wq *wq, u16 inc)
+{
+        inc *= T4_RQ_NUM_SLOTS;
+        wmb();
+        writel(QID(wq->rq.qid) | PIDX(inc), wq->db);
+}
+
+static inline int t4_wq_in_error(struct t4_wq *wq)
+{
+        return wq->sq.queue[wq->sq.size].status.qp_err;
+}
+
+static inline void t4_set_wq_in_error(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.qp_err = 1;
+        wq->rq.queue[wq->rq.size].status.qp_err = 1;
+}
+
+static inline void t4_disable_wq_db(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.db_off = 1;
+        wq->rq.queue[wq->rq.size].status.db_off = 1;
+}
+
+static inline void t4_enable_wq_db(struct t4_wq *wq)
+{
+        wq->sq.queue[wq->sq.size].status.db_off = 0;
+        wq->rq.queue[wq->rq.size].status.db_off = 0;
+}
+
+static inline int t4_wq_db_enabled(struct t4_wq *wq)
+{
+        return !wq->sq.queue[wq->sq.size].status.db_off;
+}
+
+struct t4_cq {
+        struct t4_cqe *queue;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping);
+        struct t4_cqe *sw_queue;
+        void __iomem *gts;
+        struct c4iw_rdev *rdev;
+        u64 ugts;
+        size_t memsize;
+        u64 timestamp;
+        u32 cqid;
+        u16 size; /* including status page */
+        u16 cidx;
+        u16 sw_pidx;
+        u16 sw_cidx;
+        u16 sw_in_use;
+        u16 cidx_inc;
+        u8 gen;
+        u8 error;
+};
+
+static inline int t4_arm_cq(struct t4_cq *cq, int se)
+{
+        u32 val;
+        u16 inc;
+
+        do {
+                /*
+                 * inc must be less the both the max update value -and-
+                 * the size of the CQ.
+                 */
+                inc = cq->cidx_inc <= CIDXINC_MASK ? cq->cidx_inc :
+                                                     CIDXINC_MASK;
+                inc = inc <= (cq->size - 1) ? inc : (cq->size - 1);
+                if (inc == cq->cidx_inc)
+                        val = SEINTARM(se) | CIDXINC(inc) | TIMERREG(6) |
+                              INGRESSQID(cq->cqid);
+                else
+                        val = SEINTARM(0) | CIDXINC(inc) | TIMERREG(7) |
+                              INGRESSQID(cq->cqid);
+                cq->cidx_inc -= inc;
+                writel(val, cq->gts);
+        } while (cq->cidx_inc);
+        return 0;
+}
+
+static inline void t4_swcq_produce(struct t4_cq *cq)
+{
+        cq->sw_in_use++;
+        if (++cq->sw_pidx == cq->size)
+                cq->sw_pidx = 0;
+}
+
+static inline void t4_swcq_consume(struct t4_cq *cq)
+{
+        cq->sw_in_use--;
+        if (++cq->sw_cidx == cq->size)
+                cq->sw_cidx = 0;
+}
+
+static inline void t4_hwcq_consume(struct t4_cq *cq)
+{
+        cq->cidx_inc++;
+        if (++cq->cidx == cq->size) {
+                cq->cidx = 0;
+                cq->gen ^= 1;
+        }
+}
+
+static inline int t4_valid_cqe(struct t4_cq *cq, struct t4_cqe *cqe)
+{
+        return (CQE_GENBIT(cqe) == cq->gen);
+}
+
+static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
+{
+        int ret = 0;
+        u64 bits_type_ts = be64_to_cpu(cq->queue[cq->cidx].bits_type_ts);
+
+        if (G_CQE_GENBIT(bits_type_ts) == cq->gen) {
+                *cqe = &cq->queue[cq->cidx];
+                cq->timestamp = G_CQE_TS(bits_type_ts);
+        } else if (G_CQE_TS(bits_type_ts) > cq->timestamp)
+                ret = -EOVERFLOW;
+        else
+                ret = -ENODATA;
+        if (ret == -EOVERFLOW) {
+                printk(KERN_ERR MOD "cq overflow cqid %u\n", cq->cqid);
+                cq->error = 1;
+        }
+        return ret;
+}
+
+static inline struct t4_cqe *t4_next_sw_cqe(struct t4_cq *cq)
+{
+        if (cq->sw_in_use)
+                return &cq->sw_queue[cq->sw_cidx];
+        return NULL;
+}
+
+static inline int t4_next_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
+{
+        int ret = 0;
+
+        if (cq->error)
+                ret = -ENODATA;
+        else if (cq->sw_in_use)
+                *cqe = &cq->sw_queue[cq->sw_cidx];
+        else
+                ret = t4_next_hw_cqe(cq, cqe);
+        return ret;
+}
+
+static inline int t4_cq_in_error(struct t4_cq *cq)
+{
+        return ((struct t4_status_page *)&cq->queue[cq->size])->qp_err;
+}
+
+static inline void t4_set_cq_in_error(struct t4_cq *cq)
+{
+        ((struct t4_status_page *)&cq->queue[cq->size])->qp_err = 1;
+}
+#endif
diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
new file mode 100644
index 000000000000..fc706bd07fae
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
@@ -0,0 +1,829 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _T4FW_RI_API_H_
+#define _T4FW_RI_API_H_
+
+#include "t4fw_api.h"
+
+enum fw_ri_wr_opcode {
+        FW_RI_RDMA_WRITE                = 0x0,  /* IETF RDMAP v1.0 ... */
+        FW_RI_READ_REQ                  = 0x1,
+        FW_RI_READ_RESP                 = 0x2,
+        FW_RI_SEND                      = 0x3,
+        FW_RI_SEND_WITH_INV             = 0x4,
+        FW_RI_SEND_WITH_SE              = 0x5,
+        FW_RI_SEND_WITH_SE_INV          = 0x6,
+        FW_RI_TERMINATE                 = 0x7,
+        FW_RI_RDMA_INIT                 = 0x8,  /* CHELSIO RI specific ... */
+        FW_RI_BIND_MW                   = 0x9,
+        FW_RI_FAST_REGISTER             = 0xa,
+        FW_RI_LOCAL_INV                 = 0xb,
+        FW_RI_QP_MODIFY                 = 0xc,
+        FW_RI_BYPASS                    = 0xd,
+        FW_RI_RECEIVE                   = 0xe,
+
+        FW_RI_SGE_EC_CR_RETURN          = 0xf
+};
+
+enum fw_ri_wr_flags {
+        FW_RI_COMPLETION_FLAG           = 0x01,
+        FW_RI_NOTIFICATION_FLAG         = 0x02,
+        FW_RI_SOLICITED_EVENT_FLAG      = 0x04,
+        FW_RI_READ_FENCE_FLAG           = 0x08,
+        FW_RI_LOCAL_FENCE_FLAG          = 0x10,
+        FW_RI_RDMA_READ_INVALIDATE      = 0x20
+};
+
+enum fw_ri_mpa_attrs {
+        FW_RI_MPA_RX_MARKER_ENABLE      = 0x01,
+        FW_RI_MPA_TX_MARKER_ENABLE      = 0x02,
+        FW_RI_MPA_CRC_ENABLE            = 0x04,
+        FW_RI_MPA_IETF_ENABLE           = 0x08
+};
+
+enum fw_ri_qp_caps {
+        FW_RI_QP_RDMA_READ_ENABLE       = 0x01,
+        FW_RI_QP_RDMA_WRITE_ENABLE      = 0x02,
+        FW_RI_QP_BIND_ENABLE            = 0x04,
+        FW_RI_QP_FAST_REGISTER_ENABLE   = 0x08,
+        FW_RI_QP_STAG0_ENABLE           = 0x10
+};
+
+enum fw_ri_addr_type {
+        FW_RI_ZERO_BASED_TO             = 0x00,
+        FW_RI_VA_BASED_TO               = 0x01
+};
+
+enum fw_ri_mem_perms {
+        FW_RI_MEM_ACCESS_REM_WRITE      = 0x01,
+        FW_RI_MEM_ACCESS_REM_READ       = 0x02,
+        FW_RI_MEM_ACCESS_REM            = 0x03,
+        FW_RI_MEM_ACCESS_LOCAL_WRITE    = 0x04,
+        FW_RI_MEM_ACCESS_LOCAL_READ     = 0x08,
+        FW_RI_MEM_ACCESS_LOCAL          = 0x0C
+};
+
+enum fw_ri_stag_type {
+        FW_RI_STAG_NSMR                 = 0x00,
+        FW_RI_STAG_SMR                  = 0x01,
+        FW_RI_STAG_MW                   = 0x02,
+        FW_RI_STAG_MW_RELAXED           = 0x03
+};
+
+enum fw_ri_data_op {
+        FW_RI_DATA_IMMD                 = 0x81,
+        FW_RI_DATA_DSGL                 = 0x82,
+        FW_RI_DATA_ISGL                 = 0x83
+};
+
+enum fw_ri_sgl_depth {
+        FW_RI_SGL_DEPTH_MAX_SQ          = 16,
+        FW_RI_SGL_DEPTH_MAX_RQ          = 4
+};
+
+struct fw_ri_dsge_pair {
+        __be32  len[2];
+        __be64  addr[2];
+};
+
+struct fw_ri_dsgl {
+        __u8    op;
+        __u8    r1;
+        __be16  nsge;
+        __be32  len0;
+        __be64  addr0;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_dsge_pair sge[0];
+#endif
+};
+
+struct fw_ri_sge {
+        __be32 stag;
+        __be32 len;
+        __be64 to;
+};
+
+struct fw_ri_isgl {
+        __u8    op;
+        __u8    r1;
+        __be16  nsge;
+        __be32  r2;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_sge sge[0];
+#endif
+};
+
+struct fw_ri_immd {
+        __u8    op;
+        __u8    r1;
+        __be16  r2;
+        __be32  immdlen;
+#ifndef C99_NOT_SUPPORTED
+        __u8    data[0];
+#endif
+};
+
+struct fw_ri_tpte {
+        __be32 valid_to_pdid;
+        __be32 locread_to_qpid;
+        __be32 nosnoop_pbladdr;
+        __be32 len_lo;
+        __be32 va_hi;
+        __be32 va_lo_fbo;
+        __be32 dca_mwbcnt_pstag;
+        __be32 len_hi;
+};
+
+#define S_FW_RI_TPTE_VALID              31
+#define M_FW_RI_TPTE_VALID              0x1
+#define V_FW_RI_TPTE_VALID(x)           ((x) << S_FW_RI_TPTE_VALID)
+#define G_FW_RI_TPTE_VALID(x)           \
+    (((x) >> S_FW_RI_TPTE_VALID) & M_FW_RI_TPTE_VALID)
+#define F_FW_RI_TPTE_VALID              V_FW_RI_TPTE_VALID(1U)
+
+#define S_FW_RI_TPTE_STAGKEY            23
+#define M_FW_RI_TPTE_STAGKEY            0xff
+#define V_FW_RI_TPTE_STAGKEY(x)         ((x) << S_FW_RI_TPTE_STAGKEY)
+#define G_FW_RI_TPTE_STAGKEY(x)         \
+    (((x) >> S_FW_RI_TPTE_STAGKEY) & M_FW_RI_TPTE_STAGKEY)
+
+#define S_FW_RI_TPTE_STAGSTATE          22
+#define M_FW_RI_TPTE_STAGSTATE          0x1
+#define V_FW_RI_TPTE_STAGSTATE(x)       ((x) << S_FW_RI_TPTE_STAGSTATE)
+#define G_FW_RI_TPTE_STAGSTATE(x)       \
+    (((x) >> S_FW_RI_TPTE_STAGSTATE) & M_FW_RI_TPTE_STAGSTATE)
+#define F_FW_RI_TPTE_STAGSTATE          V_FW_RI_TPTE_STAGSTATE(1U)
+
+#define S_FW_RI_TPTE_STAGTYPE           20
+#define M_FW_RI_TPTE_STAGTYPE           0x3
+#define V_FW_RI_TPTE_STAGTYPE(x)        ((x) << S_FW_RI_TPTE_STAGTYPE)
+#define G_FW_RI_TPTE_STAGTYPE(x)        \
+    (((x) >> S_FW_RI_TPTE_STAGTYPE) & M_FW_RI_TPTE_STAGTYPE)
+
+#define S_FW_RI_TPTE_PDID               0
+#define M_FW_RI_TPTE_PDID               0xfffff
+#define V_FW_RI_TPTE_PDID(x)            ((x) << S_FW_RI_TPTE_PDID)
+#define G_FW_RI_TPTE_PDID(x)            \
+    (((x) >> S_FW_RI_TPTE_PDID) & M_FW_RI_TPTE_PDID)
+
+#define S_FW_RI_TPTE_PERM               28
+#define M_FW_RI_TPTE_PERM               0xf
+#define V_FW_RI_TPTE_PERM(x)            ((x) << S_FW_RI_TPTE_PERM)
+#define G_FW_RI_TPTE_PERM(x)            \
+    (((x) >> S_FW_RI_TPTE_PERM) & M_FW_RI_TPTE_PERM)
+
+#define S_FW_RI_TPTE_REMINVDIS          27
+#define M_FW_RI_TPTE_REMINVDIS          0x1
+#define V_FW_RI_TPTE_REMINVDIS(x)       ((x) << S_FW_RI_TPTE_REMINVDIS)
+#define G_FW_RI_TPTE_REMINVDIS(x)       \
+    (((x) >> S_FW_RI_TPTE_REMINVDIS) & M_FW_RI_TPTE_REMINVDIS)
+#define F_FW_RI_TPTE_REMINVDIS          V_FW_RI_TPTE_REMINVDIS(1U)
+
+#define S_FW_RI_TPTE_ADDRTYPE           26
+#define M_FW_RI_TPTE_ADDRTYPE           1
+#define V_FW_RI_TPTE_ADDRTYPE(x)        ((x) << S_FW_RI_TPTE_ADDRTYPE)
+#define G_FW_RI_TPTE_ADDRTYPE(x)        \
+    (((x) >> S_FW_RI_TPTE_ADDRTYPE) & M_FW_RI_TPTE_ADDRTYPE)
+#define F_FW_RI_TPTE_ADDRTYPE           V_FW_RI_TPTE_ADDRTYPE(1U)
+
+#define S_FW_RI_TPTE_MWBINDEN           25
+#define M_FW_RI_TPTE_MWBINDEN           0x1
+#define V_FW_RI_TPTE_MWBINDEN(x)        ((x) << S_FW_RI_TPTE_MWBINDEN)
+#define G_FW_RI_TPTE_MWBINDEN(x)        \
+    (((x) >> S_FW_RI_TPTE_MWBINDEN) & M_FW_RI_TPTE_MWBINDEN)
+#define F_FW_RI_TPTE_MWBINDEN           V_FW_RI_TPTE_MWBINDEN(1U)
+
+#define S_FW_RI_TPTE_PS                 20
+#define M_FW_RI_TPTE_PS                 0x1f
+#define V_FW_RI_TPTE_PS(x)              ((x) << S_FW_RI_TPTE_PS)
+#define G_FW_RI_TPTE_PS(x)              \
+    (((x) >> S_FW_RI_TPTE_PS) & M_FW_RI_TPTE_PS)
+
+#define S_FW_RI_TPTE_QPID               0
+#define M_FW_RI_TPTE_QPID               0xfffff
+#define V_FW_RI_TPTE_QPID(x)            ((x) << S_FW_RI_TPTE_QPID)
+#define G_FW_RI_TPTE_QPID(x)            \
+    (((x) >> S_FW_RI_TPTE_QPID) & M_FW_RI_TPTE_QPID)
+
+#define S_FW_RI_TPTE_NOSNOOP            30
+#define M_FW_RI_TPTE_NOSNOOP            0x1
+#define V_FW_RI_TPTE_NOSNOOP(x)         ((x) << S_FW_RI_TPTE_NOSNOOP)
+#define G_FW_RI_TPTE_NOSNOOP(x)         \
+    (((x) >> S_FW_RI_TPTE_NOSNOOP) & M_FW_RI_TPTE_NOSNOOP)
+#define F_FW_RI_TPTE_NOSNOOP            V_FW_RI_TPTE_NOSNOOP(1U)
+
+#define S_FW_RI_TPTE_PBLADDR            0
+#define M_FW_RI_TPTE_PBLADDR            0x1fffffff
+#define V_FW_RI_TPTE_PBLADDR(x)         ((x) << S_FW_RI_TPTE_PBLADDR)
+#define G_FW_RI_TPTE_PBLADDR(x)         \
+    (((x) >> S_FW_RI_TPTE_PBLADDR) & M_FW_RI_TPTE_PBLADDR)
+
+#define S_FW_RI_TPTE_DCA                24
+#define M_FW_RI_TPTE_DCA                0x1f
+#define V_FW_RI_TPTE_DCA(x)             ((x) << S_FW_RI_TPTE_DCA)
+#define G_FW_RI_TPTE_DCA(x)             \
+    (((x) >> S_FW_RI_TPTE_DCA) & M_FW_RI_TPTE_DCA)
+
+#define S_FW_RI_TPTE_MWBCNT_PSTAG       0
+#define M_FW_RI_TPTE_MWBCNT_PSTAG       0xffffff
+#define V_FW_RI_TPTE_MWBCNT_PSTAT(x)    \
+    ((x) << S_FW_RI_TPTE_MWBCNT_PSTAG)
+#define G_FW_RI_TPTE_MWBCNT_PSTAG(x)    \
+    (((x) >> S_FW_RI_TPTE_MWBCNT_PSTAG) & M_FW_RI_TPTE_MWBCNT_PSTAG)
+
+enum fw_ri_res_type {
+        FW_RI_RES_TYPE_SQ,
+        FW_RI_RES_TYPE_RQ,
+        FW_RI_RES_TYPE_CQ,
+};
+
+enum fw_ri_res_op {
+        FW_RI_RES_OP_WRITE,
+        FW_RI_RES_OP_RESET,
+};
+
+struct fw_ri_res {
+        union fw_ri_restype {
+                struct fw_ri_res_sqrq {
+                        __u8   restype;
+                        __u8   op;
+                        __be16 r3;
+                        __be32 eqid;
+                        __be32 r4[2];
+                        __be32 fetchszm_to_iqid;
+                        __be32 dcaen_to_eqsize;
+                        __be64 eqaddr;
+                } sqrq;
+                struct fw_ri_res_cq {
+                        __u8   restype;
+                        __u8   op;
+                        __be16 r3;
+                        __be32 iqid;
+                        __be32 r4[2];
+                        __be32 iqandst_to_iqandstindex;
+                        __be16 iqdroprss_to_iqesize;
+                        __be16 iqsize;
+                        __be64 iqaddr;
+                        __be32 iqns_iqro;
+                        __be32 r6_lo;
+                        __be64 r7;
+                } cq;
+        } u;
+};
+
+struct fw_ri_res_wr {
+        __be32 op_nres;
+        __be32 len16_pkd;
+        __u64  cookie;
+#ifndef C99_NOT_SUPPORTED
+        struct fw_ri_res res[0];
+#endif
+};
+
+#define S_FW_RI_RES_WR_NRES     0
+#define M_FW_RI_RES_WR_NRES     0xff
+#define V_FW_RI_RES_WR_NRES(x)  ((x) << S_FW_RI_RES_WR_NRES)
+#define G_FW_RI_RES_WR_NRES(x)  \
+    (((x) >> S_FW_RI_RES_WR_NRES) & M_FW_RI_RES_WR_NRES)
+
+#define S_FW_RI_RES_WR_FETCHSZM         26
+#define M_FW_RI_RES_WR_FETCHSZM         0x1
+#define V_FW_RI_RES_WR_FETCHSZM(x)      ((x) << S_FW_RI_RES_WR_FETCHSZM)
+#define G_FW_RI_RES_WR_FETCHSZM(x)      \
+    (((x) >> S_FW_RI_RES_WR_FETCHSZM) & M_FW_RI_RES_WR_FETCHSZM)
+#define F_FW_RI_RES_WR_FETCHSZM V_FW_RI_RES_WR_FETCHSZM(1U)
+
+#define S_FW_RI_RES_WR_STATUSPGNS       25
+#define M_FW_RI_RES_WR_STATUSPGNS       0x1
+#define V_FW_RI_RES_WR_STATUSPGNS(x)    ((x) << S_FW_RI_RES_WR_STATUSPGNS)
+#define G_FW_RI_RES_WR_STATUSPGNS(x)    \
+    (((x) >> S_FW_RI_RES_WR_STATUSPGNS) & M_FW_RI_RES_WR_STATUSPGNS)
+#define F_FW_RI_RES_WR_STATUSPGNS       V_FW_RI_RES_WR_STATUSPGNS(1U)
+
+#define S_FW_RI_RES_WR_STATUSPGRO       24
+#define M_FW_RI_RES_WR_STATUSPGRO       0x1
+#define V_FW_RI_RES_WR_STATUSPGRO(x)    ((x) << S_FW_RI_RES_WR_STATUSPGRO)
+#define G_FW_RI_RES_WR_STATUSPGRO(x)    \
+    (((x) >> S_FW_RI_RES_WR_STATUSPGRO) & M_FW_RI_RES_WR_STATUSPGRO)
+#define F_FW_RI_RES_WR_STATUSPGRO       V_FW_RI_RES_WR_STATUSPGRO(1U)
+
+#define S_FW_RI_RES_WR_FETCHNS          23
+#define M_FW_RI_RES_WR_FETCHNS          0x1
+#define V_FW_RI_RES_WR_FETCHNS(x)       ((x) << S_FW_RI_RES_WR_FETCHNS)
+#define G_FW_RI_RES_WR_FETCHNS(x)       \
+    (((x) >> S_FW_RI_RES_WR_FETCHNS) & M_FW_RI_RES_WR_FETCHNS)
+#define F_FW_RI_RES_WR_FETCHNS  V_FW_RI_RES_WR_FETCHNS(1U)
+
+#define S_FW_RI_RES_WR_FETCHRO          22
+#define M_FW_RI_RES_WR_FETCHRO          0x1
+#define V_FW_RI_RES_WR_FETCHRO(x)       ((x) << S_FW_RI_RES_WR_FETCHRO)
+#define G_FW_RI_RES_WR_FETCHRO(x)       \
+    (((x) >> S_FW_RI_RES_WR_FETCHRO) & M_FW_RI_RES_WR_FETCHRO)
+#define F_FW_RI_RES_WR_FETCHRO  V_FW_RI_RES_WR_FETCHRO(1U)
+
+#define S_FW_RI_RES_WR_HOSTFCMODE       20
+#define M_FW_RI_RES_WR_HOSTFCMODE       0x3
+#define V_FW_RI_RES_WR_HOSTFCMODE(x)    ((x) << S_FW_RI_RES_WR_HOSTFCMODE)
+#define G_FW_RI_RES_WR_HOSTFCMODE(x)    \
+    (((x) >> S_FW_RI_RES_WR_HOSTFCMODE) & M_FW_RI_RES_WR_HOSTFCMODE)
+
+#define S_FW_RI_RES_WR_CPRIO    19
+#define M_FW_RI_RES_WR_CPRIO    0x1
+#define V_FW_RI_RES_WR_CPRIO(x) ((x) << S_FW_RI_RES_WR_CPRIO)
+#define G_FW_RI_RES_WR_CPRIO(x) \
+    (((x) >> S_FW_RI_RES_WR_CPRIO) & M_FW_RI_RES_WR_CPRIO)
+#define F_FW_RI_RES_WR_CPRIO    V_FW_RI_RES_WR_CPRIO(1U)
+
+#define S_FW_RI_RES_WR_ONCHIP           18
+#define M_FW_RI_RES_WR_ONCHIP           0x1
+#define V_FW_RI_RES_WR_ONCHIP(x)        ((x) << S_FW_RI_RES_WR_ONCHIP)
+#define G_FW_RI_RES_WR_ONCHIP(x)        \
+    (((x) >> S_FW_RI_RES_WR_ONCHIP) & M_FW_RI_RES_WR_ONCHIP)
+#define F_FW_RI_RES_WR_ONCHIP   V_FW_RI_RES_WR_ONCHIP(1U)
+
+#define S_FW_RI_RES_WR_PCIECHN          16
+#define M_FW_RI_RES_WR_PCIECHN          0x3
+#define V_FW_RI_RES_WR_PCIECHN(x)       ((x) << S_FW_RI_RES_WR_PCIECHN)
+#define G_FW_RI_RES_WR_PCIECHN(x)       \
+    (((x) >> S_FW_RI_RES_WR_PCIECHN) & M_FW_RI_RES_WR_PCIECHN)
+
+#define S_FW_RI_RES_WR_IQID     0
+#define M_FW_RI_RES_WR_IQID     0xffff
+#define V_FW_RI_RES_WR_IQID(x)  ((x) << S_FW_RI_RES_WR_IQID)
+#define G_FW_RI_RES_WR_IQID(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQID) & M_FW_RI_RES_WR_IQID)
+
+#define S_FW_RI_RES_WR_DCAEN    31
+#define M_FW_RI_RES_WR_DCAEN    0x1
+#define V_FW_RI_RES_WR_DCAEN(x) ((x) << S_FW_RI_RES_WR_DCAEN)
+#define G_FW_RI_RES_WR_DCAEN(x) \
+    (((x) >> S_FW_RI_RES_WR_DCAEN) & M_FW_RI_RES_WR_DCAEN)
+#define F_FW_RI_RES_WR_DCAEN    V_FW_RI_RES_WR_DCAEN(1U)
+
+#define S_FW_RI_RES_WR_DCACPU           26
+#define M_FW_RI_RES_WR_DCACPU           0x1f
+#define V_FW_RI_RES_WR_DCACPU(x)        ((x) << S_FW_RI_RES_WR_DCACPU)
+#define G_FW_RI_RES_WR_DCACPU(x)        \
+    (((x) >> S_FW_RI_RES_WR_DCACPU) & M_FW_RI_RES_WR_DCACPU)
+
+#define S_FW_RI_RES_WR_FBMIN    23
+#define M_FW_RI_RES_WR_FBMIN    0x7
+#define V_FW_RI_RES_WR_FBMIN(x) ((x) << S_FW_RI_RES_WR_FBMIN)
+#define G_FW_RI_RES_WR_FBMIN(x) \
+    (((x) >> S_FW_RI_RES_WR_FBMIN) & M_FW_RI_RES_WR_FBMIN)
+
+#define S_FW_RI_RES_WR_FBMAX    20
+#define M_FW_RI_RES_WR_FBMAX    0x7
+#define V_FW_RI_RES_WR_FBMAX(x) ((x) << S_FW_RI_RES_WR_FBMAX)
+#define G_FW_RI_RES_WR_FBMAX(x) \
+    (((x) >> S_FW_RI_RES_WR_FBMAX) & M_FW_RI_RES_WR_FBMAX)
+
+#define S_FW_RI_RES_WR_CIDXFTHRESHO     19
+#define M_FW_RI_RES_WR_CIDXFTHRESHO     0x1
+#define V_FW_RI_RES_WR_CIDXFTHRESHO(x)  ((x) << S_FW_RI_RES_WR_CIDXFTHRESHO)
+#define G_FW_RI_RES_WR_CIDXFTHRESHO(x)  \
+    (((x) >> S_FW_RI_RES_WR_CIDXFTHRESHO) & M_FW_RI_RES_WR_CIDXFTHRESHO)
+#define F_FW_RI_RES_WR_CIDXFTHRESHO     V_FW_RI_RES_WR_CIDXFTHRESHO(1U)
+
+#define S_FW_RI_RES_WR_CIDXFTHRESH      16
+#define M_FW_RI_RES_WR_CIDXFTHRESH      0x7
+#define V_FW_RI_RES_WR_CIDXFTHRESH(x)   ((x) << S_FW_RI_RES_WR_CIDXFTHRESH)
+#define G_FW_RI_RES_WR_CIDXFTHRESH(x)   \
+    (((x) >> S_FW_RI_RES_WR_CIDXFTHRESH) & M_FW_RI_RES_WR_CIDXFTHRESH)
+
+#define S_FW_RI_RES_WR_EQSIZE           0
+#define M_FW_RI_RES_WR_EQSIZE           0xffff
+#define V_FW_RI_RES_WR_EQSIZE(x)        ((x) << S_FW_RI_RES_WR_EQSIZE)
+#define G_FW_RI_RES_WR_EQSIZE(x)        \
+    (((x) >> S_FW_RI_RES_WR_EQSIZE) & M_FW_RI_RES_WR_EQSIZE)
+
+#define S_FW_RI_RES_WR_IQANDST          15
+#define M_FW_RI_RES_WR_IQANDST          0x1
+#define V_FW_RI_RES_WR_IQANDST(x)       ((x) << S_FW_RI_RES_WR_IQANDST)
+#define G_FW_RI_RES_WR_IQANDST(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQANDST) & M_FW_RI_RES_WR_IQANDST)
+#define F_FW_RI_RES_WR_IQANDST  V_FW_RI_RES_WR_IQANDST(1U)
+
+#define S_FW_RI_RES_WR_IQANUS           14
+#define M_FW_RI_RES_WR_IQANUS           0x1
+#define V_FW_RI_RES_WR_IQANUS(x)        ((x) << S_FW_RI_RES_WR_IQANUS)
+#define G_FW_RI_RES_WR_IQANUS(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQANUS) & M_FW_RI_RES_WR_IQANUS)
+#define F_FW_RI_RES_WR_IQANUS   V_FW_RI_RES_WR_IQANUS(1U)
+
+#define S_FW_RI_RES_WR_IQANUD           12
+#define M_FW_RI_RES_WR_IQANUD           0x3
+#define V_FW_RI_RES_WR_IQANUD(x)        ((x) << S_FW_RI_RES_WR_IQANUD)
+#define G_FW_RI_RES_WR_IQANUD(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQANUD) & M_FW_RI_RES_WR_IQANUD)
+
+#define S_FW_RI_RES_WR_IQANDSTINDEX     0
+#define M_FW_RI_RES_WR_IQANDSTINDEX     0xfff
+#define V_FW_RI_RES_WR_IQANDSTINDEX(x)  ((x) << S_FW_RI_RES_WR_IQANDSTINDEX)
+#define G_FW_RI_RES_WR_IQANDSTINDEX(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQANDSTINDEX) & M_FW_RI_RES_WR_IQANDSTINDEX)
+
+#define S_FW_RI_RES_WR_IQDROPRSS        15
+#define M_FW_RI_RES_WR_IQDROPRSS        0x1
+#define V_FW_RI_RES_WR_IQDROPRSS(x)     ((x) << S_FW_RI_RES_WR_IQDROPRSS)
+#define G_FW_RI_RES_WR_IQDROPRSS(x)     \
+    (((x) >> S_FW_RI_RES_WR_IQDROPRSS) & M_FW_RI_RES_WR_IQDROPRSS)
+#define F_FW_RI_RES_WR_IQDROPRSS        V_FW_RI_RES_WR_IQDROPRSS(1U)
+
+#define S_FW_RI_RES_WR_IQGTSMODE        14
+#define M_FW_RI_RES_WR_IQGTSMODE        0x1
+#define V_FW_RI_RES_WR_IQGTSMODE(x)     ((x) << S_FW_RI_RES_WR_IQGTSMODE)
+#define G_FW_RI_RES_WR_IQGTSMODE(x)     \
+    (((x) >> S_FW_RI_RES_WR_IQGTSMODE) & M_FW_RI_RES_WR_IQGTSMODE)
+#define F_FW_RI_RES_WR_IQGTSMODE        V_FW_RI_RES_WR_IQGTSMODE(1U)
+
+#define S_FW_RI_RES_WR_IQPCIECH         12
+#define M_FW_RI_RES_WR_IQPCIECH         0x3
+#define V_FW_RI_RES_WR_IQPCIECH(x)      ((x) << S_FW_RI_RES_WR_IQPCIECH)
+#define G_FW_RI_RES_WR_IQPCIECH(x)      \
+    (((x) >> S_FW_RI_RES_WR_IQPCIECH) & M_FW_RI_RES_WR_IQPCIECH)
+
+#define S_FW_RI_RES_WR_IQDCAEN          11
+#define M_FW_RI_RES_WR_IQDCAEN          0x1
+#define V_FW_RI_RES_WR_IQDCAEN(x)       ((x) << S_FW_RI_RES_WR_IQDCAEN)
+#define G_FW_RI_RES_WR_IQDCAEN(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQDCAEN) & M_FW_RI_RES_WR_IQDCAEN)
+#define F_FW_RI_RES_WR_IQDCAEN  V_FW_RI_RES_WR_IQDCAEN(1U)
+
+#define S_FW_RI_RES_WR_IQDCACPU         6
+#define M_FW_RI_RES_WR_IQDCACPU         0x1f
+#define V_FW_RI_RES_WR_IQDCACPU(x)      ((x) << S_FW_RI_RES_WR_IQDCACPU)
+#define G_FW_RI_RES_WR_IQDCACPU(x)      \
+    (((x) >> S_FW_RI_RES_WR_IQDCACPU) & M_FW_RI_RES_WR_IQDCACPU)
+
+#define S_FW_RI_RES_WR_IQINTCNTTHRESH           4
+#define M_FW_RI_RES_WR_IQINTCNTTHRESH           0x3
+#define V_FW_RI_RES_WR_IQINTCNTTHRESH(x)        \
+    ((x) << S_FW_RI_RES_WR_IQINTCNTTHRESH)
+#define G_FW_RI_RES_WR_IQINTCNTTHRESH(x)        \
+    (((x) >> S_FW_RI_RES_WR_IQINTCNTTHRESH) & M_FW_RI_RES_WR_IQINTCNTTHRESH)
+
+#define S_FW_RI_RES_WR_IQO      3
+#define M_FW_RI_RES_WR_IQO      0x1
+#define V_FW_RI_RES_WR_IQO(x)   ((x) << S_FW_RI_RES_WR_IQO)
+#define G_FW_RI_RES_WR_IQO(x)   \
+    (((x) >> S_FW_RI_RES_WR_IQO) & M_FW_RI_RES_WR_IQO)
+#define F_FW_RI_RES_WR_IQO      V_FW_RI_RES_WR_IQO(1U)
+
+#define S_FW_RI_RES_WR_IQCPRIO          2
+#define M_FW_RI_RES_WR_IQCPRIO          0x1
+#define V_FW_RI_RES_WR_IQCPRIO(x)       ((x) << S_FW_RI_RES_WR_IQCPRIO)
+#define G_FW_RI_RES_WR_IQCPRIO(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQCPRIO) & M_FW_RI_RES_WR_IQCPRIO)
+#define F_FW_RI_RES_WR_IQCPRIO  V_FW_RI_RES_WR_IQCPRIO(1U)
+
+#define S_FW_RI_RES_WR_IQESIZE          0
+#define M_FW_RI_RES_WR_IQESIZE          0x3
+#define V_FW_RI_RES_WR_IQESIZE(x)       ((x) << S_FW_RI_RES_WR_IQESIZE)
+#define G_FW_RI_RES_WR_IQESIZE(x)       \
+    (((x) >> S_FW_RI_RES_WR_IQESIZE) & M_FW_RI_RES_WR_IQESIZE)
+
+#define S_FW_RI_RES_WR_IQNS     31
+#define M_FW_RI_RES_WR_IQNS     0x1
+#define V_FW_RI_RES_WR_IQNS(x)  ((x) << S_FW_RI_RES_WR_IQNS)
+#define G_FW_RI_RES_WR_IQNS(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQNS) & M_FW_RI_RES_WR_IQNS)
+#define F_FW_RI_RES_WR_IQNS     V_FW_RI_RES_WR_IQNS(1U)
+
+#define S_FW_RI_RES_WR_IQRO     30
+#define M_FW_RI_RES_WR_IQRO     0x1
+#define V_FW_RI_RES_WR_IQRO(x)  ((x) << S_FW_RI_RES_WR_IQRO)
+#define G_FW_RI_RES_WR_IQRO(x)  \
+    (((x) >> S_FW_RI_RES_WR_IQRO) & M_FW_RI_RES_WR_IQRO)
+#define F_FW_RI_RES_WR_IQRO     V_FW_RI_RES_WR_IQRO(1U)
+
+struct fw_ri_rdma_write_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be64 r2;
+        __be32 plen;
+        __be32 stag_sink;
+        __be64 to_sink;
+#ifndef C99_NOT_SUPPORTED
+        union {
+                struct fw_ri_immd immd_src[0];
+                struct fw_ri_isgl isgl_src[0];
+        } u;
+#endif
+};
+
+struct fw_ri_send_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be32 sendop_pkd;
+        __be32 stag_inv;
+        __be32 plen;
+        __be32 r3;
+        __be64 r4;
+#ifndef C99_NOT_SUPPORTED
+        union {
+                struct fw_ri_immd immd_src[0];
+                struct fw_ri_isgl isgl_src[0];
+        } u;
+#endif
+};
+
+#define S_FW_RI_SEND_WR_SENDOP          0
+#define M_FW_RI_SEND_WR_SENDOP          0xf
+#define V_FW_RI_SEND_WR_SENDOP(x)       ((x) << S_FW_RI_SEND_WR_SENDOP)
+#define G_FW_RI_SEND_WR_SENDOP(x)       \
+    (((x) >> S_FW_RI_SEND_WR_SENDOP) & M_FW_RI_SEND_WR_SENDOP)
+
+struct fw_ri_rdma_read_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be64 r2;
+        __be32 stag_sink;
+        __be32 to_sink_hi;
+        __be32 to_sink_lo;
+        __be32 plen;
+        __be32 stag_src;
+        __be32 to_src_hi;
+        __be32 to_src_lo;
+        __be32 r5;
+};
+
+struct fw_ri_recv_wr {
+        __u8   opcode;
+        __u8   r1;
+        __u16  wrid;
+        __u8   r2[3];
+        __u8   len16;
+        struct fw_ri_isgl isgl;
+};
+
+struct fw_ri_bind_mw_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __u8   qpbinde_to_dcacpu;
+        __u8   pgsz_shift;
+        __u8   addr_type;
+        __u8   mem_perms;
+        __be32 stag_mr;
+        __be32 stag_mw;
+        __be32 r3;
+        __be64 len_mw;
+        __be64 va_fbo;
+        __be64 r4;
+};
+
+#define S_FW_RI_BIND_MW_WR_QPBINDE      6
+#define M_FW_RI_BIND_MW_WR_QPBINDE      0x1
+#define V_FW_RI_BIND_MW_WR_QPBINDE(x)   ((x) << S_FW_RI_BIND_MW_WR_QPBINDE)
+#define G_FW_RI_BIND_MW_WR_QPBINDE(x)   \
+    (((x) >> S_FW_RI_BIND_MW_WR_QPBINDE) & M_FW_RI_BIND_MW_WR_QPBINDE)
+#define F_FW_RI_BIND_MW_WR_QPBINDE      V_FW_RI_BIND_MW_WR_QPBINDE(1U)
+
+#define S_FW_RI_BIND_MW_WR_NS           5
+#define M_FW_RI_BIND_MW_WR_NS           0x1
+#define V_FW_RI_BIND_MW_WR_NS(x)        ((x) << S_FW_RI_BIND_MW_WR_NS)
+#define G_FW_RI_BIND_MW_WR_NS(x)        \
+    (((x) >> S_FW_RI_BIND_MW_WR_NS) & M_FW_RI_BIND_MW_WR_NS)
+#define F_FW_RI_BIND_MW_WR_NS   V_FW_RI_BIND_MW_WR_NS(1U)
+
+#define S_FW_RI_BIND_MW_WR_DCACPU       0
+#define M_FW_RI_BIND_MW_WR_DCACPU       0x1f
+#define V_FW_RI_BIND_MW_WR_DCACPU(x)    ((x) << S_FW_RI_BIND_MW_WR_DCACPU)
+#define G_FW_RI_BIND_MW_WR_DCACPU(x)    \
+    (((x) >> S_FW_RI_BIND_MW_WR_DCACPU) & M_FW_RI_BIND_MW_WR_DCACPU)
+
+struct fw_ri_fr_nsmr_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __u8   qpbinde_to_dcacpu;
+        __u8   pgsz_shift;
+        __u8   addr_type;
+        __u8   mem_perms;
+        __be32 stag;
+        __be32 len_hi;
+        __be32 len_lo;
+        __be32 va_hi;
+        __be32 va_lo_fbo;
+};
+
+#define S_FW_RI_FR_NSMR_WR_QPBINDE      6
+#define M_FW_RI_FR_NSMR_WR_QPBINDE      0x1
+#define V_FW_RI_FR_NSMR_WR_QPBINDE(x)   ((x) << S_FW_RI_FR_NSMR_WR_QPBINDE)
+#define G_FW_RI_FR_NSMR_WR_QPBINDE(x)   \
+    (((x) >> S_FW_RI_FR_NSMR_WR_QPBINDE) & M_FW_RI_FR_NSMR_WR_QPBINDE)
+#define F_FW_RI_FR_NSMR_WR_QPBINDE      V_FW_RI_FR_NSMR_WR_QPBINDE(1U)
+
+#define S_FW_RI_FR_NSMR_WR_NS           5
+#define M_FW_RI_FR_NSMR_WR_NS           0x1
+#define V_FW_RI_FR_NSMR_WR_NS(x)        ((x) << S_FW_RI_FR_NSMR_WR_NS)
+#define G_FW_RI_FR_NSMR_WR_NS(x)        \
+    (((x) >> S_FW_RI_FR_NSMR_WR_NS) & M_FW_RI_FR_NSMR_WR_NS)
+#define F_FW_RI_FR_NSMR_WR_NS   V_FW_RI_FR_NSMR_WR_NS(1U)
+
+#define S_FW_RI_FR_NSMR_WR_DCACPU       0
+#define M_FW_RI_FR_NSMR_WR_DCACPU       0x1f
+#define V_FW_RI_FR_NSMR_WR_DCACPU(x)    ((x) << S_FW_RI_FR_NSMR_WR_DCACPU)
+#define G_FW_RI_FR_NSMR_WR_DCACPU(x)    \
+    (((x) >> S_FW_RI_FR_NSMR_WR_DCACPU) & M_FW_RI_FR_NSMR_WR_DCACPU)
+
+struct fw_ri_inv_lstag_wr {
+        __u8   opcode;
+        __u8   flags;
+        __u16  wrid;
+        __u8   r1[3];
+        __u8   len16;
+        __be32 r2;
+        __be32 stag_inv;
+};
+
+enum fw_ri_type {
+        FW_RI_TYPE_INIT,
+        FW_RI_TYPE_FINI,
+        FW_RI_TYPE_TERMINATE
+};
+
+enum fw_ri_init_p2ptype {
+        FW_RI_INIT_P2PTYPE_RDMA_WRITE           = FW_RI_RDMA_WRITE,
+        FW_RI_INIT_P2PTYPE_READ_REQ             = FW_RI_READ_REQ,
+        FW_RI_INIT_P2PTYPE_SEND                 = FW_RI_SEND,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_INV        = FW_RI_SEND_WITH_INV,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_SE         = FW_RI_SEND_WITH_SE,
+        FW_RI_INIT_P2PTYPE_SEND_WITH_SE_INV     = FW_RI_SEND_WITH_SE_INV,
+        FW_RI_INIT_P2PTYPE_DISABLED             = 0xf,
+};
+
+struct fw_ri_wr {
+        __be32 op_compl;
+        __be32 flowid_len16;
+        __u64  cookie;
+        union fw_ri {
+                struct fw_ri_init {
+                        __u8   type;
+                        __u8   mpareqbit_p2ptype;
+                        __u8   r4[2];
+                        __u8   mpa_attrs;
+                        __u8   qp_caps;
+                        __be16 nrqe;
+                        __be32 pdid;
+                        __be32 qpid;
+                        __be32 sq_eqid;
+                        __be32 rq_eqid;
+                        __be32 scqid;
+                        __be32 rcqid;
+                        __be32 ord_max;
+                        __be32 ird_max;
+                        __be32 iss;
+                        __be32 irs;
+                        __be32 hwrqsize;
+                        __be32 hwrqaddr;
+                        __be64 r5;
+                        union fw_ri_init_p2p {
+                                struct fw_ri_rdma_write_wr write;
+                                struct fw_ri_rdma_read_wr read;
+                                struct fw_ri_send_wr send;
+                        } u;
+                } init;
+                struct fw_ri_fini {
+                        __u8   type;
+                        __u8   r3[7];
+                        __be64 r4;
+                } fini;
+                struct fw_ri_terminate {
+                        __u8   type;
+                        __u8   r3[3];
+                        __be32 immdlen;
+                        __u8   termmsg[40];
+                } terminate;
+        } u;
+};
+
+#define S_FW_RI_WR_MPAREQBIT    7
+#define M_FW_RI_WR_MPAREQBIT    0x1
+#define V_FW_RI_WR_MPAREQBIT(x) ((x) << S_FW_RI_WR_MPAREQBIT)
+#define G_FW_RI_WR_MPAREQBIT(x) \
+    (((x) >> S_FW_RI_WR_MPAREQBIT) & M_FW_RI_WR_MPAREQBIT)
+#define F_FW_RI_WR_MPAREQBIT    V_FW_RI_WR_MPAREQBIT(1U)
+
+#define S_FW_RI_WR_P2PTYPE      0
+#define M_FW_RI_WR_P2PTYPE      0xf
+#define V_FW_RI_WR_P2PTYPE(x)   ((x) << S_FW_RI_WR_P2PTYPE)
+#define G_FW_RI_WR_P2PTYPE(x)   \
+    (((x) >> S_FW_RI_WR_P2PTYPE) & M_FW_RI_WR_P2PTYPE)
+
+struct tcp_options {
+        __be16 mss;
+        __u8 wsf;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        __u8:4;
+        __u8 unknown:1;
+        __u8:1;
+        __u8 sack:1;
+        __u8 tstamp:1;
+#else
+        __u8 tstamp:1;
+        __u8 sack:1;
+        __u8:1;
+        __u8 unknown:1;
+        __u8:4;
+#endif
+};
+
+struct cpl_pass_accept_req {
+        union opcode_tid ot;
+        __be16 rsvd;
+        __be16 len;
+        __be32 hdr_len;
+        __be16 vlan;
+        __be16 l2info;
+        __be32 tos_stid;
+        struct tcp_options tcpopt;
+};
+
+/* cpl_pass_accept_req.hdr_len fields */
+#define S_SYN_RX_CHAN    0
+#define M_SYN_RX_CHAN    0xF
+#define V_SYN_RX_CHAN(x) ((x) << S_SYN_RX_CHAN)
+#define G_SYN_RX_CHAN(x) (((x) >> S_SYN_RX_CHAN) & M_SYN_RX_CHAN)
+
+#define S_TCP_HDR_LEN    10
+#define M_TCP_HDR_LEN    0x3F
+#define V_TCP_HDR_LEN(x) ((x) << S_TCP_HDR_LEN)
+#define G_TCP_HDR_LEN(x) (((x) >> S_TCP_HDR_LEN) & M_TCP_HDR_LEN)
+
+#define S_IP_HDR_LEN    16
+#define M_IP_HDR_LEN    0x3FF
+#define V_IP_HDR_LEN(x) ((x) << S_IP_HDR_LEN)
+#define G_IP_HDR_LEN(x) (((x) >> S_IP_HDR_LEN) & M_IP_HDR_LEN)
+
+#define S_ETH_HDR_LEN    26
+#define M_ETH_HDR_LEN    0x1F
+#define V_ETH_HDR_LEN(x) ((x) << S_ETH_HDR_LEN)
+#define G_ETH_HDR_LEN(x) (((x) >> S_ETH_HDR_LEN) & M_ETH_HDR_LEN)
+
+/* cpl_pass_accept_req.l2info fields */
+#define S_SYN_MAC_IDX    0
+#define M_SYN_MAC_IDX    0x1FF
+#define V_SYN_MAC_IDX(x) ((x) << S_SYN_MAC_IDX)
+#define G_SYN_MAC_IDX(x) (((x) >> S_SYN_MAC_IDX) & M_SYN_MAC_IDX)
+
+#define S_SYN_XACT_MATCH    9
+#define V_SYN_XACT_MATCH(x) ((x) << S_SYN_XACT_MATCH)
+#define F_SYN_XACT_MATCH    V_SYN_XACT_MATCH(1U)
+
+#define S_SYN_INTF    12
+#define M_SYN_INTF    0xF
+#define V_SYN_INTF(x) ((x) << S_SYN_INTF)
+#define G_SYN_INTF(x) (((x) >> S_SYN_INTF) & M_SYN_INTF)
+
+struct ulptx_idata {
+        __be32 cmd_more;
+        __be32 len;
+};
+
+#define S_ULPTX_NSGE    0
+#define M_ULPTX_NSGE    0xFFFF
+#define V_ULPTX_NSGE(x) ((x) << S_ULPTX_NSGE)
+#endif /* _T4FW_RI_API_H_ */
diff --git a/drivers/infiniband/hw/cxgb4/user.h b/drivers/infiniband/hw/cxgb4/user.h
new file mode 100644
index 000000000000..ed6414abde02
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb4/user.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2009-2010 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __C4IW_USER_H__
+#define __C4IW_USER_H__
+
+#define C4IW_UVERBS_ABI_VERSION 1
+
+/*
+ * Make sure that all structs defined in this file remain laid out so
+ * that they pack the same way on 32-bit and 64-bit architectures (to
+ * avoid incompatibility between 32-bit userspace and 64-bit kernels).
+ * In particular do not use pointer types -- pass pointers in __u64
+ * instead.
+ */
+struct c4iw_create_cq_resp {
+        __u64 key;
+        __u64 gts_key;
+        __u64 memsize;
+        __u32 cqid;
+        __u32 size;
+        __u32 qid_mask;
+};
+
+struct c4iw_create_qp_resp {
+        __u64 sq_key;
+        __u64 rq_key;
+        __u64 sq_db_gts_key;
+        __u64 rq_db_gts_key;
+        __u64 sq_memsize;
+        __u64 rq_memsize;
+        __u32 sqid;
+        __u32 rqid;
+        __u32 sq_size;
+        __u32 rq_size;
+        __u32 qid_mask;
+};
+#endif
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index cc2ddd29ac57..5a219a2fdf16 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -661,6 +661,14 @@ repoll:
                         wc->opcode    = IB_WC_FETCH_ADD;
                         wc->byte_len  = 8;
                         break;
+                case MLX4_OPCODE_MASKED_ATOMIC_CS:
+                        wc->opcode    = IB_WC_MASKED_COMP_SWAP;
+                        wc->byte_len  = 8;
+                        break;
+                case MLX4_OPCODE_MASKED_ATOMIC_FA:
+                        wc->opcode    = IB_WC_MASKED_FETCH_ADD;
+                        wc->byte_len  = 8;
+                        break;
                 case MLX4_OPCODE_BIND_MW:
                         wc->opcode    = IB_WC_BIND_MW;
                         break;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 01f2a3f93355..39051417054c 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -139,6 +139,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->local_ca_ack_delay  = dev->dev->caps.local_ca_ack_delay;
         props->atomic_cap          = dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_ATOMIC ?
                 IB_ATOMIC_HCA : IB_ATOMIC_NONE;
+        props->masked_atomic_cap   = IB_ATOMIC_HCA;
         props->max_pkeys           = dev->dev->caps.pkey_table_len[1];
         props->max_mcast_grp       = dev->dev->caps.num_mgms + dev->dev->caps.num_amgms;
         props->max_mcast_qp_attach = dev->dev->caps.num_qp_per_mgm;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 5643f4a8ffef..6a60827b2301 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -74,17 +74,19 @@ enum {
 };
 
 static const __be32 mlx4_ib_opcode[] = {
-        [IB_WR_SEND]                    = cpu_to_be32(MLX4_OPCODE_SEND),
-        [IB_WR_LSO]                     = cpu_to_be32(MLX4_OPCODE_LSO),
-        [IB_WR_SEND_WITH_IMM]           = cpu_to_be32(MLX4_OPCODE_SEND_IMM),
-        [IB_WR_RDMA_WRITE]              = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE),
-        [IB_WR_RDMA_WRITE_WITH_IMM]     = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE_IMM),
-        [IB_WR_RDMA_READ]               = cpu_to_be32(MLX4_OPCODE_RDMA_READ),
-        [IB_WR_ATOMIC_CMP_AND_SWP]      = cpu_to_be32(MLX4_OPCODE_ATOMIC_CS),
-        [IB_WR_ATOMIC_FETCH_AND_ADD]    = cpu_to_be32(MLX4_OPCODE_ATOMIC_FA),
-        [IB_WR_SEND_WITH_INV]           = cpu_to_be32(MLX4_OPCODE_SEND_INVAL),
-        [IB_WR_LOCAL_INV]               = cpu_to_be32(MLX4_OPCODE_LOCAL_INVAL),
-        [IB_WR_FAST_REG_MR]             = cpu_to_be32(MLX4_OPCODE_FMR),
+        [IB_WR_SEND]                            = cpu_to_be32(MLX4_OPCODE_SEND),
+        [IB_WR_LSO]                             = cpu_to_be32(MLX4_OPCODE_LSO),
+        [IB_WR_SEND_WITH_IMM]                   = cpu_to_be32(MLX4_OPCODE_SEND_IMM),
+        [IB_WR_RDMA_WRITE]                      = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE),
+        [IB_WR_RDMA_WRITE_WITH_IMM]             = cpu_to_be32(MLX4_OPCODE_RDMA_WRITE_IMM),
+        [IB_WR_RDMA_READ]                       = cpu_to_be32(MLX4_OPCODE_RDMA_READ),
+        [IB_WR_ATOMIC_CMP_AND_SWP]              = cpu_to_be32(MLX4_OPCODE_ATOMIC_CS),
+        [IB_WR_ATOMIC_FETCH_AND_ADD]            = cpu_to_be32(MLX4_OPCODE_ATOMIC_FA),
+        [IB_WR_SEND_WITH_INV]                   = cpu_to_be32(MLX4_OPCODE_SEND_INVAL),
+        [IB_WR_LOCAL_INV]                       = cpu_to_be32(MLX4_OPCODE_LOCAL_INVAL),
+        [IB_WR_FAST_REG_MR]                     = cpu_to_be32(MLX4_OPCODE_FMR),
+        [IB_WR_MASKED_ATOMIC_CMP_AND_SWP]       = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_CS),
+        [IB_WR_MASKED_ATOMIC_FETCH_AND_ADD]     = cpu_to_be32(MLX4_OPCODE_MASKED_ATOMIC_FA),
 };
 
 static struct mlx4_ib_sqp *to_msqp(struct mlx4_ib_qp *mqp)
@@ -1407,6 +1409,9 @@ static void set_atomic_seg(struct mlx4_wqe_atomic_seg *aseg, struct ib_send_wr *
         if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
                 aseg->swap_add = cpu_to_be64(wr->wr.atomic.swap);
                 aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add);
+        } else if (wr->opcode == IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) {
+                aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
+                aseg->compare  = cpu_to_be64(wr->wr.atomic.compare_add_mask);
         } else {
                 aseg->swap_add = cpu_to_be64(wr->wr.atomic.compare_add);
                 aseg->compare  = 0;
@@ -1414,6 +1419,15 @@ static void set_atomic_seg(struct mlx4_wqe_atomic_seg *aseg, struct ib_send_wr *
 
 }
 
+static void set_masked_atomic_seg(struct mlx4_wqe_masked_atomic_seg *aseg,
+                                  struct ib_send_wr *wr)
+{
+        aseg->swap_add          = cpu_to_be64(wr->wr.atomic.swap);
+        aseg->swap_add_mask     = cpu_to_be64(wr->wr.atomic.swap_mask);
+        aseg->compare           = cpu_to_be64(wr->wr.atomic.compare_add);
+        aseg->compare_mask      = cpu_to_be64(wr->wr.atomic.compare_add_mask);
+}
+
 static void set_datagram_seg(struct mlx4_wqe_datagram_seg *dseg,
                              struct ib_send_wr *wr)
 {
@@ -1567,6 +1581,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         switch (wr->opcode) {
                         case IB_WR_ATOMIC_CMP_AND_SWP:
                         case IB_WR_ATOMIC_FETCH_AND_ADD:
+                        case IB_WR_MASKED_ATOMIC_FETCH_AND_ADD:
                                 set_raddr_seg(wqe, wr->wr.atomic.remote_addr,
                                               wr->wr.atomic.rkey);
                                 wqe  += sizeof (struct mlx4_wqe_raddr_seg);
@@ -1579,6 +1594,19 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
                                 break;
 
+                        case IB_WR_MASKED_ATOMIC_CMP_AND_SWP:
+                                set_raddr_seg(wqe, wr->wr.atomic.remote_addr,
+                                              wr->wr.atomic.rkey);
+                                wqe  += sizeof (struct mlx4_wqe_raddr_seg);
+
+                                set_masked_atomic_seg(wqe, wr);
+                                wqe  += sizeof (struct mlx4_wqe_masked_atomic_seg);
+
+                                size += (sizeof (struct mlx4_wqe_raddr_seg) +
+                                         sizeof (struct mlx4_wqe_masked_atomic_seg)) / 16;
+
+                                break;
+
                         case IB_WR_RDMA_READ:
                         case IB_WR_RDMA_WRITE:
                         case IB_WR_RDMA_WRITE_WITH_IMM:
diff --git a/drivers/infiniband/hw/mthca/mthca_allocator.c b/drivers/infiniband/hw/mthca/mthca_allocator.c
index c5ccc2daab60..b4e0cf4e95cd 100644
--- a/drivers/infiniband/hw/mthca/mthca_allocator.c
+++ b/drivers/infiniband/hw/mthca/mthca_allocator.c
@@ -211,7 +211,7 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                 if (!buf->direct.buf)
                         return -ENOMEM;
 
-                pci_unmap_addr_set(&buf->direct, mapping, t);
+                dma_unmap_addr_set(&buf->direct, mapping, t);
 
                 memset(buf->direct.buf, 0, size);
 
@@ -251,7 +251,7 @@ int mthca_buf_alloc(struct mthca_dev *dev, int size, int max_direct,
                                 goto err_free;
 
                         dma_list[i] = t;
-                        pci_unmap_addr_set(&buf->page_list[i], mapping, t);
+                        dma_unmap_addr_set(&buf->page_list[i], mapping, t);
 
                         clear_page(buf->page_list[i].buf);
                 }
@@ -289,12 +289,12 @@ void mthca_buf_free(struct mthca_dev *dev, int size, union mthca_buf *buf,
 
         if (is_direct)
                 dma_free_coherent(&dev->pdev->dev, size, buf->direct.buf,
-                                  pci_unmap_addr(&buf->direct, mapping));
+                                  dma_unmap_addr(&buf->direct, mapping));
         else {
                 for (i = 0; i < (size + PAGE_SIZE - 1) / PAGE_SIZE; ++i)
                         dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
                                           buf->page_list[i].buf,
-                                          pci_unmap_addr(&buf->page_list[i],
+                                          dma_unmap_addr(&buf->page_list[i],
                                                          mapping));
                 kfree(buf->page_list);
         }
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index 9388164b6053..8e8c728aff88 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -504,7 +504,7 @@ static int mthca_create_eq(struct mthca_dev *dev,
                         goto err_out_free_pages;
 
                 dma_list[i] = t;
-                pci_unmap_addr_set(&eq->page_list[i], mapping, t);
+                dma_unmap_addr_set(&eq->page_list[i], mapping, t);
 
                 clear_page(eq->page_list[i].buf);
         }
@@ -579,7 +579,7 @@ static int mthca_create_eq(struct mthca_dev *dev,
                 if (eq->page_list[i].buf)
                         dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
                                           eq->page_list[i].buf,
-                                          pci_unmap_addr(&eq->page_list[i],
+                                          dma_unmap_addr(&eq->page_list[i],
                                                          mapping));
 
         mthca_free_mailbox(dev, mailbox);
@@ -629,7 +629,7 @@ static void mthca_free_eq(struct mthca_dev *dev,
         for (i = 0; i < npages; ++i)
                 pci_free_consistent(dev->pdev, PAGE_SIZE,
                                     eq->page_list[i].buf,
-                                    pci_unmap_addr(&eq->page_list[i], mapping));
+                                    dma_unmap_addr(&eq->page_list[i], mapping));
 
         kfree(eq->page_list);
         mthca_free_mailbox(dev, mailbox);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 90f4c4d2e983..596acc45569b 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -46,7 +46,7 @@
 
 struct mthca_buf_list {
         void *buf;
-        DECLARE_PCI_UNMAP_ADDR(mapping)
+        DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
 union mthca_buf {
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index c36a3f514929..86acb7d57064 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -1297,7 +1297,7 @@ int nes_destroy_cqp(struct nes_device *nesdev)
 /**
  * nes_init_1g_phy
  */
-int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
+static int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 {
         u32 counter = 0;
         u16 phy_data;
@@ -1351,7 +1351,7 @@ int nes_init_1g_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 /**
  * nes_init_2025_phy
  */
-int nes_init_2025_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
+static int nes_init_2025_phy(struct nes_device *nesdev, u8 phy_type, u8 phy_index)
 {
         u32 temp_phy_data = 0;
         u32 temp_phy_data2 = 0;
@@ -2458,7 +2458,6 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                 return;
         }
         nesadapter->mac_sw_state[mac_number] = NES_MAC_SW_INTERRUPT;
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 
         /* ack the MAC interrupt */
         mac_status = nes_read_indexed(nesdev, NES_IDX_MAC_INT_STATUS + (mac_index * 0x200));
@@ -2469,11 +2468,9 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
 
         if (mac_status & (NES_MAC_INT_LINK_STAT_CHG | NES_MAC_INT_XGMII_EXT)) {
                 nesdev->link_status_interrupts++;
-                if (0 == (++nesadapter->link_interrupt_count[mac_index] % ((u16)NES_MAX_LINK_INTERRUPTS))) {
-                        spin_lock_irqsave(&nesadapter->phy_lock, flags);
+                if (0 == (++nesadapter->link_interrupt_count[mac_index] % ((u16)NES_MAX_LINK_INTERRUPTS)))
                         nes_reset_link(nesdev, mac_index);
-                        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
-                }
+
                 /* read the PHY interrupt status register */
                 if ((nesadapter->OneG_Mode) &&
                 (nesadapter->phy_type[mac_index] != NES_PHY_TYPE_PUMA_1G)) {
@@ -2587,6 +2584,7 @@ static void nes_process_mac_intr(struct nes_device *nesdev, u32 mac_number)
                                 break;
                         }
                 }
+                spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 
                 if (phy_data & 0x0004) {
                         if (wide_ppm_offset &&
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index b7c813f4be43..9f4cadf9f851 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1461,11 +1461,14 @@ static int nes_netdev_get_settings(struct net_device *netdev, struct ethtool_cmd
                         et_cmd->transceiver = XCVR_INTERNAL;
                         et_cmd->phy_address = mac_index;
                 } else {
+                        unsigned long flags;
                         et_cmd->supported   = SUPPORTED_1000baseT_Full
                                             | SUPPORTED_Autoneg;
                         et_cmd->advertising = ADVERTISED_1000baseT_Full
                                             | ADVERTISED_Autoneg;
+                        spin_lock_irqsave(&nesadapter->phy_lock, flags);
                         nes_read_1G_phy_reg(nesdev, 0, phy_index, &phy_data);
+                        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
                         if (phy_data & 0x1000)
                                 et_cmd->autoneg = AUTONEG_ENABLE;
                         else
@@ -1503,12 +1506,15 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
         struct nes_vnic *nesvnic = netdev_priv(netdev);
         struct nes_device *nesdev = nesvnic->nesdev;
         struct nes_adapter *nesadapter = nesdev->nesadapter;
-        u16 phy_data;
 
         if ((nesadapter->OneG_Mode) &&
             (nesadapter->phy_type[nesdev->mac_index] != NES_PHY_TYPE_PUMA_1G)) {
-                nes_read_1G_phy_reg(nesdev, 0, nesadapter->phy_index[nesdev->mac_index],
-                                &phy_data);
+                unsigned long flags;
+                u16 phy_data;
+                u8 phy_index = nesadapter->phy_index[nesdev->mac_index];
+
+                spin_lock_irqsave(&nesadapter->phy_lock, flags);
+                nes_read_1G_phy_reg(nesdev, 0, phy_index, &phy_data);
                 if (et_cmd->autoneg) {
                         /* Turn on Full duplex, Autoneg, and restart autonegotiation */
                         phy_data |= 0x1300;
@@ -1516,8 +1522,8 @@ static int nes_netdev_set_settings(struct net_device *netdev, struct ethtool_cmd
                         /* Turn off autoneg */
                         phy_data &= ~0x1000;
                 }
-                nes_write_1G_phy_reg(nesdev, 0, nesadapter->phy_index[nesdev->mac_index],
-                                phy_data);
+                nes_write_1G_phy_reg(nesdev, 0, phy_index, phy_data);
+                spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
         }
 
         return 0;
diff --git a/drivers/infiniband/hw/nes/nes_utils.c b/drivers/infiniband/hw/nes/nes_utils.c
index 186623d86959..a9f5dd272f1a 100644
--- a/drivers/infiniband/hw/nes/nes_utils.c
+++ b/drivers/infiniband/hw/nes/nes_utils.c
@@ -381,12 +381,8 @@ static u16 nes_read16_eeprom(void __iomem *addr, u16 offset)
  */
 void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16 data)
 {
-        struct nes_adapter *nesadapter = nesdev->nesadapter;
         u32 u32temp;
         u32 counter;
-        unsigned long flags;
-
-        spin_lock_irqsave(&nesadapter->phy_lock, flags);
 
         nes_write_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL,
                         0x50020000 | data | ((u32)phy_reg << 18) | ((u32)phy_addr << 23));
@@ -402,8 +398,6 @@ void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u1
         if (!(u32temp & 1))
                 nes_debug(NES_DBG_PHY, "Phy is not responding. interrupt status = 0x%X.\n",
                                 u32temp);
-
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 }
 
 
@@ -414,14 +408,11 @@ void nes_write_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u1
  */
 void nes_read_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16 *data)
 {
-        struct nes_adapter *nesadapter = nesdev->nesadapter;
         u32 u32temp;
         u32 counter;
-        unsigned long flags;
 
         /* nes_debug(NES_DBG_PHY, "phy addr = %d, mac_index = %d\n",
                         phy_addr, nesdev->mac_index); */
-        spin_lock_irqsave(&nesadapter->phy_lock, flags);
 
         nes_write_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL,
                         0x60020000 | ((u32)phy_reg << 18) | ((u32)phy_addr << 23));
@@ -441,7 +432,6 @@ void nes_read_1G_phy_reg(struct nes_device *nesdev, u8 phy_reg, u8 phy_addr, u16
         } else {
                 *data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
         }
-        spin_unlock_irqrestore(&nesadapter->phy_lock, flags);
 }
 
 
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index e54f312e4bdc..925e1f2d1d55 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -374,7 +374,7 @@ static int alloc_fast_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
 /*
  * nes_alloc_fast_reg_mr
  */
-struct ib_mr *nes_alloc_fast_reg_mr(struct ib_pd *ibpd, int max_page_list_len)
+static struct ib_mr *nes_alloc_fast_reg_mr(struct ib_pd *ibpd, int max_page_list_len)
 {
         struct nes_pd *nespd = to_nespd(ibpd);
         struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
index d10b4ec68d28..40e858492f90 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c
@@ -49,6 +49,25 @@ static u32 ipoib_get_rx_csum(struct net_device *dev)
                 !test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
 }
 
+static int ipoib_set_tso(struct net_device *dev, u32 data)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+
+        if (data) {
+                if (!test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags) &&
+                    (dev->features & NETIF_F_SG) &&
+                    (priv->hca_caps & IB_DEVICE_UD_TSO)) {
+                        dev->features |= NETIF_F_TSO;
+                } else {
+                        ipoib_warn(priv, "can't set TSO on\n");
+                        return -EOPNOTSUPP;
+                }
+        } else
+                dev->features &= ~NETIF_F_TSO;
+
+        return 0;
+}
+
 static int ipoib_get_coalesce(struct net_device *dev,
                               struct ethtool_coalesce *coal)
 {
@@ -131,6 +150,7 @@ static void ipoib_get_ethtool_stats(struct net_device *dev,
 static const struct ethtool_ops ipoib_ethtool_ops = {
         .get_drvinfo            = ipoib_get_drvinfo,
         .get_rx_csum            = ipoib_get_rx_csum,
+        .set_tso                = ipoib_set_tso,
         .get_coalesce           = ipoib_get_coalesce,
         .set_coalesce           = ipoib_set_coalesce,
         .get_flags              = ethtool_op_get_flags,
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 93399dff0c6f..7b2fc98e2f2b 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -325,7 +325,7 @@ iscsi_iser_conn_destroy(struct iscsi_cls_conn *cls_conn)
          */
         if (ib_conn) {
                 ib_conn->iser_conn = NULL;
-                iser_conn_put(ib_conn);
+                iser_conn_put(ib_conn, 1); /* deref iscsi/ib conn unbinding */
         }
 }
 
@@ -357,11 +357,12 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session,
         /* binds the iSER connection retrieved from the previously
          * connected ep_handle to the iSCSI layer connection. exchanges
          * connection pointers */
-        iser_err("binding iscsi conn %p to iser_conn %p\n",conn,ib_conn);
+        iser_err("binding iscsi/iser conn %p %p to ib_conn %p\n",
+                                        conn, conn->dd_data, ib_conn);
         iser_conn = conn->dd_data;
         ib_conn->iser_conn = iser_conn;
         iser_conn->ib_conn  = ib_conn;
-        iser_conn_get(ib_conn);
+        iser_conn_get(ib_conn); /* ref iscsi/ib conn binding */
         return 0;
 }
 
@@ -382,7 +383,7 @@ iscsi_iser_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
                  * There is no unbind event so the stop callback
                  * must release the ref from the bind.
                  */
-                iser_conn_put(ib_conn);
+                iser_conn_put(ib_conn, 1); /* deref iscsi/ib conn unbinding */
         }
         iser_conn->ib_conn = NULL;
 }
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 036934cdcb92..f1df01567bb6 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -232,6 +232,7 @@ struct iser_device {
         struct ib_cq                 *tx_cq;
         struct ib_mr                 *mr;
         struct tasklet_struct        cq_tasklet;
+        struct ib_event_handler      event_handler;
         struct list_head             ig_list; /* entry in ig devices list */
         int                          refcount;
 };
@@ -246,7 +247,6 @@ struct iser_conn {
         struct rdma_cm_id            *cma_id;       /* CMA ID                  */
         struct ib_qp                 *qp;           /* QP                      */
         struct ib_fmr_pool           *fmr_pool;     /* pool of IB FMRs         */
-        int                          disc_evt_flag; /* disconn event delivered */
         wait_queue_head_t            wait;          /* waitq for conn/disconn  */
         int                          post_recv_buf_count; /* posted rx count  */
         atomic_t                     post_send_buf_count; /* posted tx count   */
@@ -320,7 +320,7 @@ void iser_conn_init(struct iser_conn *ib_conn);
 
 void iser_conn_get(struct iser_conn *ib_conn);
 
-void iser_conn_put(struct iser_conn *ib_conn);
+int iser_conn_put(struct iser_conn *ib_conn, int destroy_cma_id_allowed);
 
 void iser_conn_terminate(struct iser_conn *ib_conn);
 
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index b89d76b39a13..9876865732f7 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -54,6 +54,13 @@ static void iser_qp_event_callback(struct ib_event *cause, void *context)
         iser_err("got qp event %d\n",cause->event);
 }
 
+static void iser_event_handler(struct ib_event_handler *handler,
+                                struct ib_event *event)
+{
+        iser_err("async event %d on device %s port %d\n", event->event,
+                event->device->name, event->element.port_num);
+}
+
 /**
  * iser_create_device_ib_res - creates Protection Domain (PD), Completion
  * Queue (CQ), DMA Memory Region (DMA MR) with the device associated with
@@ -96,8 +103,15 @@ static int iser_create_device_ib_res(struct iser_device *device)
         if (IS_ERR(device->mr))
                 goto dma_mr_err;
 
+        INIT_IB_EVENT_HANDLER(&device->event_handler, device->ib_device,
+                                iser_event_handler);
+        if (ib_register_event_handler(&device->event_handler))
+                goto handler_err;
+
         return 0;
 
+handler_err:
+        ib_dereg_mr(device->mr);
 dma_mr_err:
         tasklet_kill(&device->cq_tasklet);
 cq_arm_err:
@@ -120,7 +134,7 @@ static void iser_free_device_ib_res(struct iser_device *device)
         BUG_ON(device->mr == NULL);
 
         tasklet_kill(&device->cq_tasklet);
-
+        (void)ib_unregister_event_handler(&device->event_handler);
         (void)ib_dereg_mr(device->mr);
         (void)ib_destroy_cq(device->tx_cq);
         (void)ib_destroy_cq(device->rx_cq);
@@ -149,10 +163,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         device = ib_conn->device;
 
         ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-        if (!ib_conn->login_buf) {
-                goto alloc_err;
-                ret = -ENOMEM;
-        }
+        if (!ib_conn->login_buf)
+                goto out_err;
 
         ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
                                 (void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,
@@ -161,10 +173,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
                                     (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
                                     GFP_KERNEL);
-        if (!ib_conn->page_vec) {
-                ret = -ENOMEM;
-                goto alloc_err;
-        }
+        if (!ib_conn->page_vec)
+                goto out_err;
+
         ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
         params.page_shift        = SHIFT_4K;
@@ -184,7 +195,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
         ib_conn->fmr_pool = ib_create_fmr_pool(device->pd, &params);
         if (IS_ERR(ib_conn->fmr_pool)) {
                 ret = PTR_ERR(ib_conn->fmr_pool);
-                goto fmr_pool_err;
+                ib_conn->fmr_pool = NULL;
+                goto out_err;
         }
 
         memset(&init_attr, 0, sizeof init_attr);
@@ -202,7 +214,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 
         ret = rdma_create_qp(ib_conn->cma_id, device->pd, &init_attr);
         if (ret)
-                goto qp_err;
+                goto out_err;
 
         ib_conn->qp = ib_conn->cma_id->qp;
         iser_err("setting conn %p cma_id %p: fmr_pool %p qp %p\n",
@@ -210,12 +222,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
                  ib_conn->fmr_pool, ib_conn->cma_id->qp);
         return ret;
 
-qp_err:
-        (void)ib_destroy_fmr_pool(ib_conn->fmr_pool);
-fmr_pool_err:
-        kfree(ib_conn->page_vec);
-        kfree(ib_conn->login_buf);
-alloc_err:
+out_err:
         iser_err("unable to alloc mem or create resource, err %d\n", ret);
         return ret;
 }
@@ -224,7 +231,7 @@ alloc_err:
  * releases the FMR pool, QP and CMA ID objects, returns 0 on success,
  * -1 on failure
  */
-static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
+static int iser_free_ib_conn_res(struct iser_conn *ib_conn, int can_destroy_id)
 {
         BUG_ON(ib_conn == NULL);
 
@@ -239,7 +246,8 @@ static int iser_free_ib_conn_res(struct iser_conn *ib_conn)
         if (ib_conn->qp != NULL)
                 rdma_destroy_qp(ib_conn->cma_id);
 
-        if (ib_conn->cma_id != NULL)
+        /* if cma handler context, the caller acts s.t the cma destroy the id */
+        if (ib_conn->cma_id != NULL && can_destroy_id)
                 rdma_destroy_id(ib_conn->cma_id);
 
         ib_conn->fmr_pool = NULL;
@@ -317,7 +325,7 @@ static int iser_conn_state_comp_exch(struct iser_conn *ib_conn,
 /**
  * Frees all conn objects and deallocs conn descriptor
  */
-static void iser_conn_release(struct iser_conn *ib_conn)
+static void iser_conn_release(struct iser_conn *ib_conn, int can_destroy_id)
 {
         struct iser_device  *device = ib_conn->device;
 
@@ -327,13 +335,11 @@ static void iser_conn_release(struct iser_conn *ib_conn)
         list_del(&ib_conn->conn_list);
         mutex_unlock(&ig.connlist_mutex);
         iser_free_rx_descriptors(ib_conn);
-        iser_free_ib_conn_res(ib_conn);
+        iser_free_ib_conn_res(ib_conn, can_destroy_id);
         ib_conn->device = NULL;
         /* on EVENT_ADDR_ERROR there's no device yet for this conn */
         if (device != NULL)
                 iser_device_try_release(device);
-        if (ib_conn->iser_conn)
-                ib_conn->iser_conn->ib_conn = NULL;
         iscsi_destroy_endpoint(ib_conn->ep);
 }
 
@@ -342,10 +348,13 @@ void iser_conn_get(struct iser_conn *ib_conn)
         atomic_inc(&ib_conn->refcount);
 }
 
-void iser_conn_put(struct iser_conn *ib_conn)
+int iser_conn_put(struct iser_conn *ib_conn, int can_destroy_id)
 {
-        if (atomic_dec_and_test(&ib_conn->refcount))
-                iser_conn_release(ib_conn);
+        if (atomic_dec_and_test(&ib_conn->refcount)) {
+                iser_conn_release(ib_conn, can_destroy_id);
+                return 1;
+        }
+        return 0;
 }
 
 /**
@@ -369,19 +378,20 @@ void iser_conn_terminate(struct iser_conn *ib_conn)
         wait_event_interruptible(ib_conn->wait,
                                  ib_conn->state == ISER_CONN_DOWN);
 
-        iser_conn_put(ib_conn);
+        iser_conn_put(ib_conn, 1); /* deref ib conn deallocate */
 }
 
-static void iser_connect_error(struct rdma_cm_id *cma_id)
+static int iser_connect_error(struct rdma_cm_id *cma_id)
 {
         struct iser_conn *ib_conn;
         ib_conn = (struct iser_conn *)cma_id->context;
 
         ib_conn->state = ISER_CONN_DOWN;
         wake_up_interruptible(&ib_conn->wait);
+        return iser_conn_put(ib_conn, 0); /* deref ib conn's cma id */
 }
 
-static void iser_addr_handler(struct rdma_cm_id *cma_id)
+static int iser_addr_handler(struct rdma_cm_id *cma_id)
 {
         struct iser_device *device;
         struct iser_conn   *ib_conn;
@@ -390,8 +400,7 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         device = iser_device_find_by_ib_device(cma_id);
         if (!device) {
                 iser_err("device lookup/creation failed\n");
-                iser_connect_error(cma_id);
-                return;
+                return iser_connect_error(cma_id);
         }
 
         ib_conn = (struct iser_conn *)cma_id->context;
@@ -400,11 +409,13 @@ static void iser_addr_handler(struct rdma_cm_id *cma_id)
         ret = rdma_resolve_route(cma_id, 1000);
         if (ret) {
                 iser_err("resolve route failed: %d\n", ret);
-                iser_connect_error(cma_id);
+                return iser_connect_error(cma_id);
         }
+
+        return 0;
 }
 
-static void iser_route_handler(struct rdma_cm_id *cma_id)
+static int iser_route_handler(struct rdma_cm_id *cma_id)
 {
         struct rdma_conn_param conn_param;
         int    ret;
@@ -425,9 +436,9 @@ static void iser_route_handler(struct rdma_cm_id *cma_id)
                 goto failure;
         }
 
-        return;
+        return 0;
 failure:
-        iser_connect_error(cma_id);
+        return iser_connect_error(cma_id);
 }
 
 static void iser_connected_handler(struct rdma_cm_id *cma_id)
@@ -439,12 +450,12 @@ static void iser_connected_handler(struct rdma_cm_id *cma_id)
         wake_up_interruptible(&ib_conn->wait);
 }
 
-static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
+static int iser_disconnected_handler(struct rdma_cm_id *cma_id)
 {
         struct iser_conn *ib_conn;
+        int ret;
 
         ib_conn = (struct iser_conn *)cma_id->context;
-        ib_conn->disc_evt_flag = 1;
 
         /* getting here when the state is UP means that the conn is being *
          * terminated asynchronously from the iSCSI layer's perspective.  */
@@ -459,20 +470,24 @@ static void iser_disconnected_handler(struct rdma_cm_id *cma_id)
                 ib_conn->state = ISER_CONN_DOWN;
                 wake_up_interruptible(&ib_conn->wait);
         }
+
+        ret = iser_conn_put(ib_conn, 0); /* deref ib conn's cma id */
+        return ret;
 }
 
 static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         int ret = 0;
 
-        iser_err("event %d conn %p id %p\n",event->event,cma_id->context,cma_id);
+        iser_err("event %d status %d conn %p id %p\n",
+                event->event, event->status, cma_id->context, cma_id);
 
         switch (event->event) {
         case RDMA_CM_EVENT_ADDR_RESOLVED:
-                iser_addr_handler(cma_id);
+                ret = iser_addr_handler(cma_id);
                 break;
         case RDMA_CM_EVENT_ROUTE_RESOLVED:
-                iser_route_handler(cma_id);
+                ret = iser_route_handler(cma_id);
                 break;
         case RDMA_CM_EVENT_ESTABLISHED:
                 iser_connected_handler(cma_id);
@@ -482,13 +497,12 @@ static int iser_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *eve
         case RDMA_CM_EVENT_CONNECT_ERROR:
         case RDMA_CM_EVENT_UNREACHABLE:
         case RDMA_CM_EVENT_REJECTED:
-                iser_err("event: %d, error: %d\n", event->event, event->status);
-                iser_connect_error(cma_id);
+                ret = iser_connect_error(cma_id);
                 break;
         case RDMA_CM_EVENT_DISCONNECTED:
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
         case RDMA_CM_EVENT_ADDR_CHANGE:
-                iser_disconnected_handler(cma_id);
+                ret = iser_disconnected_handler(cma_id);
                 break;
         default:
                 iser_err("Unexpected RDMA CM event (%d)\n", event->event);
@@ -503,7 +517,7 @@ void iser_conn_init(struct iser_conn *ib_conn)
         init_waitqueue_head(&ib_conn->wait);
         ib_conn->post_recv_buf_count = 0;
         atomic_set(&ib_conn->post_send_buf_count, 0);
-        atomic_set(&ib_conn->refcount, 1);
+        atomic_set(&ib_conn->refcount, 1); /* ref ib conn allocation */
         INIT_LIST_HEAD(&ib_conn->conn_list);
         spin_lock_init(&ib_conn->lock);
 }
@@ -531,6 +545,7 @@ int iser_connect(struct iser_conn   *ib_conn,
 
         ib_conn->state = ISER_CONN_PENDING;
 
+        iser_conn_get(ib_conn); /* ref ib conn's cma id */
         ib_conn->cma_id = rdma_create_id(iser_cma_handler,
                                              (void *)ib_conn,
                                              RDMA_PS_TCP);
@@ -568,7 +583,7 @@ id_failure:
 addr_failure:
         ib_conn->state = ISER_CONN_DOWN;
 connect_failure:
-        iser_conn_release(ib_conn);
+        iser_conn_release(ib_conn, 1);
         return err;
 }
 
@@ -737,12 +752,10 @@ static void iser_handle_comp_error(struct iser_tx_desc *desc,
                         iscsi_conn_failure(ib_conn->iser_conn->iscsi_conn,
                                            ISCSI_ERR_CONN_FAILED);
 
-                /* complete the termination process if disconnect event was delivered *
-                 * note there are no more non completed posts to the QP               */
-                if (ib_conn->disc_evt_flag) {
-                        ib_conn->state = ISER_CONN_DOWN;
-                        wake_up_interruptible(&ib_conn->wait);
-                }
+                /* no more non completed posts to the QP, complete the
+                 * termination process w.o worrying on disconnect event */
+                ib_conn->state = ISER_CONN_DOWN;
+                wake_up_interruptible(&ib_conn->wait);
         }
 }
 
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 7e18bcf05a66..46239e47a260 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -59,11 +59,11 @@ static unsigned int get_time_pit(void)
         unsigned long flags;
         unsigned int count;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         outb_p(0x00, 0x43);
         count = inb_p(0x40);
         count |= inb_p(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return count;
 }
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index c52bec4d0530..423e0e6031ab 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -929,6 +929,24 @@ static const struct input_device_id joydev_ids[] = {
                 .evbit = { BIT_MASK(EV_ABS) },
                 .absbit = { BIT_MASK(ABS_THROTTLE) },
         },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = {[BIT_WORD(BTN_JOYSTICK)] = BIT_MASK(BTN_JOYSTICK) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_GAMEPAD)] = BIT_MASK(BTN_GAMEPAD) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_TRIGGER_HAPPY)] = BIT_MASK(BTN_TRIGGER_HAPPY) },
+        },
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 1c0b529c06aa..4afe0a3b4884 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -146,11 +146,11 @@ static unsigned int get_time_pit(void)
         unsigned long flags;
         unsigned int count;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
         outb_p(0x00, 0x43);
         count = inb_p(0x40);
         count |= inb_p(0x40) << 8;
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return count;
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b1edd778639c..405febd94f24 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -54,6 +54,9 @@ static signed short btn_avb_wheel[] =
 static signed short abs_joystick[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_HAT0X, ABS_HAT0Y, -1 };
 
+static signed short abs_joystick_rudder[] =
+{ ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y, -1 };
+
 static signed short abs_avb_pegasus[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y,
   ABS_HAT1X, ABS_HAT1Y, -1 };
@@ -76,8 +79,9 @@ static struct iforce_device iforce_device[] = {
         { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback",        btn_joystick, abs_joystick_rudder, ff_iforce },
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
-        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06f8, 0xa302, "Guillemot Jet Leader 3D",                    btn_joystick, abs_joystick, ff_iforce }, //?
         { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
         { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index b41303d3ec54..6c96631ae5d9 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -212,6 +212,7 @@ static struct usb_device_id iforce_usb_ids [] = {
         { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
+        { USB_DEVICE(0x06f8, 0x0003) },         /* Guillemot Jet Leader Force Feedback */
         { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
         { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
         { }                                     /* Terminating entry */
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 64c102355f53..a8293388d019 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -143,19 +143,6 @@ config KEYBOARD_BFIN
           To compile this driver as a module, choose M here: the
           module will be called bf54x-keys.
 
-config KEYBOARD_CORGI
-        tristate "Corgi keyboard (deprecated)"
-        depends on PXA_SHARPSL
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-C7xx
-          series of PDAs.
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called corgikbd.
-
 config KEYBOARD_LKKBD
         tristate "DECstation/VAXstation LK201/LK401 keyboard"
         select SERIO
@@ -339,19 +326,6 @@ config KEYBOARD_PXA930_ROTARY
           To compile this driver as a module, choose M here: the
           module will be called pxa930_rotary.
 
-config KEYBOARD_SPITZ
-        tristate "Spitz keyboard (deprecated)"
-        depends on PXA_SHARPSL
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-C1000,
-          SL-C3000 and Sl-C3100 series of PDAs.
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called spitzkbd.
-
 config KEYBOARD_STOWAWAY
         tristate "Stowaway keyboard"
         select SERIO
@@ -414,28 +388,6 @@ config KEYBOARD_TWL4030
           To compile this driver as a module, choose M here: the
           module will be called twl4030_keypad.
 
-config KEYBOARD_TOSA
-        tristate "Tosa keyboard (deprecated)"
-        depends on MACH_TOSA
-        help
-          Say Y here to enable the keyboard on the Sharp Zaurus SL-6000x (Tosa)
-
-          This driver is now deprecated, use generic GPIO based matrix
-          keyboard driver instead.
-
-          To compile this driver as a module, choose M here: the
-          module will be called tosakbd.
-
-config KEYBOARD_TOSA_USE_EXT_KEYCODES
-        bool "Tosa keyboard: use extended keycodes"
-        depends on KEYBOARD_TOSA
-        help
-          Say Y here to enable the tosa keyboard driver to generate extended
-          (>= 127) keycodes. Be aware, that they can't be correctly interpreted
-          by either console keyboard driver or by Kdrive keybd driver.
-
-          Say Y only if you know, what you are doing!
-
 config KEYBOARD_XTKBD
         tristate "XT keyboard"
         select SERIO
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index 706c6b5ed5f4..9a74127e4d17 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_KEYBOARD_AMIGA)		+= amikbd.o
 obj-$(CONFIG_KEYBOARD_ATARI)            += atakbd.o
 obj-$(CONFIG_KEYBOARD_ATKBD)            += atkbd.o
 obj-$(CONFIG_KEYBOARD_BFIN)             += bf54x-keys.o
-obj-$(CONFIG_KEYBOARD_CORGI)            += corgikbd.o
 obj-$(CONFIG_KEYBOARD_DAVINCI)          += davinci_keyscan.o
 obj-$(CONFIG_KEYBOARD_EP93XX)           += ep93xx_keypad.o
 obj-$(CONFIG_KEYBOARD_GPIO)             += gpio_keys.o
@@ -33,10 +32,8 @@ obj-$(CONFIG_KEYBOARD_PXA27x)		+= pxa27x_keypad.o
 obj-$(CONFIG_KEYBOARD_PXA930_ROTARY)    += pxa930_rotary.o
 obj-$(CONFIG_KEYBOARD_QT2160)           += qt2160.o
 obj-$(CONFIG_KEYBOARD_SH_KEYSC)         += sh_keysc.o
-obj-$(CONFIG_KEYBOARD_SPITZ)            += spitzkbd.o
 obj-$(CONFIG_KEYBOARD_STOWAWAY)         += stowaway.o
 obj-$(CONFIG_KEYBOARD_SUNKBD)           += sunkbd.o
-obj-$(CONFIG_KEYBOARD_TOSA)             += tosakbd.o
 obj-$(CONFIG_KEYBOARD_TWL4030)          += twl4030_keypad.o
 obj-$(CONFIG_KEYBOARD_XTKBD)            += xtkbd.o
 obj-$(CONFIG_KEYBOARD_W90P910)          += w90p910_keypad.o
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
deleted file mode 100644
index 634af6a8e6b3..000000000000
--- a/drivers/input/keyboard/corgikbd.c
+++ /dev/null
@@ -1,414 +0,0 @@
-/*
- *  Keyboard driver for Sharp Corgi models (SL-C7xx)
- *
- *  Copyright (c) 2004-2005 Richard Purdie
- *
- *  Based on xtkbd.c/locomkbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include <mach/corgi.h>
-#include <mach/pxa2xx-gpio.h>
-#include <asm/hardware/scoop.h>
-
-#define KB_ROWS                         8
-#define KB_COLS                         12
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r,c)           ( ((r)<<4) + (c) + 1 )
-/* zero code, 124 scancodes */
-#define NR_SCANCODES            ( SCANCODE(KB_ROWS-1,KB_COLS-1) +1 +1 )
-
-#define SCAN_INTERVAL           (50) /* ms */
-#define HINGE_SCAN_INTERVAL     (250) /* ms */
-
-#define CORGI_KEY_CALENDER      KEY_F1
-#define CORGI_KEY_ADDRESS       KEY_F2
-#define CORGI_KEY_FN            KEY_F3
-#define CORGI_KEY_CANCEL        KEY_F4
-#define CORGI_KEY_OFF           KEY_SUSPEND
-#define CORGI_KEY_EXOK          KEY_F5
-#define CORGI_KEY_EXCANCEL      KEY_F6
-#define CORGI_KEY_EXJOGDOWN     KEY_F7
-#define CORGI_KEY_EXJOGUP       KEY_F8
-#define CORGI_KEY_JAP1          KEY_LEFTCTRL
-#define CORGI_KEY_JAP2          KEY_LEFTALT
-#define CORGI_KEY_MAIL          KEY_F10
-#define CORGI_KEY_OK            KEY_F11
-#define CORGI_KEY_MENU          KEY_F12
-
-static unsigned char corgikbd_keycode[NR_SCANCODES] = {
-        0,                                                                                                                /* 0 */
-        0, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, 0, 0, 0, 0, 0, 0, 0,                               /* 1-16 */
-        0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, 0, 0, 0, 0, 0, 0, 0,                                   /* 17-32 */
-        KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        CORGI_KEY_CALENDER, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        CORGI_KEY_ADDRESS, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, 0, KEY_LEFTSHIFT, 0, 0, 0, 0, 0,     /* 65-80 */
-        CORGI_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, 0, CORGI_KEY_FN, 0, 0, 0, 0,            /* 81-96 */
-        KEY_SYSRQ, CORGI_KEY_JAP1, CORGI_KEY_JAP2, CORGI_KEY_CANCEL, CORGI_KEY_OK, CORGI_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0,  /* 97-112 */
-        CORGI_KEY_OFF, CORGI_KEY_EXOK, CORGI_KEY_EXCANCEL, CORGI_KEY_EXJOGDOWN, CORGI_KEY_EXJOGUP, 0, 0, 0, 0, 0, 0, 0,   /* 113-124 */
-};
-
-
-struct corgikbd {
-        unsigned char keycode[ARRAY_SIZE(corgikbd_keycode)];
-        struct input_dev *input;
-
-        spinlock_t lock;
-        struct timer_list timer;
-        struct timer_list htimer;
-
-        unsigned int suspended;
-        unsigned long suspend_jiffies;
-};
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 12 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-static inline void corgikbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR2  = CORGI_GPIO_ALL_STROBE_BIT;
-        GPDR2 &= ~CORGI_GPIO_ALL_STROBE_BIT;
-}
-
-static inline void corgikbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR2  = CORGI_GPIO_ALL_STROBE_BIT;
-        GPDR2 |= CORGI_GPIO_ALL_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* Clear any interrupts we may have triggered when altering the GPIO lines */
-        GEDR1 = CORGI_GPIO_HIGH_SENSE_BIT;
-        GEDR2 = CORGI_GPIO_LOW_SENSE_BIT;
-}
-
-static inline void corgikbd_activate_col(int col)
-{
-        /* STROBE col -> High, not col -> HiZ */
-        GPSR2 = CORGI_GPIO_STROBE_BIT(col);
-        GPDR2 = (GPDR2 & ~CORGI_GPIO_ALL_STROBE_BIT) | CORGI_GPIO_STROBE_BIT(col);
-}
-
-static inline void corgikbd_reset_col(int col)
-{
-        /* STROBE col -> Low */
-        GPCR2 = CORGI_GPIO_STROBE_BIT(col);
-        /* STROBE col -> out, not col -> HiZ */
-        GPDR2 = (GPDR2 & ~CORGI_GPIO_ALL_STROBE_BIT) | CORGI_GPIO_STROBE_BIT(col);
-}
-
-#define GET_ROWS_STATUS(c)      (((GPLR1 & CORGI_GPIO_HIGH_SENSE_BIT) >> CORGI_GPIO_HIGH_SENSE_RSHIFT) | ((GPLR2 & CORGI_GPIO_LOW_SENSE_BIT) << CORGI_GPIO_LOW_SENSE_LSHIFT))
-
-/*
- * The corgi keyboard only generates interrupts when a key is pressed.
- * When a key is pressed, we enable a timer which then scans the
- * keyboard to detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void corgikbd_scankeyboard(struct corgikbd *corgikbd_data)
-{
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed;
-
-        if (corgikbd_data->suspended)
-                return;
-
-        spin_lock_irqsave(&corgikbd_data->lock, flags);
-
-        num_pressed = 0;
-        for (col = 0; col < KB_COLS; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-
-                corgikbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                corgikbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = GET_ROWS_STATUS(col);
-                for (row = 0; row < KB_ROWS; row++) {
-                        unsigned int scancode, pressed;
-
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        input_report_key(corgikbd_data->input, corgikbd_data->keycode[scancode], pressed);
-
-                        if (pressed)
-                                num_pressed++;
-
-                        if (pressed && (corgikbd_data->keycode[scancode] == CORGI_KEY_OFF)
-                                        && time_after(jiffies, corgikbd_data->suspend_jiffies + HZ)) {
-                                input_event(corgikbd_data->input, EV_PWR, CORGI_KEY_OFF, 1);
-                                corgikbd_data->suspend_jiffies=jiffies;
-                        }
-                }
-                corgikbd_reset_col(col);
-        }
-
-        corgikbd_activate_all();
-
-        input_sync(corgikbd_data->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&corgikbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
-
-        spin_unlock_irqrestore(&corgikbd_data->lock, flags);
-}
-
-/*
- * corgi keyboard interrupt handler.
- */
-static irqreturn_t corgikbd_interrupt(int irq, void *dev_id)
-{
-        struct corgikbd *corgikbd_data = dev_id;
-
-        if (!timer_pending(&corgikbd_data->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                corgikbd_scankeyboard(corgikbd_data);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * corgi timer checking for released keys
- */
-static void corgikbd_timer_callback(unsigned long data)
-{
-        struct corgikbd *corgikbd_data = (struct corgikbd *) data;
-        corgikbd_scankeyboard(corgikbd_data);
-}
-
-/*
- * The hinge switches generate no interrupt so they need to be
- * monitored by a timer.
- *
- * We debounce the switches and pass them to the input system.
- *
- *  gprr == 0x00 - Keyboard with Landscape Screen
- *          0x08 - No Keyboard with Portrait Screen
- *          0x0c - Keyboard and Screen Closed
- */
-
-#define READ_GPIO_BIT(x)    (GPLR(x) & GPIO_bit(x))
-#define HINGE_STABLE_COUNT 2
-static int sharpsl_hinge_state;
-static int hinge_count;
-
-static void corgikbd_hinge_timer(unsigned long data)
-{
-        struct corgikbd *corgikbd_data = (struct corgikbd *) data;
-        unsigned long gprr;
-        unsigned long flags;
-
-        gprr = read_scoop_reg(&corgiscoop_device.dev, SCOOP_GPRR) & (CORGI_SCP_SWA | CORGI_SCP_SWB);
-        gprr |= (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0);
-        if (gprr != sharpsl_hinge_state) {
-                hinge_count = 0;
-                sharpsl_hinge_state = gprr;
-        } else if (hinge_count < HINGE_STABLE_COUNT) {
-                hinge_count++;
-                if (hinge_count >= HINGE_STABLE_COUNT) {
-                        spin_lock_irqsave(&corgikbd_data->lock, flags);
-
-                        input_report_switch(corgikbd_data->input, SW_LID, ((sharpsl_hinge_state & CORGI_SCP_SWA) != 0));
-                        input_report_switch(corgikbd_data->input, SW_TABLET_MODE, ((sharpsl_hinge_state & CORGI_SCP_SWB) != 0));
-                        input_report_switch(corgikbd_data->input, SW_HEADPHONE_INSERT, (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0));
-                        input_sync(corgikbd_data->input);
-
-                        spin_unlock_irqrestore(&corgikbd_data->lock, flags);
-                }
-        }
-        mod_timer(&corgikbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-}
-
-#ifdef CONFIG_PM
-static int corgikbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(dev);
-
-        corgikbd->suspended = 1;
-        /* strobe 0 is the power key so this can't be made an input for
-           powersaving therefore i = 1 */
-        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_IN);
-
-        return 0;
-}
-
-static int corgikbd_resume(struct platform_device *dev)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(dev);
-
-        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Upon resume, ignore the suspend key for a short while */
-        corgikbd->suspend_jiffies=jiffies;
-        corgikbd->suspended = 0;
-
-        return 0;
-}
-#else
-#define corgikbd_suspend        NULL
-#define corgikbd_resume         NULL
-#endif
-
-static int __devinit corgikbd_probe(struct platform_device *pdev)
-{
-        struct corgikbd *corgikbd;
-        struct input_dev *input_dev;
-        int i, err = -ENOMEM;
-
-        corgikbd = kzalloc(sizeof(struct corgikbd), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!corgikbd || !input_dev)
-                goto fail;
-
-        platform_set_drvdata(pdev, corgikbd);
-
-        corgikbd->input = input_dev;
-        spin_lock_init(&corgikbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&corgikbd->timer);
-        corgikbd->timer.function = corgikbd_timer_callback;
-        corgikbd->timer.data = (unsigned long) corgikbd;
-
-        /* Init Hinge Timer */
-        init_timer(&corgikbd->htimer);
-        corgikbd->htimer.function = corgikbd_hinge_timer;
-        corgikbd->htimer.data = (unsigned long) corgikbd;
-
-        corgikbd->suspend_jiffies=jiffies;
-
-        memcpy(corgikbd->keycode, corgikbd_keycode, sizeof(corgikbd->keycode));
-
-        input_dev->name = "Corgi Keyboard";
-        input_dev->phys = "corgikbd/input0";
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP) |
-                BIT_MASK(EV_PWR) | BIT_MASK(EV_SW);
-        input_dev->keycode = corgikbd->keycode;
-        input_dev->keycodesize = sizeof(unsigned char);
-        input_dev->keycodemax = ARRAY_SIZE(corgikbd_keycode);
-
-        for (i = 0; i < ARRAY_SIZE(corgikbd_keycode); i++)
-                set_bit(corgikbd->keycode[i], input_dev->keybit);
-        clear_bit(0, input_dev->keybit);
-        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
-
-        err = input_register_device(corgikbd->input);
-        if (err)
-                goto fail;
-
-        mod_timer(&corgikbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < CORGI_KEY_SENSE_NUM; i++) {
-                pxa_gpio_mode(CORGI_GPIO_KEY_SENSE(i) | GPIO_IN);
-                if (request_irq(CORGI_IRQ_GPIO_KEY_SENSE(i), corgikbd_interrupt,
-                                IRQF_DISABLED | IRQF_TRIGGER_RISING,
-                                "corgikbd", corgikbd))
-                        printk(KERN_WARNING "corgikbd: Can't get IRQ: %d!\n", i);
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < CORGI_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Setup the headphone jack as an input */
-        pxa_gpio_mode(CORGI_GPIO_AK_INT | GPIO_IN);
-
-        return 0;
-
- fail:  input_free_device(input_dev);
-        kfree(corgikbd);
-        return err;
-}
-
-static int __devexit corgikbd_remove(struct platform_device *pdev)
-{
-        int i;
-        struct corgikbd *corgikbd = platform_get_drvdata(pdev);
-
-        for (i = 0; i < CORGI_KEY_SENSE_NUM; i++)
-                free_irq(CORGI_IRQ_GPIO_KEY_SENSE(i), corgikbd);
-
-        del_timer_sync(&corgikbd->htimer);
-        del_timer_sync(&corgikbd->timer);
-
-        input_unregister_device(corgikbd->input);
-
-        kfree(corgikbd);
-
-        return 0;
-}
-
-static struct platform_driver corgikbd_driver = {
-        .probe          = corgikbd_probe,
-        .remove         = __devexit_p(corgikbd_remove),
-        .suspend        = corgikbd_suspend,
-        .resume         = corgikbd_resume,
-        .driver         = {
-                .name   = "corgi-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init corgikbd_init(void)
-{
-        return platform_driver_register(&corgikbd_driver);
-}
-
-static void __exit corgikbd_exit(void)
-{
-        platform_driver_unregister(&corgikbd_driver);
-}
-
-module_init(corgikbd_init);
-module_exit(corgikbd_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Corgi Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:corgi-keyboard");
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
deleted file mode 100644
index 13967422658c..000000000000
--- a/drivers/input/keyboard/spitzkbd.c
+++ /dev/null
@@ -1,496 +0,0 @@
-/*
- *  Keyboard driver for Sharp Spitz, Borzoi and Akita (SL-Cxx00 series)
- *
- *  Copyright (c) 2005 Richard Purdie
- *
- *  Based on corgikbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include <mach/spitz.h>
-#include <mach/pxa2xx-gpio.h>
-
-#define KB_ROWS                 7
-#define KB_COLS                 11
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r,c)           (((r)<<4) + (c) + 1)
-#define NR_SCANCODES            ((KB_ROWS<<4) + 1)
-
-#define SCAN_INTERVAL           (50) /* ms */
-#define HINGE_SCAN_INTERVAL     (150) /* ms */
-
-#define SPITZ_KEY_CALENDER      KEY_F1
-#define SPITZ_KEY_ADDRESS       KEY_F2
-#define SPITZ_KEY_FN            KEY_F3
-#define SPITZ_KEY_CANCEL        KEY_F4
-#define SPITZ_KEY_EXOK          KEY_F5
-#define SPITZ_KEY_EXCANCEL      KEY_F6
-#define SPITZ_KEY_EXJOGDOWN     KEY_F7
-#define SPITZ_KEY_EXJOGUP       KEY_F8
-#define SPITZ_KEY_JAP1          KEY_LEFTALT
-#define SPITZ_KEY_JAP2          KEY_RIGHTCTRL
-#define SPITZ_KEY_SYNC          KEY_F9
-#define SPITZ_KEY_MAIL          KEY_F10
-#define SPITZ_KEY_OK            KEY_F11
-#define SPITZ_KEY_MENU          KEY_F12
-
-static unsigned char spitzkbd_keycode[NR_SCANCODES] = {
-        0,                                                                                                                /* 0 */
-        KEY_LEFTCTRL, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, SPITZ_KEY_EXOK, SPITZ_KEY_EXCANCEL, 0, 0, 0, 0, 0,  /* 1-16 */
-        0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, SPITZ_KEY_EXJOGDOWN, SPITZ_KEY_EXJOGUP, 0, 0, 0, 0, 0, /* 17-32 */
-        KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        SPITZ_KEY_ADDRESS, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        SPITZ_KEY_CALENDER, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,    /* 65-80 */
-        SPITZ_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, SPITZ_KEY_FN, 0, 0, 0, 0, 0,      /* 81-96 */
-        KEY_SYSRQ, SPITZ_KEY_JAP1, SPITZ_KEY_JAP2, SPITZ_KEY_CANCEL, SPITZ_KEY_OK, SPITZ_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0  /* 97-112 */
-};
-
-static int spitz_strobes[] = {
-        SPITZ_GPIO_KEY_STROBE0,
-        SPITZ_GPIO_KEY_STROBE1,
-        SPITZ_GPIO_KEY_STROBE2,
-        SPITZ_GPIO_KEY_STROBE3,
-        SPITZ_GPIO_KEY_STROBE4,
-        SPITZ_GPIO_KEY_STROBE5,
-        SPITZ_GPIO_KEY_STROBE6,
-        SPITZ_GPIO_KEY_STROBE7,
-        SPITZ_GPIO_KEY_STROBE8,
-        SPITZ_GPIO_KEY_STROBE9,
-        SPITZ_GPIO_KEY_STROBE10,
-};
-
-static int spitz_senses[] = {
-        SPITZ_GPIO_KEY_SENSE0,
-        SPITZ_GPIO_KEY_SENSE1,
-        SPITZ_GPIO_KEY_SENSE2,
-        SPITZ_GPIO_KEY_SENSE3,
-        SPITZ_GPIO_KEY_SENSE4,
-        SPITZ_GPIO_KEY_SENSE5,
-        SPITZ_GPIO_KEY_SENSE6,
-};
-
-struct spitzkbd {
-        unsigned char keycode[ARRAY_SIZE(spitzkbd_keycode)];
-        struct input_dev *input;
-        char phys[32];
-
-        spinlock_t lock;
-        struct timer_list timer;
-        struct timer_list htimer;
-
-        unsigned int suspended;
-        unsigned long suspend_jiffies;
-};
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 11 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-static inline void spitzkbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR0  =  SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPCR1  =  SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPCR2  =  SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPCR3  =  SPITZ_GPIO_G3_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-}
-
-static inline void spitzkbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR0  =  SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR0 |=  SPITZ_GPIO_G0_STROBE_BIT;
-        GPSR1  =  SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR1 |=  SPITZ_GPIO_G1_STROBE_BIT;
-        GPSR2  =  SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR2 |=  SPITZ_GPIO_G2_STROBE_BIT;
-        GPSR3  =  SPITZ_GPIO_G3_STROBE_BIT;
-        GPDR3 |=  SPITZ_GPIO_G3_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* Clear any interrupts we may have triggered when altering the GPIO lines */
-        GEDR0 = SPITZ_GPIO_G0_SENSE_BIT;
-        GEDR1 = SPITZ_GPIO_G1_SENSE_BIT;
-        GEDR2 = SPITZ_GPIO_G2_SENSE_BIT;
-        GEDR3 = SPITZ_GPIO_G3_SENSE_BIT;
-}
-
-static inline void spitzkbd_activate_col(int col)
-{
-        int gpio = spitz_strobes[col];
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-        GPSR(gpio) = GPIO_bit(gpio);
-        GPDR(gpio) |= GPIO_bit(gpio);
-}
-
-static inline void spitzkbd_reset_col(int col)
-{
-        int gpio = spitz_strobes[col];
-        GPDR0 &= ~SPITZ_GPIO_G0_STROBE_BIT;
-        GPDR1 &= ~SPITZ_GPIO_G1_STROBE_BIT;
-        GPDR2 &= ~SPITZ_GPIO_G2_STROBE_BIT;
-        GPDR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
-        GPCR(gpio) = GPIO_bit(gpio);
-        GPDR(gpio) |= GPIO_bit(gpio);
-}
-
-static inline int spitzkbd_get_row_status(int col)
-{
-        return ((GPLR0 >> 12) & 0x01) | ((GPLR0 >> 16) & 0x02)
-                | ((GPLR2 >> 25) & 0x04) | ((GPLR1 << 1) & 0x08)
-                | ((GPLR1 >> 0) & 0x10) | ((GPLR1 >> 1) & 0x60);
-}
-
-/*
- * The spitz keyboard only generates interrupts when a key is pressed.
- * When a key is pressed, we enable a timer which then scans the
- * keyboard to detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void spitzkbd_scankeyboard(struct spitzkbd *spitzkbd_data)
-{
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed, pwrkey = ((GPLR(SPITZ_GPIO_ON_KEY) & GPIO_bit(SPITZ_GPIO_ON_KEY)) != 0);
-
-        if (spitzkbd_data->suspended)
-                return;
-
-        spin_lock_irqsave(&spitzkbd_data->lock, flags);
-
-        num_pressed = 0;
-        for (col = 0; col < KB_COLS; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-
-                spitzkbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                spitzkbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = spitzkbd_get_row_status(col);
-                for (row = 0; row < KB_ROWS; row++) {
-                        unsigned int scancode, pressed;
-
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        input_report_key(spitzkbd_data->input, spitzkbd_data->keycode[scancode], pressed);
-
-                        if (pressed)
-                                num_pressed++;
-                }
-                spitzkbd_reset_col(col);
-        }
-
-        spitzkbd_activate_all();
-
-        input_report_key(spitzkbd_data->input, SPITZ_KEY_SYNC, (GPLR(SPITZ_GPIO_SYNC) & GPIO_bit(SPITZ_GPIO_SYNC)) != 0 );
-        input_report_key(spitzkbd_data->input, KEY_SUSPEND, pwrkey);
-
-        if (pwrkey && time_after(jiffies, spitzkbd_data->suspend_jiffies + msecs_to_jiffies(1000))) {
-                input_event(spitzkbd_data->input, EV_PWR, KEY_SUSPEND, 1);
-                spitzkbd_data->suspend_jiffies = jiffies;
-        }
-
-        input_sync(spitzkbd_data->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&spitzkbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
-
-        spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
-}
-
-/*
- * spitz keyboard interrupt handler.
- */
-static irqreturn_t spitzkbd_interrupt(int irq, void *dev_id)
-{
-        struct spitzkbd *spitzkbd_data = dev_id;
-
-        if (!timer_pending(&spitzkbd_data->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                spitzkbd_scankeyboard(spitzkbd_data);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * spitz timer checking for released keys
- */
-static void spitzkbd_timer_callback(unsigned long data)
-{
-        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
-
-        spitzkbd_scankeyboard(spitzkbd_data);
-}
-
-/*
- * The hinge switches generate an interrupt.
- * We debounce the switches and pass them to the input system.
- */
-
-static irqreturn_t spitzkbd_hinge_isr(int irq, void *dev_id)
-{
-        struct spitzkbd *spitzkbd_data = dev_id;
-
-        if (!timer_pending(&spitzkbd_data->htimer))
-                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        return IRQ_HANDLED;
-}
-
-#define HINGE_STABLE_COUNT 2
-static int sharpsl_hinge_state;
-static int hinge_count;
-
-static void spitzkbd_hinge_timer(unsigned long data)
-{
-        struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
-        unsigned long state;
-        unsigned long flags;
-
-        state = GPLR(SPITZ_GPIO_SWA) & (GPIO_bit(SPITZ_GPIO_SWA)|GPIO_bit(SPITZ_GPIO_SWB));
-        state |= (GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT));
-        if (state != sharpsl_hinge_state) {
-                hinge_count = 0;
-                sharpsl_hinge_state = state;
-        } else if (hinge_count < HINGE_STABLE_COUNT) {
-                hinge_count++;
-        }
-
-        if (hinge_count >= HINGE_STABLE_COUNT) {
-                spin_lock_irqsave(&spitzkbd_data->lock, flags);
-
-                input_report_switch(spitzkbd_data->input, SW_LID, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_TABLET_MODE, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_HEADPHONE_INSERT, ((GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT)) != 0));
-                input_sync(spitzkbd_data->input);
-
-                spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
-        } else {
-                mod_timer(&spitzkbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-        }
-}
-
-#ifdef CONFIG_PM
-static int spitzkbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-        spitzkbd->suspended = 1;
-
-        /* Set Strobe lines as inputs - *except* strobe line 0 leave this
-           enabled so we can detect a power button press for resume */
-        for (i = 1; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_IN);
-
-        return 0;
-}
-
-static int spitzkbd_resume(struct platform_device *dev)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        /* Upon resume, ignore the suspend key for a short while */
-        spitzkbd->suspend_jiffies = jiffies;
-        spitzkbd->suspended = 0;
-
-        return 0;
-}
-#else
-#define spitzkbd_suspend        NULL
-#define spitzkbd_resume         NULL
-#endif
-
-static int __devinit spitzkbd_probe(struct platform_device *dev)
-{
-        struct spitzkbd *spitzkbd;
-        struct input_dev *input_dev;
-        int i, err = -ENOMEM;
-
-        spitzkbd = kzalloc(sizeof(struct spitzkbd), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!spitzkbd || !input_dev)
-                goto fail;
-
-        platform_set_drvdata(dev, spitzkbd);
-        strcpy(spitzkbd->phys, "spitzkbd/input0");
-
-        spin_lock_init(&spitzkbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&spitzkbd->timer);
-        spitzkbd->timer.function = spitzkbd_timer_callback;
-        spitzkbd->timer.data = (unsigned long) spitzkbd;
-
-        /* Init Hinge Timer */
-        init_timer(&spitzkbd->htimer);
-        spitzkbd->htimer.function = spitzkbd_hinge_timer;
-        spitzkbd->htimer.data = (unsigned long) spitzkbd;
-
-        spitzkbd->suspend_jiffies = jiffies;
-
-        spitzkbd->input = input_dev;
-
-        input_dev->name = "Spitz Keyboard";
-        input_dev->phys = spitzkbd->phys;
-        input_dev->dev.parent = &dev->dev;
-
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP) |
-                BIT_MASK(EV_PWR) | BIT_MASK(EV_SW);
-        input_dev->keycode = spitzkbd->keycode;
-        input_dev->keycodesize = sizeof(unsigned char);
-        input_dev->keycodemax = ARRAY_SIZE(spitzkbd_keycode);
-
-        memcpy(spitzkbd->keycode, spitzkbd_keycode, sizeof(spitzkbd->keycode));
-        for (i = 0; i < ARRAY_SIZE(spitzkbd_keycode); i++)
-                set_bit(spitzkbd->keycode[i], input_dev->keybit);
-        clear_bit(0, input_dev->keybit);
-        set_bit(KEY_SUSPEND, input_dev->keybit);
-        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
-
-        err = input_register_device(input_dev);
-        if (err)
-                goto fail;
-
-        mod_timer(&spitzkbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++) {
-                pxa_gpio_mode(spitz_senses[i] | GPIO_IN);
-                if (request_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd_interrupt,
-                                IRQF_DISABLED|IRQF_TRIGGER_RISING,
-                                "Spitzkbd Sense", spitzkbd))
-                        printk(KERN_WARNING "spitzkbd: Can't get Sense IRQ: %d!\n", i);
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < SPITZ_KEY_STROBE_NUM; i++)
-                pxa_gpio_mode(spitz_strobes[i] | GPIO_OUT | GPIO_DFLT_HIGH);
-
-        pxa_gpio_mode(SPITZ_GPIO_SYNC | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_ON_KEY | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_SWA | GPIO_IN);
-        pxa_gpio_mode(SPITZ_GPIO_SWB | GPIO_IN);
-
-        request_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd_interrupt,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd Sync", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd_interrupt,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd PwrOn", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd SWA", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd SWB", spitzkbd);
-        request_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd_hinge_isr,
-                    IRQF_DISABLED | IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-                    "Spitzkbd HP", spitzkbd);
-
-        return 0;
-
- fail:  input_free_device(input_dev);
-        kfree(spitzkbd);
-        return err;
-}
-
-static int __devexit spitzkbd_remove(struct platform_device *dev)
-{
-        int i;
-        struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < SPITZ_KEY_SENSE_NUM; i++)
-                free_irq(IRQ_GPIO(spitz_senses[i]), spitzkbd);
-
-        free_irq(SPITZ_IRQ_GPIO_SYNC, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd);
-        free_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd);
-
-        del_timer_sync(&spitzkbd->htimer);
-        del_timer_sync(&spitzkbd->timer);
-
-        input_unregister_device(spitzkbd->input);
-
-        kfree(spitzkbd);
-
-        return 0;
-}
-
-static struct platform_driver spitzkbd_driver = {
-        .probe          = spitzkbd_probe,
-        .remove         = __devexit_p(spitzkbd_remove),
-        .suspend        = spitzkbd_suspend,
-        .resume         = spitzkbd_resume,
-        .driver         = {
-                .name   = "spitz-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init spitzkbd_init(void)
-{
-        return platform_driver_register(&spitzkbd_driver);
-}
-
-static void __exit spitzkbd_exit(void)
-{
-        platform_driver_unregister(&spitzkbd_driver);
-}
-
-module_init(spitzkbd_init);
-module_exit(spitzkbd_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Spitz Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:spitz-keyboard");
diff --git a/drivers/input/keyboard/tosakbd.c b/drivers/input/keyboard/tosakbd.c
deleted file mode 100644
index 3910f269cfc8..000000000000
--- a/drivers/input/keyboard/tosakbd.c
+++ /dev/null
@@ -1,431 +0,0 @@
-/*
- *  Keyboard driver for Sharp Tosa models (SL-6000x)
- *
- *  Copyright (c) 2005 Dirk Opfer
- *  Copyright (c) 2007 Dmitry Baryshkov
- *
- *  Based on xtkbd.c/locomkbd.c/corgikbd.c
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/input.h>
-#include <linux/delay.h>
-#include <linux/interrupt.h>
-#include <linux/slab.h>
-
-#include <mach/gpio.h>
-#include <mach/tosa.h>
-
-#define KB_ROWMASK(r)           (1 << (r))
-#define SCANCODE(r, c)          (((r)<<4) + (c) + 1)
-#define NR_SCANCODES            SCANCODE(TOSA_KEY_SENSE_NUM - 1, TOSA_KEY_STROBE_NUM - 1) + 1
-
-#define SCAN_INTERVAL           (HZ/10)
-
-#define KB_DISCHARGE_DELAY      10
-#define KB_ACTIVATE_DELAY       10
-
-static unsigned short tosakbd_keycode[NR_SCANCODES] = {
-0,
-0, KEY_W, 0, 0, 0, KEY_K, KEY_BACKSPACE, KEY_P,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_Q, KEY_E, KEY_T, KEY_Y, 0, KEY_O, KEY_I, KEY_COMMA,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_A, KEY_D, KEY_G, KEY_U, 0, KEY_L, KEY_ENTER, KEY_DOT,
-0, 0, 0, 0, 0, 0, 0, 0,
-KEY_Z, KEY_C, KEY_V, KEY_J, TOSA_KEY_ADDRESSBOOK, TOSA_KEY_CANCEL, TOSA_KEY_CENTER, TOSA_KEY_OK,
-KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0, 0,
-KEY_S, KEY_R, KEY_B, KEY_N, TOSA_KEY_CALENDAR, TOSA_KEY_HOMEPAGE, KEY_LEFTCTRL, TOSA_KEY_LIGHT,
-0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,
-KEY_TAB, KEY_SLASH, KEY_H, KEY_M, TOSA_KEY_MENU, 0, KEY_UP, 0,
-0, 0, TOSA_KEY_FN, 0, 0, 0, 0, 0,
-KEY_X, KEY_F, KEY_SPACE, KEY_APOSTROPHE, TOSA_KEY_MAIL, KEY_LEFT, KEY_DOWN, KEY_RIGHT,
-0, 0, 0,
-};
-
-struct tosakbd {
-        unsigned short keycode[ARRAY_SIZE(tosakbd_keycode)];
-        struct input_dev *input;
-        bool suspended;
-        spinlock_t lock; /* protect kbd scanning */
-        struct timer_list timer;
-};
-
-
-/* Helper functions for reading the keyboard matrix
- * Note: We should really be using the generic gpio functions to alter
- *       GPDR but it requires a function call per GPIO bit which is
- *       excessive when we need to access 12 bits at once, multiple times.
- * These functions must be called within local_irq_save()/local_irq_restore()
- * or similar.
- */
-#define GET_ROWS_STATUS(c)      ((GPLR2 & TOSA_GPIO_ALL_SENSE_BIT) >> TOSA_GPIO_ALL_SENSE_RSHIFT)
-
-static inline void tosakbd_discharge_all(void)
-{
-        /* STROBE All HiZ */
-        GPCR1  = TOSA_GPIO_HIGH_STROBE_BIT;
-        GPDR1 &= ~TOSA_GPIO_HIGH_STROBE_BIT;
-        GPCR2  = TOSA_GPIO_LOW_STROBE_BIT;
-        GPDR2 &= ~TOSA_GPIO_LOW_STROBE_BIT;
-}
-
-static inline void tosakbd_activate_all(void)
-{
-        /* STROBE ALL -> High */
-        GPSR1  = TOSA_GPIO_HIGH_STROBE_BIT;
-        GPDR1 |= TOSA_GPIO_HIGH_STROBE_BIT;
-        GPSR2  = TOSA_GPIO_LOW_STROBE_BIT;
-        GPDR2 |= TOSA_GPIO_LOW_STROBE_BIT;
-
-        udelay(KB_DISCHARGE_DELAY);
-
-        /* STATE CLEAR */
-        GEDR2 |= TOSA_GPIO_ALL_SENSE_BIT;
-}
-
-static inline void tosakbd_activate_col(int col)
-{
-        if (col <= 5) {
-                /* STROBE col -> High, not col -> HiZ */
-                GPSR1 = TOSA_GPIO_STROBE_BIT(col);
-                GPDR1 = (GPDR1 & ~TOSA_GPIO_HIGH_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        } else {
-                /* STROBE col -> High, not col -> HiZ */
-                GPSR2 = TOSA_GPIO_STROBE_BIT(col);
-                GPDR2 = (GPDR2 & ~TOSA_GPIO_LOW_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        }
-}
-
-static inline void tosakbd_reset_col(int col)
-{
-        if (col <= 5) {
-                /* STROBE col -> Low */
-                GPCR1 = TOSA_GPIO_STROBE_BIT(col);
-                /* STROBE col -> out, not col -> HiZ */
-                GPDR1 = (GPDR1 & ~TOSA_GPIO_HIGH_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        } else {
-                /* STROBE col -> Low */
-                GPCR2 = TOSA_GPIO_STROBE_BIT(col);
-                /* STROBE col -> out, not col -> HiZ */
-                GPDR2 = (GPDR2 & ~TOSA_GPIO_LOW_STROBE_BIT) | TOSA_GPIO_STROBE_BIT(col);
-        }
-}
-/*
- * The tosa keyboard only generates interrupts when a key is pressed.
- * So when a key is pressed, we enable a timer.  This timer scans the
- * keyboard, and this is how we detect when the key is released.
- */
-
-/* Scan the hardware keyboard and push any changes up through the input layer */
-static void tosakbd_scankeyboard(struct platform_device *dev)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-        unsigned int row, col, rowd;
-        unsigned long flags;
-        unsigned int num_pressed = 0;
-
-        spin_lock_irqsave(&tosakbd->lock, flags);
-
-        if (tosakbd->suspended)
-                goto out;
-
-        for (col = 0; col < TOSA_KEY_STROBE_NUM; col++) {
-                /*
-                 * Discharge the output driver capacitatance
-                 * in the keyboard matrix. (Yes it is significant..)
-                 */
-                tosakbd_discharge_all();
-                udelay(KB_DISCHARGE_DELAY);
-
-                tosakbd_activate_col(col);
-                udelay(KB_ACTIVATE_DELAY);
-
-                rowd = GET_ROWS_STATUS(col);
-
-                for (row = 0; row < TOSA_KEY_SENSE_NUM; row++) {
-                        unsigned int scancode, pressed;
-                        scancode = SCANCODE(row, col);
-                        pressed = rowd & KB_ROWMASK(row);
-
-                        if (pressed && !tosakbd->keycode[scancode])
-                                dev_warn(&dev->dev,
-                                                "unhandled scancode: 0x%02x\n",
-                                                scancode);
-
-                        input_report_key(tosakbd->input,
-                                        tosakbd->keycode[scancode],
-                                        pressed);
-                        if (pressed)
-                                num_pressed++;
-                }
-
-                tosakbd_reset_col(col);
-        }
-
-        tosakbd_activate_all();
-
-        input_sync(tosakbd->input);
-
-        /* if any keys are pressed, enable the timer */
-        if (num_pressed)
-                mod_timer(&tosakbd->timer, jiffies + SCAN_INTERVAL);
-
- out:
-        spin_unlock_irqrestore(&tosakbd->lock, flags);
-}
-
-/*
- * tosa keyboard interrupt handler.
- */
-static irqreturn_t tosakbd_interrupt(int irq, void *__dev)
-{
-        struct platform_device *dev = __dev;
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        if (!timer_pending(&tosakbd->timer)) {
-                /** wait chattering delay **/
-                udelay(20);
-                tosakbd_scankeyboard(dev);
-        }
-
-        return IRQ_HANDLED;
-}
-
-/*
- * tosa timer checking for released keys
- */
-static void tosakbd_timer_callback(unsigned long __dev)
-{
-        struct platform_device *dev = (struct platform_device *)__dev;
-
-        tosakbd_scankeyboard(dev);
-}
-
-#ifdef CONFIG_PM
-static int tosakbd_suspend(struct platform_device *dev, pm_message_t state)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-        unsigned long flags;
-
-        spin_lock_irqsave(&tosakbd->lock, flags);
-        tosakbd->suspended = true;
-        spin_unlock_irqrestore(&tosakbd->lock, flags);
-
-        del_timer_sync(&tosakbd->timer);
-
-        return 0;
-}
-
-static int tosakbd_resume(struct platform_device *dev)
-{
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        tosakbd->suspended = false;
-        tosakbd_scankeyboard(dev);
-
-        return 0;
-}
-#else
-#define tosakbd_suspend         NULL
-#define tosakbd_resume          NULL
-#endif
-
-static int __devinit tosakbd_probe(struct platform_device *pdev) {
-
-        int i;
-        struct tosakbd *tosakbd;
-        struct input_dev *input_dev;
-        int error;
-
-        tosakbd = kzalloc(sizeof(struct tosakbd), GFP_KERNEL);
-        if (!tosakbd)
-                return -ENOMEM;
-
-        input_dev = input_allocate_device();
-        if (!input_dev) {
-                kfree(tosakbd);
-                return -ENOMEM;
-        }
-
-        platform_set_drvdata(pdev, tosakbd);
-
-        spin_lock_init(&tosakbd->lock);
-
-        /* Init Keyboard rescan timer */
-        init_timer(&tosakbd->timer);
-        tosakbd->timer.function = tosakbd_timer_callback;
-        tosakbd->timer.data = (unsigned long) pdev;
-
-        tosakbd->input = input_dev;
-
-        input_set_drvdata(input_dev, tosakbd);
-        input_dev->name = "Tosa Keyboard";
-        input_dev->phys = "tosakbd/input0";
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0001;
-        input_dev->id.version = 0x0100;
-
-        input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
-        input_dev->keycode = tosakbd->keycode;
-        input_dev->keycodesize = sizeof(tosakbd->keycode[0]);
-        input_dev->keycodemax = ARRAY_SIZE(tosakbd_keycode);
-
-        memcpy(tosakbd->keycode, tosakbd_keycode, sizeof(tosakbd_keycode));
-
-        for (i = 0; i < ARRAY_SIZE(tosakbd_keycode); i++)
-                __set_bit(tosakbd->keycode[i], input_dev->keybit);
-        __clear_bit(KEY_RESERVED, input_dev->keybit);
-
-        /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
-        for (i = 0; i < TOSA_KEY_SENSE_NUM; i++) {
-                int gpio = TOSA_GPIO_KEY_SENSE(i);
-                int irq;
-                error = gpio_request(gpio, "tosakbd");
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to request GPIO %d, "
-                                " error %d\n", gpio, error);
-                        goto fail;
-                }
-
-                error = gpio_direction_input(TOSA_GPIO_KEY_SENSE(i));
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to configure input"
-                                " direction for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-
-                irq = gpio_to_irq(gpio);
-                if (irq < 0) {
-                        error = irq;
-                        printk(KERN_ERR "gpio-keys: Unable to get irq number"
-                                " for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-
-                error = request_irq(irq, tosakbd_interrupt,
-                                        IRQF_DISABLED | IRQF_TRIGGER_RISING,
-                                        "tosakbd", pdev);
-
-                if (error) {
-                        printk("tosakbd: Can't get IRQ: %d: error %d!\n",
-                                        irq, error);
-                        gpio_free(gpio);
-                        goto fail;
-                }
-        }
-
-        /* Set Strobe lines as outputs - set high */
-        for (i = 0; i < TOSA_KEY_STROBE_NUM; i++) {
-                int gpio = TOSA_GPIO_KEY_STROBE(i);
-                error = gpio_request(gpio, "tosakbd");
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to request GPIO %d, "
-                                " error %d\n", gpio, error);
-                        goto fail2;
-                }
-
-                error = gpio_direction_output(gpio, 1);
-                if (error < 0) {
-                        printk(KERN_ERR "tosakbd: failed to configure input"
-                                " direction for GPIO %d, error %d\n",
-                                gpio, error);
-                        gpio_free(gpio);
-                        goto fail2;
-                }
-
-        }
-
-        error = input_register_device(input_dev);
-        if (error) {
-                printk(KERN_ERR "tosakbd: Unable to register input device, "
-                        "error: %d\n", error);
-                goto fail2;
-        }
-
-        printk(KERN_INFO "input: Tosa Keyboard Registered\n");
-
-        return 0;
-
-fail2:
-        while (--i >= 0)
-                gpio_free(TOSA_GPIO_KEY_STROBE(i));
-
-        i = TOSA_KEY_SENSE_NUM;
-fail:
-        while (--i >= 0) {
-                free_irq(gpio_to_irq(TOSA_GPIO_KEY_SENSE(i)), pdev);
-                gpio_free(TOSA_GPIO_KEY_SENSE(i));
-        }
-
-        platform_set_drvdata(pdev, NULL);
-        input_free_device(input_dev);
-        kfree(tosakbd);
-
-        return error;
-}
-
-static int __devexit tosakbd_remove(struct platform_device *dev)
-{
-        int i;
-        struct tosakbd *tosakbd = platform_get_drvdata(dev);
-
-        for (i = 0; i < TOSA_KEY_STROBE_NUM; i++)
-                gpio_free(TOSA_GPIO_KEY_STROBE(i));
-
-        for (i = 0; i < TOSA_KEY_SENSE_NUM; i++) {
-                free_irq(gpio_to_irq(TOSA_GPIO_KEY_SENSE(i)), dev);
-                gpio_free(TOSA_GPIO_KEY_SENSE(i));
-        }
-
-        del_timer_sync(&tosakbd->timer);
-
-        input_unregister_device(tosakbd->input);
-
-        kfree(tosakbd);
-
-        return 0;
-}
-
-static struct platform_driver tosakbd_driver = {
-        .probe          = tosakbd_probe,
-        .remove         = __devexit_p(tosakbd_remove),
-        .suspend        = tosakbd_suspend,
-        .resume         = tosakbd_resume,
-        .driver         = {
-                .name   = "tosa-keyboard",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __devinit tosakbd_init(void)
-{
-        return platform_driver_register(&tosakbd_driver);
-}
-
-static void __exit tosakbd_exit(void)
-{
-        platform_driver_unregister(&tosakbd_driver);
-}
-
-module_init(tosakbd_init);
-module_exit(tosakbd_exit);
-
-MODULE_AUTHOR("Dirk Opfer <Dirk@Opfer-Online.de>");
-MODULE_DESCRIPTION("Tosa Keyboard Driver");
-MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:tosa-keyboard");
diff --git a/drivers/input/misc/ati_remote.c b/drivers/input/misc/ati_remote.c
index 614b65d78fe9..e8bbc619f6df 100644
--- a/drivers/input/misc/ati_remote.c
+++ b/drivers/input/misc/ati_remote.c
@@ -98,10 +98,12 @@
  * Module and Version Information, Module Parameters
  */
 
-#define ATI_REMOTE_VENDOR_ID    0x0bc7
-#define ATI_REMOTE_PRODUCT_ID   0x004
-#define LOLA_REMOTE_PRODUCT_ID  0x002
-#define MEDION_REMOTE_PRODUCT_ID 0x006
+#define ATI_REMOTE_VENDOR_ID            0x0bc7
+#define LOLA_REMOTE_PRODUCT_ID          0x0002
+#define LOLA2_REMOTE_PRODUCT_ID         0x0003
+#define ATI_REMOTE_PRODUCT_ID           0x0004
+#define NVIDIA_REMOTE_PRODUCT_ID        0x0005
+#define MEDION_REMOTE_PRODUCT_ID        0x0006
 
 #define DRIVER_VERSION          "2.2.1"
 #define DRIVER_AUTHOR           "Torrey Hoffman <thoffman@arnor.net>"
@@ -142,8 +144,10 @@ MODULE_PARM_DESC(repeat_delay, "Delay before sending repeats, default = 500 msec
 #define err(format, arg...) printk(KERN_ERR format , ## arg)
 
 static struct usb_device_id ati_remote_table[] = {
-        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
         { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA2_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, NVIDIA_REMOTE_PRODUCT_ID) },
         { USB_DEVICE(ATI_REMOTE_VENDOR_ID, MEDION_REMOTE_PRODUCT_ID) },
         {}      /* Terminating entry */
 };
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index ea4e1fd12651..f080dd31499b 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -30,7 +30,7 @@ MODULE_ALIAS("platform:pcspkr");
 #include <asm/i8253.h>
 #else
 #include <asm/8253pit.h>
-static DEFINE_SPINLOCK(i8253_lock);
+static DEFINE_RAW_SPINLOCK(i8253_lock);
 #endif
 
 static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
@@ -50,7 +50,7 @@ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int c
         if (value > 20 && value < 32767)
                 count = PIT_TICK_RATE / value;
 
-        spin_lock_irqsave(&i8253_lock, flags);
+        raw_spin_lock_irqsave(&i8253_lock, flags);
 
         if (count) {
                 /* set command for counter 2, 2 byte write */
@@ -65,7 +65,7 @@ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int c
                 outb(inb_p(0x61) & 0xFC, 0x61);
         }
 
-        spin_unlock_irqrestore(&i8253_lock, flags);
+        raw_spin_unlock_irqrestore(&i8253_lock, flags);
 
         return 0;
 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0d22cb9ce42e..99d58764ef03 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -64,7 +64,6 @@ static const struct alps_model_info alps_model_data[] = {
         { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
         { { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },          /* Dell Vostro 1400 */
-        { { 0x73, 0x02, 0x64 }, 0xf8, 0xf8, 0 },                          /* HP Pavilion dm3 */
         { { 0x52, 0x01, 0x14 }, 0xff, 0xff,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },      /* Toshiba Tecra A11-11L */
 };
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index a138b5da79f9..112b4ee52ff2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -25,6 +25,10 @@
                         printk(KERN_DEBUG format, ##arg);       \
         } while (0)
 
+static bool force_elantech;
+module_param_named(force_elantech, force_elantech, bool, 0644);
+MODULE_PARM_DESC(force_elantech, "Force the Elantech PS/2 protocol extension to be used, 1 = enabled, 0 = disabled (default).");
+
 /*
  * Send a Synaptics style sliced query command
  */
@@ -181,14 +185,18 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         int fingers;
         static int old_fingers;
 
-        if (etd->fw_version_maj == 0x01) {
-                /* byte 0:  D   U  p1  p2   1  p3   R   L
-                   byte 1:  f   0  th  tw  x9  x8  y9  y8 */
+        if (etd->fw_version < 0x020000) {
+                /*
+                 * byte 0:  D   U  p1  p2   1  p3   R   L
+                 * byte 1:  f   0  th  tw  x9  x8  y9  y8
+                 */
                 fingers = ((packet[1] & 0x80) >> 7) +
                                 ((packet[1] & 0x30) >> 4);
         } else {
-                /* byte 0: n1  n0  p2  p1   1  p3   R   L
-                   byte 1:  0   0   0   0  x9  x8  y9  y8 */
+                /*
+                 * byte 0: n1  n0  p2  p1   1  p3   R   L
+                 * byte 1:  0   0   0   0  x9  x8  y9  y8
+                 */
                 fingers = (packet[0] & 0xc0) >> 6;
         }
 
@@ -202,13 +210,15 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
 
         input_report_key(dev, BTN_TOUCH, fingers != 0);
 
-        /* byte 2: x7  x6  x5  x4  x3  x2  x1  x0
-           byte 3: y7  y6  y5  y4  y3  y2  y1  y0 */
+        /*
+         * byte 2: x7  x6  x5  x4  x3  x2  x1  x0
+         * byte 3: y7  y6  y5  y4  y3  y2  y1  y0
+         */
         if (fingers) {
                 input_report_abs(dev, ABS_X,
                         ((packet[1] & 0x0c) << 6) | packet[2]);
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V1 -
-                        (((packet[1] & 0x03) << 8) | packet[3]));
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V1 - (((packet[1] & 0x03) << 8) | packet[3]));
         }
 
         input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
@@ -217,7 +227,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
         input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
         input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
 
-        if ((etd->fw_version_maj == 0x01) &&
+        if (etd->fw_version < 0x020000 &&
             (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                 /* rocker up */
                 input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
@@ -247,34 +257,47 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
 
         switch (fingers) {
         case 1:
-                /* byte 1: x15 x14 x13 x12 x11 x10 x9  x8
-                   byte 2: x7  x6  x5  x4  x4  x2  x1  x0 */
-                input_report_abs(dev, ABS_X, (packet[1] << 8) | packet[2]);
-                /* byte 4: y15 y14 y13 y12 y11 y10 y8  y8
-                   byte 5: y7  y6  y5  y4  y3  y2  y1  y0 */
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V2 -
-                        ((packet[4] << 8) | packet[5]));
+                /*
+                 * byte 1:  .   .   .   .   .  x10 x9  x8
+                 * byte 2: x7  x6  x5  x4  x4  x2  x1  x0
+                 */
+                input_report_abs(dev, ABS_X,
+                        ((packet[1] & 0x07) << 8) | packet[2]);
+                /*
+                 * byte 4:  .   .   .   .   .   .  y9  y8
+                 * byte 5: y7  y6  y5  y4  y3  y2  y1  y0
+                 */
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V2 - (((packet[4] & 0x03) << 8) | packet[5]));
                 break;
 
         case 2:
-                /* The coordinate of each finger is reported separately with
-                   a lower resolution for two finger touches */
-                /* byte 0:  .   .  ay8 ax8  .   .   .   .
-                   byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0 */
+                /*
+                 * The coordinate of each finger is reported separately
+                 * with a lower resolution for two finger touches:
+                 * byte 0:  .   .  ay8 ax8  .   .   .   .
+                 * byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0
+                 */
                 x1 = ((packet[0] & 0x10) << 4) | packet[1];
                 /* byte 2: ay7 ay6 ay5 ay4 ay3 ay2 ay1 ay0 */
                 y1 = ETP_2FT_YMAX - (((packet[0] & 0x20) << 3) | packet[2]);
-                /* byte 3:  .   .  by8 bx8  .   .   .   .
-                   byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0 */
+                /*
+                 * byte 3:  .   .  by8 bx8  .   .   .   .
+                 * byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0
+                 */
                 x2 = ((packet[3] & 0x10) << 4) | packet[4];
                 /* byte 5: by7 by8 by5 by4 by3 by2 by1 by0 */
                 y2 = ETP_2FT_YMAX - (((packet[3] & 0x20) << 3) | packet[5]);
-                /* For compatibility with the X Synaptics driver scale up one
-                   coordinate and report as ordinary mouse movent */
+                /*
+                 * For compatibility with the X Synaptics driver scale up
+                 * one coordinate and report as ordinary mouse movent
+                 */
                 input_report_abs(dev, ABS_X, x1 << 2);
                 input_report_abs(dev, ABS_Y, y1 << 2);
-                /* For compatibility with the proprietary X Elantech driver
-                   report both coordinates as hat coordinates */
+                /*
+                 * For compatibility with the proprietary X Elantech driver
+                 * report both coordinates as hat coordinates
+                 */
                 input_report_abs(dev, ABS_HAT0X, x1);
                 input_report_abs(dev, ABS_HAT0Y, y1);
                 input_report_abs(dev, ABS_HAT1X, x2);
@@ -298,7 +321,7 @@ static int elantech_check_parity_v1(struct psmouse *psmouse)
         unsigned char p1, p2, p3;
 
         /* Parity bits are placed differently */
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                 /* byte 0:  D   U  p1  p2   1  p3   R   L */
                 p1 = (packet[0] & 0x20) >> 5;
                 p2 = (packet[0] & 0x10) >> 4;
@@ -434,7 +457,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
         switch (etd->hw_version) {
         case 1:
                 /* Rocker button */
-                if ((etd->fw_version_maj == 0x01) &&
+                if (etd->fw_version < 0x020000 &&
                     (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                         __set_bit(BTN_FORWARD, dev->keybit);
                         __set_bit(BTN_BACK, dev->keybit);
@@ -596,8 +619,12 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
                  param[0], param[1], param[2]);
 
         if (param[0] == 0 || param[1] != 0) {
-                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
-                return -1;
+                if (!force_elantech) {
+                        pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+                        return -1;
+                }
+
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Enabling anyway due to force_elantech.\n");
         }
 
         if (set_properties) {
@@ -659,14 +686,14 @@ int elantech_init(struct psmouse *psmouse)
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        etd->fw_version_maj = param[0];
-        etd->fw_version_min = param[2];
+
+        etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
 
         /*
          * Assume every version greater than this is new EeePC style
          * hardware with 6 byte packets
          */
-        if (etd->fw_version_maj >= 0x02 && etd->fw_version_min >= 0x30) {
+        if (etd->fw_version >= 0x020030) {
                 etd->hw_version = 2;
                 /* For now show extra debug information */
                 etd->debug = 1;
@@ -676,8 +703,9 @@ int elantech_init(struct psmouse *psmouse)
                 etd->hw_version = 1;
                 etd->paritycheck = 1;
         }
-        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
-                etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
+
+        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
+                etd->hw_version, param[0], param[1], param[2]);
 
         if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
                 pr_err("elantech.c: failed to query capabilities.\n");
@@ -692,8 +720,8 @@ int elantech_init(struct psmouse *psmouse)
          * a touch action starts causing the mouse cursor or scrolled page
          * to jump. Enable a workaround.
          */
-        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
-                pr_info("elantech.c: firmware version 2.34 detected, "
+        if (etd->fw_version == 0x020022) {
+                pr_info("elantech.c: firmware version 2.0.34 detected, "
                         "enabling jumpy cursor workaround\n");
                 etd->jumpy_cursor = 1;
         }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index feac5f7af966..ac57bde1bb9f 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,11 +100,10 @@ struct elantech_data {
         unsigned char reg_26;
         unsigned char debug;
         unsigned char capabilities;
-        unsigned char fw_version_maj;
-        unsigned char fw_version_min;
-        unsigned char hw_version;
         unsigned char paritycheck;
         unsigned char jumpy_cursor;
+        unsigned char hw_version;
+        unsigned int  fw_version;
         unsigned char parity[256];
 };
 
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index d8c0c8d6992c..a3c97315a473 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -110,6 +110,7 @@ static struct workqueue_struct *kpsmoused_wq;
 struct psmouse_protocol {
         enum psmouse_type type;
         bool maxproto;
+        bool ignore_parity; /* Protocol should ignore parity errors from KBC */
         const char *name;
         const char *alias;
         int (*detect)(struct psmouse *, bool);
@@ -288,7 +289,9 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
         if (psmouse->state == PSMOUSE_IGNORE)
                 goto out;
 
-        if (flags & (SERIO_PARITY|SERIO_TIMEOUT)) {
+        if (unlikely((flags & SERIO_TIMEOUT) ||
+                     ((flags & SERIO_PARITY) && !psmouse->ignore_parity))) {
+
                 if (psmouse->state == PSMOUSE_ACTIVATED)
                         printk(KERN_WARNING "psmouse.c: bad data from KBC -%s%s\n",
                                 flags & SERIO_TIMEOUT ? " timeout" : "",
@@ -759,6 +762,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "PS/2",
                 .alias          = "bare",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = ps2bare_detect,
         },
 #ifdef CONFIG_MOUSE_PS2_LOGIPS2PP
@@ -786,6 +790,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "ImPS/2",
                 .alias          = "imps",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = intellimouse_detect,
         },
         {
@@ -793,6 +798,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                 .name           = "ImExPS/2",
                 .alias          = "exps",
                 .maxproto       = true,
+                .ignore_parity  = true,
                 .detect         = im_explorer_detect,
         },
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
@@ -1222,6 +1228,7 @@ static void psmouse_disconnect(struct serio *serio)
 static int psmouse_switch_protocol(struct psmouse *psmouse,
                                    const struct psmouse_protocol *proto)
 {
+        const struct psmouse_protocol *selected_proto;
         struct input_dev *input_dev = psmouse->dev;
 
         input_dev->dev.parent = &psmouse->ps2dev.serio->dev;
@@ -1245,9 +1252,14 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                         return -1;
 
                 psmouse->type = proto->type;
-        } else
+                selected_proto = proto;
+        } else {
                 psmouse->type = psmouse_extensions(psmouse,
                                                    psmouse_max_proto, true);
+                selected_proto = psmouse_protocol_by_type(psmouse->type);
+        }
+
+        psmouse->ignore_parity = selected_proto->ignore_parity;
 
         /*
          * If mouse's packet size is 3 there is no point in polling the
@@ -1267,7 +1279,7 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                 psmouse->resync_time = 0;
 
         snprintf(psmouse->devname, sizeof(psmouse->devname), "%s %s %s",
-                 psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
+                 selected_proto->name, psmouse->vendor, psmouse->name);
 
         input_dev->name = psmouse->devname;
         input_dev->phys = psmouse->phys;
@@ -1382,6 +1394,7 @@ static int psmouse_reconnect(struct serio *serio)
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
         struct serio_driver *drv = serio->drv;
+        unsigned char type;
         int rc = -1;
 
         if (!drv || !psmouse) {
@@ -1401,10 +1414,15 @@ static int psmouse_reconnect(struct serio *serio)
         if (psmouse->reconnect) {
                 if (psmouse->reconnect(psmouse))
                         goto out;
-        } else if (psmouse_probe(psmouse) < 0 ||
-                   psmouse->type != psmouse_extensions(psmouse,
-                                                psmouse_max_proto, false)) {
-                goto out;
+        } else {
+                psmouse_reset(psmouse);
+
+                if (psmouse_probe(psmouse) < 0)
+                        goto out;
+
+                type = psmouse_extensions(psmouse, psmouse_max_proto, false);
+                if (psmouse->type != type)
+                        goto out;
         }
 
         /* ok, the device type (and capabilities) match the old one,
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index e053bdd137ff..593e910bfc7a 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -47,6 +47,7 @@ struct psmouse {
         unsigned char pktcnt;
         unsigned char pktsize;
         unsigned char type;
+        bool ignore_parity;
         bool acks_disable_command;
         unsigned int model;
         unsigned long last;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 026df6010161..ebd7a99efeae 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -137,7 +137,8 @@ static int synaptics_capability(struct psmouse *psmouse)
         if (synaptics_send_cmd(psmouse, SYN_QUE_CAPABILITIES, cap))
                 return -1;
         priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
-        priv->ext_cap = 0;
+        priv->ext_cap = priv->ext_cap_0c = 0;
+
         if (!SYN_CAP_VALID(priv->capabilities))
                 return -1;
 
@@ -150,7 +151,7 @@ static int synaptics_capability(struct psmouse *psmouse)
         if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 1) {
                 if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB, cap)) {
                         printk(KERN_ERR "Synaptics claims to have extended capabilities,"
-                               " but I'm not able to read them.");
+                               " but I'm not able to read them.\n");
                 } else {
                         priv->ext_cap = (cap[0] << 16) | (cap[1] << 8) | cap[2];
 
@@ -162,6 +163,16 @@ static int synaptics_capability(struct psmouse *psmouse)
                                 priv->ext_cap &= 0xff0fff;
                 }
         }
+
+        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 4) {
+                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB_0C, cap)) {
+                        printk(KERN_ERR "Synaptics claims to have extended capability 0x0c,"
+                               " but I'm not able to read it.\n");
+                } else {
+                        priv->ext_cap_0c = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+                }
+        }
+
         return 0;
 }
 
@@ -348,7 +359,15 @@ static void synaptics_parse_hw_state(unsigned char buf[], struct synaptics_data
                 hw->left  = (buf[0] & 0x01) ? 1 : 0;
                 hw->right = (buf[0] & 0x02) ? 1 : 0;
 
-                if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
+                if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                        /*
+                         * Clickpad's button is transmitted as middle button,
+                         * however, since it is primary button, we will report
+                         * it as BTN_LEFT.
+                         */
+                        hw->left = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
+
+                } else if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
                         hw->middle = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
                         if (hw->w == 2)
                                 hw->scroll = (signed char)(buf[1]);
@@ -593,6 +612,12 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
 
         dev->absres[ABS_X] = priv->x_res;
         dev->absres[ABS_Y] = priv->y_res;
+
+        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                /* Clickpads report only left button */
+                __clear_bit(BTN_RIGHT, dev->keybit);
+                __clear_bit(BTN_MIDDLE, dev->keybit);
+        }
 }
 
 static void synaptics_disconnect(struct psmouse *psmouse)
@@ -697,10 +722,10 @@ int synaptics_init(struct psmouse *psmouse)
 
         priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
 
-        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx\n",
+        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx\n",
                 SYN_ID_MODEL(priv->identity),
                 SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
-                priv->model_id, priv->capabilities, priv->ext_cap);
+                priv->model_id, priv->capabilities, priv->ext_cap, priv->ext_cap_0c);
 
         set_input_params(psmouse->dev, priv);
 
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index f0f40a331dc8..ae37c5d162a4 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -18,6 +18,7 @@
 #define SYN_QUE_SERIAL_NUMBER_SUFFIX    0x07
 #define SYN_QUE_RESOLUTION              0x08
 #define SYN_QUE_EXT_CAPAB               0x09
+#define SYN_QUE_EXT_CAPAB_0C            0x0c
 
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -48,6 +49,8 @@
 #define SYN_CAP_VALID(c)                ((((c) & 0x00ff00) >> 8) == 0x47)
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
+#define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
 
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
@@ -96,6 +99,7 @@ struct synaptics_data {
         unsigned long int model_id;             /* Model-ID */
         unsigned long int capabilities;         /* Capabilities */
         unsigned long int ext_cap;              /* Extended Capabilities */
+        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
         unsigned long int identity;             /* Identification */
         int x_res;                              /* X resolution in units/mm */
         int y_res;                              /* Y resolution in units/mm */
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 8a8fa4d2d6a8..6c0f1712f55b 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -99,22 +99,6 @@ config TOUCHSCREEN_BITSY
           To compile this driver as a module, choose M here: the
           module will be called h3600_ts_input.
 
-config TOUCHSCREEN_CORGI
-        tristate "SharpSL (Corgi and Spitz series) touchscreen driver (DEPRECATED)"
-        depends on PXA_SHARPSL
-        select CORGI_SSP_DEPRECATED
-        help
-          Say Y here to enable the driver for the touchscreen on the
-          Sharp SL-C7xx and SL-Cxx00 series of PDAs.
-
-          If unsure, say N.
-
-          To compile this driver as a module, choose M here: the
-          module will be called corgi_ts.
-
-          NOTE: this driver is deprecated, try enable SPI and generic
-          ADS7846-based touchscreen driver.
-
 config TOUCHSCREEN_DA9034
         tristate "Touchscreen support for Dialog Semiconductor DA9034"
         depends on PMIC_DA903X
@@ -158,8 +142,8 @@ config TOUCHSCREEN_FUJITSU
           module will be called fujitsu-ts.
 
 config TOUCHSCREEN_S3C2410
-        tristate "Samsung S3C2410 touchscreen input driver"
-        depends on ARCH_S3C2410
+        tristate "Samsung S3C2410/generic touchscreen input driver"
+        depends on ARCH_S3C2410 || SAMSUNG_DEV_TS
         select S3C24XX_ADC
         help
           Say Y here if you have the s3c2410 touchscreen.
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 7fef7d5cca23..41145d074dec 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_TOUCHSCREEN_AD7879)	+= ad7879.o
 obj-$(CONFIG_TOUCHSCREEN_ADS7846)       += ads7846.o
 obj-$(CONFIG_TOUCHSCREEN_ATMEL_TSADCC)  += atmel_tsadcc.o
 obj-$(CONFIG_TOUCHSCREEN_BITSY)         += h3600_ts_input.o
-obj-$(CONFIG_TOUCHSCREEN_CORGI)         += corgi_ts.o
 obj-$(CONFIG_TOUCHSCREEN_DYNAPRO)       += dynapro.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE)         += gunze.o
 obj-$(CONFIG_TOUCHSCREEN_EETI)          += eeti_ts.o
diff --git a/drivers/input/touchscreen/ad7877.c b/drivers/input/touchscreen/ad7877.c
index e019d53d1ab4..0d2d7e54b465 100644
--- a/drivers/input/touchscreen/ad7877.c
+++ b/drivers/input/touchscreen/ad7877.c
@@ -156,9 +156,14 @@ struct ser_req {
         u16                     reset;
         u16                     ref_on;
         u16                     command;
-        u16                     sample;
         struct spi_message      msg;
         struct spi_transfer     xfer[6];
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 sample ____cacheline_aligned;
 };
 
 struct ad7877 {
@@ -182,8 +187,6 @@ struct ad7877 {
         u8                      averaging;
         u8                      pen_down_acc_interval;
 
-        u16                     conversion_data[AD7877_NR_SENSE];
-
         struct spi_transfer     xfer[AD7877_NR_SENSE + 2];
         struct spi_message      msg;
 
@@ -195,6 +198,12 @@ struct ad7877 {
         spinlock_t              lock;
         struct timer_list       timer;          /* P: lock */
         unsigned                pending:1;      /* P: lock */
+
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 conversion_data[AD7877_NR_SENSE] ____cacheline_aligned;
 };
 
 static int gpio3;
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
deleted file mode 100644
index 94a1919d439d..000000000000
--- a/drivers/input/touchscreen/corgi_ts.c
+++ /dev/null
@@ -1,385 +0,0 @@
-/*
- *  Touchscreen driver for Sharp SL-C7xx and SL-Cxx00 models
- *
- *  Copyright (c) 2004-2005 Richard Purdie
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2 as
- *  published by the Free Software Foundation.
- *
- */
-
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/init.h>
-#include <linux/input.h>
-#include <linux/interrupt.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/irq.h>
-
-#include <mach/sharpsl.h>
-#include <mach/hardware.h>
-#include <mach/pxa2xx-gpio.h>
-
-
-#define PWR_MODE_ACTIVE         0
-#define PWR_MODE_SUSPEND        1
-
-#define X_AXIS_MAX              3830
-#define X_AXIS_MIN              150
-#define Y_AXIS_MAX              3830
-#define Y_AXIS_MIN              190
-#define PRESSURE_MIN            0
-#define PRESSURE_MAX            15000
-
-struct ts_event {
-        short pressure;
-        short x;
-        short y;
-};
-
-struct corgi_ts {
-        struct input_dev *input;
-        struct timer_list timer;
-        struct ts_event tc;
-        int pendown;
-        int power_mode;
-        int irq_gpio;
-        struct corgits_machinfo *machinfo;
-};
-
-#ifdef CONFIG_PXA25x
-#define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C0, 0" : "=r"(a))
-#define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C0, 0" : "=r"(x))
-#define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C0, 0" : : "r"(x))
-#endif
-#ifdef CONFIG_PXA27x
-#define CCNT(a)         asm volatile ("mrc p14, 0, %0, C1, C1, 0" : "=r"(a))
-#define PMNC_GET(x)     asm volatile ("mrc p14, 0, %0, C0, C1, 0" : "=r"(x))
-#define PMNC_SET(x)     asm volatile ("mcr p14, 0, %0, C0, C1, 0" : : "r"(x))
-#endif
-
-/* ADS7846 Touch Screen Controller bit definitions */
-#define ADSCTRL_PD0             (1u << 0)       /* PD0 */
-#define ADSCTRL_PD1             (1u << 1)       /* PD1 */
-#define ADSCTRL_DFR             (1u << 2)       /* SER/DFR */
-#define ADSCTRL_MOD             (1u << 3)       /* Mode */
-#define ADSCTRL_ADR_SH  4       /* Address setting */
-#define ADSCTRL_STS             (1u << 7)       /* Start Bit */
-
-/* External Functions */
-extern unsigned int get_clk_frequency_khz(int info);
-
-static unsigned long calc_waittime(struct corgi_ts *corgi_ts)
-{
-        unsigned long hsync_invperiod = corgi_ts->machinfo->get_hsync_invperiod();
-
-        if (hsync_invperiod)
-                return get_clk_frequency_khz(0)*1000/hsync_invperiod;
-        else
-                return 0;
-}
-
-static int sync_receive_data_send_cmd(struct corgi_ts *corgi_ts, int doRecive, int doSend,
-                unsigned int address, unsigned long wait_time)
-{
-        unsigned long timer1 = 0, timer2, pmnc = 0;
-        int pos = 0;
-
-        if (wait_time && doSend) {
-                PMNC_GET(pmnc);
-                if (!(pmnc & 0x01))
-                        PMNC_SET(0x01);
-
-                /* polling HSync */
-                corgi_ts->machinfo->wait_hsync();
-                /* get CCNT */
-                CCNT(timer1);
-        }
-
-        if (doRecive)
-                pos = corgi_ssp_ads7846_get();
-
-        if (doSend) {
-                int cmd = ADSCTRL_PD0 | ADSCTRL_PD1 | (address << ADSCTRL_ADR_SH) | ADSCTRL_STS;
-                /* dummy command */
-                corgi_ssp_ads7846_put(cmd);
-                corgi_ssp_ads7846_get();
-
-                if (wait_time) {
-                        /* Wait after HSync */
-                        CCNT(timer2);
-                        if (timer2-timer1 > wait_time) {
-                                /* too slow - timeout, try again */
-                                corgi_ts->machinfo->wait_hsync();
-                                /* get CCNT */
-                                CCNT(timer1);
-                                /* Wait after HSync */
-                                CCNT(timer2);
-                        }
-                        while (timer2 - timer1 < wait_time)
-                                CCNT(timer2);
-                }
-                corgi_ssp_ads7846_put(cmd);
-                if (wait_time && !(pmnc & 0x01))
-                        PMNC_SET(pmnc);
-        }
-        return pos;
-}
-
-static int read_xydata(struct corgi_ts *corgi_ts)
-{
-        unsigned int x, y, z1, z2;
-        unsigned long flags, wait_time;
-
-        /* critical section */
-        local_irq_save(flags);
-        corgi_ssp_ads7846_lock();
-        wait_time = calc_waittime(corgi_ts);
-
-        /* Y-axis */
-        sync_receive_data_send_cmd(corgi_ts, 0, 1, 1u, wait_time);
-
-        /* Y-axis */
-        sync_receive_data_send_cmd(corgi_ts, 1, 1, 1u, wait_time);
-
-        /* X-axis */
-        y = sync_receive_data_send_cmd(corgi_ts, 1, 1, 5u, wait_time);
-
-        /* Z1 */
-        x = sync_receive_data_send_cmd(corgi_ts, 1, 1, 3u, wait_time);
-
-        /* Z2 */
-        z1 = sync_receive_data_send_cmd(corgi_ts, 1, 1, 4u, wait_time);
-        z2 = sync_receive_data_send_cmd(corgi_ts, 1, 0, 4u, wait_time);
-
-        /* Power-Down Enable */
-        corgi_ssp_ads7846_put((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        corgi_ssp_ads7846_get();
-
-        corgi_ssp_ads7846_unlock();
-        local_irq_restore(flags);
-
-        if (x== 0 || y == 0 || z1 == 0 || (x * (z2 - z1) / z1) >= 15000) {
-                corgi_ts->tc.pressure = 0;
-                return 0;
-        }
-
-        corgi_ts->tc.x = x;
-        corgi_ts->tc.y = y;
-        corgi_ts->tc.pressure = (x * (z2 - z1)) / z1;
-        return 1;
-}
-
-static void new_data(struct corgi_ts *corgi_ts)
-{
-        struct input_dev *dev = corgi_ts->input;
-
-        if (corgi_ts->power_mode != PWR_MODE_ACTIVE)
-                return;
-
-        if (!corgi_ts->tc.pressure && corgi_ts->pendown == 0)
-                return;
-
-        input_report_abs(dev, ABS_X, corgi_ts->tc.x);
-        input_report_abs(dev, ABS_Y, corgi_ts->tc.y);
-        input_report_abs(dev, ABS_PRESSURE, corgi_ts->tc.pressure);
-        input_report_key(dev, BTN_TOUCH, corgi_ts->pendown);
-        input_sync(dev);
-}
-
-static void ts_interrupt_main(struct corgi_ts *corgi_ts, int isTimer)
-{
-        if ((GPLR(IRQ_TO_GPIO(corgi_ts->irq_gpio)) & GPIO_bit(IRQ_TO_GPIO(corgi_ts->irq_gpio))) == 0) {
-                /* Disable Interrupt */
-                set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_NONE);
-                if (read_xydata(corgi_ts)) {
-                        corgi_ts->pendown = 1;
-                        new_data(corgi_ts);
-                }
-                mod_timer(&corgi_ts->timer, jiffies + HZ / 100);
-        } else {
-                if (corgi_ts->pendown == 1 || corgi_ts->pendown == 2) {
-                        mod_timer(&corgi_ts->timer, jiffies + HZ / 100);
-                        corgi_ts->pendown++;
-                        return;
-                }
-
-                if (corgi_ts->pendown) {
-                        corgi_ts->tc.pressure = 0;
-                        new_data(corgi_ts);
-                }
-
-                /* Enable Falling Edge */
-                set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-                corgi_ts->pendown = 0;
-        }
-}
-
-static void corgi_ts_timer(unsigned long data)
-{
-        struct corgi_ts *corgits_data = (struct corgi_ts *) data;
-
-        ts_interrupt_main(corgits_data, 1);
-}
-
-static irqreturn_t ts_interrupt(int irq, void *dev_id)
-{
-        struct corgi_ts *corgits_data = dev_id;
-
-        ts_interrupt_main(corgits_data, 0);
-        return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_PM
-static int corgits_suspend(struct platform_device *dev, pm_message_t state)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(dev);
-
-        if (corgi_ts->pendown) {
-                del_timer_sync(&corgi_ts->timer);
-                corgi_ts->tc.pressure = 0;
-                new_data(corgi_ts);
-                corgi_ts->pendown = 0;
-        }
-        corgi_ts->power_mode = PWR_MODE_SUSPEND;
-
-        corgi_ssp_ads7846_putget((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-
-        return 0;
-}
-
-static int corgits_resume(struct platform_device *dev)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(dev);
-
-        corgi_ssp_ads7846_putget((4u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        /* Enable Falling Edge */
-        set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-        corgi_ts->power_mode = PWR_MODE_ACTIVE;
-
-        return 0;
-}
-#else
-#define corgits_suspend         NULL
-#define corgits_resume          NULL
-#endif
-
-static int __devinit corgits_probe(struct platform_device *pdev)
-{
-        struct corgi_ts *corgi_ts;
-        struct input_dev *input_dev;
-        int err = -ENOMEM;
-
-        corgi_ts = kzalloc(sizeof(struct corgi_ts), GFP_KERNEL);
-        input_dev = input_allocate_device();
-        if (!corgi_ts || !input_dev)
-                goto fail1;
-
-        platform_set_drvdata(pdev, corgi_ts);
-
-        corgi_ts->machinfo = pdev->dev.platform_data;
-        corgi_ts->irq_gpio = platform_get_irq(pdev, 0);
-
-        if (corgi_ts->irq_gpio < 0) {
-                err = -ENODEV;
-                goto fail1;
-        }
-
-        corgi_ts->input = input_dev;
-
-        init_timer(&corgi_ts->timer);
-        corgi_ts->timer.data = (unsigned long) corgi_ts;
-        corgi_ts->timer.function = corgi_ts_timer;
-
-        input_dev->name = "Corgi Touchscreen";
-        input_dev->phys = "corgits/input0";
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0x0001;
-        input_dev->id.product = 0x0002;
-        input_dev->id.version = 0x0100;
-        input_dev->dev.parent = &pdev->dev;
-
-        input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-        input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
-        input_set_abs_params(input_dev, ABS_X, X_AXIS_MIN, X_AXIS_MAX, 0, 0);
-        input_set_abs_params(input_dev, ABS_Y, Y_AXIS_MIN, Y_AXIS_MAX, 0, 0);
-        input_set_abs_params(input_dev, ABS_PRESSURE, PRESSURE_MIN, PRESSURE_MAX, 0, 0);
-
-        pxa_gpio_mode(IRQ_TO_GPIO(corgi_ts->irq_gpio) | GPIO_IN);
-
-        /* Initiaize ADS7846 Difference Reference mode */
-        corgi_ssp_ads7846_putget((1u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((3u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((4u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-        corgi_ssp_ads7846_putget((5u << ADSCTRL_ADR_SH) | ADSCTRL_STS);
-        mdelay(5);
-
-        if (request_irq(corgi_ts->irq_gpio, ts_interrupt, IRQF_DISABLED, "ts", corgi_ts)) {
-                err = -EBUSY;
-                goto fail1;
-        }
-
-        err = input_register_device(corgi_ts->input);
-        if (err)
-                goto fail2;
-
-        corgi_ts->power_mode = PWR_MODE_ACTIVE;
-
-        /* Enable Falling Edge */
-        set_irq_type(corgi_ts->irq_gpio, IRQ_TYPE_EDGE_FALLING);
-
-        return 0;
-
- fail2: free_irq(corgi_ts->irq_gpio, corgi_ts);
- fail1: input_free_device(input_dev);
-        kfree(corgi_ts);
-        return err;
-}
-
-static int __devexit corgits_remove(struct platform_device *pdev)
-{
-        struct corgi_ts *corgi_ts = platform_get_drvdata(pdev);
-
-        free_irq(corgi_ts->irq_gpio, corgi_ts);
-        del_timer_sync(&corgi_ts->timer);
-        corgi_ts->machinfo->put_hsync();
-        input_unregister_device(corgi_ts->input);
-        kfree(corgi_ts);
-
-        return 0;
-}
-
-static struct platform_driver corgits_driver = {
-        .probe          = corgits_probe,
-        .remove         = __devexit_p(corgits_remove),
-        .suspend        = corgits_suspend,
-        .resume         = corgits_resume,
-        .driver         = {
-                .name   = "corgi-ts",
-                .owner  = THIS_MODULE,
-        },
-};
-
-static int __init corgits_init(void)
-{
-        return platform_driver_register(&corgits_driver);
-}
-
-static void __exit corgits_exit(void)
-{
-        platform_driver_unregister(&corgits_driver);
-}
-
-module_init(corgits_init);
-module_exit(corgits_exit);
-
-MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
-MODULE_DESCRIPTION("Corgi TouchScreen Driver");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:corgi-ts");
diff --git a/drivers/input/touchscreen/eeti_ts.c b/drivers/input/touchscreen/eeti_ts.c
index 204b8a1a601c..75f8b73010fa 100644
--- a/drivers/input/touchscreen/eeti_ts.c
+++ b/drivers/input/touchscreen/eeti_ts.c
@@ -124,14 +124,25 @@ static irqreturn_t eeti_ts_isr(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static int eeti_ts_open(struct input_dev *dev)
+static void eeti_ts_start(struct eeti_ts_priv *priv)
 {
-        struct eeti_ts_priv *priv = input_get_drvdata(dev);
-
         enable_irq(priv->irq);
 
         /* Read the events once to arm the IRQ */
         eeti_ts_read(&priv->work);
+}
+
+static void eeti_ts_stop(struct eeti_ts_priv *priv)
+{
+        disable_irq(priv->irq);
+        cancel_work_sync(&priv->work);
+}
+
+static int eeti_ts_open(struct input_dev *dev)
+{
+        struct eeti_ts_priv *priv = input_get_drvdata(dev);
+
+        eeti_ts_start(priv);
 
         return 0;
 }
@@ -140,8 +151,7 @@ static void eeti_ts_close(struct input_dev *dev)
 {
         struct eeti_ts_priv *priv = input_get_drvdata(dev);
 
-        disable_irq(priv->irq);
-        cancel_work_sync(&priv->work);
+        eeti_ts_stop(priv);
 }
 
 static int __devinit eeti_ts_probe(struct i2c_client *client,
@@ -153,10 +163,12 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
         unsigned int irq_flags;
         int err = -ENOMEM;
 
-        /* In contrast to what's described in the datasheet, there seems
+        /*
+         * In contrast to what's described in the datasheet, there seems
          * to be no way of probing the presence of that device using I2C
          * commands. So we need to blindly believe it is there, and wait
-         * for interrupts to occur. */
+         * for interrupts to occur.
+         */
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
@@ -212,9 +224,11 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
                 goto err2;
         }
 
-        /* Disable the irq for now. It will be enabled once the input device
-         * is opened. */
-        disable_irq(priv->irq);
+        /*
+         * Disable the device for now. It will be enabled once the
+         * input device is opened.
+         */
+        eeti_ts_stop(priv);
 
         device_init_wakeup(&client->dev, 0);
         return 0;
@@ -235,6 +249,12 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
 
         free_irq(priv->irq, priv);
+        /*
+         * eeti_ts_stop() leaves IRQ disabled. We need to re-enable it
+         * so that device still works if we reload the driver.
+         */
+        enable_irq(priv->irq);
+
         input_unregister_device(priv->input);
         i2c_set_clientdata(client, NULL);
         kfree(priv);
@@ -246,6 +266,14 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
 static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 {
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
+
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users)
+                eeti_ts_stop(priv);
+
+        mutex_unlock(&input_dev->mutex);
 
         if (device_may_wakeup(&client->dev))
                 enable_irq_wake(priv->irq);
@@ -256,10 +284,18 @@ static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 static int eeti_ts_resume(struct i2c_client *client)
 {
         struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
 
         if (device_may_wakeup(&client->dev))
                 disable_irq_wake(priv->irq);
 
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users)
+                eeti_ts_start(priv);
+
+        mutex_unlock(&input_dev->mutex);
+
         return 0;
 }
 #else
diff --git a/drivers/input/touchscreen/s3c2410_ts.c b/drivers/input/touchscreen/s3c2410_ts.c
index 98a7d1279486..e0b7c834111d 100644
--- a/drivers/input/touchscreen/s3c2410_ts.c
+++ b/drivers/input/touchscreen/s3c2410_ts.c
@@ -37,9 +37,7 @@
 
 #include <plat/adc.h>
 #include <plat/regs-adc.h>
-
-#include <mach/regs-gpio.h>
-#include <mach/ts.h>
+#include <plat/ts.h>
 
 #define TSC_SLEEP  (S3C2410_ADCTSC_PULL_UP_DISABLE | S3C2410_ADCTSC_XY_PST(0))
 
@@ -57,6 +55,8 @@
                          S3C2410_ADCTSC_AUTO_PST | \
                          S3C2410_ADCTSC_XY_PST(0))
 
+#define FEAT_PEN_IRQ    (1 << 0)        /* HAS ADCCLRINTPNDNUP */
+
 /* Per-touchscreen data. */
 
 /**
@@ -71,6 +71,7 @@
  * @irq_tc: The interrupt number for pen up/down interrupt
  * @count: The number of samples collected.
  * @shift: The log2 of the maximum count to read in one go.
+ * @features: The features supported by the TSADC MOdule.
  */
 struct s3c2410ts {
         struct s3c_adc_client *client;
@@ -83,26 +84,12 @@ struct s3c2410ts {
         int irq_tc;
         int count;
         int shift;
+        int features;
 };
 
 static struct s3c2410ts ts;
 
 /**
- * s3c2410_ts_connect - configure gpio for s3c2410 systems
- *
- * Configure the GPIO for the S3C2410 system, where we have external FETs
- * connected to the device (later systems such as the S3C2440 integrate
- * these into the device).
-*/
-static inline void s3c2410_ts_connect(void)
-{
-        s3c2410_gpio_cfgpin(S3C2410_GPG(12), S3C2410_GPG12_XMON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(13), S3C2410_GPG13_nXPON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(14), S3C2410_GPG14_YMON);
-        s3c2410_gpio_cfgpin(S3C2410_GPG(15), S3C2410_GPG15_nYPON);
-}
-
-/**
  * get_down - return the down state of the pen
  * @data0: The data read from ADCDAT0 register.
  * @data1: The data read from ADCDAT1 register.
@@ -188,6 +175,11 @@ static irqreturn_t stylus_irq(int irq, void *dev_id)
         else
                 dev_info(ts.dev, "%s: count=%d\n", __func__, ts.count);
 
+        if (ts.features & FEAT_PEN_IRQ) {
+                /* Clear pen down/up interrupt */
+                writel(0x0, ts.io + S3C64XX_ADCCLRINTPNDNUP);
+        }
+
         return IRQ_HANDLED;
 }
 
@@ -296,9 +288,9 @@ static int __devinit s3c2410ts_probe(struct platform_device *pdev)
                 goto err_clk;
         }
 
-        /* Configure the touchscreen external FETs on the S3C2410 */
-        if (!platform_get_device_id(pdev)->driver_data)
-                s3c2410_ts_connect();
+        /* inititalise the gpio */
+        if (info->cfg_gpio)
+                info->cfg_gpio(to_platform_device(ts.dev));
 
         ts.client = s3c_adc_register(pdev, s3c24xx_ts_select,
                                      s3c24xx_ts_conversion, 1);
@@ -334,6 +326,7 @@ static int __devinit s3c2410ts_probe(struct platform_device *pdev)
         ts.input->id.version = 0x0102;
 
         ts.shift = info->oversampling_shift;
+        ts.features = platform_get_device_id(pdev)->driver_data;
 
         ret = request_irq(ts.irq_tc, stylus_irq, IRQF_DISABLED,
                           "s3c2410_ts_pen", ts.input);
@@ -420,15 +413,14 @@ static struct dev_pm_ops s3c_ts_pmops = {
 #endif
 
 static struct platform_device_id s3cts_driver_ids[] = {
-        { "s3c2410-ts", 0 },
-        { "s3c2440-ts", 1 },
+        { "s3c64xx-ts", FEAT_PEN_IRQ },
         { }
 };
 MODULE_DEVICE_TABLE(platform, s3cts_driver_ids);
 
 static struct platform_driver s3c_ts_driver = {
         .driver         = {
-                .name   = "s3c24xx-ts",
+                .name   = "samsung-ts",
                 .owner  = THIS_MODULE,
 #ifdef CONFIG_PM
                 .pm     = &s3c_ts_pmops,
diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 9f49d9065791..c53e2417e7d4 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -20,6 +20,7 @@
 #include <linux/sched.h>
 #include <linux/isdnif.h>
 #include <net/net_namespace.h>
+#include <linux/smp_lock.h>
 #include "isdn_divert.h"
 
 
@@ -177,9 +178,7 @@ isdn_divert_close(struct inode *ino, struct file *filep)
 /*********/
 /* IOCTL */
 /*********/
-static int
-isdn_divert_ioctl(struct inode *inode, struct file *file,
-                  uint cmd, ulong arg)
+static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
 {
         divert_ioctl dioctl;
         int i;
@@ -258,6 +257,17 @@ isdn_divert_ioctl(struct inode *inode, struct file *file,
         return copy_to_user((void __user *)arg, &dioctl, sizeof(dioctl)) ? -EFAULT : 0;
 }                               /* isdn_divert_ioctl */
 
+static long isdn_divert_ioctl(struct file *file, uint cmd, ulong arg)
+{
+        long ret;
+
+        lock_kernel();
+        ret = isdn_divert_ioctl_unlocked(file, cmd, arg);
+        unlock_kernel();
+
+        return ret;
+}
+
 static const struct file_operations isdn_fops =
 {
         .owner          = THIS_MODULE,
@@ -265,7 +275,7 @@ static const struct file_operations isdn_fops =
         .read           = isdn_divert_read,
         .write          = isdn_divert_write,
         .poll           = isdn_divert_poll,
-        .ioctl          = isdn_divert_ioctl,
+        .unlocked_ioctl = isdn_divert_ioctl,
         .open           = isdn_divert_open,
         .release        = isdn_divert_close,                                      
 };
diff --git a/drivers/isdn/hardware/avm/avm_cs.c b/drivers/isdn/hardware/avm/avm_cs.c
index 94b796d84053..f410d0eb2fef 100644
--- a/drivers/isdn/hardware/avm/avm_cs.c
+++ b/drivers/isdn/hardware/avm/avm_cs.c
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/ptrace.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/tty.h>
 #include <linux/serial.h>
@@ -61,31 +60,6 @@ static void avmcs_release(struct pcmcia_device *link);
 
 static void avmcs_detach(struct pcmcia_device *p_dev);
 
-/*
-   A linked list of "instances" of the skeleton device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one struct pcmcia_device structure (defined in ds.h).
-
-   You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of struct pcmcia_device pointers, where minor
-   device numbers are used to derive the corresponding array index.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally can't be allocated dynamically.
-*/
-   
-typedef struct local_info_t {
-    dev_node_t  node;
-} local_info_t;
-
 /*======================================================================
 
     avmcs_attach() creates an "instance" of the driver, allocating
@@ -100,32 +74,19 @@ typedef struct local_info_t {
 
 static int avmcs_probe(struct pcmcia_device *p_dev)
 {
-    local_info_t *local;
 
     /* The io structure describes IO port mapping */
     p_dev->io.NumPorts1 = 16;
     p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     p_dev->io.NumPorts2 = 0;
 
-    /* Interrupt setup */
-    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
     /* General socket configuration */
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
     p_dev->conf.IntType = INT_MEMORY_AND_IO;
     p_dev->conf.ConfigIndex = 1;
     p_dev->conf.Present = PRESENT_OPTION;
 
-    /* Allocate space for private device-specific data */
-    local = kzalloc(sizeof(local_info_t), GFP_KERNEL);
-    if (!local)
-        goto err;
-    p_dev->priv = local;
-
     return avmcs_config(p_dev);
-
- err:
-    return -ENOMEM;
 } /* avmcs_attach */
 
 /*======================================================================
@@ -140,7 +101,6 @@ static int avmcs_probe(struct pcmcia_device *p_dev)
 static void avmcs_detach(struct pcmcia_device *link)
 {
         avmcs_release(link);
-        kfree(link->priv);
 } /* avmcs_detach */
 
 /*======================================================================
@@ -171,14 +131,11 @@ static int avmcs_configcheck(struct pcmcia_device *p_dev,
 
 static int avmcs_config(struct pcmcia_device *link)
 {
-    local_info_t *dev;
-    int i;
+    int i = -1;
     char devname[128];
     int cardtype;
     int (*addcard)(unsigned int port, unsigned irq);
 
-    dev = link->priv;
-
     devname[0] = 0;
     if (link->prod_id[1])
             strlcpy(devname, link->prod_id[1], sizeof(devname));
@@ -190,11 +147,7 @@ static int avmcs_config(struct pcmcia_device *link)
             return -ENODEV;
 
     do {
-        /*
-         * allocate an interrupt line
-         */
-        i = pcmcia_request_irq(link, &link->irq);
-        if (i != 0) {
+        if (!link->irq) {
             /* undo */
             pcmcia_disable_device(link);
             break;
@@ -211,15 +164,11 @@ static int avmcs_config(struct pcmcia_device *link)
 
     } while (0);
 
-    /* At this point, the dev_node_t structure(s) should be
-       initialized and arranged in a linked list at link->dev. */
-
     if (devname[0]) {
         char *s = strrchr(devname, ' ');
         if (!s)
            s = devname;
         else s++;
-        strcpy(dev->node.dev_name, s);
         if (strcmp("M1", s) == 0) {
            cardtype = AVM_CARDTYPE_M1;
         } else if (strcmp("M2", s) == 0) {
@@ -227,14 +176,8 @@ static int avmcs_config(struct pcmcia_device *link)
         } else {
            cardtype = AVM_CARDTYPE_B1;
         }
-    } else {
-        strcpy(dev->node.dev_name, "b1");
+    } else
         cardtype = AVM_CARDTYPE_B1;
-    }
-
-    dev->node.major = 64;
-    dev->node.minor = 0;
-    link->dev_node = &dev->node;
 
     /* If any step failed, release any partially configured state */
     if (i != 0) {
@@ -249,13 +192,12 @@ static int avmcs_config(struct pcmcia_device *link)
         default:
         case AVM_CARDTYPE_B1: addcard = b1pcmcia_addcard_b1; break;
     }
-    if ((i = (*addcard)(link->io.BasePort1, link->irq.AssignedIRQ)) < 0) {
-        printk(KERN_ERR "avm_cs: failed to add AVM-%s-Controller at i/o %#x, irq %d\n",
-                dev->node.dev_name, link->io.BasePort1, link->irq.AssignedIRQ);
-        avmcs_release(link);
-        return -ENODEV;
+    if ((i = (*addcard)(link->io.BasePort1, link->irq)) < 0) {
+            dev_err(&link->dev, "avm_cs: failed to add AVM-Controller at i/o %#x, irq %d\n",
+                    link->io.BasePort1, link->irq);
+            avmcs_release(link);
+            return -ENODEV;
     }
-    dev->node.minor = i;
     return 0;
 
 } /* avmcs_config */
@@ -270,7 +212,7 @@ static int avmcs_config(struct pcmcia_device *link)
 
 static void avmcs_release(struct pcmcia_device *link)
 {
-        b1pcmcia_delcard(link->io.BasePort1, link->irq.AssignedIRQ);
+        b1pcmcia_delcard(link->io.BasePort1, link->irq);
         pcmcia_disable_device(link);
 } /* avmcs_release */
 
diff --git a/drivers/isdn/hisax/avma1_cs.c b/drivers/isdn/hisax/avma1_cs.c
index 8d1d63a02b34..a80a7617f16f 100644
--- a/drivers/isdn/hisax/avma1_cs.c
+++ b/drivers/isdn/hisax/avma1_cs.c
@@ -62,31 +62,6 @@ static void avma1cs_release(struct pcmcia_device *link);
 static void avma1cs_detach(struct pcmcia_device *p_dev) __devexit ;
 
 
-/*
-   A linked list of "instances" of the skeleton device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one struct pcmcia_device structure (defined in ds.h).
-
-   You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of struct pcmcia_device pointers, where minor
-   device numbers are used to derive the corresponding array index.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally can't be allocated dynamically.
-*/
-   
-typedef struct local_info_t {
-    dev_node_t  node;
-} local_info_t;
-
 /*======================================================================
 
     avma1cs_attach() creates an "instance" of the driver, allocating
@@ -101,17 +76,8 @@ typedef struct local_info_t {
 
 static int __devinit avma1cs_probe(struct pcmcia_device *p_dev)
 {
-    local_info_t *local;
-
     dev_dbg(&p_dev->dev, "avma1cs_attach()\n");
 
-    /* Allocate space for private device-specific data */
-    local = kzalloc(sizeof(local_info_t), GFP_KERNEL);
-    if (!local)
-        return -ENOMEM;
-
-    p_dev->priv = local;
-
     /* The io structure describes IO port mapping */
     p_dev->io.NumPorts1 = 16;
     p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -119,9 +85,6 @@ static int __devinit avma1cs_probe(struct pcmcia_device *p_dev)
     p_dev->io.Attributes2 = IO_DATA_PATH_WIDTH_16;
     p_dev->io.IOAddrLines = 5;
 
-    /* Interrupt setup */
-    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-
     /* General socket configuration */
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
     p_dev->conf.IntType = INT_MEMORY_AND_IO;
@@ -176,14 +139,11 @@ static int avma1cs_configcheck(struct pcmcia_device *p_dev,
 
 static int __devinit avma1cs_config(struct pcmcia_device *link)
 {
-    local_info_t *dev;
-    int i;
+    int i = -1;
     char devname[128];
     IsdnCard_t  icard;
     int busy = 0;
 
-    dev = link->priv;
-
     dev_dbg(&link->dev, "avma1cs_config(0x%p)\n", link);
 
     devname[0] = 0;
@@ -197,8 +157,7 @@ static int __devinit avma1cs_config(struct pcmcia_device *link)
         /*
          * allocate an interrupt line
          */
-        i = pcmcia_request_irq(link, &link->irq);
-        if (i != 0) {
+        if (!link->irq) {
             /* undo */
             pcmcia_disable_device(link);
             break;
@@ -215,14 +174,6 @@ static int __devinit avma1cs_config(struct pcmcia_device *link)
 
     } while (0);
 
-    /* At this point, the dev_node_t structure(s) should be
-       initialized and arranged in a linked list at link->dev. */
-
-    strcpy(dev->node.dev_name, "A1");
-    dev->node.major = 45;
-    dev->node.minor = 0;
-    link->dev_node = &dev->node;
-
     /* If any step failed, release any partially configured state */
     if (i != 0) {
         avma1cs_release(link);
@@ -230,9 +181,9 @@ static int __devinit avma1cs_config(struct pcmcia_device *link)
     }
 
     printk(KERN_NOTICE "avma1_cs: checking at i/o %#x, irq %d\n",
-                                link->io.BasePort1, link->irq.AssignedIRQ);
+                                link->io.BasePort1, link->irq);
 
-    icard.para[0] = link->irq.AssignedIRQ;
+    icard.para[0] = link->irq;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = isdnprot;
     icard.typ = ISDN_CTYPE_A1_PCMCIA;
@@ -243,7 +194,7 @@ static int __devinit avma1cs_config(struct pcmcia_device *link)
         avma1cs_release(link);
         return -ENODEV;
     }
-    dev->node.minor = i;
+    link->priv = (void *) (unsigned long) i;
 
     return 0;
 } /* avma1cs_config */
@@ -258,12 +209,12 @@ static int __devinit avma1cs_config(struct pcmcia_device *link)
 
 static void avma1cs_release(struct pcmcia_device *link)
 {
-        local_info_t *local = link->priv;
+        unsigned long minor = (unsigned long) link->priv;
 
         dev_dbg(&link->dev, "avma1cs_release(0x%p)\n", link);
 
         /* now unregister function with hisax */
-        HiSax_closecard(local->node.minor);
+        HiSax_closecard(minor);
 
         pcmcia_disable_device(link);
 } /* avma1cs_release */
diff --git a/drivers/isdn/hisax/elsa_cs.c b/drivers/isdn/hisax/elsa_cs.c
index c9f2279e21f5..218927e3a4ea 100644
--- a/drivers/isdn/hisax/elsa_cs.c
+++ b/drivers/isdn/hisax/elsa_cs.c
@@ -87,24 +87,8 @@ static void elsa_cs_release(struct pcmcia_device *link);
 
 static void elsa_cs_detach(struct pcmcia_device *p_dev) __devexit;
 
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally shouldn't be allocated dynamically.
-   In this case, we also provide a flag to indicate if a device is
-   "stopped" due to a power management event, or card ejection.  The
-   device IO routines can use a flag like this to throttle IO to a
-   card that is not ready to accept it.
-*/
-
 typedef struct local_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     int                 busy;
     int                 cardnr;
 } local_info_t;
@@ -136,10 +120,6 @@ static int __devinit elsa_cs_probe(struct pcmcia_device *link)
 
     local->cardnr = -1;
 
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = NULL;
-
     /*
       General socket configuration defaults can go here.  In this
       client, we assume very little, and rely on the CIS for almost
@@ -223,28 +203,18 @@ static int __devinit elsa_cs_config(struct pcmcia_device *link)
     if (i != 0)
         goto failed;
 
-    i = pcmcia_request_irq(link, &link->irq);
-    if (i != 0) {
-        link->irq.AssignedIRQ = 0;
+    if (!link->irq)
         goto failed;
-    }
 
     i = pcmcia_request_configuration(link, &link->conf);
     if (i != 0)
         goto failed;
 
-    /* At this point, the dev_node_t structure(s) should be
-       initialized and arranged in a linked list at link->dev. *//*  */
-    sprintf(dev->node.dev_name, "elsa");
-    dev->node.major = dev->node.minor = 0x0;
-
-    link->dev_node = &dev->node;
-
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x: ",
-           dev->node.dev_name, link->conf.ConfigIndex);
+    dev_info(&link->dev, "index 0x%02x: ",
+            link->conf.ConfigIndex);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
-        printk(", irq %d", link->irq.AssignedIRQ);
+        printk(", irq %d", link->irq);
     if (link->io.NumPorts1)
         printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                link->io.BasePort1+link->io.NumPorts1-1);
@@ -253,7 +223,7 @@ static int __devinit elsa_cs_config(struct pcmcia_device *link)
                link->io.BasePort2+link->io.NumPorts2-1);
     printk("\n");
 
-    icard.para[0] = link->irq.AssignedIRQ;
+    icard.para[0] = link->irq;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = protocol;
     icard.typ = ISDN_CTYPE_ELSA_PCMCIA;
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index 71b3ddef03bb..1f4feaab21af 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -87,32 +87,8 @@ static void sedlbauer_release(struct pcmcia_device *link);
 
 static void sedlbauer_detach(struct pcmcia_device *p_dev) __devexit;
 
-/*
-   You'll also need to prototype all the functions that will actually
-   be used to talk to your device.  See 'memory_cs' for a good example
-   of a fully self-sufficient driver; the other drivers rely more or
-   less on other parts of the kernel.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally shouldn't be allocated dynamically.
-
-   In this case, we also provide a flag to indicate if a device is
-   "stopped" due to a power management event, or card ejection.  The
-   device IO routines can use a flag like this to throttle IO to a
-   card that is not ready to accept it.
-*/
-   
 typedef struct local_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     int                 stop;
     int                 cardnr;
 } local_info_t;
@@ -143,10 +119,6 @@ static int __devinit sedlbauer_probe(struct pcmcia_device *link)
     local->p_dev = link;
     link->priv = local;
 
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = NULL;
-
     /*
       General socket configuration defaults can go here.  In this
       client, we assume very little, and rely on the CIS for almost
@@ -227,9 +199,7 @@ static int sedlbauer_config_check(struct pcmcia_device *p_dev,
         else if (dflt->vpp1.present & (1<<CISTPL_POWER_VNOM))
                 p_dev->conf.Vpp = dflt->vpp1.param[CISTPL_POWER_VNOM]/10000;
 
-        /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -285,7 +255,6 @@ static int sedlbauer_config_check(struct pcmcia_device *p_dev,
 
 static int __devinit sedlbauer_config(struct pcmcia_device *link)
 {
-    local_info_t *dev = link->priv;
     win_req_t *req;
     int ret;
     IsdnCard_t  icard;
@@ -313,17 +282,6 @@ static int __devinit sedlbauer_config(struct pcmcia_device *link)
             goto failed;
 
     /*
-       Allocate an interrupt line.  Note that this does not assign a
-       handler to the interrupt, unless the 'Handler' member of the
-       irq structure is initialized.
-    */
-    if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-            ret = pcmcia_request_irq(link, &link->irq);
-            if (ret)
-                    goto failed;
-    }
-        
-    /*
        This actually configures the PCMCIA socket -- setting up
        the I/O windows and the interrupt mapping, and putting the
        card and host interface into "Memory and IO" mode.
@@ -332,21 +290,13 @@ static int __devinit sedlbauer_config(struct pcmcia_device *link)
     if (ret)
             goto failed;
 
-    /*
-      At this point, the dev_node_t structure(s) need to be
-      initialized and arranged in a linked list at link->dev.
-    */
-    sprintf(dev->node.dev_name, "sedlbauer");
-    dev->node.major = dev->node.minor = 0;
-    link->dev_node = &dev->node;
-
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x:",
-           dev->node.dev_name, link->conf.ConfigIndex);
+    dev_info(&link->dev, "index 0x%02x:",
+           link->conf.ConfigIndex);
     if (link->conf.Vpp)
         printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
-        printk(", irq %d", link->irq.AssignedIRQ);
+        printk(", irq %d", link->irq);
     if (link->io.NumPorts1)
         printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                link->io.BasePort1+link->io.NumPorts1-1);
@@ -358,7 +308,7 @@ static int __devinit sedlbauer_config(struct pcmcia_device *link)
                req->Base+req->Size-1);
     printk("\n");
 
-    icard.para[0] = link->irq.AssignedIRQ;
+    icard.para[0] = link->irq;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = protocol;
     icard.typ = ISDN_CTYPE_SEDLBAUER_PCMCIA;
diff --git a/drivers/isdn/hisax/teles_cs.c b/drivers/isdn/hisax/teles_cs.c
index d010a0da8e19..5771955cc532 100644
--- a/drivers/isdn/hisax/teles_cs.c
+++ b/drivers/isdn/hisax/teles_cs.c
@@ -68,34 +68,8 @@ static void teles_cs_release(struct pcmcia_device *link);
 
 static void teles_detach(struct pcmcia_device *p_dev) __devexit ;
 
-/*
-   A linked list of "instances" of the teles_cs device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one struct pcmcia_device structure (defined in ds.h).
-
-   You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of struct pcmcia_device pointers, where minor
-   device numbers are used to derive the corresponding array index.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally shouldn't be allocated dynamically.
-   In this case, we also provide a flag to indicate if a device is
-   "stopped" due to a power management event, or card ejection.  The
-   device IO routines can use a flag like this to throttle IO to a
-   card that is not ready to accept it.
-*/
-
 typedef struct local_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     int                 busy;
     int                 cardnr;
 } local_info_t;
@@ -126,10 +100,6 @@ static int __devinit teles_probe(struct pcmcia_device *link)
     local->p_dev = link;
     link->priv = local;
 
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = NULL;
-
     /*
       General socket configuration defaults can go here.  In this
       client, we assume very little, and rely on the CIS for almost
@@ -213,28 +183,18 @@ static int __devinit teles_cs_config(struct pcmcia_device *link)
     if (i != 0)
         goto cs_failed;
 
-    i = pcmcia_request_irq(link, &link->irq);
-    if (i != 0) {
-        link->irq.AssignedIRQ = 0;
+    if (!link->irq)
         goto cs_failed;
-    }
 
     i = pcmcia_request_configuration(link, &link->conf);
     if (i != 0)
       goto cs_failed;
 
-    /* At this point, the dev_node_t structure(s) should be
-       initialized and arranged in a linked list at link->dev. *//*  */
-    sprintf(dev->node.dev_name, "teles");
-    dev->node.major = dev->node.minor = 0x0;
-
-    link->dev_node = &dev->node;
-
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x:",
-           dev->node.dev_name, link->conf.ConfigIndex);
+    dev_info(&link->dev, "index 0x%02x:",
+            link->conf.ConfigIndex);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
-        printk(", irq %d", link->irq.AssignedIRQ);
+            printk(", irq %d", link->irq);
     if (link->io.NumPorts1)
         printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                link->io.BasePort1+link->io.NumPorts1-1);
@@ -243,7 +203,7 @@ static int __devinit teles_cs_config(struct pcmcia_device *link)
                link->io.BasePort2+link->io.NumPorts2-1);
     printk("\n");
 
-    icard.para[0] = link->irq.AssignedIRQ;
+    icard.para[0] = link->irq;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = protocol;
     icard.typ = ISDN_CTYPE_TELESPCMCIA;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9712b2e97be4..cefd63daff31 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2109,12 +2109,18 @@ repeat:
                 if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
                         /* .. if the array isn't clean, an 'even' event must also go
                          * to spares. */
-                        if ((mddev->events&1)==0)
+                        if ((mddev->events&1)==0) {
                                 nospares = 0;
+                                sync_req = 2; /* force a second update to get the
+                                               * even/odd in sync */
+                        }
                 } else {
                         /* otherwise an 'odd' event must go to spares */
-                        if ((mddev->events&1))
+                        if ((mddev->events&1)) {
                                 nospares = 0;
+                                sync_req = 2; /* force a second update to get the
+                                               * even/odd in sync */
+                        }
                 }
         }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 20e48401910e..15348c393b5d 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1527,7 +1527,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
 
                 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                 atomic_inc(&rdev->read_errors);
-                if (conf->mddev->degraded)
+                if (conf->mddev->degraded >= conf->max_degraded)
                         printk_rl(KERN_WARNING
                                   "raid5:%s: read error not correctable "
                                   "(sector %llu on %s).\n",
@@ -1650,7 +1650,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                      int previous, int *dd_idx,
                                      struct stripe_head *sh)
 {
-        sector_t stripe;
+        sector_t stripe, stripe2;
         sector_t chunk_number;
         unsigned int chunk_offset;
         int pd_idx, qd_idx;
@@ -1677,7 +1677,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
          */
         stripe = chunk_number;
         *dd_idx = sector_div(stripe, data_disks);
-
+        stripe2 = stripe;
         /*
          * Select the parity disk based on the user selected algorithm.
          */
@@ -1689,21 +1689,21 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
         case 5:
                 switch (algorithm) {
                 case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         break;
                 case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         break;
                 case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_PARITY_0:
@@ -1723,7 +1723,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 switch (algorithm) {
                 case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1732,7 +1732,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                 (*dd_idx) += 2; /* D D P Q D */
                         break;
                 case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1741,12 +1741,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                 (*dd_idx) += 2; /* D D P Q D */
                         break;
                 case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + 1) % raid_disks;
                         *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                         break;
                 case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + 1) % raid_disks;
                         *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                         break;
@@ -1765,7 +1765,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                         /* Exactly the same as RIGHT_ASYMMETRIC, but or
                          * of blocks for computing Q is different.
                          */
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1780,7 +1780,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                          * D D D P Q  rather than
                          * Q D D D P
                          */
-                        pd_idx = raid_disks - 1 - ((stripe + 1) % raid_disks);
+                        stripe2 += 1;
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = pd_idx + 1;
                         if (pd_idx == raid_disks-1) {
                                 (*dd_idx)++;    /* Q D D D P */
@@ -1792,7 +1793,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 case ALGORITHM_ROTATING_N_CONTINUE:
                         /* Same as left_symmetric but Q is before P */
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                         qd_idx = (pd_idx + raid_disks - 1) % raid_disks;
                         *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                         ddf_layout = 1;
@@ -1800,27 +1801,27 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
 
                 case ALGORITHM_LEFT_ASYMMETRIC_6:
                         /* RAID5 left_asymmetric, with Q on last device */
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_RIGHT_ASYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                         if (*dd_idx >= pd_idx)
                                 (*dd_idx)++;
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_LEFT_SYMMETRIC_6:
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                         qd_idx = raid_disks - 1;
                         break;
 
                 case ALGORITHM_RIGHT_SYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                         *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                         qd_idx = raid_disks - 1;
                         break;
diff --git a/drivers/media/common/saa7146_fops.c b/drivers/media/common/saa7146_fops.c
index fd8e1f45be36..7364b9642d00 100644
--- a/drivers/media/common/saa7146_fops.c
+++ b/drivers/media/common/saa7146_fops.c
@@ -423,15 +423,14 @@ static void vv_callback(struct saa7146_dev *dev, unsigned long status)
         }
 }
 
-int saa7146_vv_devinit(struct saa7146_dev *dev)
-{
-        return v4l2_device_register(&dev->pci->dev, &dev->v4l2_dev);
-}
-EXPORT_SYMBOL_GPL(saa7146_vv_devinit);
-
 int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv)
 {
         struct saa7146_vv *vv;
+        int err;
+
+        err = v4l2_device_register(&dev->pci->dev, &dev->v4l2_dev);
+        if (err)
+                return err;
 
         vv = kzalloc(sizeof(struct saa7146_vv), GFP_KERNEL);
         if (vv == NULL) {
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 5ed75263340a..b8b2c551a1e2 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -558,9 +558,11 @@ static int vidioc_s_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *f
         /* ok, accept it */
         vv->ov_fb = *fb;
         vv->ov_fmt = fmt;
-        if (0 == vv->ov_fb.fmt.bytesperline)
-                vv->ov_fb.fmt.bytesperline =
-                        vv->ov_fb.fmt.width * fmt->depth / 8;
+
+        if (vv->ov_fb.fmt.bytesperline < vv->ov_fb.fmt.width) {
+                vv->ov_fb.fmt.bytesperline = vv->ov_fb.fmt.width * fmt->depth / 8;
+                DEB_D(("setting bytesperline to %d\n", vv->ov_fb.fmt.bytesperline));
+        }
 
         mutex_unlock(&dev->lock);
         return 0;
diff --git a/drivers/media/dvb/frontends/stv090x.c b/drivers/media/dvb/frontends/stv090x.c
index a3c07fe0e6c4..96972804f4ad 100644
--- a/drivers/media/dvb/frontends/stv090x.c
+++ b/drivers/media/dvb/frontends/stv090x.c
@@ -4470,6 +4470,10 @@ static int stv090x_setup(struct dvb_frontend *fe)
         if (stv090x_write_reg(state, STV090x_TSTRES0, 0x00) < 0)
                 goto err;
 
+        /* workaround for stuck DiSEqC output */
+        if (config->diseqc_envelope_mode)
+                stv090x_send_diseqc_burst(fe, SEC_MINI_A);
+
         return 0;
 err:
         dprintk(FE_ERROR, 1, "I/O error");
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 9fdf26cc6998..1500210c06cf 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -643,9 +643,6 @@ static void frontend_init(struct budget *budget)
                                         &budget->i2c_adap,
                                         &tt1600_isl6423_config);
 
-                        } else {
-                                dvb_frontend_detach(budget->dvb_frontend);
-                                budget->dvb_frontend = NULL;
                         }
                 }
                 break;
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index f8fc8654693d..9644cf760aaa 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -361,7 +361,7 @@ config VIDEO_SAA717X
 
 config VIDEO_SAA7191
         tristate "Philips SAA7191 video decoder"
-        depends on VIDEO_V4L1 && I2C
+        depends on VIDEO_V4L2 && I2C
         ---help---
           Support for the Philips SAA7191 video decoder.
 
@@ -756,7 +756,7 @@ source "drivers/media/video/saa7134/Kconfig"
 
 config VIDEO_MXB
         tristate "Siemens-Nixdorf 'Multimedia eXtension Board'"
-        depends on PCI && VIDEO_V4L1 && I2C
+        depends on PCI && VIDEO_V4L2 && I2C
         select VIDEO_SAA7146_VV
         select VIDEO_TUNER
         select VIDEO_SAA711X if VIDEO_HELPER_CHIPS_AUTO
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index b88b6174a331..c51c386559f2 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -160,8 +160,6 @@ obj-$(CONFIG_VIDEO_MX3)			+= mx3_camera.o
 obj-$(CONFIG_VIDEO_PXA27x)              += pxa_camera.o
 obj-$(CONFIG_VIDEO_SH_MOBILE_CEU)       += sh_mobile_ceu_camera.o
 
-obj-$(CONFIG_ARCH_DAVINCI)              += davinci/
-
 obj-$(CONFIG_VIDEO_AU0828) += au0828/
 
 obj-$(CONFIG_USB_VIDEO_CLASS)   += uvc/
diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index 7cf042f9b377..398dbe71cb82 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -223,7 +223,6 @@ int vpfe_register_ccdc_device(struct ccdc_hw_device *dev)
         BUG_ON(!dev->hw_ops.get_frame_format);
         BUG_ON(!dev->hw_ops.get_pixel_format);
         BUG_ON(!dev->hw_ops.set_pixel_format);
-        BUG_ON(!dev->hw_ops.set_params);
         BUG_ON(!dev->hw_ops.set_image_window);
         BUG_ON(!dev->hw_ops.get_image_window);
         BUG_ON(!dev->hw_ops.get_line_length);
@@ -1689,11 +1688,12 @@ static long vpfe_param_handler(struct file *file, void *priv,
         struct vpfe_device *vpfe_dev = video_drvdata(file);
         int ret = 0;
 
-        v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_param_handler\n");
+        v4l2_dbg(2, debug, &vpfe_dev->v4l2_dev, "vpfe_param_handler\n");
 
         if (vpfe_dev->started) {
                 /* only allowed if streaming is not started */
-                v4l2_err(&vpfe_dev->v4l2_dev, "device already started\n");
+                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                        "device already started\n");
                 return -EBUSY;
         }
 
@@ -1705,16 +1705,23 @@ static long vpfe_param_handler(struct file *file, void *priv,
         case VPFE_CMD_S_CCDC_RAW_PARAMS:
                 v4l2_warn(&vpfe_dev->v4l2_dev,
                           "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
-                ret = ccdc_dev->hw_ops.set_params(param);
-                if (ret) {
-                        v4l2_err(&vpfe_dev->v4l2_dev,
-                                "Error in setting parameters in CCDC\n");
-                        goto unlock_out;
-                }
-                if (vpfe_get_ccdc_image_format(vpfe_dev, &vpfe_dev->fmt) < 0) {
-                        v4l2_err(&vpfe_dev->v4l2_dev,
-                                "Invalid image format at CCDC\n");
-                        goto unlock_out;
+                if (ccdc_dev->hw_ops.set_params) {
+                        ret = ccdc_dev->hw_ops.set_params(param);
+                        if (ret) {
+                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                        "Error setting parameters in CCDC\n");
+                                goto unlock_out;
+                        }
+                        if (vpfe_get_ccdc_image_format(vpfe_dev,
+                                                       &vpfe_dev->fmt) < 0) {
+                                v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                        "Invalid image format at CCDC\n");
+                                goto unlock_out;
+                        }
+                } else {
+                        ret = -EINVAL;
+                        v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+                                "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
                 }
                 break;
         default:
@@ -1830,7 +1837,7 @@ static __init int vpfe_probe(struct platform_device *pdev)
         if (NULL == ccdc_cfg) {
                 v4l2_err(pdev->dev.driver,
                          "Memory allocation failed for ccdc_cfg\n");
-                goto probe_free_dev_mem;
+                goto probe_free_lock;
         }
 
         strncpy(ccdc_cfg->name, vpfe_cfg->ccdc, 32);
@@ -1982,8 +1989,9 @@ probe_out_video_release:
 probe_out_release_irq:
         free_irq(vpfe_dev->ccdc_irq0, vpfe_dev);
 probe_free_ccdc_cfg_mem:
-        mutex_unlock(&ccdc_lock);
         kfree(ccdc_cfg);
+probe_free_lock:
+        mutex_unlock(&ccdc_lock);
 probe_free_dev_mem:
         kfree(vpfe_dev);
         return ret;
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 38a6e15e096b..3dee3e5844b6 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -1427,7 +1427,7 @@ static int input_kthread(void *data)
         struct gspca_dev *gspca_dev = (struct gspca_dev *)data;
         struct sd *sd = (struct sd *) gspca_dev;
 
-        DECLARE_WAIT_QUEUE_HEAD(wait);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait);
         set_freezable();
         for (;;) {
                 if (kthread_should_stop())
diff --git a/drivers/media/video/gspca/spca508.c b/drivers/media/video/gspca/spca508.c
index 15b2eef8a3f6..edf0fe157501 100644
--- a/drivers/media/video/gspca/spca508.c
+++ b/drivers/media/video/gspca/spca508.c
@@ -1513,7 +1513,6 @@ static const struct sd_desc sd_desc = {
 static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x0130, 0x0130), .driver_info = HamaUSBSightcam},
         {USB_DEVICE(0x041e, 0x4018), .driver_info = CreativeVista},
-        {USB_DEVICE(0x0461, 0x0815), .driver_info = MicroInnovationIC200},
         {USB_DEVICE(0x0733, 0x0110), .driver_info = ViewQuestVQ110},
         {USB_DEVICE(0x0af9, 0x0010), .driver_info = HamaUSBSightcam},
         {USB_DEVICE(0x0af9, 0x0011), .driver_info = HamaUSBSightcam2},
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index dc7f2b0fbc79..b9c80e2103b9 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -1053,6 +1053,7 @@ static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x041e, 0x401a), .driver_info = Rev072A},
         {USB_DEVICE(0x041e, 0x403b), .driver_info = Rev012A},
         {USB_DEVICE(0x0458, 0x7004), .driver_info = Rev072A},
+        {USB_DEVICE(0x0461, 0x0815), .driver_info = Rev072A},
         {USB_DEVICE(0x046d, 0x0928), .driver_info = Rev012A},
         {USB_DEVICE(0x046d, 0x0929), .driver_info = Rev012A},
         {USB_DEVICE(0x046d, 0x092a), .driver_info = Rev012A},
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index af73da34c83f..14f179a19485 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -524,8 +524,6 @@ static const __devinitdata struct usb_device_id device_table[] = {
         {USB_DEVICE(0x046D, 0x08F5), .driver_info = BRIDGE_ST6422 },
         /* QuickCam Messenger (new) */
         {USB_DEVICE(0x046D, 0x08F6), .driver_info = BRIDGE_ST6422 },
-        /* QuickCam Messenger (new) */
-        {USB_DEVICE(0x046D, 0x08DA), .driver_info = BRIDGE_ST6422 },
         {}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/hexium_gemini.c b/drivers/media/video/hexium_gemini.c
index e620a3a92f25..ad2c232baa6d 100644
--- a/drivers/media/video/hexium_gemini.c
+++ b/drivers/media/video/hexium_gemini.c
@@ -356,9 +356,6 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
 
         DEB_EE((".\n"));
 
-        ret = saa7146_vv_devinit(dev);
-        if (ret)
-                return ret;
         hexium = kzalloc(sizeof(struct hexium), GFP_KERNEL);
         if (NULL == hexium) {
                 printk("hexium_gemini: not enough kernel memory in hexium_attach().\n");
diff --git a/drivers/media/video/hexium_orion.c b/drivers/media/video/hexium_orion.c
index fe596a1c12a8..938a1f8f880a 100644
--- a/drivers/media/video/hexium_orion.c
+++ b/drivers/media/video/hexium_orion.c
@@ -216,10 +216,6 @@ static int hexium_probe(struct saa7146_dev *dev)
                 return -EFAULT;
         }
 
-        err = saa7146_vv_devinit(dev);
-        if (err)
-                return err;
-
         hexium = kzalloc(sizeof(struct hexium), GFP_KERNEL);
         if (NULL == hexium) {
                 printk("hexium_orion: hexium_probe: not enough kernel memory.\n");
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 3c8ebfcb742e..34a66019190e 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -49,8 +49,6 @@
 /*
  * CSI registers
  */
-#define DMA_CCR(x)      (0x8c + ((x) << 6))     /* Control Registers */
-#define DMA_DIMR        0x08                    /* Interrupt mask Register */
 #define CSICR1          0x00                    /* CSI Control Register 1 */
 #define CSISR           0x08                    /* CSI Status Register */
 #define CSIRXR          0x10                    /* CSI RxFIFO Register */
@@ -784,7 +782,7 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
                                pcdev);
 
         imx_dma_config_channel(pcdev->dma_chan, IMX_DMA_TYPE_FIFO,
-                               IMX_DMA_MEMSIZE_32, DMA_REQ_CSI_R, 0);
+                               IMX_DMA_MEMSIZE_32, MX1_DMA_REQ_CSI_R, 0);
         /* burst length : 16 words = 64 bytes */
         imx_dma_config_burstlen(pcdev->dma_chan, 0);
 
@@ -798,8 +796,8 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
         set_fiq_handler(&mx1_camera_sof_fiq_start, &mx1_camera_sof_fiq_end -
                                                    &mx1_camera_sof_fiq_start);
 
-        regs.ARM_r8 = DMA_BASE + DMA_DIMR;
-        regs.ARM_r9 = DMA_BASE + DMA_CCR(pcdev->dma_chan);
+        regs.ARM_r8 = (long)MX1_DMA_DIMR;
+        regs.ARM_r9 = (long)MX1_DMA_CCR(pcdev->dma_chan);
         regs.ARM_r10 = (long)pcdev->base + CSICR1;
         regs.ARM_fp = (long)pcdev->base + CSISR;
         regs.ARM_sp = 1 << pcdev->dma_chan;
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 9f01f14e4aa2..ef0c8178f255 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -169,11 +169,7 @@ static struct saa7146_extension extension;
 static int mxb_probe(struct saa7146_dev *dev)
 {
         struct mxb *mxb = NULL;
-        int err;
 
-        err = saa7146_vv_devinit(dev);
-        if (err)
-                return err;
         mxb = kzalloc(sizeof(struct mxb), GFP_KERNEL);
         if (mxb == NULL) {
                 DEB_D(("not enough kernel memory.\n"));
@@ -699,14 +695,17 @@ static struct saa7146_ext_vv vv_data;
 /* this function only gets called when the probing was successful */
 static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info)
 {
-        struct mxb *mxb = (struct mxb *)dev->ext_priv;
+        struct mxb *mxb;
 
         DEB_EE(("dev:%p\n", dev));
 
-        /* checking for i2c-devices can be omitted here, because we
-           already did this in "mxb_vl42_probe" */
-
         saa7146_vv_init(dev, &vv_data);
+        if (mxb_probe(dev)) {
+                saa7146_vv_release(dev);
+                return -1;
+        }
+        mxb = (struct mxb *)dev->ext_priv;
+
         vv_data.ops.vidioc_queryctrl = vidioc_queryctrl;
         vv_data.ops.vidioc_g_ctrl = vidioc_g_ctrl;
         vv_data.ops.vidioc_s_ctrl = vidioc_s_ctrl;
@@ -726,6 +725,7 @@ static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data
         vv_data.ops.vidioc_default = vidioc_default;
         if (saa7146_register_device(&mxb->video_dev, dev, "mxb", VFL_TYPE_GRABBER)) {
                 ERR(("cannot register capture v4l2 device. skipping.\n"));
+                saa7146_vv_release(dev);
                 return -1;
         }
 
@@ -846,7 +846,6 @@ static struct saa7146_extension extension = {
         .pci_tbl        = &pci_tbl[0],
         .module         = THIS_MODULE,
 
-        .probe          = mxb_probe,
         .attach         = mxb_attach,
         .detach         = mxb_detach,
 
diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
index b189fe63394b..ce76d952e161 100644
--- a/drivers/media/video/omap24xxcam.c
+++ b/drivers/media/video/omap24xxcam.c
@@ -1405,7 +1405,7 @@ static int omap24xxcam_mmap_buffers(struct file *file,
         }
 
         size = 0;
-        for (i = first; i <= last; i++) {
+        for (i = first; i <= last && i < VIDEO_MAX_FRAME; i++) {
                 struct videobuf_dmabuf *dma = videobuf_to_dma(vbq->bufs[i]);
 
                 for (j = 0; j < dma->sglen; j++) {
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 5ecc30daef2d..04bf5c11308d 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -609,12 +609,9 @@ static void pxa_dma_add_tail_buf(struct pxa_camera_dev *pcdev,
  */
 static void pxa_camera_start_capture(struct pxa_camera_dev *pcdev)
 {
-        unsigned long cicr0, cifr;
+        unsigned long cicr0;
 
         dev_dbg(pcdev->soc_host.v4l2_dev.dev, "%s\n", __func__);
-        /* Reset the FIFOs */
-        cifr = __raw_readl(pcdev->base + CIFR) | CIFR_RESET_F;
-        __raw_writel(cifr, pcdev->base + CIFR);
         /* Enable End-Of-Frame Interrupt */
         cicr0 = __raw_readl(pcdev->base + CICR0) | CICR0_ENB;
         cicr0 &= ~CICR0_EOFM;
@@ -935,7 +932,7 @@ static void pxa_camera_deactivate(struct pxa_camera_dev *pcdev)
 static irqreturn_t pxa_camera_irq(int irq, void *data)
 {
         struct pxa_camera_dev *pcdev = data;
-        unsigned long status, cicr0;
+        unsigned long status, cifr, cicr0;
         struct pxa_buffer *buf;
         struct videobuf_buffer *vb;
 
@@ -949,6 +946,10 @@ static irqreturn_t pxa_camera_irq(int irq, void *data)
         __raw_writel(status, pcdev->base + CISR);
 
         if (status & CISR_EOF) {
+                /* Reset the FIFOs */
+                cifr = __raw_readl(pcdev->base + CIFR) | CIFR_RESET_F;
+                __raw_writel(cifr, pcdev->base + CIFR);
+
                 pcdev->active = list_first_entry(&pcdev->capture,
                                            struct pxa_buffer, vb.queue);
                 vb = &pcdev->active->vb;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 6e16b3979326..1ad980f8e770 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -1633,7 +1633,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         height = pix->height;
 
         pix->bytesperline = soc_mbus_bytes_per_line(width, xlate->host_fmt);
-        if (pix->bytesperline < 0)
+        if ((int)pix->bytesperline < 0)
                 return pix->bytesperline;
         pix->sizeimage = height * pix->bytesperline;
 
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index a3d5728b6449..f2ab025ad97a 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -349,6 +349,9 @@ int wm831x_auxadc_read(struct wm831x *wm831x, enum wm831x_auxadc input)
                 goto disable;
         }
 
+        /* If an interrupt arrived late clean up after it */
+        try_wait_for_completion(&wm831x->auxadc_done);
+
         /* Ignore the result to allow us to soldier on without IRQ hookup */
         wait_for_completion_timeout(&wm831x->auxadc_done, msecs_to_jiffies(5));
 
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index e400a3bed063..b5807484b4c9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -363,6 +363,10 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
         reg |= 1 << channel | WM8350_AUXADC_POLL;
         wm8350_reg_write(wm8350, WM8350_DIGITISER_CONTROL_1, reg);
 
+        /* If a late IRQ left the completion signalled then consume
+         * the completion. */
+        try_wait_for_completion(&wm8350->auxadc_done);
+
         /* We ignore the result of the completion and just check for a
          * conversion result, allowing us to soldier on if the IRQ
          * infrastructure is not set up for the chip. */
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2191c8d896a0..0d0d625fece2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -311,6 +311,22 @@ config TI_DAC7512
           This driver can also be built as a module. If so, the module
           will be calles ti_dac7512.
 
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called vmware_balloon.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 27c484355414..7b6f7eefdf8d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -29,3 +29,4 @@ obj-$(CONFIG_C2PORT)		+= c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
new file mode 100644
index 000000000000..db9cd0240c6f
--- /dev/null
+++ b/drivers/misc/vmware_balloon.c
@@ -0,0 +1,832 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/hypervisor.h>
+
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.0-K");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+
+
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+
+struct vmballoon {
+
+        /* list of reserved physical pages */
+        struct list_head pages;
+
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+
+        /* reset flag */
+        bool reset_required;
+
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+
+        struct sysinfo sysinfo;
+
+        struct delayed_work dwork;
+};
+
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        STATS_INC(b->stats.start);
+
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+
+        default:
+                return false;
+        }
+}
+
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+
+        STATS_INC(b->stats.guest_type);
+
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+
+        /* update stats */
+        STATS_INC(b->stats.target);
+
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.lock);
+
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+
+        STATS_INC(b->stats.unlock);
+
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+
+                        /* place on list of non-balloonable pages, retry allocation */
+                        list_add(&page->lru, &b->refused_pages);
+                        STATS_INC(b->stats.refused_alloc);
+                }
+        } while (!locked);
+
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+
+        /* update balloon size */
+        b->size++;
+
+        return 0;
+}
+
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+
+        list_del(&page->lru);
+
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+
+        /* update balloon size */
+        b->size--;
+
+        return 0;
+}
+
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+}
+
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+
+        for (i = 0; i < goal; i++) {
+
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+
+                        if (i >= b->rate_alloc)
+                                break;
+
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+
+        vmballoon_release_refused_pages(b);
+}
+
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+
+                if (++i >= goal)
+                        break;
+        }
+
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+
+        STATS_INC(b->stats.timer);
+
+        if (b->reset_required)
+                vmballoon_reset(b);
+
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+
+        return 0;
+}
+
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+
+#else
+
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+static int __init vmballoon_init(void)
+{
+        int error;
+
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (x86_hyper != &x86_hyper_vmware)
+                return -ENODEV;
+
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+
+        return 0;
+
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+
+        vmballoon_debugfs_exit(&balloon);
+
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);
diff --git a/drivers/mmc/host/at91_mci.c b/drivers/mmc/host/at91_mci.c
index a6dd7da37357..336d9f553f3e 100644
--- a/drivers/mmc/host/at91_mci.c
+++ b/drivers/mmc/host/at91_mci.c
@@ -314,8 +314,8 @@ static void at91_mci_post_dma_read(struct at91mci_host *host)
                         dmabuf = (unsigned *)tmpv;
                 }
 
+                flush_kernel_dcache_page(sg_page(sg));
                 kunmap_atomic(sgbuffer, KM_BIO_SRC_IRQ);
-                dmac_flush_range((void *)sgbuffer, ((void *)sgbuffer) + amount);
                 data->bytes_xfered += amount;
                 if (size == 0)
                         break;
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 88be37d9e9a5..fb279f4ed8b3 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -266,7 +266,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 cmd->opcode, cmd->arg, cmd->flags,
                                 cmd->resp[0], cmd->resp[1], cmd->resp[2],
-                                cmd->resp[2], cmd->error);
+                                cmd->resp[3], cmd->error);
                 if (data)
                         seq_printf(s, "DATA %u / %u * %u flg %x err %d\n",
                                 data->bytes_xfered, data->blocks,
@@ -276,7 +276,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                 "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                 stop->opcode, stop->arg, stop->flags,
                                 stop->resp[0], stop->resp[1], stop->resp[2],
-                                stop->resp[2], stop->error);
+                                stop->resp[3], stop->error);
         }
 
         spin_unlock_bh(&slot->host->lock);
@@ -569,9 +569,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
 {
         struct mmc_data                 *data = host->data;
 
-        dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-                     ((data->flags & MMC_DATA_WRITE)
-                      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+        if (data)
+                dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+                             ((data->flags & MMC_DATA_WRITE)
+                              ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
 }
 
 static void atmci_stop_dma(struct atmel_mci *host)
@@ -1099,8 +1100,8 @@ static void atmci_command_complete(struct atmel_mci *host,
                         "command error: status=0x%08x\n", status);
 
                 if (cmd->data) {
-                        host->data = NULL;
                         atmci_stop_dma(host);
+                        host->data = NULL;
                         mci_writel(host, IDR, MCI_NOTBUSY
                                         | MCI_TXRDY | MCI_RXRDY
                                         | ATMCI_DATA_ERROR_FLAGS);
@@ -1293,6 +1294,7 @@ static void atmci_tasklet_func(unsigned long priv)
                         } else {
                                 data->bytes_xfered = data->blocks * data->blksz;
                                 data->error = 0;
+                                mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
                         }
 
                         if (!data->stop) {
@@ -1751,13 +1753,13 @@ static int __init atmci_probe(struct platform_device *pdev)
         ret = -ENODEV;
         if (pdata->slot[0].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[0],
-                                MCI_SDCSEL_SLOT_A, 0);
+                                0, MCI_SDCSEL_SLOT_A);
                 if (!ret)
                         nr_slots++;
         }
         if (pdata->slot[1].bus_width) {
                 ret = atmci_init_slot(host, &pdata->slot[1],
-                                MCI_SDCSEL_SLOT_B, 1);
+                                1, MCI_SDCSEL_SLOT_B);
                 if (!ret)
                         nr_slots++;
         }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 84c103a7ee13..ff115d920888 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -55,14 +55,16 @@ static void mmci_set_clkreg(struct mmci_host *host, unsigned int desired)
                         host->cclk = host->mclk / (2 * (clk + 1));
                 }
                 if (host->hw_designer == AMBA_VENDOR_ST)
-                        clk |= MCI_FCEN; /* Bug fix in ST IP block */
+                        clk |= MCI_ST_FCEN; /* Bug fix in ST IP block */
                 clk |= MCI_CLK_ENABLE;
                 /* This hasn't proven to be worthwhile */
                 /* clk |= MCI_CLK_PWRSAVE; */
         }
 
         if (host->mmc->ios.bus_width == MMC_BUS_WIDTH_4)
-                clk |= MCI_WIDE_BUS;
+                clk |= MCI_4BIT_BUS;
+        if (host->mmc->ios.bus_width == MMC_BUS_WIDTH_8)
+                clk |= MCI_ST_8BIT_BUS;
 
         writel(clk, host->base + MMCICLOCK);
 }
@@ -629,7 +631,18 @@ static int __devinit mmci_probe(struct amba_device *dev, struct amba_id *id)
 
         mmc->ops = &mmci_ops;
         mmc->f_min = (host->mclk + 511) / 512;
-        mmc->f_max = min(host->mclk, fmax);
+        /*
+         * If the platform data supplies a maximum operating
+         * frequency, this takes precedence. Else, we fall back
+         * to using the module parameter, which has a (low)
+         * default value in case it is not specified. Either
+         * value must not exceed the clock rate into the block,
+         * of course.
+         */
+        if (plat->f_max)
+                mmc->f_max = min(host->mclk, plat->f_max);
+        else
+                mmc->f_max = min(host->mclk, fmax);
         dev_dbg(mmc_dev(mmc), "clocking block at %u Hz\n", mmc->f_max);
 
 #ifdef CONFIG_REGULATOR
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index 1ceb9a90f59b..d77062e5e3af 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -25,9 +25,11 @@
 #define MCI_CLK_ENABLE          (1 << 8)
 #define MCI_CLK_PWRSAVE         (1 << 9)
 #define MCI_CLK_BYPASS          (1 << 10)
-#define MCI_WIDE_BUS            (1 << 11)
+#define MCI_4BIT_BUS            (1 << 11)
+/* 8bit wide buses supported in ST Micro versions */
+#define MCI_ST_8BIT_BUS         (1 << 12)
 /* HW flow control on the ST Micro version */
-#define MCI_FCEN                (1 << 13)
+#define MCI_ST_FCEN             (1 << 13)
 
 #define MMCIARGUMENT            0x008
 #define MMCICOMMAND             0x00c
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 0ed48959b590..e4f00e70a749 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -544,7 +544,7 @@ static irqreturn_t pxamci_detect_irq(int irq, void *devid)
 {
         struct pxamci_host *host = mmc_priv(devid);
 
-        mmc_detect_change(devid, host->pdata->detect_delay);
+        mmc_detect_change(devid, msecs_to_jiffies(host->pdata->detect_delay_ms));
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 82d1e4de475b..4521b1ecce45 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -4,7 +4,7 @@
 
 # Core functionality.
 obj-$(CONFIG_MTD)               += mtd.o
-mtd-y                           := mtdcore.o mtdsuper.o mtdbdi.o
+mtd-y                           := mtdcore.o mtdsuper.o
 mtd-$(CONFIG_MTD_PARTITIONS)    += mtdpart.o
 
 obj-$(CONFIG_MTD_CONCAT)        += mtdconcat.o
diff --git a/drivers/mtd/internal.h b/drivers/mtd/internal.h
deleted file mode 100644
index c658fe7216b5..000000000000
--- a/drivers/mtd/internal.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/* Internal MTD definitions
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-/*
- * mtdbdi.c
- */
-extern struct backing_dev_info mtd_bdi_unmappable;
-extern struct backing_dev_info mtd_bdi_ro_mappable;
-extern struct backing_dev_info mtd_bdi_rw_mappable;
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index 689d6a79ffc0..87b2b8ff331e 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -52,7 +52,6 @@ static const int debug = 0;
 
 struct pcmciamtd_dev {
         struct pcmcia_device    *p_dev;
-        dev_node_t      node;           /* device node */
         caddr_t         win_base;       /* ioremapped address of PCMCIA window */
         unsigned int    win_size;       /* size of window */
         unsigned int    offset;         /* offset into card the window currently points at */
@@ -647,9 +646,7 @@ static int pcmciamtd_config(struct pcmcia_device *link)
                 pcmciamtd_release(link);
                 return -ENODEV;
         }
-        snprintf(dev->node.dev_name, sizeof(dev->node.dev_name), "mtd%d", mtd->index);
         info("mtd%d: %s", mtd->index, mtd->name);
-        link->dev_node = &dev->node;
         return 0;
 
  failed:
diff --git a/drivers/mtd/mtdbdi.c b/drivers/mtd/mtdbdi.c
deleted file mode 100644
index 5ca5aed0b225..000000000000
--- a/drivers/mtd/mtdbdi.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/* MTD backing device capabilities
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-
-#include <linux/backing-dev.h>
-#include <linux/mtd/mtd.h>
-#include "internal.h"
-
-/*
- * backing device capabilities for non-mappable devices (such as NAND flash)
- * - permits private mappings, copies are taken of the data
- */
-struct backing_dev_info mtd_bdi_unmappable = {
-        .capabilities   = BDI_CAP_MAP_COPY,
-};
-
-/*
- * backing device capabilities for R/O mappable devices (such as ROM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_ro_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
-};
-
-/*
- * backing device capabilities for writable mappable devices (such as RAM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_rw_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
-                           BDI_CAP_WRITE_MAP),
-};
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 5b38b17d2229..b177e750efc3 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -2,6 +2,9 @@
  * Core registration and callback routines for MTD
  * drivers and users.
  *
+ * bdi bits are:
+ * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
  */
 
 #include <linux/module.h>
@@ -16,11 +19,39 @@
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
 #include <linux/proc_fs.h>
+#include <linux/backing-dev.h>
 
 #include <linux/mtd/mtd.h>
-#include "internal.h"
 
 #include "mtdcore.h"
+/*
+ * backing device capabilities for non-mappable devices (such as NAND flash)
+ * - permits private mappings, copies are taken of the data
+ */
+struct backing_dev_info mtd_bdi_unmappable = {
+        .capabilities   = BDI_CAP_MAP_COPY,
+};
+
+/*
+ * backing device capabilities for R/O mappable devices (such as ROM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_ro_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
+};
+
+/*
+ * backing device capabilities for writable mappable devices (such as RAM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_rw_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
+                           BDI_CAP_WRITE_MAP),
+};
 
 static int mtd_cls_suspend(struct device *dev, pm_message_t state);
 static int mtd_cls_resume(struct device *dev);
@@ -628,20 +659,55 @@ done:
 /*====================================================================*/
 /* Init code */
 
+static int __init mtd_bdi_init(struct backing_dev_info *bdi, const char *name)
+{
+        int ret;
+
+        ret = bdi_init(bdi);
+        if (!ret)
+                ret = bdi_register(bdi, NULL, name);
+
+        if (ret)
+                bdi_destroy(bdi);
+
+        return ret;
+}
+
 static int __init init_mtd(void)
 {
         int ret;
+
         ret = class_register(&mtd_class);
+        if (ret)
+                goto err_reg;
+
+        ret = mtd_bdi_init(&mtd_bdi_unmappable, "mtd-unmap");
+        if (ret)
+                goto err_bdi1;
+
+        ret = mtd_bdi_init(&mtd_bdi_ro_mappable, "mtd-romap");
+        if (ret)
+                goto err_bdi2;
+
+        ret = mtd_bdi_init(&mtd_bdi_rw_mappable, "mtd-rwmap");
+        if (ret)
+                goto err_bdi3;
 
-        if (ret) {
-                pr_err("Error registering mtd class: %d\n", ret);
-                return ret;
-        }
 #ifdef CONFIG_PROC_FS
         if ((proc_mtd = create_proc_entry( "mtd", 0, NULL )))
                 proc_mtd->read_proc = mtd_read_proc;
 #endif /* CONFIG_PROC_FS */
         return 0;
+
+err_bdi3:
+        bdi_destroy(&mtd_bdi_ro_mappable);
+err_bdi2:
+        bdi_destroy(&mtd_bdi_unmappable);
+err_bdi1:
+        class_unregister(&mtd_class);
+err_reg:
+        pr_err("Error registering mtd class or bdi: %d\n", ret);
+        return ret;
 }
 
 static void __exit cleanup_mtd(void)
@@ -651,6 +717,9 @@ static void __exit cleanup_mtd(void)
                 remove_proc_entry( "mtd", NULL);
 #endif /* CONFIG_PROC_FS */
         class_unregister(&mtd_class);
+        bdi_destroy(&mtd_bdi_unmappable);
+        bdi_destroy(&mtd_bdi_ro_mappable);
+        bdi_destroy(&mtd_bdi_rw_mappable);
 }
 
 module_init(init_mtd);
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index af8b42e0a55b..7c003191fca4 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -13,6 +13,7 @@
 #include <linux/mtd/super.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 
 /*
  * compare superblocks to see if they're equivalent
@@ -44,6 +45,7 @@ static int get_sb_mtd_set(struct super_block *sb, void *_mtd)
 
         sb->s_mtd = mtd;
         sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
+        sb->s_bdi = mtd->backing_dev_info;
         return 0;
 }
 
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index f59c07427af3..d60fc5719fef 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -60,7 +60,13 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
         }
         buf64 = (uint64_t *)buf;
         while (i < len/8) {
-                uint64_t x;
+                /*
+                 * Since GCC has no proper constraint (PR 43518)
+                 * force x variable to r2/r3 registers as ldrd instruction
+                 * requires first register to be even.
+                 */
+                register uint64_t x asm ("r2");
+
                 asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                 buf64[i++] = x;
         }
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a03d291de854..f0d23de32967 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                 netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                           __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                                DUMP_PREFIX_OFFSET, 16, 1,
                                &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50d9de8..12b280afdd51 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/a2065.c b/drivers/net/a2065.c
index ed5e9742be2c..a8f0512bad38 100644
--- a/drivers/net/a2065.c
+++ b/drivers/net/a2065.c
@@ -674,6 +674,7 @@ static struct zorro_device_id a2065_zorro_tbl[] __devinitdata = {
         { ZORRO_PROD_AMERISTAR_A2065 },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, a2065_zorro_tbl);
 
 static struct zorro_driver a2065_driver = {
         .name           = "a2065",
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index fa1a2354f5f9..4b30a46486e2 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -145,6 +145,7 @@ static struct zorro_device_id ariadne_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_VILLAGE_TRONIC_ARIADNE },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, ariadne_zorro_tbl);
 
 static struct zorro_driver ariadne_driver = {
     .name       = "ariadne",
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 6995169d285a..cd17d09f385c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -311,11 +311,6 @@ err:
                 processed++;
         }
 
-        if (processed) {
-                wrw(ep, REG_RXDENQ, processed);
-                wrw(ep, REG_RXSTSENQ, processed);
-        }
-
         return processed;
 }
 
@@ -350,6 +345,11 @@ poll_some_more:
                         goto poll_some_more;
         }
 
+        if (rx) {
+                wrw(ep, REG_RXDENQ, rx);
+                wrw(ep, REG_RXSTSENQ, rx);
+        }
+
         return rx;
 }
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index a257babd1bb4..ac90a3828f69 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_VERSION      "2.0.9"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
         if (netif_running(bp->dev)) {
                 int i;
 
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
         if (atomic_dec_and_test(&bp->intr_sem)) {
                 if (netif_running(bp->dev)) {
                         netif_tx_wake_all_queues(bp->dev);
                         bnx2_napi_enable(bp);
                         bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                 }
         }
 }
@@ -4759,8 +4761,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 rc = bnx2_alloc_bad_rbuf(bp);
         }
 
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                 bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
 
         return rc;
 }
@@ -6273,12 +6279,12 @@ bnx2_reset_task(struct work_struct *work)
                 return;
         }
 
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
 
         bnx2_init_nic(bp, 1);
 
         atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         rtnl_unlock();
 }
 
@@ -6320,7 +6326,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
 
         bp->vlgrp = vlgrp;
 
@@ -6331,7 +6337,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                 bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
 
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
 
@@ -7051,9 +7057,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
         bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
 
         return 0;
@@ -7083,7 +7089,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                 /* Reset will erase chipset stats; save them */
                 bnx2_save_stats(bp);
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                 bnx2_free_skbs(bp);
                 bnx2_free_mem(bp);
@@ -7111,7 +7117,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                         bnx2_setup_cnic_irq_info(bp);
                 mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
         return 0;
 }
@@ -7364,7 +7370,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
         if (etest->flags & ETH_TEST_FL_OFFLINE) {
                 int i;
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                 bnx2_free_skbs(bp);
 
@@ -7383,7 +7389,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                         bnx2_shutdown_chip(bp);
                 else {
                         bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                 }
 
                 /* wait for link up */
@@ -8377,7 +8383,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                 return 0;
 
         flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
         netif_device_detach(dev);
         del_timer_sync(&bp->timer);
         bnx2_shutdown_chip(bp);
@@ -8399,7 +8405,7 @@ bnx2_resume(struct pci_dev *pdev)
         bnx2_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
         bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         return 0;
 }
 
@@ -8426,7 +8432,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
         }
 
         if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 del_timer_sync(&bp->timer);
                 bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
         }
@@ -8483,7 +8489,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
 
         rtnl_lock();
         if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
 
         netif_device_attach(dev);
         rtnl_unlock();
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
         if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                 return -ENOMEM;
         }
 
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                 goto cleanup_candev;
         }
 
         dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
         if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                 goto cleanup_intr_urb;
         }
 
         dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                      sizeof(struct ems_cpc_msg), GFP_KERNEL);
         if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                 goto cleanup_intr_in_buffer;
         }
 
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                             int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                   SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                   "10GBASE-CX4");
         return 0;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index aced6c5e635c..e3f1b8566495 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -439,7 +439,7 @@ static void free_irq_resources(struct adapter *adapter)
 static int await_mgmt_replies(struct adapter *adap, unsigned long init_cnt,
                               unsigned long n)
 {
-        int attempts = 5;
+        int attempts = 10;
 
         while (adap->sge.qs[0].rspq.offload_pkts < init_cnt + n) {
                 if (!--attempts)
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index b997e578e58f..791080303db1 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,6 +166,7 @@
 #include <linux/ethtool.h>
 #include <linux/string.h>
 #include <linux/firmware.h>
+#include <linux/rtnetlink.h>
 #include <asm/unaligned.h>
 
 
@@ -2265,8 +2266,13 @@ static void e100_tx_timeout_task(struct work_struct *work)
 
         DPRINTK(TX_ERR, DEBUG, "scb.status=0x%02X\n",
                 ioread8(&nic->csr->scb.status));
-        e100_down(netdev_priv(netdev));
-        e100_up(netdev_priv(netdev));
+
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                e100_down(netdev_priv(netdev));
+                e100_up(netdev_priv(netdev));
+        }
+        rtnl_unlock();
 }
 
 static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 712ccc66ba25..90155552ea09 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -336,7 +336,6 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         static int global_quad_port_a; /* global port a indication */
         struct pci_dev *pdev = adapter->pdev;
-        u16 eeprom_data = 0;
         int is_port_b = er32(STATUS) & E1000_STATUS_FUNC_1;
         s32 rc;
 
@@ -387,16 +386,15 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
                 if (pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)
                         adapter->flags &= ~FLAG_HAS_WOL;
                 break;
-
         case e1000_82573:
+        case e1000_82574:
+        case e1000_82583:
+                /* Disable ASPM L0s due to hardware errata */
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L0S);
+
                 if (pdev->device == E1000_DEV_ID_82573L) {
-                        if (e1000_read_nvm(&adapter->hw, NVM_INIT_3GIO_3, 1,
-                                       &eeprom_data) < 0)
-                                break;
-                        if (!(eeprom_data & NVM_WORD1A_ASPM_MASK)) {
-                                adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                        }
+                        adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
+                        adapter->max_hw_frame_size = DEFAULT_JUMBO;
                 }
                 break;
         default:
@@ -1792,6 +1790,7 @@ struct e1000_info e1000_82571_info = {
                                   | FLAG_RESET_OVERWRITES_LAA /* errata */
                                   | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                   | FLAG_APME_CHECK_PORT_B,
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1809,6 +1808,7 @@ struct e1000_info e1000_82572_info = {
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
                                   | FLAG_TARC_SPEED_MODE_BIT, /* errata */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1820,13 +1820,11 @@ struct e1000_info e1000_82572_info = {
 struct e1000_info e1000_82573_info = {
         .mac                    = e1000_82573,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
-                                  | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
-                                  | FLAG_HAS_ERT
                                   | FLAG_HAS_SWSM_ON_LOAD,
         .pba                    = 20,
         .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 118bdf483593..ee32b9b27a9f 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -37,6 +37,7 @@
 #include <linux/io.h>
 #include <linux/netdevice.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 
 #include "hw.h"
 
@@ -374,7 +375,7 @@ struct e1000_adapter {
 struct e1000_info {
         enum e1000_mac_type     mac;
         unsigned int            flags;
-        unsigned int            flags2;
+        unsigned int            flags2;
         u32                     pba;
         u32                     max_hw_frame_size;
         s32                     (*get_variants)(struct e1000_adapter *);
@@ -421,6 +422,7 @@ struct e1000_info {
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
 #define FLAG2_IS_DISCARDING               (1 << 2)
+#define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -461,6 +463,7 @@ extern void e1000e_update_stats(struct e1000_adapter *adapter);
 extern bool e1000e_has_link(struct e1000_adapter *adapter);
 extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
 extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+extern void e1000e_disable_aspm(struct pci_dev *pdev, u16 state);
 
 extern unsigned int copybreak;
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 73d43c53015a..d5d55c6a373f 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2524,12 +2524,12 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
                          * excessive C-state transition latencies result in
                          * dropped transactions.
                          */
-                        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                                  adapter->netdev->name, 55);
+                        pm_qos_update_request(
+                                adapter->netdev->pm_qos_req, 55);
                 } else {
-                        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                                  adapter->netdev->name,
-                                                  PM_QOS_DEFAULT_VALUE);
+                        pm_qos_update_request(
+                                adapter->netdev->pm_qos_req,
+                                PM_QOS_DEFAULT_VALUE);
                 }
         }
 
@@ -2824,8 +2824,8 @@ int e1000e_up(struct e1000_adapter *adapter)
 
         /* DMA latency requirement to workaround early-receive/jumbo issue */
         if (adapter->flags & FLAG_HAS_ERT)
-                pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                       adapter->netdev->name,
+                adapter->netdev->pm_qos_req =
+                        pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                                        PM_QOS_DEFAULT_VALUE);
 
         /* hardware has been reset, we need to reload some things */
@@ -2887,9 +2887,11 @@ void e1000e_down(struct e1000_adapter *adapter)
         e1000_clean_tx_ring(adapter);
         e1000_clean_rx_ring(adapter);
 
-        if (adapter->flags & FLAG_HAS_ERT)
-                pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY,
-                                          adapter->netdev->name);
+        if (adapter->flags & FLAG_HAS_ERT) {
+                pm_qos_remove_request(
+                              adapter->netdev->pm_qos_req);
+                adapter->netdev->pm_qos_req = NULL;
+        }
 
         /*
          * TODO: for power management, we could drop the link and
@@ -4283,6 +4285,14 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* 82573 Errata 17 */
+        if (((adapter->hw.mac.type == e1000_82573) ||
+             (adapter->hw.mac.type == e1000_82574)) &&
+            (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+                adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+        }
+
         while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
                 msleep(1);
         /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
@@ -4605,29 +4615,42 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
         }
 }
 
-static void e1000e_disable_l1aspm(struct pci_dev *pdev)
+#ifdef CONFIG_PCIEASPM
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        pci_disable_link_state(pdev, state);
+}
+#else
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
 {
         int pos;
-        u16 val;
+        u16 reg16;
 
         /*
-         * 82573 workaround - disable L1 ASPM on mobile chipsets
-         *
-         * L1 ASPM on various mobile (ich7) chipsets do not behave properly
-         * resulting in lost data or garbage information on the pci-e link
-         * level. This could result in (false) bad EEPROM checksum errors,
-         * long ping times (up to 2s) or even a system freeze/hang.
-         *
-         * Unfortunately this feature saves about 1W power consumption when
-         * active.
+         * Both device and parent should have the same ASPM setting.
+         * Disable ASPM in downstream component first and then upstream.
          */
-        pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
-        if (val & 0x2) {
-                dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
-                val &= ~0x2;
-                pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, val);
-        }
+        pos = pci_pcie_cap(pdev);
+        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
+
+        if (!pdev->bus->self)
+                return;
+
+        pos = pci_pcie_cap(pdev->bus->self);
+        pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, reg16);
+}
+#endif
+void e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        dev_info(&pdev->dev, "Disabling ASPM %s %s\n",
+                 (state & PCIE_LINK_STATE_L0S) ? "L0s" : "",
+                 (state & PCIE_LINK_STATE_L1) ? "L1" : "");
+
+        __e1000e_disable_aspm(pdev, state);
 }
 
 #ifdef CONFIG_PM
@@ -4653,7 +4676,8 @@ static int e1000_resume(struct pci_dev *pdev)
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
         pci_save_state(pdev);
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         err = pci_enable_device_mem(pdev);
         if (err) {
@@ -4795,7 +4819,8 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         int err;
         pci_ers_result_t result;
 
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
@@ -4889,13 +4914,6 @@ static void e1000_eeprom_checks(struct e1000_adapter *adapter)
                 dev_warn(&adapter->pdev->dev,
                          "Warning: detected DSPD enabled in EEPROM\n");
         }
-
-        ret_val = e1000_read_nvm(hw, NVM_INIT_3GIO_3, 1, &buf);
-        if (!ret_val && (le16_to_cpu(buf) & (3 << 2))) {
-                /* ASPM enable */
-                dev_warn(&adapter->pdev->dev,
-                         "Warning: detected ASPM enabled in EEPROM\n");
-        }
 }
 
 static const struct net_device_ops e1000e_netdev_ops = {
@@ -4944,7 +4962,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         u16 eeprom_data = 0;
         u16 eeprom_apme_mask = E1000_EEPROM_APME;
 
-        e1000e_disable_l1aspm(pdev);
+        if (ei->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         err = pci_enable_device_mem(pdev);
         if (err)
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 9f98c1c4a344..9b4e8f797a7a 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1653,7 +1653,7 @@ fec_set_mac_address(struct net_device *dev, void *p)
                 (dev->dev_addr[1] << 16) | (dev->dev_addr[0] << 24),
                 fep->hwp + FEC_ADDR_LOW);
         writel((dev->dev_addr[5] << 16) | (dev->dev_addr[4] << 24),
-                fep + FEC_ADDR_HIGH);
+                fep->hwp + FEC_ADDR_HIGH);
         return 0;
 }
 
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
         struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
 
         /*
          * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                 return &enet_regs->tbipa;
         } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
+                return of_iomap(np, 1);
         } else
                 return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         u32 __iomem *tbipa;
         struct mii_bus *new_bus;
         int tbiaddr = -1;
+        const u32 *addrp;
         u64 addr = 0, size = 0;
         int err = 0;
 
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         new_bus->priv = priv;
         fsl_pq_mdio_bus_name(new_bus->id, np);
 
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         map = ioremap(addr, size);
         if (!map) {
                 err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 080d1cea5b26..5d3763fb3472 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -549,12 +549,8 @@ static int gfar_parse_group(struct device_node *np,
                 struct gfar_private *priv, const char *model)
 {
         u32 *queue_mask;
-        u64 addr, size;
-
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
 
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
         if (!priv->gfargrp[priv->num_grps].regs)
                 return -ENOMEM;
 
@@ -1515,9 +1511,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                 tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                 gfar_write(&regs->dmactrl, tempval);
 
-                while (!(gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
-                        cpu_relax();
+                spin_event_timeout(((gfar_read(&regs->ievent) &
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
         }
 }
 
@@ -1653,6 +1649,7 @@ static void free_skb_resources(struct gfar_private *priv)
                         sizeof(struct rxbd8) * priv->total_rx_ring_size,
                         priv->tx_queue[0]->tx_bd_base,
                         priv->tx_queue[0]->tx_bd_dma_base);
+        skb_queue_purge(&priv->rx_recycle);
 }
 
 void gfar_start(struct net_device *dev)
@@ -2092,7 +2089,6 @@ static int gfar_close(struct net_device *dev)
 
         disable_napi(priv);
 
-        skb_queue_purge(&priv->rx_recycle);
         cancel_work_sync(&priv->reset_task);
         stop_gfar(dev);
 
diff --git a/drivers/net/hydra.c b/drivers/net/hydra.c
index 24724b4ad709..07d8e5b634f3 100644
--- a/drivers/net/hydra.c
+++ b/drivers/net/hydra.c
@@ -71,6 +71,7 @@ static struct zorro_device_id hydra_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_HYDRA_SYSTEMS_AMIGANET },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, hydra_zorro_tbl);
 
 static struct zorro_driver hydra_driver = {
     .name       = "hydra",
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 1b1edad1eb5e..f16e981812a9 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -48,6 +48,7 @@
 #define DRV_VERSION "1.0.0-k0"
 char igbvf_driver_name[] = "igbvf";
 const char igbvf_driver_version[] = DRV_VERSION;
+struct pm_qos_request_list *igbvf_driver_pm_qos_req;
 static const char igbvf_driver_string[] =
                                 "Intel(R) Virtual Function Network Driver";
 static const char igbvf_copyright[] = "Copyright (c) 2009 Intel Corporation.";
@@ -2899,7 +2900,7 @@ static int __init igbvf_init_module(void)
         printk(KERN_INFO "%s\n", igbvf_copyright);
 
         ret = pci_register_driver(&igbvf_driver);
-        pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY, igbvf_driver_name,
+        igbvf_driver_pm_qos_req = pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                                PM_QOS_DEFAULT_VALUE);
 
         return ret;
@@ -2915,7 +2916,8 @@ module_init(igbvf_init_module);
 static void __exit igbvf_exit_module(void)
 {
         pci_unregister_driver(&igbvf_driver);
-        pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY, igbvf_driver_name);
+        pm_qos_remove_request(igbvf_driver_pm_qos_req);
+        igbvf_driver_pm_qos_req = NULL;
 }
 module_exit(igbvf_exit_module);
 
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index b405a00817c6..12fc0e7ba2ca 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,8 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                           ixgbe_link_speed speed,
@@ -69,8 +71,14 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
         if (hw->phy.multispeed_fiber) {
                 /* Set up dual speed SFP+ support */
                 mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.disable_tx_laser =
+                                       &ixgbe_disable_tx_laser_multispeed_fiber;
+                mac->ops.enable_tx_laser =
+                                        &ixgbe_enable_tx_laser_multispeed_fiber;
                 mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
         } else {
+                mac->ops.disable_tx_laser = NULL;
+                mac->ops.enable_tx_laser = NULL;
                 mac->ops.flap_tx_laser = NULL;
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
@@ -415,6 +423,44 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
         return status;
 }
 
+ /**
+  *  ixgbe_disable_tx_laser_multispeed_fiber - Disable Tx laser
+  *  @hw: pointer to hardware structure
+  *
+  *  The base drivers may require better control over SFP+ module
+  *  PHY states.  This includes selectively shutting down the Tx
+  *  laser on the PHY, effectively halting physical link.
+  **/
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Disable tx laser; allow 100us to go dark per spec */
+        esdp_reg |= IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        udelay(100);
+}
+
+/**
+ *  ixgbe_enable_tx_laser_multispeed_fiber - Enable Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  The base drivers may require better control over SFP+ module
+ *  PHY states.  This includes selectively turning on the Tx
+ *  laser on the PHY, effectively starting physical link.
+ **/
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Enable tx laser; allow 100ms to light up */
+        esdp_reg &= ~IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        msleep(100);
+}
+
 /**
  *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
  *  @hw: pointer to hardware structure
@@ -429,23 +475,11 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
  **/
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
-        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
-
         hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
 
         if (hw->mac.autotry_restart) {
-                /* Disable tx laser; allow 100us to go dark per spec */
-                esdp_reg |= IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                udelay(100);
-
-                /* Enable tx laser; allow 100ms to light up */
-                esdp_reg &= ~IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                msleep(100);
-
+                ixgbe_disable_tx_laser_multispeed_fiber(hw);
+                ixgbe_enable_tx_laser_multispeed_fiber(hw);
                 hw->mac.autotry_restart = false;
         }
 }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 8f677cb86290..6c00ee493a3b 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2982,6 +2982,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         else
                 ixgbe_configure_msi_and_legacy(adapter);
 
+        /* enable the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.enable_tx_laser(hw);
+
         clear_bit(__IXGBE_DOWN, &adapter->state);
         ixgbe_napi_enable_all(adapter);
 
@@ -3243,6 +3247,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
                 /* ping all the active vfs to let them know we are going down */
@@ -6253,6 +6261,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_eeprom;
         }
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         init_timer(&adapter->watchdog_timer);
         adapter->watchdog_timer.function = &ixgbe_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -6400,16 +6412,6 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
         del_timer_sync(&adapter->sfp_timer);
         cancel_work_sync(&adapter->watchdog_task);
         cancel_work_sync(&adapter->sfp_task);
-        if (adapter->hw.phy.multispeed_fiber) {
-                struct ixgbe_hw *hw = &adapter->hw;
-                /*
-                 * Restart clause 37 autoneg, disable and re-enable
-                 * the tx laser, to clear & alert the link partner
-                 * that it needs to restart autotry
-                 */
-                hw->mac.autotry_restart = true;
-                hw->mac.ops.flap_tx_laser(hw);
-        }
         cancel_work_sync(&adapter->multispeed_fiber_task);
         cancel_work_sync(&adapter->sfp_config_module_task);
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 4ec6dc1a5b75..534affcc38ca 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2398,6 +2398,8 @@ struct ixgbe_mac_operations {
         s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
 
         /* Link */
+        void (*disable_tx_laser)(struct ixgbe_hw *);
+        void (*enable_tx_laser)(struct ixgbe_hw *);
         void (*flap_tx_laser)(struct ixgbe_hw *);
         s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
         s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 13cc1ca261d9..9e9f9b349766 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work)
                 txb = skb_dequeue(&ks->txq);
                 last = skb_queue_empty(&ks->txq);
 
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                if (txb != NULL) {
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                        ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
 
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
         }
 
         mutex_unlock(&ks->lock);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..30b7cf70fbe6 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -93,7 +93,6 @@ earlier 3Com products.
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ciscode.h>
 #include <pcmcia/ds.h>
-#include <pcmcia/mem_op.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -200,7 +199,6 @@ enum Window4 {		/* Window 4: Xcvr/media bits. */
 
 struct el3_private {
         struct pcmcia_device    *p_dev;
-        dev_node_t node;
         u16 advertising, partner;               /* NWay media advertisement */
         unsigned char phys;                     /* MII device address */
         unsigned int autoselect:1, default_media:3;     /* Read from the EEPROM/Wn3_Config. */
@@ -283,8 +281,6 @@ static int tc574_probe(struct pcmcia_device *link)
         spin_lock_init(&lp->window_lock);
         link->io.NumPorts1 = 32;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = &el3_interrupt;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.ConfigIndex = 1;
@@ -311,8 +307,7 @@ static void tc574_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "3c574_detach()\n");
 
-        if (link->dev_node)
-                unregister_netdev(dev);
+        unregister_netdev(dev);
 
         tc574_release(link);
 
@@ -353,7 +348,7 @@ static int tc574_config(struct pcmcia_device *link)
         if (i != 0)
                 goto failed;
 
-        ret = pcmcia_request_irq(link, &link->irq);
+        ret = pcmcia_request_irq(link, el3_interrupt);
         if (ret)
                 goto failed;
 
@@ -361,7 +356,7 @@ static int tc574_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        dev->irq = link->irq.AssignedIRQ;
+        dev->irq = link->irq;
         dev->base_addr = link->io.BasePort1;
 
         ioaddr = dev->base_addr;
@@ -446,17 +441,13 @@ static int tc574_config(struct pcmcia_device *link)
                 }
         }
 
-        link->dev_node = &lp->node;
         SET_NETDEV_DEV(dev, &link->dev);
 
         if (register_netdev(dev) != 0) {
                 printk(KERN_NOTICE "3c574_cs: register_netdev() failed\n");
-                link->dev_node = NULL;
                 goto failed;
         }
 
-        strcpy(lp->node.dev_name, dev->name);
-
         printk(KERN_INFO "%s: %s at io %#3lx, irq %d, "
                "hw_addr %pM.\n",
                dev->name, cardname, dev->base_addr, dev->irq,
@@ -781,8 +772,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                   inw(ioaddr + EL3_STATUS));
 
         spin_lock_irqsave(&lp->window_lock, flags);
+
+        dev->stats.tx_bytes += skb->len;
+
+        /* Put out the doubleword header... */
         outw(skb->len, ioaddr + TX_FIFO);
         outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
         outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
 
         dev->trans_start = jiffies;
@@ -1021,8 +1017,6 @@ static void update_stats(struct net_device *dev)
         /* BadSSD */                               inb(ioaddr + 12);
         up                                       = inb(ioaddr + 13);
 
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
-
         EL3WINDOW(1);
 }
 
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 091e0b00043e..5ab589d3b385 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -106,7 +106,6 @@ enum RxFilter {
 
 struct el3_private {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     /* For transceiver monitoring */
     struct timer_list   media;
     u16                 media_status;
@@ -194,8 +193,7 @@ static int tc589_probe(struct pcmcia_device *link)
     spin_lock_init(&lp->lock);
     link->io.NumPorts1 = 16;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = &el3_interrupt;
+
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
@@ -223,8 +221,7 @@ static void tc589_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "3c589_detach\n");
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     tc589_release(link);
 
@@ -242,7 +239,6 @@ static void tc589_detach(struct pcmcia_device *link)
 static int tc589_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
-    struct el3_private *lp = netdev_priv(dev);
     __be16 *phys_addr;
     int ret, i, j, multi = 0, fifo;
     unsigned int ioaddr;
@@ -271,7 +267,7 @@ static int tc589_config(struct pcmcia_device *link)
     if (i != 0)
         goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
+    ret = pcmcia_request_irq(link, el3_interrupt);
     if (ret)
             goto failed;
 
@@ -279,7 +275,7 @@ static int tc589_config(struct pcmcia_device *link)
     if (ret)
             goto failed;
         
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
     ioaddr = dev->base_addr;
     EL3WINDOW(0);
@@ -313,17 +309,13 @@ static int tc589_config(struct pcmcia_device *link)
     else
         printk(KERN_ERR "3c589_cs: invalid if_port requested\n");
     
-    link->dev_node = &lp->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
         printk(KERN_ERR "3c589_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(lp->node.dev_name, dev->name);
-
     printk(KERN_INFO "%s: 3Com 3c%s, io %#3lx, irq %d, "
            "hw_addr %pM\n",
            dev->name, (multi ? "562" : "589"), dev->base_addr, dev->irq,
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 9f3d593f14ed..59f6fa3c9ddc 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -113,7 +113,6 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id);
 
 typedef struct axnet_dev_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     caddr_t             base;
     struct timer_list   watchdog;
     int                 stale, fast_poll;
@@ -168,7 +167,6 @@ static int axnet_probe(struct pcmcia_device *link)
     info = PRIV(dev);
     info->p_dev = link;
     link->priv = dev;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -195,8 +193,7 @@ static void axnet_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "axnet_detach(0x%p)\n", link);
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     axnet_release(link);
 
@@ -265,12 +262,9 @@ static int try_io_port(struct pcmcia_device *link)
     int j, ret;
     if (link->io.NumPorts1 == 32) {
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
-        if (link->io.NumPorts2 > 0) {
-            /* for master/slave multifunction cards */
+        /* for master/slave multifunction cards */
+        if (link->io.NumPorts2 > 0)
             link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
-            link->irq.Attributes =
-                IRQ_TYPE_DYNAMIC_SHARING;
-        }
     } else {
         /* This should be two 16-port windows */
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -336,8 +330,7 @@ static int axnet_config(struct pcmcia_device *link)
     if (ret != 0)
         goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
     
     if (link->io.NumPorts2 == 8) {
@@ -349,7 +342,7 @@ static int axnet_config(struct pcmcia_device *link)
     if (ret)
             goto failed;
 
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
 
     if (!get_prom(link)) {
@@ -397,17 +390,13 @@ static int axnet_config(struct pcmcia_device *link)
     }
 
     info->phy_id = (i < 32) ? i : -1;
-    link->dev_node = &info->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "axnet_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(info->node.dev_name, dev->name);
-
     printk(KERN_INFO "%s: Asix AX88%d90: io %#3lx, irq %d, "
            "hw_addr %pM\n",
            dev->name, ((info->flags & IS_AX88790) ? 7 : 1),
diff --git a/drivers/net/pcmcia/com20020_cs.c b/drivers/net/pcmcia/com20020_cs.c
index 21d9c9d815d1..5643f94541bc 100644
--- a/drivers/net/pcmcia/com20020_cs.c
+++ b/drivers/net/pcmcia/com20020_cs.c
@@ -122,7 +122,6 @@ static void com20020_detach(struct pcmcia_device *p_dev);
 
 typedef struct com20020_dev_t {
     struct net_device       *dev;
-    dev_node_t          node;
 } com20020_dev_t;
 
 /*======================================================================
@@ -163,7 +162,6 @@ static int com20020_probe(struct pcmcia_device *p_dev)
     p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     p_dev->io.NumPorts1 = 16;
     p_dev->io.IOAddrLines = 16;
-    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
     p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -196,18 +194,16 @@ static void com20020_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "com20020_detach\n");
 
-    if (link->dev_node) {
-        dev_dbg(&link->dev, "unregister...\n");
+    dev_dbg(&link->dev, "unregister...\n");
 
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
-        /*
-         * this is necessary because we register our IRQ separately
-         * from card services.
-         */
-        if (dev->irq)
+    /*
+     * this is necessary because we register our IRQ separately
+     * from card services.
+     */
+    if (dev->irq)
             free_irq(dev->irq, dev);
-    }
 
     com20020_release(link);
 
@@ -275,15 +271,14 @@ static int com20020_config(struct pcmcia_device *link)
     dev_dbg(&link->dev, "got ioaddr %Xh\n", ioaddr);
 
     dev_dbg(&link->dev, "request IRQ %d\n",
-            link->irq.AssignedIRQ);
-    i = pcmcia_request_irq(link, &link->irq);
-    if (i != 0)
+            link->irq);
+    if (!link->irq)
     {
         dev_dbg(&link->dev, "requestIRQ failed totally!\n");
         goto failed;
     }
 
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
 
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
@@ -299,7 +294,6 @@ static int com20020_config(struct pcmcia_device *link)
     lp->card_name = "PCMCIA COM20020";
     lp->card_flags = ARC_CAN_10MBIT; /* pretend all of them can 10Mbit */
 
-    link->dev_node = &info->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     i = com20020_found(dev, 0); /* calls register_netdev */
@@ -307,12 +301,9 @@ static int com20020_config(struct pcmcia_device *link)
     if (i != 0) {
         dev_printk(KERN_NOTICE, &link->dev,
                 "com20020_cs: com20020_found() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(info->node.dev_name, dev->name);
-
     dev_dbg(&link->dev,KERN_INFO "%s: port %#3lx, irq %d\n",
            dev->name, dev->base_addr, dev->irq);
     return 0;
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index b9dc80b9d04a..6580d78397d1 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -110,7 +110,6 @@ typedef enum { MBH10302, MBH10304, TDK, CONTEC, LA501, UNGERMANN,
 */
 typedef struct local_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t node;
     long open_time;
     uint tx_started:1;
     uint tx_queue;
@@ -254,10 +253,6 @@ static int fmvj18x_probe(struct pcmcia_device *link)
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.IOAddrLines = 5;
 
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = fjn_interrupt;
-
     /* General socket configuration */
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
@@ -278,8 +273,7 @@ static void fmvj18x_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "fmvj18x_detach\n");
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     fmvj18x_release(link);
 
@@ -425,8 +419,6 @@ static int fmvj18x_config(struct pcmcia_device *link)
     }
 
     if (link->io.NumPorts2 != 0) {
-        link->irq.Attributes =
-                IRQ_TYPE_DYNAMIC_SHARING;
         ret = mfc_try_io_port(link);
         if (ret != 0) goto failed;
     } else if (cardtype == UNGERMANN) {
@@ -437,14 +429,14 @@ static int fmvj18x_config(struct pcmcia_device *link)
             if (ret)
                     goto failed;
     }
-    ret = pcmcia_request_irq(link, &link->irq);
+    ret = pcmcia_request_irq(link, fjn_interrupt);
     if (ret)
             goto failed;
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
             goto failed;
 
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
 
     if (link->io.BasePort2 != 0) {
@@ -529,17 +521,13 @@ static int fmvj18x_config(struct pcmcia_device *link)
     }
 
     lp->cardtype = cardtype;
-    link->dev_node = &lp->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "fmvj18x_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(lp->node.dev_name, dev->name);
-
     /* print current configuration */
     printk(KERN_INFO "%s: %s, sram %s, port %#3lx, irq %d, "
            "hw_addr %pM\n",
diff --git a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
index 37f4a6fdc3ef..2e42d80f8cae 100644
--- a/drivers/net/pcmcia/ibmtr_cs.c
+++ b/drivers/net/pcmcia/ibmtr_cs.c
@@ -104,7 +104,6 @@ static void ibmtr_detach(struct pcmcia_device *p_dev);
 typedef struct ibmtr_dev_t {
         struct pcmcia_device    *p_dev;
     struct net_device   *dev;
-    dev_node_t          node;
     window_handle_t     sram_win_handle;
     struct tok_info     *ti;
 } ibmtr_dev_t;
@@ -156,8 +155,6 @@ static int __devinit ibmtr_attach(struct pcmcia_device *link)
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     link->io.NumPorts1 = 4;
     link->io.IOAddrLines = 16;
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.Handler = ibmtr_interrupt;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.Present = PRESENT_OPTION;
@@ -192,8 +189,7 @@ static void ibmtr_detach(struct pcmcia_device *link)
      */
     ti->sram_phys |= 1;
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
     
     del_timer_sync(&(ti->tr_timer));
 
@@ -238,11 +234,11 @@ static int __devinit ibmtr_config(struct pcmcia_device *link)
     }
     dev->base_addr = link->io.BasePort1;
 
-    ret = pcmcia_request_irq(link, &link->irq);
+    ret = pcmcia_request_exclusive_irq(link, ibmtr_interrupt);
     if (ret)
             goto failed;
-    dev->irq = link->irq.AssignedIRQ;
-    ti->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
+    ti->irq = link->irq;
     ti->global_int_enable=GLOBAL_INT_ENABLE+((dev->irq==9) ? 2 : dev->irq);
 
     /* Allocate the MMIO memory window */
@@ -291,18 +287,14 @@ static int __devinit ibmtr_config(struct pcmcia_device *link)
         Adapters Technical Reference"  SC30-3585 for this info.  */
     ibmtr_hw_setup(dev, mmiobase);
 
-    link->dev_node = &info->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     i = ibmtr_probe_card(dev);
     if (i != 0) {
         printk(KERN_NOTICE "ibmtr_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(info->node.dev_name, dev->name);
-
     printk(KERN_INFO
            "%s: port %#3lx, irq %d,  mmio %#5lx, sram %#5lx, hwaddr=%pM\n",
            dev->name, dev->base_addr, dev->irq,
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index c717b143f11a..d8a3b3cf246e 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -363,7 +363,6 @@ typedef struct _mace_statistics {
 
 typedef struct _mace_private {
         struct pcmcia_device    *p_dev;
-    dev_node_t node;
     struct net_device_stats linux_stats; /* Linux statistics counters */
     mace_statistics mace_stats; /* MACE chip statistics counters */
 
@@ -463,8 +462,6 @@ static int nmclan_probe(struct pcmcia_device *link)
     link->io.NumPorts1 = 32;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.IOAddrLines = 5;
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.Handler = mace_interrupt;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
@@ -493,8 +490,7 @@ static void nmclan_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "nmclan_detach\n");
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     nmclan_release(link);
 
@@ -652,14 +648,14 @@ static int nmclan_config(struct pcmcia_device *link)
   ret = pcmcia_request_io(link, &link->io);
   if (ret)
           goto failed;
-  ret = pcmcia_request_irq(link, &link->irq);
+  ret = pcmcia_request_exclusive_irq(link, mace_interrupt);
   if (ret)
           goto failed;
   ret = pcmcia_request_configuration(link, &link->conf);
   if (ret)
           goto failed;
 
-  dev->irq = link->irq.AssignedIRQ;
+  dev->irq = link->irq;
   dev->base_addr = link->io.BasePort1;
 
   ioaddr = dev->base_addr;
@@ -698,18 +694,14 @@ static int nmclan_config(struct pcmcia_device *link)
   else
     printk(KERN_NOTICE "nmclan_cs: invalid if_port requested\n");
 
-  link->dev_node = &lp->node;
   SET_NETDEV_DEV(dev, &link->dev);
 
   i = register_netdev(dev);
   if (i != 0) {
     printk(KERN_NOTICE "nmclan_cs: register_netdev() failed\n");
-    link->dev_node = NULL;
     goto failed;
   }
 
-  strcpy(lp->node.dev_name, dev->name);
-
   printk(KERN_INFO "%s: nmclan: port %#3lx, irq %d, %s port,"
          " hw_addr %pM\n",
          dev->name, dev->base_addr, dev->irq, if_names[dev->if_port],
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 4c0368de1815..6f77a768ba88 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -208,7 +208,6 @@ static hw_info_t dl10022_info = { 0, 0, 0, 0, IS_DL10022|HAS_MII };
 
 typedef struct pcnet_dev_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     u_int               flags;
     void                __iomem *base;
     struct timer_list   watchdog;
@@ -264,7 +263,6 @@ static int pcnet_probe(struct pcmcia_device *link)
     info->p_dev = link;
     link->priv = dev;
 
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -288,8 +286,7 @@ static void pcnet_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "pcnet_detach\n");
 
-        if (link->dev_node)
-                unregister_netdev(dev);
+        unregister_netdev(dev);
 
         pcnet_release(link);
 
@@ -488,8 +485,6 @@ static int try_io_port(struct pcmcia_device *link)
         if (link->io.NumPorts2 > 0) {
             /* for master/slave multifunction cards */
             link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
-            link->irq.Attributes =
-                IRQ_TYPE_DYNAMIC_SHARING;
         }
     } else {
         /* This should be two 16-port windows */
@@ -559,8 +554,7 @@ static int pcnet_config(struct pcmcia_device *link)
     if (ret)
         goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
 
     if (link->io.NumPorts2 == 8) {
@@ -574,7 +568,7 @@ static int pcnet_config(struct pcmcia_device *link)
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
             goto failed;
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
     if (info->flags & HAS_MISC_REG) {
         if ((if_port == 1) || (if_port == 2))
@@ -643,17 +637,13 @@ static int pcnet_config(struct pcmcia_device *link)
     if (info->flags & (IS_DL10019|IS_DL10022))
         mii_phy_probe(dev);
 
-    link->dev_node = &info->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "pcnet_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto failed;
     }
 
-    strcpy(info->node.dev_name, dev->name);
-
     if (info->flags & (IS_DL10019|IS_DL10022)) {
         u_char id = inb(dev->base_addr + 0x1a);
         printk(KERN_INFO "%s: NE2000 (DL100%d rev %02x): ",
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index fd9d6e34fda4..59796e7d09c4 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -103,7 +103,6 @@ struct smc_private {
     u_short                     manfid;
     u_short                     cardid;
 
-    dev_node_t                  node;
     struct sk_buff              *saved_skb;
     int                         packets_waiting;
     void                        __iomem *base;
@@ -323,14 +322,11 @@ static int smc91c92_probe(struct pcmcia_device *link)
         return -ENOMEM;
     smc = netdev_priv(dev);
     smc->p_dev = link;
-    link->priv = dev;
 
     spin_lock_init(&smc->lock);
     link->io.NumPorts1 = 16;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.IOAddrLines = 4;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = &smc_interrupt;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -363,8 +359,7 @@ static void smc91c92_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "smc91c92_detach\n");
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     smc91c92_release(link);
 
@@ -453,7 +448,6 @@ static int mhz_mfc_config(struct pcmcia_device *link)
 
     link->conf.Attributes |= CONF_ENABLE_SPKR;
     link->conf.Status = CCSR_AUDIO_ENA;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->io.IOAddrLines = 16;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
     link->io.NumPorts2 = 8;
@@ -652,7 +646,6 @@ static int osi_config(struct pcmcia_device *link)
 
     link->conf.Attributes |= CONF_ENABLE_SPKR;
     link->conf.Status = CCSR_AUDIO_ENA;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->io.NumPorts1 = 64;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
     link->io.NumPorts2 = 8;
@@ -877,7 +870,7 @@ static int smc91c92_config(struct pcmcia_device *link)
     if (i)
             goto config_failed;
 
-    i = pcmcia_request_irq(link, &link->irq);
+    i = pcmcia_request_irq(link, smc_interrupt);
     if (i)
             goto config_failed;
     i = pcmcia_request_configuration(link, &link->conf);
@@ -887,7 +880,7 @@ static int smc91c92_config(struct pcmcia_device *link)
     if (smc->manfid == MANFID_MOTOROLA)
         mot_config(link);
 
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
 
     if ((if_port >= 0) && (if_port <= 2))
         dev->if_port = if_port;
@@ -960,17 +953,13 @@ static int smc91c92_config(struct pcmcia_device *link)
         SMC_SELECT_BANK(0);
     }
 
-    link->dev_node = &smc->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if (register_netdev(dev) != 0) {
         printk(KERN_ERR "smc91c92_cs: register_netdev() failed\n");
-        link->dev_node = NULL;
         goto config_undo;
     }
 
-    strcpy(smc->node.dev_name, dev->name);
-
     printk(KERN_INFO "%s: smc91c%s rev %d: io %#3lx, irq %d, "
            "hw_addr %pM\n",
            dev->name, name, (rev & 0x0f), dev->base_addr, dev->irq,
@@ -1804,23 +1793,30 @@ static void media_check(u_long arg)
     SMC_SELECT_BANK(1);
     media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
 
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
+
     /* Check for pending interrupt with watchdog flag set: with
        this, we can limp along even if the interrupt is blocked */
     if (smc->watchdog++ && ((i>>8) & i)) {
         if (!smc->fast_poll)
             printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
         smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
         smc->fast_poll = HZ;
     }
     if (smc->fast_poll) {
         smc->fast_poll--;
         smc->media.expires = jiffies + HZ/100;
         add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
         return;
     }
 
+    spin_lock_irqsave(&smc->lock, flags);
+
+    saved_bank = inw(ioaddr + BANK_SELECT);
+
     if (smc->cfg & CFG_MII_SELECT) {
         if (smc->mii_if.phy_id < 0)
             goto reschedule;
@@ -1978,15 +1974,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_gset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_get_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -1996,15 +1993,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_sset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_set_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2014,12 +2012,13 @@ static u32 smc_get_link(struct net_device *dev)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         u32 ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         ret = smc_link_ok(dev);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2056,16 +2055,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
         int rc = 0;
         u16 saved_bank;
         unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
 
         if (!netif_running(dev))
                 return -EINVAL;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         saved_bank = inw(ioaddr + BANK_SELECT);
         SMC_SELECT_BANK(3);
         rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return rc;
 }
 
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index 4d1802e457be..5e6b62ba8887 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -297,31 +297,9 @@ static void xirc2ps_detach(struct pcmcia_device *p_dev);
 
 static irqreturn_t xirc2ps_interrupt(int irq, void *dev_id);
 
-/****************
- * A linked list of "instances" of the device.  Each actual
- * PCMCIA card corresponds to one device instance, and is described
- * by one struct pcmcia_device structure (defined in ds.h).
- *
- * You may not want to use a linked list for this -- for example, the
- * memory card driver uses an array of struct pcmcia_device pointers, where minor
- * device numbers are used to derive the corresponding array index.
- */
-
-/****************
- * A driver needs to provide a dev_node_t structure for each device
- * on a card.  In some cases, there is only one device per card (for
- * example, ethernet cards, modems).  In other cases, there may be
- * many actual or logical devices (SCSI adapters, memory cards with
- * multiple partitions).  The dev_node_t structures need to be kept
- * in a linked list starting at the 'dev' field of a struct pcmcia_device
- * structure.  We allocate them in the card's private data structure,
- * because they generally can't be allocated dynamically.
- */
-
 typedef struct local_info_t {
         struct net_device       *dev;
         struct pcmcia_device    *p_dev;
-    dev_node_t node;
 
     int card_type;
     int probe_port;
@@ -555,7 +533,6 @@ xirc2ps_probe(struct pcmcia_device *link)
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
-    link->irq.Handler = xirc2ps_interrupt;
 
     /* Fill in card specific entries */
     dev->netdev_ops = &netdev_ops;
@@ -580,8 +557,7 @@ xirc2ps_detach(struct pcmcia_device *link)
 
     dev_dbg(&link->dev, "detach\n");
 
-    if (link->dev_node)
-        unregister_netdev(dev);
+    unregister_netdev(dev);
 
     xirc2ps_release(link);
 
@@ -841,7 +817,6 @@ xirc2ps_config(struct pcmcia_device * link)
             link->conf.Attributes |= CONF_ENABLE_SPKR;
             link->conf.Status |= CCSR_AUDIO_ENA;
         }
-        link->irq.Attributes |= IRQ_TYPE_DYNAMIC_SHARING;
         link->io.NumPorts2 = 8;
         link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
         if (local->dingo) {
@@ -866,7 +841,6 @@ xirc2ps_config(struct pcmcia_device * link)
         }
         printk(KNOT_XIRC "no ports available\n");
     } else {
-        link->irq.Attributes |= IRQ_TYPE_DYNAMIC_SHARING;
         link->io.NumPorts1 = 16;
         for (ioaddr = 0x300; ioaddr < 0x400; ioaddr += 0x10) {
             link->io.BasePort1 = ioaddr;
@@ -885,7 +859,7 @@ xirc2ps_config(struct pcmcia_device * link)
      * Now allocate an interrupt line.  Note that this does not
      * actually assign a handler to the interrupt.
      */
-    if ((err=pcmcia_request_irq(link, &link->irq)))
+    if ((err=pcmcia_request_irq(link, xirc2ps_interrupt)))
         goto config_error;
 
     /****************
@@ -982,23 +956,19 @@ xirc2ps_config(struct pcmcia_device * link)
         printk(KNOT_XIRC "invalid if_port requested\n");
 
     /* we can now register the device with the net subsystem */
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
 
     if (local->dingo)
         do_reset(dev, 1); /* a kludge to make the cem56 work */
 
-    link->dev_node = &local->node;
     SET_NETDEV_DEV(dev, &link->dev);
 
     if ((err=register_netdev(dev))) {
         printk(KNOT_XIRC "register_netdev() failed\n");
-        link->dev_node = NULL;
         goto config_error;
     }
 
-    strcpy(local->node.dev_name, dev->name);
-
     /* give some infos about the hardware */
     printk(KERN_INFO "%s: %s: port %#3lx, irq %d, hwaddr %pM\n",
            dev->name, local->manf_str,(u_long)dev->base_addr, (int)dev->irq,
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d78..a527e37728cd 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
         ---help---
           Supports the LSI ET1011C PHY.
 
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
+
 config FIXED_PHY
         bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
         depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af381..13bebab65d02 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
index a872aea4ed74..f443d43edd80 100644
--- a/drivers/net/phy/mdio-octeon.c
+++ b/drivers/net/phy/mdio-octeon.c
@@ -88,6 +88,7 @@ static int octeon_mdiobus_write(struct mii_bus *bus, int phy_id,
 static int __init octeon_mdiobus_probe(struct platform_device *pdev)
 {
         struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
         int i;
         int err = -ENOENT;
 
@@ -103,6 +104,10 @@ static int __init octeon_mdiobus_probe(struct platform_device *pdev)
         if (!bus->mii_bus)
                 goto err;
 
+        smi_en.u64 = 0;
+        smi_en.s.en = 1;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
+
         /*
          * Standard Octeon evaluation boards don't support phy
          * interrupts, we need to poll.
@@ -133,17 +138,22 @@ err_register:
 
 err:
         devm_kfree(&pdev->dev, bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
         return err;
 }
 
 static int __exit octeon_mdiobus_remove(struct platform_device *pdev)
 {
         struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
 
         bus = dev_get_drvdata(&pdev->dev);
 
         mdiobus_unregister(bus->mii_bus);
         mdiobus_free(bus->mii_bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
         return 0;
 }
 
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 000000000000..e67691dca4ab
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,105 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+
+
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+
+
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .name           = "Micrel KS8001",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+
+static int __init ksphy_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6e281bc825e5..8518a2e58e53 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         DECLARE_WAITQUEUE(wait, current);
         ssize_t ret;
         struct sk_buff *skb = NULL;
+        struct iovec iov;
 
         ret = count;
 
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         if (skb->len > count)
                 goto outf;
         ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                 goto outf;
         ret = skb->len;
 
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         struct channel *pch = chan->ppp;
         int proto;
 
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                 kfree_skb(skb);
                 return;
         }
 
-        proto = PPP_PROTO(skb);
         read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+
+        proto = PPP_PROTO(skb);
         if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                 /* put it on the channel queue */
                 skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         } else {
                 ppp_do_recv(pch->ppp, skb, pch);
         }
+
+done:
         read_unlock_bh(&pch->upl);
 }
 
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                 /* XXX do channel-level decompression here */
                 if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 else
 #endif /* CONFIG_PPP_MULTILINK */
                         ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
         }
-
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 
 static void
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index dbb1f5a1824c..dd8106ff35aa 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1042,14 +1042,14 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         u32 opts2 = le32_to_cpu(desc->opts2);
         struct vlan_group *vlgrp = tp->vlgrp;
         int ret;
 
         if (vlgrp && (opts2 & RxVlanTag)) {
-                vlan_hwaccel_receive_skb(skb, vlgrp, swab16(opts2 & 0xffff));
+                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
                 ret = 0;
         } else
                 ret = -1;
@@ -1066,7 +1066,7 @@ static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         return -1;
 }
@@ -2759,6 +2759,7 @@ static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
 {
         iounmap(ioaddr);
         pci_release_regions(pdev);
+        pci_clear_mwi(pdev);
         pci_disable_device(pdev);
         free_netdev(dev);
 }
@@ -2825,8 +2826,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
         spin_lock_irq(&tp->lock);
 
         RTL_W8(Cfg9346, Cfg9346_Unlock);
+
         RTL_W32(MAC4, high);
+        RTL_R32(MAC4);
+
         RTL_W32(MAC0, low);
+        RTL_R32(MAC0);
+
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
         spin_unlock_irq(&tp->lock);
@@ -3014,9 +3020,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_free_dev_1;
         }
 
-        rc = pci_set_mwi(pdev);
-        if (rc < 0)
-                goto err_out_disable_2;
+        if (pci_set_mwi(pdev) < 0)
+                netif_info(tp, probe, dev, "Mem-Wr-Inval unavailable\n");
 
         /* make sure PCI base addr 1 is MMIO */
         if (!(pci_resource_flags(pdev, region) & IORESOURCE_MEM)) {
@@ -3024,7 +3029,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                           "region #%d not an MMIO resource, aborting\n",
                           region);
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         /* check for weird/broken PCI region reporting */
@@ -3032,13 +3037,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 netif_err(tp, probe, dev,
                           "Invalid PCI region size(s), aborting\n");
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         rc = pci_request_regions(pdev, MODULENAME);
         if (rc < 0) {
                 netif_err(tp, probe, dev, "could not request regions\n");
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         tp->cp_cmd = PCIMulRW | RxChkSum;
@@ -3051,7 +3056,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (rc < 0) {
                         netif_err(tp, probe, dev, "DMA configuration failed\n");
-                        goto err_out_free_res_4;
+                        goto err_out_free_res_3;
                 }
         }
 
@@ -3060,7 +3065,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!ioaddr) {
                 netif_err(tp, probe, dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
-                goto err_out_free_res_4;
+                goto err_out_free_res_3;
         }
 
         tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
@@ -3102,7 +3107,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (i == ARRAY_SIZE(rtl_chip_info)) {
                 dev_err(&pdev->dev,
                         "driver bug, MAC version not found in rtl_chip_info\n");
-                goto err_out_msi_5;
+                goto err_out_msi_4;
         }
         tp->chipset = i;
 
@@ -3167,7 +3172,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         rc = register_netdev(dev);
         if (rc < 0)
-                goto err_out_msi_5;
+                goto err_out_msi_4;
 
         pci_set_drvdata(pdev, dev);
 
@@ -3190,14 +3195,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 out:
         return rc;
 
-err_out_msi_5:
+err_out_msi_4:
         rtl_disable_msi(pdev, tp);
         iounmap(ioaddr);
-err_out_free_res_4:
+err_out_free_res_3:
         pci_release_regions(pdev);
-err_out_mwi_3:
+err_out_mwi_2:
         pci_clear_mwi(pdev);
-err_out_disable_2:
         pci_disable_device(pdev);
 err_out_free_dev_1:
         free_netdev(dev);
@@ -4441,12 +4445,20 @@ out:
         return done;
 }
 
+/*
+ * Warning : rtl8169_rx_interrupt() might be called :
+ * 1) from NAPI (softirq) context
+ *      (polling = 1 : we should call netif_receive_skb())
+ * 2) from process context (rtl8169_reset_task())
+ *      (polling = 0 : we must call netif_rx() instead)
+ */
 static int rtl8169_rx_interrupt(struct net_device *dev,
                                 struct rtl8169_private *tp,
                                 void __iomem *ioaddr, u32 budget)
 {
         unsigned int cur_rx, rx_left;
         unsigned int delta, count;
+        int polling = (budget != ~(u32)0) ? 1 : 0;
 
         cur_rx = tp->cur_rx;
         rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
@@ -4508,8 +4520,12 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
-                        if (rtl8169_rx_vlan_skb(tp, desc, skb) < 0)
-                                netif_receive_skb(skb);
+                        if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
+                                if (likely(polling))
+                                        netif_receive_skb(skb);
+                                else
+                                        netif_rx(skb);
+                        }
 
                         dev->stats.rx_bytes += pkt_size;
                         dev->stats.rx_packets++;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 9944e5d662c0..04efc0c1bda9 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2353,17 +2353,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
 
         sc->mii_bus = mdiobus_alloc();
         if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto uninit_ctx;
         }
 
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR "%s.%d: unable to register netdev\n",
                        sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
-                sbmac_uninitctx(sc);
-                return err;
+                goto unreg_mdio;
         }
 
         pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2398,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
         pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
                dev->name, base, eaddr);
 
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
-
         return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
 
 
@@ -2417,16 +2432,6 @@ static int sbmac_open(struct net_device *dev)
                 goto out_err;
         }
 
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
-
         sc->sbm_speed = sbmac_speed_none;
         sc->sbm_duplex = sbmac_duplex_none;
         sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2462,7 @@ static int sbmac_open(struct net_device *dev)
         return 0;
 
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-
-out_unirq:
         free_irq(dev->irq, dev);
-
 out_err:
         return err;
 }
@@ -2650,9 +2651,6 @@ static int sbmac_close(struct net_device *dev)
 
         phy_disconnect(sc->phy_dev);
         sc->phy_dev = NULL;
-
-        mdiobus_unregister(sc->mii_bus);
-
         free_irq(dev->irq, dev);
 
         sbdma_emptyring(&(sc->sbm_txdma));
@@ -2760,6 +2758,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
 
         unregister_netdev(dev);
         sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
         mdiobus_free(sc->mii_bus);
         iounmap(sc->sbm_base);
         free_netdev(dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 6486657c47b8..649a264d6a81 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1861,6 +1861,7 @@ out:
         }
 
         if (disabled) {
+                dev_close(efx->net_dev);
                 EFX_ERR(efx, "has been disabled\n");
                 efx->state = STATE_DISABLED;
         } else {
@@ -1884,8 +1885,7 @@ static void efx_reset_work(struct work_struct *data)
         }
 
         rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
-                dev_close(efx->net_dev);
+        (void)efx_reset(efx, efx->reset_pending);
         rtnl_unlock();
 }
 
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d294d66fd600..08278e7302b3 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -1320,7 +1320,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
 
         EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
 
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
 
         kfree(nvconfig);
         return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
         },
 };
 
-static const struct falcon_board_type falcon_dummy_board = {
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
         struct falcon_board *board = falcon_board(efx);
         u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                          (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                          ? board->type->ref_model : board->type->gen_type,
                          'A' + board->major, board->minor);
+                return 0;
         } else {
                 EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
         }
 }
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 9351c0331a47..3166bafdfbef 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
  **************************************************************************
  */
 
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 38dcc42c4f79..e0c46f59d1f8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -456,8 +456,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
-                cpu_relax();
+        int retry;
+
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+
+        /* Use the old values instead */
 }
 
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 22cf1c446de3..ecc41cffb470 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8633,6 +8633,7 @@ static int tg3_test_msi(struct tg3 *tp)
         pci_disable_msi(tp->pdev);
 
         tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
+        tp->napi[0].irq_vec = tp->pdev->irq;
 
         err = tg3_request_irq(tp, 0);
         if (err)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,25 @@ config USB_CDC_PHONET
           cellular modem, as found on most Nokia handsets with the
           "PC suite" USB profile.
 
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,6 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c8cdb7f30adc..3547cf13d219 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -431,6 +431,7 @@ static const struct driver_info mbm_info = {
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 04b281002a76..5dfed9297b22 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                 goto out;
 
         dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
 
         for (i = 0; i < DM_TIMEOUT; i++) {
                 u8 tmp;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..418825d26f90
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,569 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error_nomem;
+
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto free_tx_urb;
+
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto free_rx_urb;
+
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto free_tx_buf;
+
+
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+
+free_tx_buf:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+free_rx_urb:
+        usb_free_urb(rx_urb);
+free_tx_urb:
+        usb_free_urb(tx_urb);
+error_nomem:
+        return -ENOMEM;
+}
+
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+
+        return retval;
+}
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+
+        usb_set_intfdata(intf, dev);
+
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+
+static int __init ipheth_init(void)
+{
+        int retval;
+
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
         { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
         { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
         { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
         { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
         { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
         { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..f1942d69a0d5
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1004 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+
+/* Private data structure */
+struct sierra_net_data {
+
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+
+        u8 ifnum;       /* interface number */
+
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+
+        return 1;
+}
+
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+
+        return status;
+}
+
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+
+        return status;
+}
+
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+
+        /* Set link_sense true */
+        return 1;
+}
+
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        if (urb->actual_length < sizeof *event)
+                return;
+
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+
+        return usbnet_change_mtu(net, new_mtu);
+}
+
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+
+        *datap = *attrdata;
+
+        kfree(attrdata);
+        return result;
+}
+
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+
+        sierra_net_set_private(dev, priv);
+
+        priv->kevent_flags = 0;
+
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+
+        return 0;
+}
+
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+
+        flush_scheduled_work();
+
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+
+        sierra_net_set_private(dev, NULL);
+
+        kfree(priv);
+}
+
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+
+        return new_skb;
+}
+
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+
+                skb_pull(skb, hh.hdrlen);
+
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+
+        } /* while */
+
+        return 0;
+}
+
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+
+        /* tx_dropped incremented by usbnet */
+
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+
+        return usb_register(&sierra_net_driver);
+}
+
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index f9f0730b53d5..5ec542dd5b50 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -187,7 +187,6 @@ tx_drop:
         return NETDEV_TX_OK;
 
 rx_drop:
-        kfree_skb(skb);
         rcv_stats->rx_dropped++;
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index f6036fb42319..33bdc6a84e81 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -75,42 +75,7 @@ static void airo_release(struct pcmcia_device *link);
 
 static void airo_detach(struct pcmcia_device *p_dev);
 
-/*
-   You'll also need to prototype all the functions that will actually
-   be used to talk to your device.  See 'pcmem_cs' for a good example
-   of a fully self-sufficient driver; the other drivers rely more or
-   less on other parts of the kernel.
-*/
-
-/*
-   A linked list of "instances" of the  aironet device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one struct pcmcia_device structure (defined in ds.h).
-
-   You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of struct pcmcia_device pointers,
-   where minor device numbers are used to derive the corresponding
-   array index.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally shouldn't be allocated dynamically.
-
-   In this case, we also provide a flag to indicate if a device is
-   "stopped" due to a power management event, or card ejection.  The
-   device IO routines can use a flag like this to throttle IO to a
-   card that is not ready to accept it.
-*/
-
 typedef struct local_info_t {
-        dev_node_t      node;
         struct net_device *eth_dev;
 } local_info_t;
 
@@ -132,10 +97,6 @@ static int airo_probe(struct pcmcia_device *p_dev)
 
         dev_dbg(&p_dev->dev, "airo_attach()\n");
 
-        /* Interrupt setup */
-        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.Handler = NULL;
-
         /*
           General socket configuration defaults can go here.  In this
           client, we assume very little, and rely on the CIS for almost
@@ -212,9 +173,7 @@ static int airo_cs_config_check(struct pcmcia_device *p_dev,
         else if (dflt->vpp1.present & (1<<CISTPL_POWER_VNOM))
                 p_dev->conf.Vpp = dflt->vpp1.param[CISTPL_POWER_VNOM]/10000;
 
-        /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -300,16 +259,8 @@ static int airo_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-          Allocate an interrupt line.  Note that this does not assign a
-          handler to the interrupt, unless the 'Handler' member of the
-          irq structure is initialized.
-        */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
 
         /*
           This actually configures the PCMCIA socket -- setting up
@@ -320,26 +271,17 @@ static int airo_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
         ((local_info_t *)link->priv)->eth_dev =
-                init_airo_card(link->irq.AssignedIRQ,
+                init_airo_card(link->irq,
                                link->io.BasePort1, 1, &link->dev);
         if (!((local_info_t *)link->priv)->eth_dev)
                 goto failed;
 
-        /*
-          At this point, the dev_node_t structure(s) need to be
-          initialized and arranged in a linked list at link->dev_node.
-        */
-        strcpy(dev->node.dev_name, ((local_info_t *)link->priv)->eth_dev->name);
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x: ",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x: ",
+               link->conf.ConfigIndex);
         if (link->conf.Vpp)
                 printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
-        if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %d", link->irq.AssignedIRQ);
+        printk(", irq %d", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1+link->io.NumPorts1-1);
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 99a6da464bd3..e1c2fcaa8bed 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
         struct device *parent = aru->udev->dev.parent;
 
+        complete(&aru->firmware_loading_complete);
+
         /* unbind anything failed */
         if (parent)
                 down(&parent->sem);
         device_release_driver(&aru->udev->dev);
         if (parent)
                 up(&parent->sem);
+
+        usb_put_dev(aru->udev);
 }
 
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
         if (err)
                 goto err_unrx;
 
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
         return;
 
  err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         init_usb_anchor(&aru->tx_pending);
         init_usb_anchor(&aru->tx_submitted);
         init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         if (err)
                 goto err_freehw;
 
+        usb_get_dev(aru->udev);
         return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                        &aru->udev->dev, GFP_KERNEL, aru,
                                        ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                 return;
 
         aru->common.state = AR9170_IDLE;
+
+        wait_for_completion(&aru->firmware_loading_complete);
+
         ar9170_unregister(&aru->common);
         ar9170_usb_cancel_urbs(aru);
 
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ceb..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
+        struct completion firmware_loading_complete;
         int readlen;
         u8 *readbuf;
 
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index 32407911842f..c2746fc7f2be 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -85,41 +85,7 @@ static void atmel_release(struct pcmcia_device *link);
 
 static void atmel_detach(struct pcmcia_device *p_dev);
 
-/*
-   You'll also need to prototype all the functions that will actually
-   be used to talk to your device.  See 'pcmem_cs' for a good example
-   of a fully self-sufficient driver; the other drivers rely more or
-   less on other parts of the kernel.
-*/
-
-/*
-   A linked list of "instances" of the  atmelnet device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one struct pcmcia_device structure (defined in ds.h).
-
-   You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of struct pcmcia_device pointers, where minor
-   device numbers are used to derive the corresponding array index.
-*/
-
-/*
-   A driver needs to provide a dev_node_t structure for each device
-   on a card.  In some cases, there is only one device per card (for
-   example, ethernet cards, modems).  In other cases, there may be
-   many actual or logical devices (SCSI adapters, memory cards with
-   multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a struct pcmcia_device
-   structure.  We allocate them in the card's private data structure,
-   because they generally shouldn't be allocated dynamically.
-
-   In this case, we also provide a flag to indicate if a device is
-   "stopped" due to a power management event, or card ejection.  The
-   device IO routines can use a flag like this to throttle IO to a
-   card that is not ready to accept it.
-*/
-
 typedef struct local_info_t {
-        dev_node_t      node;
         struct net_device *eth_dev;
 } local_info_t;
 
@@ -141,10 +107,6 @@ static int atmel_probe(struct pcmcia_device *p_dev)
 
         dev_dbg(&p_dev->dev, "atmel_attach()\n");
 
-        /* Interrupt setup */
-        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.Handler = NULL;
-
         /*
           General socket configuration defaults can go here.  In this
           client, we assume very little, and rely on the CIS for almost
@@ -226,9 +188,7 @@ static int atmel_config_check(struct pcmcia_device *p_dev,
         else if (dflt->vpp1.present & (1<<CISTPL_POWER_VNOM))
                 p_dev->conf.Vpp = dflt->vpp1.param[CISTPL_POWER_VNOM]/10000;
 
-        /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -278,15 +238,9 @@ static int atmel_config(struct pcmcia_device *link)
         if (pcmcia_loop_config(link, atmel_config_check, NULL))
                 goto failed;
 
-        /*
-          Allocate an interrupt line.  Note that this does not assign a
-          handler to the interrupt, unless the 'Handler' member of the
-          irq structure is initialized.
-        */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
+        if (!link->irq) {
+                dev_err(&link->dev, "atmel: cannot assign IRQ: check that CONFIG_ISA is set in kernel config.");
+                goto failed;
         }
 
         /*
@@ -298,14 +252,8 @@ static int atmel_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        if (link->irq.AssignedIRQ == 0) {
-                printk(KERN_ALERT
-                       "atmel: cannot assign IRQ: check that CONFIG_ISA is set in kernel config.");
-                goto failed;
-        }
-
         ((local_info_t*)link->priv)->eth_dev =
-                init_atmel_card(link->irq.AssignedIRQ,
+                init_atmel_card(link->irq,
                                 link->io.BasePort1,
                                 did ? did->driver_info : ATMEL_FW_TYPE_NONE,
                                 &link->dev,
@@ -315,14 +263,6 @@ static int atmel_config(struct pcmcia_device *link)
                         goto failed;
 
 
-        /*
-          At this point, the dev_node_t structure(s) need to be
-          initialized and arranged in a linked list at link->dev_node.
-        */
-        strcpy(dev->node.dev_name, ((local_info_t*)link->priv)->eth_dev->name );
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         return 0;
 
  failed:
diff --git a/drivers/net/wireless/b43/pcmcia.c b/drivers/net/wireless/b43/pcmcia.c
index 609e7051e018..0e99b634267c 100644
--- a/drivers/net/wireless/b43/pcmcia.c
+++ b/drivers/net/wireless/b43/pcmcia.c
@@ -98,10 +98,7 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         if (res != 0)
                 goto err_disable;
 
-        dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        dev->irq.Handler = NULL; /* The handler is registered later. */
-        res = pcmcia_request_irq(dev, &dev->irq);
-        if (res != 0)
+        if (!dev->irq)
                 goto err_disable;
 
         res = pcmcia_request_configuration(dev, &dev->conf);
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index a36501dbbe02..db72461c486b 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -39,7 +39,6 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Ignore broken CIS VCC entry");
 
 /* struct local_info::hw_priv */
 struct hostap_cs_priv {
-        dev_node_t node;
         struct pcmcia_device *link;
         int sandisk_connectplus;
 };
@@ -556,15 +555,7 @@ static int prism2_config_check(struct pcmcia_device *p_dev,
                 p_dev->conf.Vpp = dflt->vpp1.param[CISTPL_POWER_VNOM] / 10000;
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
-        else if (!(p_dev->conf.Attributes & CONF_ENABLE_IRQ)) {
-                /* At least Compaq WL200 does not have IRQInfo1 set,
-                 * but it does not work without interrupts.. */
-                printk(KERN_WARNING "Config has no IRQ info, but trying to "
-                       "enable IRQ anyway..\n");
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
-        }
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         PDEBUG(DEBUG_EXTRA, "IO window settings: cfg->io.nwin=%d "
@@ -633,21 +624,10 @@ static int prism2_config(struct pcmcia_device *link)
         local = iface->local;
         local->hw_priv = hw_priv;
         hw_priv->link = link;
-        strcpy(hw_priv->node.dev_name, dev->name);
-        link->dev_node = &hw_priv->node;
 
-        /*
-         * Allocate an interrupt line.  Note that this does not assign a
-         * handler to the interrupt, unless the 'Handler' member of the
-         * irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-                link->irq.Handler = prism2_interrupt;
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        ret = pcmcia_request_irq(link, prism2_interrupt);
+        if (ret)
+                goto failed;
 
         /*
          * This actually configures the PCMCIA socket -- setting up
@@ -658,7 +638,7 @@ static int prism2_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        dev->irq = link->irq.AssignedIRQ;
+        dev->irq = link->irq;
         dev->base_addr = link->io.BasePort1;
 
         /* Finally, report what we've done */
@@ -668,7 +648,7 @@ static int prism2_config(struct pcmcia_device *link)
                 printk(", Vpp %d.%d", link->conf.Vpp / 10,
                        link->conf.Vpp % 10);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %d", link->irq.AssignedIRQ);
+                printk(", irq %d", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1+link->io.NumPorts1-1);
@@ -682,11 +662,9 @@ static int prism2_config(struct pcmcia_device *link)
         sandisk_enable_wireless(dev);
 
         ret = prism2_hw_config(dev, 1);
-        if (!ret) {
+        if (!ret)
                 ret = hostap_hw_ready(dev);
-                if (ret == 0 && local->ddev)
-                        strcpy(hw_priv->node.dev_name, local->ddev->name);
-        }
+
         return ret;
 
  failed:
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9b72c45a7748..2b05fe5e994c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -174,6 +174,8 @@ that only one external action is invoked at a time.
 #define DRV_DESCRIPTION "Intel(R) PRO/Wireless 2100 Network Driver"
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2006 Intel Corporation"
 
+struct pm_qos_request_list *ipw2100_pm_qos_req;
+
 /* Debugging stuff */
 #ifdef CONFIG_IPW2100_DEBUG
 #define IPW2100_RX_DEBUG        /* Reception debugging */
@@ -1739,7 +1741,7 @@ static int ipw2100_up(struct ipw2100_priv *priv, int deferred)
         /* the ipw2100 hardware really doesn't want power management delays
          * longer than 175usec
          */
-        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100", 175);
+        pm_qos_update_request(ipw2100_pm_qos_req, 175);
 
         /* If the interrupt is enabled, turn it off... */
         spin_lock_irqsave(&priv->low_lock, flags);
@@ -1887,8 +1889,7 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         ipw2100_disable_interrupts(priv);
         spin_unlock_irqrestore(&priv->low_lock, flags);
 
-        pm_qos_update_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
-                        PM_QOS_DEFAULT_VALUE);
+        pm_qos_update_request(ipw2100_pm_qos_req, PM_QOS_DEFAULT_VALUE);
 
         /* We have to signal any supplicant if we are disassociating */
         if (associated)
@@ -6669,7 +6670,7 @@ static int __init ipw2100_init(void)
         if (ret)
                 goto out;
 
-        pm_qos_add_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100",
+        ipw2100_pm_qos_req = pm_qos_add_request(PM_QOS_CPU_DMA_LATENCY,
                         PM_QOS_DEFAULT_VALUE);
 #ifdef CONFIG_IPW2100_DEBUG
         ipw2100_debug_level = debug;
@@ -6692,7 +6693,7 @@ static void __exit ipw2100_exit(void)
                            &driver_attr_debug_level);
 #endif
         pci_unregister_driver(&ipw2100_pci_driver);
-        pm_qos_remove_requirement(PM_QOS_CPU_DMA_LATENCY, "ipw2100");
+        pm_qos_remove_request(ipw2100_pm_qos_req);
 }
 
 module_init(ipw2100_init);
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b3..f4e59ae07f8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f7086632..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -3358,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -506,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..741e65ec8301 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
         priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
         queue_work(priv->workqueue, &priv->request_scan);
-
-out:
-        return ret;
+ unlock:
+        mutex_unlock(&priv->mutex);
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 
@@ -805,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                         rate = IWL_RATE_1M_PLCP;
                         rate_flags = RATE_MCS_CCK_MSK;
                 }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
         } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                 band = IEEE80211_BAND_5GHZ;
                 rate = IWL_RATE_6M_PLCP;
                 /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
 
                 /* Force use of chains B and C (0x6) for scan Rx for 4965
                  * Avoid A (0x1) because of its off-channel reception on A-band.
@@ -965,6 +986,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e1..b74a56c48d26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 6d55439a7b97..08e4e3908003 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -777,7 +777,7 @@ static void if_cs_release(struct pcmcia_device *p_dev)
 
         lbs_deb_enter(LBS_DEB_CS);
 
-        free_irq(p_dev->irq.AssignedIRQ, card);
+        free_irq(p_dev->irq, card);
         pcmcia_disable_device(p_dev);
         if (card->iobase)
                 ioport_unmap(card->iobase);
@@ -807,8 +807,7 @@ static int if_cs_ioprobe(struct pcmcia_device *p_dev,
         p_dev->io.NumPorts1 = cfg->io.win[0].len;
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         if (cfg->io.nwin != 1) {
@@ -837,9 +836,6 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
         card->p_dev = p_dev;
         p_dev->priv = card;
 
-        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.Handler = NULL;
-
         p_dev->conf.Attributes = 0;
         p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -854,13 +850,8 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
          * a handler to the interrupt, unless the 'Handler' member of
          * the irq structure is initialized.
          */
-        if (p_dev->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(p_dev, &p_dev->irq);
-                if (ret) {
-                        lbs_pr_err("error in pcmcia_request_irq\n");
-                        goto out1;
-                }
-        }
+        if (!p_dev->irq)
+                goto out1;
 
         /* Initialize io access */
         card->iobase = ioport_map(p_dev->io.BasePort1, p_dev->io.NumPorts1);
@@ -883,7 +874,7 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
 
         /* Finally, report what we've done */
         lbs_deb_cs("irq %d, io 0x%04x-0x%04x\n",
-               p_dev->irq.AssignedIRQ, p_dev->io.BasePort1,
+               p_dev->irq, p_dev->io.BasePort1,
                p_dev->io.BasePort1 + p_dev->io.NumPorts1 - 1);
 
         /*
@@ -940,7 +931,7 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
         priv->fw_ready = 1;
 
         /* Now actually get the IRQ */
-        ret = request_irq(p_dev->irq.AssignedIRQ, if_cs_interrupt,
+        ret = request_irq(p_dev->irq, if_cs_interrupt,
                 IRQF_SHARED, DRV_NAME, card);
         if (ret) {
                 lbs_pr_err("error in request_irq\n");
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index 1d4ada188eda..03056ab73032 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -50,7 +50,6 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket
  * struct orinoco_private */
 struct orinoco_pccard {
         struct pcmcia_device    *p_dev;
-        dev_node_t node;
 
         /* Used to handle hard reset */
         /* yuck, we need this hack to work around the insanity of the
@@ -119,10 +118,6 @@ orinoco_cs_probe(struct pcmcia_device *link)
         card->p_dev = link;
         link->priv = priv;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = orinoco_interrupt;
-
         /* General socket configuration defaults can go here.  In this
          * client, we assume very little, and rely on the CIS for
          * almost everything.  In most clients, many details (i.e.,
@@ -144,8 +139,7 @@ static void orinoco_cs_detach(struct pcmcia_device *link)
 {
         struct orinoco_private *priv = link->priv;
 
-        if (link->dev_node)
-                orinoco_if_del(priv);
+        orinoco_if_del(priv);
 
         orinoco_cs_release(link);
 
@@ -230,7 +224,6 @@ static int
 orinoco_cs_config(struct pcmcia_device *link)
 {
         struct orinoco_private *priv = link->priv;
-        struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
         int ret;
         void __iomem *mem;
@@ -258,12 +251,7 @@ orinoco_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-         * Allocate an interrupt line.  Note that this does not assign
-         * a handler to the interrupt, unless the 'Handler' member of
-         * the irq structure is initialized.
-         */
-        ret = pcmcia_request_irq(link, &link->irq);
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
         if (ret)
                 goto failed;
 
@@ -285,9 +273,6 @@ orinoco_cs_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /* Ok, we have the configuration, prepare to register the netdev */
-        card->node.major = card->node.minor = 0;
-
         /* Initialise the main driver */
         if (orinoco_init(priv) != 0) {
                 printk(KERN_ERR PFX "orinoco_init() failed\n");
@@ -296,17 +281,11 @@ orinoco_cs_config(struct pcmcia_device *link)
 
         /* Register an interface with the stack */
         if (orinoco_if_add(priv, link->io.BasePort1,
-                           link->irq.AssignedIRQ) != 0) {
+                           link->irq) != 0) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto failed;
         }
 
-        /* At this point, the dev_node_t structure(s) needs to be
-         * initialized and arranged in a linked list at link->dev_node. */
-        strcpy(card->node.dev_name, priv->ndev->name);
-        link->dev_node = &card->node; /* link->dev_node being non-NULL is also
-                                       * used to indicate that the
-                                       * net_device has been registered */
         return 0;
 
  failed:
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index 59bda240fdc2..41b9ce425855 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -57,7 +57,6 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket
  * struct orinoco_private */
 struct orinoco_pccard {
         struct pcmcia_device    *p_dev;
-        dev_node_t node;
 };
 
 /********************************************************************/
@@ -193,10 +192,6 @@ spectrum_cs_probe(struct pcmcia_device *link)
         card->p_dev = link;
         link->priv = priv;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = orinoco_interrupt;
-
         /* General socket configuration defaults can go here.  In this
          * client, we assume very little, and rely on the CIS for
          * almost everything.  In most clients, many details (i.e.,
@@ -218,8 +213,7 @@ static void spectrum_cs_detach(struct pcmcia_device *link)
 {
         struct orinoco_private *priv = link->priv;
 
-        if (link->dev_node)
-                orinoco_if_del(priv);
+        orinoco_if_del(priv);
 
         spectrum_cs_release(link);
 
@@ -304,7 +298,6 @@ static int
 spectrum_cs_config(struct pcmcia_device *link)
 {
         struct orinoco_private *priv = link->priv;
-        struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
         int ret;
         void __iomem *mem;
@@ -332,12 +325,7 @@ spectrum_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-         * Allocate an interrupt line.  Note that this does not assign
-         * a handler to the interrupt, unless the 'Handler' member of
-         * the irq structure is initialized.
-         */
-        ret = pcmcia_request_irq(link, &link->irq);
+        ret = pcmcia_request_irq(link, orinoco_interrupt);
         if (ret)
                 goto failed;
 
@@ -359,9 +347,6 @@ spectrum_cs_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /* Ok, we have the configuration, prepare to register the netdev */
-        card->node.major = card->node.minor = 0;
-
         /* Reset card */
         if (spectrum_cs_hard_reset(priv) != 0)
                 goto failed;
@@ -374,17 +359,11 @@ spectrum_cs_config(struct pcmcia_device *link)
 
         /* Register an interface with the stack */
         if (orinoco_if_add(priv, link->io.BasePort1,
-                           link->irq.AssignedIRQ) != 0) {
+                           link->irq) != 0) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto failed;
         }
 
-        /* At this point, the dev_node_t structure(s) needs to be
-         * initialized and arranged in a linked list at link->dev_node. */
-        strcpy(card->node.dev_name, priv->ndev->name);
-        link->dev_node = &card->node; /* link->dev_node being non-NULL is also
-                                       * used to indicate that the
-                                       * net_device has been registered */
         return 0;
 
  failed:
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda362836..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 11865ea21875..f7d2a34ca531 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -51,7 +51,6 @@
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ds.h>
-#include <pcmcia/mem_op.h>
 
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
@@ -321,10 +320,6 @@ static int ray_probe(struct pcmcia_device *p_dev)
         p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         p_dev->io.IOAddrLines = 5;
 
-        /* Interrupt setup. For PCMCIA, driver takes what's given */
-        p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.Handler = &ray_interrupt;
-
         /* General socket configuration */
         p_dev->conf.Attributes = CONF_ENABLE_IRQ;
         p_dev->conf.IntType = INT_MEMORY_AND_IO;
@@ -383,8 +378,7 @@ static void ray_detach(struct pcmcia_device *link)
         del_timer(&local->timer);
 
         if (link->priv) {
-                if (link->dev_node)
-                        unregister_netdev(dev);
+                unregister_netdev(dev);
                 free_netdev(dev);
         }
         dev_dbg(&link->dev, "ray_cs ray_detach ending\n");
@@ -417,10 +411,10 @@ static int ray_config(struct pcmcia_device *link)
         /* Now allocate an interrupt line.  Note that this does not
            actually assign a handler to the interrupt.
          */
-        ret = pcmcia_request_irq(link, &link->irq);
+        ret = pcmcia_request_irq(link, ray_interrupt);
         if (ret)
                 goto failed;
-        dev->irq = link->irq.AssignedIRQ;
+        dev->irq = link->irq;
 
         /* This actually configures the PCMCIA socket -- setting up
            the I/O windows and the interrupt mapping.
@@ -493,9 +487,6 @@ static int ray_config(struct pcmcia_device *link)
                 return i;
         }
 
-        strcpy(local->node.dev_name, dev->name);
-        link->dev_node = &local->node;
-
         printk(KERN_INFO "%s: RayLink, irq %d, hw_addr %pM\n",
                dev->name, dev->irq, dev->dev_addr);
 
diff --git a/drivers/net/wireless/ray_cs.h b/drivers/net/wireless/ray_cs.h
index 1e23b7f4cca7..9f01ddb19748 100644
--- a/drivers/net/wireless/ray_cs.h
+++ b/drivers/net/wireless/ray_cs.h
@@ -25,7 +25,6 @@ struct beacon_rx {
 typedef struct ray_dev_t {
     int card_status;
     int authentication_state;
-    dev_node_t  node;
     window_handle_t amem_handle;   /* handle to window for attribute memory  */
     window_handle_t rmem_handle;   /* handle to window for rx buffer on card */
     void __iomem *sram;            /* pointer to beginning of shared RAM     */
diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
index 8bce1a550a22..8816e371fd0e 100644
--- a/drivers/net/wireless/wl3501.h
+++ b/drivers/net/wireless/wl3501.h
@@ -610,7 +610,6 @@ struct wl3501_card {
         struct iw_statistics            wstats;
         struct iw_spy_data              spy_data;
         struct iw_public_data           wireless_data;
-        struct dev_node_t               node;
         struct pcmcia_device            *p_dev;
 };
 #endif
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 7b9621de239f..5e5d24c1ce2b 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1451,6 +1451,8 @@ static void wl3501_detach(struct pcmcia_device *link)
         netif_device_detach(dev);
         wl3501_release(link);
 
+        unregister_netdev(dev);
+
         if (link->priv)
                 free_netdev(link->priv);
 
@@ -1897,10 +1899,6 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
         p_dev->io.Attributes1   = IO_DATA_PATH_WIDTH_8;
         p_dev->io.IOAddrLines   = 5;
 
-        /* Interrupt setup */
-        p_dev->irq.Attributes   = IRQ_TYPE_DYNAMIC_SHARING;
-        p_dev->irq.Handler = wl3501_interrupt;
-
         /* General socket configuration */
         p_dev->conf.Attributes  = CONF_ENABLE_IRQ;
         p_dev->conf.IntType     = INT_MEMORY_AND_IO;
@@ -1961,7 +1959,7 @@ static int wl3501_config(struct pcmcia_device *link)
         /* Now allocate an interrupt line. Note that this does not actually
          * assign a handler to the interrupt. */
 
-        ret = pcmcia_request_irq(link, &link->irq);
+        ret = pcmcia_request_irq(link, wl3501_interrupt);
         if (ret)
                 goto failed;
 
@@ -1972,7 +1970,7 @@ static int wl3501_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        dev->irq = link->irq.AssignedIRQ;
+        dev->irq = link->irq;
         dev->base_addr = link->io.BasePort1;
         SET_NETDEV_DEV(dev, &link->dev);
         if (register_netdev(dev)) {
@@ -1981,20 +1979,15 @@ static int wl3501_config(struct pcmcia_device *link)
         }
 
         this = netdev_priv(dev);
-        /*
-         * At this point, the dev_node_t structure(s) should be initialized and
-         * arranged in a linked list at link->dev_node.
-         */
-        link->dev_node = &this->node;
 
         this->base_addr = dev->base_addr;
 
         if (!wl3501_get_flash_mac_addr(this)) {
                 printk(KERN_WARNING "%s: Cant read MAC addr in flash ROM?\n",
                        dev->name);
+                unregister_netdev(dev);
                 goto failed;
         }
-        strcpy(this->node.dev_name, dev->name);
 
         for (i = 0; i < 6; i++)
                 dev->dev_addr[i] = ((char *)&this->mac_addr)[i];
@@ -2038,12 +2031,6 @@ failed:
  */
 static void wl3501_release(struct pcmcia_device *link)
 {
-        struct net_device *dev = link->priv;
-
-        /* Unlink the device chain */
-        if (link->dev_node)
-                unregister_netdev(dev);
-
         pcmcia_disable_device(link);
 }
 
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 81c753a617ab..9548cbb5012a 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -102,6 +102,7 @@ static struct zorro_device_id zorro8390_zorro_tbl[] __devinitdata = {
     { ZORRO_PROD_INDIVIDUAL_COMPUTERS_X_SURF, },
     { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, zorro8390_zorro_tbl);
 
 static struct zorro_driver zorro8390_driver = {
     .name       = "zorro8390",
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 18ecae4a4375..b4748337223b 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -69,7 +69,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                 }
 
                 phy = get_phy_device(mdio, be32_to_cpup(addr));
-                if (!phy) {
+                if (!phy || IS_ERR(phy)) {
                         dev_err(&mdio->dev, "error probing PHY at address %i\n",
                                 *addr);
                         continue;
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 166b67ea622f..219f79e2210a 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -30,23 +30,7 @@
 
 #define OP_BUFFER_FLAGS 0
 
-/*
- * Read and write access is using spin locking. Thus, writing to the
- * buffer by NMI handler (x86) could occur also during critical
- * sections when reading the buffer. To avoid this, there are 2
- * buffers for independent read and write access. Read access is in
- * process context only, write access only in the NMI handler. If the
- * read buffer runs empty, both buffers are swapped atomically. There
- * is potentially a small window during swapping where the buffers are
- * disabled and samples could be lost.
- *
- * Using 2 buffers is a little bit overhead, but the solution is clear
- * and does not require changes in the ring buffer implementation. It
- * can be changed to a single buffer solution when the ring buffer
- * access is implemented as non-locking atomic code.
- */
-static struct ring_buffer *op_ring_buffer_read;
-static struct ring_buffer *op_ring_buffer_write;
+static struct ring_buffer *op_ring_buffer;
 DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer);
 
 static void wq_sync_buffer(struct work_struct *work);
@@ -68,12 +52,9 @@ void oprofile_cpu_buffer_inc_smpl_lost(void)
 
 void free_cpu_buffers(void)
 {
-        if (op_ring_buffer_read)
-                ring_buffer_free(op_ring_buffer_read);
-        op_ring_buffer_read = NULL;
-        if (op_ring_buffer_write)
-                ring_buffer_free(op_ring_buffer_write);
-        op_ring_buffer_write = NULL;
+        if (op_ring_buffer)
+                ring_buffer_free(op_ring_buffer);
+        op_ring_buffer = NULL;
 }
 
 #define RB_EVENT_HDR_SIZE 4
@@ -86,11 +67,8 @@ int alloc_cpu_buffers(void)
         unsigned long byte_size = buffer_size * (sizeof(struct op_sample) +
                                                  RB_EVENT_HDR_SIZE);
 
-        op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
-        if (!op_ring_buffer_read)
-                goto fail;
-        op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
-        if (!op_ring_buffer_write)
+        op_ring_buffer = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
+        if (!op_ring_buffer)
                 goto fail;
 
         for_each_possible_cpu(i) {
@@ -162,16 +140,11 @@ struct op_sample
 *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size)
 {
         entry->event = ring_buffer_lock_reserve
-                (op_ring_buffer_write, sizeof(struct op_sample) +
+                (op_ring_buffer, sizeof(struct op_sample) +
                  size * sizeof(entry->sample->data[0]));
-        if (entry->event)
-                entry->sample = ring_buffer_event_data(entry->event);
-        else
-                entry->sample = NULL;
-
-        if (!entry->sample)
+        if (!entry->event)
                 return NULL;
-
+        entry->sample = ring_buffer_event_data(entry->event);
         entry->size = size;
         entry->data = entry->sample->data;
 
@@ -180,25 +153,16 @@ struct op_sample
 
 int op_cpu_buffer_write_commit(struct op_entry *entry)
 {
-        return ring_buffer_unlock_commit(op_ring_buffer_write, entry->event);
+        return ring_buffer_unlock_commit(op_ring_buffer, entry->event);
 }
 
 struct op_sample *op_cpu_buffer_read_entry(struct op_entry *entry, int cpu)
 {
         struct ring_buffer_event *e;
-        e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
-        if (e)
-                goto event;
-        if (ring_buffer_swap_cpu(op_ring_buffer_read,
-                                 op_ring_buffer_write,
-                                 cpu))
+        e = ring_buffer_consume(op_ring_buffer, cpu, NULL, NULL);
+        if (!e)
                 return NULL;
-        e = ring_buffer_consume(op_ring_buffer_read, cpu, NULL);
-        if (e)
-                goto event;
-        return NULL;
 
-event:
         entry->event = e;
         entry->sample = ring_buffer_event_data(e);
         entry->size = (ring_buffer_event_length(e) - sizeof(struct op_sample))
@@ -209,8 +173,7 @@ event:
 
 unsigned long op_cpu_buffer_entries(int cpu)
 {
-        return ring_buffer_entries_cpu(op_ring_buffer_read, cpu)
-                + ring_buffer_entries_cpu(op_ring_buffer_write, cpu);
+        return ring_buffer_entries_cpu(op_ring_buffer, cpu);
 }
 
 static int
@@ -356,8 +319,16 @@ void oprofile_add_ext_sample(unsigned long pc, struct pt_regs * const regs,
 
 void oprofile_add_sample(struct pt_regs * const regs, unsigned long event)
 {
-        int is_kernel = !user_mode(regs);
-        unsigned long pc = profile_pc(regs);
+        int is_kernel;
+        unsigned long pc;
+
+        if (likely(regs)) {
+                is_kernel = !user_mode(regs);
+                pc = profile_pc(regs);
+        } else {
+                is_kernel = 0;    /* This value will not be used */
+                pc = ESCAPE_CODE; /* as this causes an early return. */
+        }
 
         __oprofile_add_ext_sample(pc, regs, event, is_kernel);
 }
diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
index dc8a0428260d..b336cd9ee7a1 100644
--- a/drivers/oprofile/oprof.c
+++ b/drivers/oprofile/oprof.c
@@ -253,22 +253,26 @@ static int __init oprofile_init(void)
         int err;
 
         err = oprofile_arch_init(&oprofile_ops);
-
         if (err < 0 || timer) {
                 printk(KERN_INFO "oprofile: using timer interrupt.\n");
-                oprofile_timer_init(&oprofile_ops);
+                err = oprofile_timer_init(&oprofile_ops);
+                if (err)
+                        goto out_arch;
         }
-
         err = oprofilefs_register();
         if (err)
-                oprofile_arch_exit();
+                goto out_arch;
+        return 0;
 
+out_arch:
+        oprofile_arch_exit();
         return err;
 }
 
 
 static void __exit oprofile_exit(void)
 {
+        oprofile_timer_exit();
         oprofilefs_unregister();
         oprofile_arch_exit();
 }
diff --git a/drivers/oprofile/oprof.h b/drivers/oprofile/oprof.h
index cb92f5c98c1a..47e12cb4ee8b 100644
--- a/drivers/oprofile/oprof.h
+++ b/drivers/oprofile/oprof.h
@@ -34,7 +34,8 @@ struct super_block;
 struct dentry;
 
 void oprofile_create_files(struct super_block *sb, struct dentry *root);
-void oprofile_timer_init(struct oprofile_operations *ops);
+int oprofile_timer_init(struct oprofile_operations *ops);
+void oprofile_timer_exit(void);
 
 int oprofile_set_backtrace(unsigned long depth);
 int oprofile_set_timeout(unsigned long time);
diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
index 333f915568c7..dc0ae4d14dff 100644
--- a/drivers/oprofile/timer_int.c
+++ b/drivers/oprofile/timer_int.c
@@ -13,34 +13,94 @@
 #include <linux/oprofile.h>
 #include <linux/profile.h>
 #include <linux/init.h>
+#include <linux/cpu.h>
+#include <linux/hrtimer.h>
+#include <asm/irq_regs.h>
 #include <asm/ptrace.h>
 
 #include "oprof.h"
 
-static int timer_notify(struct pt_regs *regs)
+static DEFINE_PER_CPU(struct hrtimer, oprofile_hrtimer);
+
+static enum hrtimer_restart oprofile_hrtimer_notify(struct hrtimer *hrtimer)
+{
+        oprofile_add_sample(get_irq_regs(), 0);
+        hrtimer_forward_now(hrtimer, ns_to_ktime(TICK_NSEC));
+        return HRTIMER_RESTART;
+}
+
+static void __oprofile_hrtimer_start(void *unused)
+{
+        struct hrtimer *hrtimer = &__get_cpu_var(oprofile_hrtimer);
+
+        hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hrtimer->function = oprofile_hrtimer_notify;
+
+        hrtimer_start(hrtimer, ns_to_ktime(TICK_NSEC),
+                      HRTIMER_MODE_REL_PINNED);
+}
+
+static int oprofile_hrtimer_start(void)
 {
-        oprofile_add_sample(regs, 0);
+        on_each_cpu(__oprofile_hrtimer_start, NULL, 1);
         return 0;
 }
 
-static int timer_start(void)
+static void __oprofile_hrtimer_stop(int cpu)
 {
-        return register_timer_hook(timer_notify);
+        struct hrtimer *hrtimer = &per_cpu(oprofile_hrtimer, cpu);
+
+        hrtimer_cancel(hrtimer);
 }
 
+static void oprofile_hrtimer_stop(void)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                __oprofile_hrtimer_stop(cpu);
+}
 
-static void timer_stop(void)
+static int __cpuinit oprofile_cpu_notify(struct notifier_block *self,
+                                         unsigned long action, void *hcpu)
 {
-        unregister_timer_hook(timer_notify);
+        long cpu = (long) hcpu;
+
+        switch (action) {
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                smp_call_function_single(cpu, __oprofile_hrtimer_start,
+                                         NULL, 1);
+                break;
+        case CPU_DEAD:
+        case CPU_DEAD_FROZEN:
+                __oprofile_hrtimer_stop(cpu);
+                break;
+        }
+        return NOTIFY_OK;
 }
 
+static struct notifier_block __refdata oprofile_cpu_notifier = {
+        .notifier_call = oprofile_cpu_notify,
+};
 
-void __init oprofile_timer_init(struct oprofile_operations *ops)
+int __init oprofile_timer_init(struct oprofile_operations *ops)
 {
+        int rc;
+
+        rc = register_hotcpu_notifier(&oprofile_cpu_notifier);
+        if (rc)
+                return rc;
         ops->create_files = NULL;
         ops->setup = NULL;
         ops->shutdown = NULL;
-        ops->start = timer_start;
-        ops->stop = timer_stop;
+        ops->start = oprofile_hrtimer_start;
+        ops->stop = oprofile_hrtimer_stop;
         ops->cpu_type = "timer";
+        return 0;
+}
+
+void __exit oprofile_timer_exit(void)
+{
+        unregister_hotcpu_notifier(&oprofile_cpu_notifier);
 }
diff --git a/drivers/parport/parport_cs.c b/drivers/parport/parport_cs.c
index 7dd370fa3439..fd8cfe95f0a3 100644
--- a/drivers/parport/parport_cs.c
+++ b/drivers/parport/parport_cs.c
@@ -75,7 +75,6 @@ INT_MODULE_PARM(epp_mode, 1);
 typedef struct parport_info_t {
         struct pcmcia_device    *p_dev;
     int                 ndev;
-    dev_node_t          node;
     struct parport      *port;
 } parport_info_t;
 
@@ -105,7 +104,6 @@ static int parport_probe(struct pcmcia_device *link)
 
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -174,20 +172,19 @@ static int parport_config(struct pcmcia_device *link)
     if (ret)
             goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
             goto failed;
 
     p = parport_pc_probe_port(link->io.BasePort1, link->io.BasePort2,
-                              link->irq.AssignedIRQ, PARPORT_DMA_NONE,
+                              link->irq, PARPORT_DMA_NONE,
                               &link->dev, IRQF_SHARED);
     if (p == NULL) {
         printk(KERN_NOTICE "parport_cs: parport_pc_probe_port() at "
                "0x%3x, irq %u failed\n", link->io.BasePort1,
-               link->irq.AssignedIRQ);
+               link->irq);
         goto failed;
     }
 
@@ -195,11 +192,7 @@ static int parport_config(struct pcmcia_device *link)
     if (epp_mode)
         p->modes |= PARPORT_MODE_TRISTATE | PARPORT_MODE_EPP;
     info->ndev = 1;
-    info->node.major = LP_MAJOR;
-    info->node.minor = p->number;
     info->port = p;
-    strcpy(info->node.dev_name, p->name);
-    link->dev_node = &info->node;
 
     return 0;
 
diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
index 4e3e0382c16e..083034710fa6 100644
--- a/drivers/pci/hotplug/rpadlpar_core.c
+++ b/drivers/pci/hotplug/rpadlpar_core.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/string.h>
+#include <linux/vmalloc.h>
 
 #include <asm/pci-bridge.h>
 #include <linux/mutex.h>
@@ -430,6 +431,8 @@ int dlpar_remove_slot(char *drc_name)
                         rc = dlpar_remove_pci_slot(drc_name, dn);
                         break;
         }
+        vm_unmap_aliases();
+
         printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
 exit:
         mutex_unlock(&rpadlpar_mutex);
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 719702240780..ef7411c660b9 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -29,6 +29,7 @@
 #include <linux/pci_hotplug.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/vmalloc.h>
 #include <asm/eeh.h>       /* for eeh_add_device() */
 #include <asm/rtas.h>           /* rtas_call */
 #include <asm/pci-bridge.h>     /* for pci_controller */
@@ -418,6 +419,8 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
                 return -EINVAL;
 
         pcibios_remove_pci_devices(slot->bus);
+        vm_unmap_aliases();
+
         slot->state = NOT_CONFIGURED;
         return 0;
 }
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 417312528ddf..371dc564e2e4 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3626,14 +3626,15 @@ static void intel_iommu_detach_device(struct iommu_domain *domain,
         domain_remove_one_dev_info(dmar_domain, pdev);
 }
 
-static int intel_iommu_map_range(struct iommu_domain *domain,
-                                 unsigned long iova, phys_addr_t hpa,
-                                 size_t size, int iommu_prot)
+static int intel_iommu_map(struct iommu_domain *domain,
+                           unsigned long iova, phys_addr_t hpa,
+                           int gfp_order, int iommu_prot)
 {
         struct dmar_domain *dmar_domain = domain->priv;
         u64 max_addr;
         int addr_width;
         int prot = 0;
+        size_t size;
         int ret;
 
         if (iommu_prot & IOMMU_READ)
@@ -3643,6 +3644,7 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
         if ((iommu_prot & IOMMU_CACHE) && dmar_domain->iommu_snooping)
                 prot |= DMA_PTE_SNP;
 
+        size     = PAGE_SIZE << gfp_order;
         max_addr = iova + size;
         if (dmar_domain->max_addr < max_addr) {
                 int min_agaw;
@@ -3669,19 +3671,19 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
         return ret;
 }
 
-static void intel_iommu_unmap_range(struct iommu_domain *domain,
-                                    unsigned long iova, size_t size)
+static int intel_iommu_unmap(struct iommu_domain *domain,
+                             unsigned long iova, int gfp_order)
 {
         struct dmar_domain *dmar_domain = domain->priv;
-
-        if (!size)
-                return;
+        size_t size = PAGE_SIZE << gfp_order;
 
         dma_pte_clear_range(dmar_domain, iova >> VTD_PAGE_SHIFT,
                             (iova + size - 1) >> VTD_PAGE_SHIFT);
 
         if (dmar_domain->max_addr == iova + size)
                 dmar_domain->max_addr = iova;
+
+        return gfp_order;
 }
 
 static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
@@ -3714,8 +3716,8 @@ static struct iommu_ops intel_iommu_ops = {
         .domain_destroy = intel_iommu_domain_destroy,
         .attach_dev     = intel_iommu_attach_device,
         .detach_dev     = intel_iommu_detach_device,
-        .map            = intel_iommu_map_range,
-        .unmap          = intel_iommu_unmap_range,
+        .map            = intel_iommu_map,
+        .unmap          = intel_iommu_unmap,
         .iova_to_phys   = intel_iommu_iova_to_phys,
         .domain_has_cap = intel_iommu_domain_has_cap,
 };
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 9a3d3309f896..1df7c508814e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -679,7 +679,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
  */
 int __pci_complete_power_transition(struct pci_dev *dev, pci_power_t state)
 {
-        return state > PCI_D0 ?
+        return state >= PCI_D0 ?
                         pci_platform_power_transition(dev, state) : -EINVAL;
 }
 EXPORT_SYMBOL_GPL(__pci_complete_power_transition);
@@ -716,10 +716,6 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                  */
                 return 0;
 
-        /* Check if we're already there */
-        if (dev->current_state == state)
-                return 0;
-
         __pci_start_power_transition(dev, state);
 
         /* This device is quirked not to be put into D3, so
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index aa495ad9bbd4..7a711ee314b7 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -244,11 +244,17 @@ static pci_ers_result_t aer_root_reset(struct pci_dev *dev)
 
         /* Assert Secondary Bus Reset */
         pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &p2p_ctrl);
-        p2p_ctrl |= PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl |= PCI_BRIDGE_CTL_BUS_RESET;
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
 
+        /*
+         * we should send hot reset message for 2ms to allow it time to
+         * propogate to all downstream ports
+         */
+        msleep(2);
+
         /* De-assert Secondary Bus Reset */
-        p2p_ctrl &= ~PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET;
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
 
         /*
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 882bd8d29fe3..c82548afcd5c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -174,19 +174,14 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
         pci_read_config_dword(dev, pos, &sz);
         pci_write_config_dword(dev, pos, l);
 
-        if (!sz)
-                goto fail;      /* BAR not implemented */
-
         /*
          * All bits set in sz means the device isn't working properly.
-         * If it's a memory BAR or a ROM, bit 0 must be clear; if it's
-         * an io BAR, bit 1 must be clear.
+         * If the BAR isn't implemented, all bits must be 0.  If it's a
+         * memory BAR or a ROM, bit 0 must be clear; if it's an io BAR, bit
+         * 1 must be clear.
          */
-        if (sz == 0xffffffff) {
-                dev_err(&dev->dev, "reg %x: invalid size %#x; broken device?\n",
-                        pos, sz);
+        if (!sz || sz == 0xffffffff)
                 goto fail;
-        }
 
         /*
          * I don't know how l can have all bits set.  Copied from old code.
@@ -249,17 +244,13 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                                    pos, res);
                 }
         } else {
-                u32 size = pci_size(l, sz, mask);
+                sz = pci_size(l, sz, mask);
 
-                if (!size) {
-                        dev_err(&dev->dev, "reg %x: invalid size "
-                                "(l %#x sz %#x mask %#x); broken device?",
-                                pos, l, sz, mask);
+                if (!sz)
                         goto fail;
-                }
 
                 res->start = l;
-                res->end = l + size;
+                res->end = l + sz;
 
                 dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
         }
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4fe36d2e1049..19b111383f62 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -838,65 +838,11 @@ static void pci_bus_dump_resources(struct pci_bus *bus)
         }
 }
 
-static int __init pci_bus_get_depth(struct pci_bus *bus)
-{
-        int depth = 0;
-        struct pci_dev *dev;
-
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                int ret;
-                struct pci_bus *b = dev->subordinate;
-                if (!b)
-                        continue;
-
-                ret = pci_bus_get_depth(b);
-                if (ret + 1 > depth)
-                        depth = ret + 1;
-        }
-
-        return depth;
-}
-static int __init pci_get_max_depth(void)
-{
-        int depth = 0;
-        struct pci_bus *bus;
-
-        list_for_each_entry(bus, &pci_root_buses, node) {
-                int ret;
-
-                ret = pci_bus_get_depth(bus);
-                if (ret > depth)
-                        depth = ret;
-        }
-
-        return depth;
-}
-
-/*
- * first try will not touch pci bridge res
- * second  and later try will clear small leaf bridge res
- * will stop till to the max  deepth if can not find good one
- */
 void __init
 pci_assign_unassigned_resources(void)
 {
         struct pci_bus *bus;
-        int tried_times = 0;
-        enum release_type rel_type = leaf_only;
-        struct resource_list_x head, *list;
-        unsigned long type_mask = IORESOURCE_IO | IORESOURCE_MEM |
-                                  IORESOURCE_PREFETCH;
-        unsigned long failed_type;
-        int max_depth = pci_get_max_depth();
-        int pci_try_num;
 
-        head.next = NULL;
-
-        pci_try_num = max_depth + 1;
-        printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
-                 max_depth, pci_try_num);
-
-again:
         /* Depth first, calculate sizes and alignments of all
            subordinate buses. */
         list_for_each_entry(bus, &pci_root_buses, node) {
@@ -904,65 +850,9 @@ again:
         }
         /* Depth last, allocate resources and update the hardware. */
         list_for_each_entry(bus, &pci_root_buses, node) {
-                __pci_bus_assign_resources(bus, &head);
-        }
-        tried_times++;
-
-        /* any device complain? */
-        if (!head.next)
-                goto enable_and_dump;
-        failed_type = 0;
-        for (list = head.next; list;) {
-                failed_type |= list->flags;
-                list = list->next;
-        }
-        /*
-         * io port are tight, don't try extra
-         * or if reach the limit, don't want to try more
-         */
-        failed_type &= type_mask;
-        if ((failed_type == IORESOURCE_IO) || (tried_times >= pci_try_num)) {
-                free_failed_list(&head);
-                goto enable_and_dump;
-        }
-
-        printk(KERN_DEBUG "PCI: No. %d try to assign unassigned res\n",
-                         tried_times + 1);
-
-        /* third times and later will not check if it is leaf */
-        if ((tried_times + 1) > 2)
-                rel_type = whole_subtree;
-
-        /*
-         * Try to release leaf bridge's resources that doesn't fit resource of
-         * child device under that bridge
-         */
-        for (list = head.next; list;) {
-                bus = list->dev->bus;
-                pci_bus_release_bridge_resources(bus, list->flags & type_mask,
-                                                  rel_type);
-                list = list->next;
-        }
-        /* restore size and flags */
-        for (list = head.next; list;) {
-                struct resource *res = list->res;
-
-                res->start = list->start;
-                res->end = list->end;
-                res->flags = list->flags;
-                if (list->dev->subordinate)
-                        res->flags = 0;
-
-                list = list->next;
-        }
-        free_failed_list(&head);
-
-        goto again;
-
-enable_and_dump:
-        /* Depth last, update the hardware. */
-        list_for_each_entry(bus, &pci_root_buses, node)
+                pci_bus_assign_resources(bus);
                 pci_enable_bridges(bus);
+        }
 
         /* dump the resource on buses */
         list_for_each_entry(bus, &pci_root_buses, node) {
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index d189e4743e69..d0f5ad306078 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -49,26 +49,6 @@ config PCMCIA_LOAD_CIS
 
           If unsure, say Y.
 
-config PCMCIA_IOCTL
-        bool "PCMCIA control ioctl (obsolete)"
-        depends on PCMCIA && ARM && !SMP && !PREEMPT
-        default y
-        help
-          If you say Y here, the deprecated ioctl interface to the PCMCIA
-          subsystem will be built. It is needed by the deprecated pcmcia-cs
-          tools (cardmgr, cardctl) to function properly.
-
-          You should use the new pcmciautils package instead (see
-          <file:Documentation/Changes> for location and details).
-
-          This config option will most likely be removed from kernel 2.6.35,
-          the associated code from kernel 2.6.36.
-
-          As the PCMCIA ioctl is not locking safe, it depends on !SMP and
-          !PREEMPT.
-
-          If unsure, say N.
-
 config CARDBUS
         bool "32-bit CardBus support"
         depends on PCI
@@ -234,7 +214,8 @@ config PCMCIA_PXA2XX
         depends on ARM && ARCH_PXA && PCMCIA
         depends on (ARCH_LUBBOCK || MACH_MAINSTONE || PXA_SHARPSL \
                     || MACH_ARMCORE || ARCH_PXA_PALM || TRIZEPS_PCMCIA \
-                    || ARCOM_PCMCIA || ARCH_PXA_ESERIES || MACH_STARGATE2)
+                    || ARCOM_PCMCIA || ARCH_PXA_ESERIES || MACH_STARGATE2 \
+                    || MACH_VPAC270)
         select PCMCIA_SOC_COMMON
         help
           Say Y here to include support for the PXA2xx PCMCIA controller
@@ -317,7 +298,7 @@ config ELECTRA_CF
           PA Semi Electra eval board.
 
 config PCCARD_NONSTATIC
-        tristate
+        bool
 
 config PCCARD_IODYN
         bool
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index 381b031d9d75..d006e8beab9c 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -2,15 +2,18 @@
 # Makefile for the kernel pcmcia subsystem (c/o David Hinds)
 #
 
-pcmcia_core-y                                   += cs.o rsrc_mgr.o socket_sysfs.o
+pcmcia_core-y                                   += cs.o socket_sysfs.o
 pcmcia_core-$(CONFIG_CARDBUS)                   += cardbus.o
 obj-$(CONFIG_PCCARD)                            += pcmcia_core.o
 
-pcmcia-y                                        += ds.o pcmcia_resource.o cistpl.o
+pcmcia-y                                        += ds.o pcmcia_resource.o cistpl.o pcmcia_cis.o
 pcmcia-$(CONFIG_PCMCIA_IOCTL)                   += pcmcia_ioctl.o
 obj-$(CONFIG_PCMCIA)                            += pcmcia.o
 
-obj-$(CONFIG_PCCARD_NONSTATIC)                  += rsrc_nonstatic.o
+pcmcia_rsrc-y                                   += rsrc_mgr.o
+pcmcia_rsrc-$(CONFIG_PCCARD_NONSTATIC)          += rsrc_nonstatic.o
+pcmcia_rsrc-$(CONFIG_PCCARD_IODYN)              += rsrc_iodyn.o
+obj-$(CONFIG_PCCARD)                            += pcmcia_rsrc.o
 
 
 # socket drivers
@@ -66,6 +69,7 @@ pxa2xx-obj-$(CONFIG_MACH_PALMTC)		+= pxa2xx_palmtc.o
 pxa2xx-obj-$(CONFIG_MACH_PALMLD)                += pxa2xx_palmld.o
 pxa2xx-obj-$(CONFIG_MACH_E740)                  += pxa2xx_e740.o
 pxa2xx-obj-$(CONFIG_MACH_STARGATE2)             += pxa2xx_stargate2.o
+pxa2xx-obj-$(CONFIG_MACH_VPAC270)               += pxa2xx_vpac270.o
 
 obj-$(CONFIG_PCMCIA_PXA2XX)                     += pxa2xx_base.o $(pxa2xx-obj-y)
 
diff --git a/drivers/pcmcia/bfin_cf_pcmcia.c b/drivers/pcmcia/bfin_cf_pcmcia.c
index 9e84d039de41..eae9cbe37a3e 100644
--- a/drivers/pcmcia/bfin_cf_pcmcia.c
+++ b/drivers/pcmcia/bfin_cf_pcmcia.c
@@ -113,7 +113,7 @@ static int bfin_cf_get_status(struct pcmcia_socket *s, u_int *sp)
 
         if (bfin_cf_present(cf->cd_pfx)) {
                 *sp = SS_READY | SS_DETECT | SS_POWERON | SS_3VCARD;
-                s->irq.AssignedIRQ = 0;
+                s->pcmcia_irq = 0;
                 s->pci_irq = cf->irq;
 
         } else
diff --git a/drivers/pcmcia/cardbus.c b/drivers/pcmcia/cardbus.c
index e6ab2a47d8cb..9a58862f1401 100644
--- a/drivers/pcmcia/cardbus.c
+++ b/drivers/pcmcia/cardbus.c
@@ -94,7 +94,6 @@ int __ref cb_alloc(struct pcmcia_socket *s)
         pci_enable_bridges(bus);
         pci_bus_add_devices(bus);
 
-        s->irq.AssignedIRQ = s->pci_irq;
         return 0;
 }
 
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 854959cada3a..60d428be0b07 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -129,6 +129,8 @@ static void __iomem *set_cis_map(struct pcmcia_socket *s,
 
 /**
  * pcmcia_read_cis_mem() - low-level function to read CIS memory
+ *
+ * must be called with ops_mutex held
  */
 int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                  u_int len, void *ptr)
@@ -138,7 +140,6 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
 
         dev_dbg(&s->dev, "pcmcia_read_cis_mem(%d, %#x, %u)\n", attr, addr, len);
 
-        mutex_lock(&s->ops_mutex);
         if (attr & IS_INDIRECT) {
                 /* Indirect accesses use a bunch of special registers at fixed
                    locations in common memory */
@@ -153,7 +154,6 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                 if (!sys) {
                         dev_dbg(&s->dev, "could not map memory\n");
                         memset(ptr, 0xff, len);
-                        mutex_unlock(&s->ops_mutex);
                         return -1;
                 }
 
@@ -184,7 +184,6 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                         if (!sys) {
                                 dev_dbg(&s->dev, "could not map memory\n");
                                 memset(ptr, 0xff, len);
-                                mutex_unlock(&s->ops_mutex);
                                 return -1;
                         }
                         end = sys + s->map_size;
@@ -198,7 +197,6 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                         addr = 0;
                 }
         }
-        mutex_unlock(&s->ops_mutex);
         dev_dbg(&s->dev, "  %#2.2x %#2.2x %#2.2x %#2.2x ...\n",
                 *(u_char *)(ptr+0), *(u_char *)(ptr+1),
                 *(u_char *)(ptr+2), *(u_char *)(ptr+3));
@@ -209,7 +207,8 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
 /**
  * pcmcia_write_cis_mem() - low-level function to write CIS memory
  *
- * Probably only useful for writing one-byte registers.
+ * Probably only useful for writing one-byte registers. Must be called
+ * with ops_mutex held.
  */
 void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                    u_int len, void *ptr)
@@ -220,7 +219,6 @@ void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
         dev_dbg(&s->dev,
                 "pcmcia_write_cis_mem(%d, %#x, %u)\n", attr, addr, len);
 
-        mutex_lock(&s->ops_mutex);
         if (attr & IS_INDIRECT) {
                 /* Indirect accesses use a bunch of special registers at fixed
                    locations in common memory */
@@ -234,7 +232,6 @@ void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                                 ((cis_width) ? MAP_16BIT : 0));
                 if (!sys) {
                         dev_dbg(&s->dev, "could not map memory\n");
-                        mutex_unlock(&s->ops_mutex);
                         return; /* FIXME: Error */
                 }
 
@@ -260,7 +257,6 @@ void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                         sys = set_cis_map(s, card_offset, flags);
                         if (!sys) {
                                 dev_dbg(&s->dev, "could not map memory\n");
-                                mutex_unlock(&s->ops_mutex);
                                 return; /* FIXME: error */
                         }
 
@@ -275,7 +271,6 @@ void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
                         addr = 0;
                 }
         }
-        mutex_unlock(&s->ops_mutex);
 }
 
 
@@ -314,7 +309,6 @@ static int read_cis_cache(struct pcmcia_socket *s, int attr, u_int addr,
                         return 0;
                 }
         }
-        mutex_unlock(&s->ops_mutex);
 
         ret = pcmcia_read_cis_mem(s, attr, addr, len, ptr);
 
@@ -326,11 +320,11 @@ static int read_cis_cache(struct pcmcia_socket *s, int attr, u_int addr,
                         cis->len = len;
                         cis->attr = attr;
                         memcpy(cis->cache, ptr, len);
-                        mutex_lock(&s->ops_mutex);
                         list_add(&cis->node, &s->cis_cache);
-                        mutex_unlock(&s->ops_mutex);
                 }
         }
+        mutex_unlock(&s->ops_mutex);
+
         return ret;
 }
 
@@ -386,6 +380,7 @@ int verify_cis_cache(struct pcmcia_socket *s)
                            "no memory for verifying CIS\n");
                 return -ENOMEM;
         }
+        mutex_lock(&s->ops_mutex);
         list_for_each_entry(cis, &s->cis_cache, node) {
                 int len = cis->len;
 
@@ -395,10 +390,12 @@ int verify_cis_cache(struct pcmcia_socket *s)
                 ret = pcmcia_read_cis_mem(s, cis->attr, cis->addr, len, buf);
                 if (ret || memcmp(buf, cis->cache, len) != 0) {
                         kfree(buf);
+                        mutex_unlock(&s->ops_mutex);
                         return -1;
                 }
         }
         kfree(buf);
+        mutex_unlock(&s->ops_mutex);
         return 0;
 }
 
@@ -1362,106 +1359,6 @@ EXPORT_SYMBOL(pcmcia_parse_tuple);
 
 
 /**
- * pccard_read_tuple() - internal CIS tuple access
- * @s:          the struct pcmcia_socket where the card is inserted
- * @function:   the device function we loop for
- * @code:       which CIS code shall we look for?
- * @parse:      buffer where the tuple shall be parsed (or NULL, if no parse)
- *
- * pccard_read_tuple() reads out one tuple and attempts to parse it
- */
-int pccard_read_tuple(struct pcmcia_socket *s, unsigned int function,
-                cisdata_t code, void *parse)
-{
-        tuple_t tuple;
-        cisdata_t *buf;
-        int ret;
-
-        buf = kmalloc(256, GFP_KERNEL);
-        if (buf == NULL) {
-                dev_printk(KERN_WARNING, &s->dev, "no memory to read tuple\n");
-                return -ENOMEM;
-        }
-        tuple.DesiredTuple = code;
-        tuple.Attributes = 0;
-        if (function == BIND_FN_ALL)
-                tuple.Attributes = TUPLE_RETURN_COMMON;
-        ret = pccard_get_first_tuple(s, function, &tuple);
-        if (ret != 0)
-                goto done;
-        tuple.TupleData = buf;
-        tuple.TupleOffset = 0;
-        tuple.TupleDataMax = 255;
-        ret = pccard_get_tuple_data(s, &tuple);
-        if (ret != 0)
-                goto done;
-        ret = pcmcia_parse_tuple(&tuple, parse);
-done:
-        kfree(buf);
-        return ret;
-}
-
-
-/**
- * pccard_loop_tuple() - loop over tuples in the CIS
- * @s:          the struct pcmcia_socket where the card is inserted
- * @function:   the device function we loop for
- * @code:       which CIS code shall we look for?
- * @parse:      buffer where the tuple shall be parsed (or NULL, if no parse)
- * @priv_data:  private data to be passed to the loop_tuple function.
- * @loop_tuple: function to call for each CIS entry of type @function. IT
- *              gets passed the raw tuple, the paresed tuple (if @parse is
- *              set) and @priv_data.
- *
- * pccard_loop_tuple() loops over all CIS entries of type @function, and
- * calls the @loop_tuple function for each entry. If the call to @loop_tuple
- * returns 0, the loop exits. Returns 0 on success or errorcode otherwise.
- */
-int pccard_loop_tuple(struct pcmcia_socket *s, unsigned int function,
-                      cisdata_t code, cisparse_t *parse, void *priv_data,
-                      int (*loop_tuple) (tuple_t *tuple,
-                                         cisparse_t *parse,
-                                         void *priv_data))
-{
-        tuple_t tuple;
-        cisdata_t *buf;
-        int ret;
-
-        buf = kzalloc(256, GFP_KERNEL);
-        if (buf == NULL) {
-                dev_printk(KERN_WARNING, &s->dev, "no memory to read tuple\n");
-                return -ENOMEM;
-        }
-
-        tuple.TupleData = buf;
-        tuple.TupleDataMax = 255;
-        tuple.TupleOffset = 0;
-        tuple.DesiredTuple = code;
-        tuple.Attributes = 0;
-
-        ret = pccard_get_first_tuple(s, function, &tuple);
-        while (!ret) {
-                if (pccard_get_tuple_data(s, &tuple))
-                        goto next_entry;
-
-                if (parse)
-                        if (pcmcia_parse_tuple(&tuple, parse))
-                                goto next_entry;
-
-                ret = loop_tuple(&tuple, parse, priv_data);
-                if (!ret)
-                        break;
-
-next_entry:
-                ret = pccard_get_next_tuple(s, function, &tuple);
-        }
-
-        kfree(buf);
-        return ret;
-}
-
-
-/**
  * pccard_validate_cis() - check whether card has a sensible CIS
  * @s:          the struct pcmcia_socket we are to check
  * @info:       returns the number of tuples in the (valid) CIS, or 0
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index 75ed866e6953..976d80706eae 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -337,7 +337,6 @@ static void socket_shutdown(struct pcmcia_socket *s)
         s->socket = dead_socket;
         s->ops->init(s);
         s->ops->set_socket(s, &s->socket);
-        s->irq.AssignedIRQ = s->irq.Config = 0;
         s->lock_count = 0;
         kfree(s->fake_cis);
         s->fake_cis = NULL;
@@ -671,20 +670,22 @@ static int pccardd(void *__skt)
                                 socket_remove(skt);
                         if (sysfs_events & PCMCIA_UEVENT_INSERT)
                                 socket_insert(skt);
-                        if ((sysfs_events & PCMCIA_UEVENT_RESUME) &&
-                                !(skt->state & SOCKET_CARDBUS)) {
-                                ret = socket_resume(skt);
-                                if (!ret && skt->callback)
-                                        skt->callback->resume(skt);
-                        }
                         if ((sysfs_events & PCMCIA_UEVENT_SUSPEND) &&
                                 !(skt->state & SOCKET_CARDBUS)) {
                                 if (skt->callback)
                                         ret = skt->callback->suspend(skt);
                                 else
                                         ret = 0;
-                                if (!ret)
+                                if (!ret) {
                                         socket_suspend(skt);
+                                        msleep(100);
+                                }
+                        }
+                        if ((sysfs_events & PCMCIA_UEVENT_RESUME) &&
+                                !(skt->state & SOCKET_CARDBUS)) {
+                                ret = socket_resume(skt);
+                                if (!ret && skt->callback)
+                                        skt->callback->resume(skt);
                         }
                         if ((sysfs_events & PCMCIA_UEVENT_REQUERY) &&
                                 !(skt->state & SOCKET_CARDBUS)) {
diff --git a/drivers/pcmcia/cs_internal.h b/drivers/pcmcia/cs_internal.h
index f95864c2191e..4126a75445ea 100644
--- a/drivers/pcmcia/cs_internal.h
+++ b/drivers/pcmcia/cs_internal.h
@@ -52,13 +52,11 @@ struct cis_cache_entry {
 
 struct pccard_resource_ops {
         int     (*validate_mem)         (struct pcmcia_socket *s);
-        int     (*adjust_io_region)     (struct resource *res,
-                                         unsigned long r_start,
-                                         unsigned long r_end,
-                                         struct pcmcia_socket *s);
-        struct resource* (*find_io)     (unsigned long base, int num,
-                                         unsigned long align,
-                                         struct pcmcia_socket *s);
+        int     (*find_io)              (struct pcmcia_socket *s,
+                                         unsigned int attr,
+                                         unsigned int *base,
+                                         unsigned int num,
+                                         unsigned int align);
         struct resource* (*find_mem)    (unsigned long base, unsigned long num,
                                          unsigned long align, int low,
                                          struct pcmcia_socket *s);
@@ -89,6 +87,14 @@ struct pccard_resource_ops {
 
 
 /*
+ * Stuff internal to module "pcmcia_rsrc":
+ */
+extern int static_init(struct pcmcia_socket *s);
+extern struct resource *pcmcia_make_resource(unsigned long start,
+                                        unsigned long end,
+                                        int flags, const char *name);
+
+/*
  * Stuff internal to module "pcmcia_core":
  */
 
@@ -149,6 +155,8 @@ extern struct resource *pcmcia_find_mem_region(u_long base,
                                                int low,
                                                struct pcmcia_socket *s);
 
+void pcmcia_cleanup_irq(struct pcmcia_socket *s);
+int pcmcia_setup_irq(struct pcmcia_device *p_dev);
 
 /* cistpl.c */
 extern struct bin_attribute pccard_cis_attr;
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 2d48196a48cd..0f4cc3f00028 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -146,7 +146,6 @@ static irqreturn_t db1200_pcmcia_cdirq(int irq, void *data)
 static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
 {
         int ret;
-        unsigned long flags;
 
         if (sock->stschg_irq != -1) {
                 ret = request_irq(sock->stschg_irq, db1000_pcmcia_stschgirq,
@@ -162,30 +161,23 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
          * active one disabled.
          */
         if (sock->board_type == BOARD_TYPE_DB1200) {
-                local_irq_save(flags);
-
                 ret = request_irq(sock->insert_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_insert", sock);
-                if (ret) {
-                        local_irq_restore(flags);
+                if (ret)
                         goto out1;
-                }
 
                 ret = request_irq(sock->eject_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_eject", sock);
                 if (ret) {
                         free_irq(sock->insert_irq, sock);
-                        local_irq_restore(flags);
                         goto out1;
                 }
 
-                /* disable the currently active one */
+                /* enable the currently silent one */
                 if (db1200_card_inserted(sock))
-                        disable_irq_nosync(sock->insert_irq);
+                        enable_irq(sock->eject_irq);
                 else
-                        disable_irq_nosync(sock->eject_irq);
-
-                local_irq_restore(flags);
+                        enable_irq(sock->insert_irq);
         } else {
                 /* all other (older) Db1x00 boards use a GPIO to show
                  * card detection status:  use both-edge triggers.
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 4014cf8e4a26..7ef7adee5e4f 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -335,7 +335,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
 
                 mutex_lock(&s->ops_mutex);
                 list_del(&p_dev->socket_device_list);
-                p_dev->_removed = 1;
                 mutex_unlock(&s->ops_mutex);
 
                 dev_dbg(&p_dev->dev, "unregistering device\n");
@@ -372,8 +371,6 @@ static int pcmcia_device_remove(struct device *dev)
         if (p_drv->remove)
                 p_drv->remove(p_dev);
 
-        p_dev->dev_node = NULL;
-
         /* check for proper unloading */
         if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                 dev_printk(KERN_INFO, dev,
@@ -480,15 +477,6 @@ static int pcmcia_device_query(struct pcmcia_device *p_dev)
 }
 
 
-/* device_add_lock is needed to avoid double registration by cardmgr and kernel.
- * Serializes pcmcia_device_add; will most likely be removed in future.
- *
- * While it has the caveat that adding new PCMCIA devices inside(!) device_register()
- * won't work, this doesn't matter much at the moment: the driver core doesn't
- * support it either.
- */
-static DEFINE_MUTEX(device_add_lock);
-
 struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int function)
 {
         struct pcmcia_device *p_dev, *tmp_dev;
@@ -498,8 +486,6 @@ struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int fu
         if (!s)
                 return NULL;
 
-        mutex_lock(&device_add_lock);
-
         pr_debug("adding device to %d, function %d\n", s->sock, function);
 
         p_dev = kzalloc(sizeof(struct pcmcia_device), GFP_KERNEL);
@@ -539,8 +525,8 @@ struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int fu
 
         /*
          * p_dev->function_config must be the same for all card functions.
-         * Note that this is serialized by the device_add_lock, so that
-         * only one such struct will be created.
+         * Note that this is serialized by ops_mutex, so that only one
+         * such struct will be created.
          */
         list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
                 if (p_dev->func == tmp_dev->func) {
@@ -553,28 +539,31 @@ struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int fu
         /* Add to the list in pcmcia_bus_socket */
         list_add(&p_dev->socket_device_list, &s->devices_list);
 
-        mutex_unlock(&s->ops_mutex);
+        if (pcmcia_setup_irq(p_dev))
+                dev_warn(&p_dev->dev,
+                        "IRQ setup failed -- device might not work\n");
 
         if (!p_dev->function_config) {
                 dev_dbg(&p_dev->dev, "creating config_t\n");
                 p_dev->function_config = kzalloc(sizeof(struct config_t),
                                                  GFP_KERNEL);
-                if (!p_dev->function_config)
+                if (!p_dev->function_config) {
+                        mutex_unlock(&s->ops_mutex);
                         goto err_unreg;
+                }
                 kref_init(&p_dev->function_config->ref);
         }
+        mutex_unlock(&s->ops_mutex);
 
         dev_printk(KERN_NOTICE, &p_dev->dev,
-                   "pcmcia: registering new device %s\n",
-                   p_dev->devname);
+                   "pcmcia: registering new device %s (IRQ: %d)\n",
+                   p_dev->devname, p_dev->irq);
 
         pcmcia_device_query(p_dev);
 
         if (device_register(&p_dev->dev))
                 goto err_unreg;
 
-        mutex_unlock(&device_add_lock);
-
         return p_dev;
 
  err_unreg:
@@ -592,7 +581,6 @@ struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int fu
         kfree(p_dev->devname);
         kfree(p_dev);
  err_put:
-        mutex_unlock(&device_add_lock);
         pcmcia_put_socket(s);
 
         return NULL;
@@ -654,14 +642,7 @@ static int pcmcia_requery_callback(struct device *dev, void * _data)
 
 static void pcmcia_requery(struct pcmcia_socket *s)
 {
-        int present, has_pfc;
-
-        mutex_lock(&s->ops_mutex);
-        present = s->pcmcia_state.present;
-        mutex_unlock(&s->ops_mutex);
-
-        if (!present)
-                return;
+        int has_pfc;
 
         if (s->functions == 0) {
                 pcmcia_card_add(s);
@@ -828,11 +809,12 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) {
-                if (dev->device_no != did->device_no)
-                        return 0;
+                dev_dbg(&dev->dev, "this is a pseudo-multi-function device\n");
                 mutex_lock(&dev->socket->ops_mutex);
                 dev->socket->pcmcia_state.has_pfc = 1;
                 mutex_unlock(&dev->socket->ops_mutex);
+                if (dev->device_no != did->device_no)
+                        return 0;
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_FUNC_ID) {
@@ -843,7 +825,7 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
 
                 /* if this is a pseudo-multi-function device,
                  * we need explicit matches */
-                if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO)
+                if (dev->socket->pcmcia_state.has_pfc)
                         return 0;
                 if (dev->device_no)
                         return 0;
@@ -1260,20 +1242,19 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 
         switch (event) {
         case CS_EVENT_CARD_REMOVAL:
-                mutex_lock(&s->ops_mutex);
-                s->pcmcia_state.present = 0;
-                mutex_unlock(&s->ops_mutex);
+                atomic_set(&skt->present, 0);
                 pcmcia_card_remove(skt, NULL);
                 handle_event(skt, event);
                 mutex_lock(&s->ops_mutex);
                 destroy_cis_cache(s);
+                pcmcia_cleanup_irq(s);
                 mutex_unlock(&s->ops_mutex);
                 break;
 
         case CS_EVENT_CARD_INSERTION:
+                atomic_set(&skt->present, 1);
                 mutex_lock(&s->ops_mutex);
                 s->pcmcia_state.has_pfc = 0;
-                s->pcmcia_state.present = 1;
                 destroy_cis_cache(s); /* to be on the safe side... */
                 mutex_unlock(&s->ops_mutex);
                 pcmcia_card_add(skt);
@@ -1292,6 +1273,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
                         destroy_cis_cache(skt);
                         kfree(skt->fake_cis);
                         skt->fake_cis = NULL;
+                        s->functions = 0;
                         mutex_unlock(&s->ops_mutex);
                         /* now, add the new card */
                         ds_event(skt, CS_EVENT_CARD_INSERTION,
@@ -1313,7 +1295,13 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
     return 0;
 } /* ds_event */
 
-
+/*
+ * NOTE: This is racy. There's no guarantee the card will still be
+ * physically present, even if the call to this function returns
+ * non-NULL. Furthermore, the device driver most likely is unbound
+ * almost immediately, so the timeframe where pcmcia_dev_present
+ * returns NULL is probably really really small.
+ */
 struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
 {
         struct pcmcia_device *p_dev;
@@ -1323,22 +1311,9 @@ struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
         if (!p_dev)
                 return NULL;
 
-        mutex_lock(&p_dev->socket->ops_mutex);
-        if (!p_dev->socket->pcmcia_state.present)
-                goto out;
-
-        if (p_dev->socket->pcmcia_state.dead)
-                goto out;
-
-        if (p_dev->_removed)
-                goto out;
-
-        if (p_dev->suspended)
-                goto out;
+        if (atomic_read(&p_dev->socket->present) != 0)
+                ret = p_dev;
 
-        ret = p_dev;
- out:
-        mutex_unlock(&p_dev->socket->ops_mutex);
         pcmcia_put_dev(p_dev);
         return ret;
 }
@@ -1388,6 +1363,8 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
                 return ret;
         }
 
+        atomic_set(&socket->present, 0);
+
         return 0;
 }
 
@@ -1399,10 +1376,6 @@ static void pcmcia_bus_remove_socket(struct device *dev,
         if (!socket)
                 return;
 
-        mutex_lock(&socket->ops_mutex);
-        socket->pcmcia_state.dead = 1;
-        mutex_unlock(&socket->ops_mutex);
-
         pccard_register_pcmcia(socket, NULL);
 
         /* unregister any unbound devices */
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index a7cfc7964c7c..0ad06a3bd562 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -117,7 +117,7 @@ static int omap_cf_get_status(struct pcmcia_socket *s, u_int *sp)
 
                 *sp = SS_READY | SS_DETECT | SS_POWERON | SS_3VCARD;
                 cf = container_of(s, struct omap_cf_socket, socket);
-                s->irq.AssignedIRQ = 0;
+                s->pcmcia_irq = 0;
                 s->pci_irq = cf->irq;
         } else
                 *sp = 0;
diff --git a/drivers/pcmcia/pcmcia_cis.c b/drivers/pcmcia/pcmcia_cis.c
new file mode 100644
index 000000000000..4a65eaf96b0a
--- /dev/null
+++ b/drivers/pcmcia/pcmcia_cis.c
@@ -0,0 +1,356 @@
+/*
+ * PCMCIA high-level CIS access functions
+ *
+ * The initial developer of the original code is David A. Hinds
+ * <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
+ * are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
+ *
+ * Copyright (C) 1999        David A. Hinds
+ * Copyright (C) 2004-2009   Dominik Brodowski
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/ss.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/ds.h>
+#include "cs_internal.h"
+
+
+/**
+ * pccard_read_tuple() - internal CIS tuple access
+ * @s:          the struct pcmcia_socket where the card is inserted
+ * @function:   the device function we loop for
+ * @code:       which CIS code shall we look for?
+ * @parse:      buffer where the tuple shall be parsed (or NULL, if no parse)
+ *
+ * pccard_read_tuple() reads out one tuple and attempts to parse it
+ */
+int pccard_read_tuple(struct pcmcia_socket *s, unsigned int function,
+                cisdata_t code, void *parse)
+{
+        tuple_t tuple;
+        cisdata_t *buf;
+        int ret;
+
+        buf = kmalloc(256, GFP_KERNEL);
+        if (buf == NULL) {
+                dev_printk(KERN_WARNING, &s->dev, "no memory to read tuple\n");
+                return -ENOMEM;
+        }
+        tuple.DesiredTuple = code;
+        tuple.Attributes = 0;
+        if (function == BIND_FN_ALL)
+                tuple.Attributes = TUPLE_RETURN_COMMON;
+        ret = pccard_get_first_tuple(s, function, &tuple);
+        if (ret != 0)
+                goto done;
+        tuple.TupleData = buf;
+        tuple.TupleOffset = 0;
+        tuple.TupleDataMax = 255;
+        ret = pccard_get_tuple_data(s, &tuple);
+        if (ret != 0)
+                goto done;
+        ret = pcmcia_parse_tuple(&tuple, parse);
+done:
+        kfree(buf);
+        return ret;
+}
+
+
+/**
+ * pccard_loop_tuple() - loop over tuples in the CIS
+ * @s:          the struct pcmcia_socket where the card is inserted
+ * @function:   the device function we loop for
+ * @code:       which CIS code shall we look for?
+ * @parse:      buffer where the tuple shall be parsed (or NULL, if no parse)
+ * @priv_data:  private data to be passed to the loop_tuple function.
+ * @loop_tuple: function to call for each CIS entry of type @function. IT
+ *              gets passed the raw tuple, the paresed tuple (if @parse is
+ *              set) and @priv_data.
+ *
+ * pccard_loop_tuple() loops over all CIS entries of type @function, and
+ * calls the @loop_tuple function for each entry. If the call to @loop_tuple
+ * returns 0, the loop exits. Returns 0 on success or errorcode otherwise.
+ */
+int pccard_loop_tuple(struct pcmcia_socket *s, unsigned int function,
+                      cisdata_t code, cisparse_t *parse, void *priv_data,
+                      int (*loop_tuple) (tuple_t *tuple,
+                                         cisparse_t *parse,
+                                         void *priv_data))
+{
+        tuple_t tuple;
+        cisdata_t *buf;
+        int ret;
+
+        buf = kzalloc(256, GFP_KERNEL);
+        if (buf == NULL) {
+                dev_printk(KERN_WARNING, &s->dev, "no memory to read tuple\n");
+                return -ENOMEM;
+        }
+
+        tuple.TupleData = buf;
+        tuple.TupleDataMax = 255;
+        tuple.TupleOffset = 0;
+        tuple.DesiredTuple = code;
+        tuple.Attributes = 0;
+
+        ret = pccard_get_first_tuple(s, function, &tuple);
+        while (!ret) {
+                if (pccard_get_tuple_data(s, &tuple))
+                        goto next_entry;
+
+                if (parse)
+                        if (pcmcia_parse_tuple(&tuple, parse))
+                                goto next_entry;
+
+                ret = loop_tuple(&tuple, parse, priv_data);
+                if (!ret)
+                        break;
+
+next_entry:
+                ret = pccard_get_next_tuple(s, function, &tuple);
+        }
+
+        kfree(buf);
+        return ret;
+}
+
+struct pcmcia_cfg_mem {
+        struct pcmcia_device *p_dev;
+        void *priv_data;
+        int (*conf_check) (struct pcmcia_device *p_dev,
+                           cistpl_cftable_entry_t *cfg,
+                           cistpl_cftable_entry_t *dflt,
+                           unsigned int vcc,
+                           void *priv_data);
+        cisparse_t parse;
+        cistpl_cftable_entry_t dflt;
+};
+
+/**
+ * pcmcia_do_loop_config() - internal helper for pcmcia_loop_config()
+ *
+ * pcmcia_do_loop_config() is the internal callback for the call from
+ * pcmcia_loop_config() to pccard_loop_tuple(). Data is transferred
+ * by a struct pcmcia_cfg_mem.
+ */
+static int pcmcia_do_loop_config(tuple_t *tuple, cisparse_t *parse, void *priv)
+{
+        cistpl_cftable_entry_t *cfg = &parse->cftable_entry;
+        struct pcmcia_cfg_mem *cfg_mem = priv;
+
+        /* default values */
+        cfg_mem->p_dev->conf.ConfigIndex = cfg->index;
+        if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
+                cfg_mem->dflt = *cfg;
+
+        return cfg_mem->conf_check(cfg_mem->p_dev, cfg, &cfg_mem->dflt,
+                                   cfg_mem->p_dev->socket->socket.Vcc,
+                                   cfg_mem->priv_data);
+}
+
+/**
+ * pcmcia_loop_config() - loop over configuration options
+ * @p_dev:      the struct pcmcia_device which we need to loop for.
+ * @conf_check: function to call for each configuration option.
+ *              It gets passed the struct pcmcia_device, the CIS data
+ *              describing the configuration option, and private data
+ *              being passed to pcmcia_loop_config()
+ * @priv_data:  private data to be passed to the conf_check function.
+ *
+ * pcmcia_loop_config() loops over all configuration options, and calls
+ * the driver-specific conf_check() for each one, checking whether
+ * it is a valid one. Returns 0 on success or errorcode otherwise.
+ */
+int pcmcia_loop_config(struct pcmcia_device *p_dev,
+                       int      (*conf_check)   (struct pcmcia_device *p_dev,
+                                                 cistpl_cftable_entry_t *cfg,
+                                                 cistpl_cftable_entry_t *dflt,
+                                                 unsigned int vcc,
+                                                 void *priv_data),
+                       void *priv_data)
+{
+        struct pcmcia_cfg_mem *cfg_mem;
+        int ret;
+
+        cfg_mem = kzalloc(sizeof(struct pcmcia_cfg_mem), GFP_KERNEL);
+        if (cfg_mem == NULL)
+                return -ENOMEM;
+
+        cfg_mem->p_dev = p_dev;
+        cfg_mem->conf_check = conf_check;
+        cfg_mem->priv_data = priv_data;
+
+        ret = pccard_loop_tuple(p_dev->socket, p_dev->func,
+                                CISTPL_CFTABLE_ENTRY, &cfg_mem->parse,
+                                cfg_mem, pcmcia_do_loop_config);
+
+        kfree(cfg_mem);
+        return ret;
+}
+EXPORT_SYMBOL(pcmcia_loop_config);
+
+
+struct pcmcia_loop_mem {
+        struct pcmcia_device *p_dev;
+        void *priv_data;
+        int (*loop_tuple) (struct pcmcia_device *p_dev,
+                           tuple_t *tuple,
+                           void *priv_data);
+};
+
+/**
+ * pcmcia_do_loop_tuple() - internal helper for pcmcia_loop_config()
+ *
+ * pcmcia_do_loop_tuple() is the internal callback for the call from
+ * pcmcia_loop_tuple() to pccard_loop_tuple(). Data is transferred
+ * by a struct pcmcia_cfg_mem.
+ */
+static int pcmcia_do_loop_tuple(tuple_t *tuple, cisparse_t *parse, void *priv)
+{
+        struct pcmcia_loop_mem *loop = priv;
+
+        return loop->loop_tuple(loop->p_dev, tuple, loop->priv_data);
+};
+
+/**
+ * pcmcia_loop_tuple() - loop over tuples in the CIS
+ * @p_dev:      the struct pcmcia_device which we need to loop for.
+ * @code:       which CIS code shall we look for?
+ * @priv_data:  private data to be passed to the loop_tuple function.
+ * @loop_tuple: function to call for each CIS entry of type @function. IT
+ *              gets passed the raw tuple and @priv_data.
+ *
+ * pcmcia_loop_tuple() loops over all CIS entries of type @function, and
+ * calls the @loop_tuple function for each entry. If the call to @loop_tuple
+ * returns 0, the loop exits. Returns 0 on success or errorcode otherwise.
+ */
+int pcmcia_loop_tuple(struct pcmcia_device *p_dev, cisdata_t code,
+                      int (*loop_tuple) (struct pcmcia_device *p_dev,
+                                         tuple_t *tuple,
+                                         void *priv_data),
+                      void *priv_data)
+{
+        struct pcmcia_loop_mem loop = {
+                .p_dev = p_dev,
+                .loop_tuple = loop_tuple,
+                .priv_data = priv_data};
+
+        return pccard_loop_tuple(p_dev->socket, p_dev->func, code, NULL,
+                                 &loop, pcmcia_do_loop_tuple);
+}
+EXPORT_SYMBOL(pcmcia_loop_tuple);
+
+
+struct pcmcia_loop_get {
+        size_t len;
+        cisdata_t **buf;
+};
+
+/**
+ * pcmcia_do_get_tuple() - internal helper for pcmcia_get_tuple()
+ *
+ * pcmcia_do_get_tuple() is the internal callback for the call from
+ * pcmcia_get_tuple() to pcmcia_loop_tuple(). As we're only interested in
+ * the first tuple, return 0 unconditionally. Create a memory buffer large
+ * enough to hold the content of the tuple, and fill it with the tuple data.
+ * The caller is responsible to free the buffer.
+ */
+static int pcmcia_do_get_tuple(struct pcmcia_device *p_dev, tuple_t *tuple,
+                               void *priv)
+{
+        struct pcmcia_loop_get *get = priv;
+
+        *get->buf = kzalloc(tuple->TupleDataLen, GFP_KERNEL);
+        if (*get->buf) {
+                get->len = tuple->TupleDataLen;
+                memcpy(*get->buf, tuple->TupleData, tuple->TupleDataLen);
+        } else
+                dev_dbg(&p_dev->dev, "do_get_tuple: out of memory\n");
+        return 0;
+}
+
+/**
+ * pcmcia_get_tuple() - get first tuple from CIS
+ * @p_dev:      the struct pcmcia_device which we need to loop for.
+ * @code:       which CIS code shall we look for?
+ * @buf:        pointer to store the buffer to.
+ *
+ * pcmcia_get_tuple() gets the content of the first CIS entry of type @code.
+ * It returns the buffer length (or zero). The caller is responsible to free
+ * the buffer passed in @buf.
+ */
+size_t pcmcia_get_tuple(struct pcmcia_device *p_dev, cisdata_t code,
+                        unsigned char **buf)
+{
+        struct pcmcia_loop_get get = {
+                .len = 0,
+                .buf = buf,
+        };
+
+        *get.buf = NULL;
+        pcmcia_loop_tuple(p_dev, code, pcmcia_do_get_tuple, &get);
+
+        return get.len;
+}
+EXPORT_SYMBOL(pcmcia_get_tuple);
+
+
+/**
+ * pcmcia_do_get_mac() - internal helper for pcmcia_get_mac_from_cis()
+ *
+ * pcmcia_do_get_mac() is the internal callback for the call from
+ * pcmcia_get_mac_from_cis() to pcmcia_loop_tuple(). We check whether the
+ * tuple contains a proper LAN_NODE_ID of length 6, and copy the data
+ * to struct net_device->dev_addr[i].
+ */
+static int pcmcia_do_get_mac(struct pcmcia_device *p_dev, tuple_t *tuple,
+                             void *priv)
+{
+        struct net_device *dev = priv;
+        int i;
+
+        if (tuple->TupleData[0] != CISTPL_FUNCE_LAN_NODE_ID)
+                return -EINVAL;
+        if (tuple->TupleDataLen < ETH_ALEN + 2) {
+                dev_warn(&p_dev->dev, "Invalid CIS tuple length for "
+                        "LAN_NODE_ID\n");
+                return -EINVAL;
+        }
+
+        if (tuple->TupleData[1] != ETH_ALEN) {
+                dev_warn(&p_dev->dev, "Invalid header for LAN_NODE_ID\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < 6; i++)
+                dev->dev_addr[i] = tuple->TupleData[i+2];
+        return 0;
+}
+
+/**
+ * pcmcia_get_mac_from_cis() - read out MAC address from CISTPL_FUNCE
+ * @p_dev:      the struct pcmcia_device for which we want the address.
+ * @dev:        a properly prepared struct net_device to store the info to.
+ *
+ * pcmcia_get_mac_from_cis() reads out the hardware MAC address from
+ * CISTPL_FUNCE and stores it into struct net_device *dev->dev_addr which
+ * must be set up properly by the driver (see examples!).
+ */
+int pcmcia_get_mac_from_cis(struct pcmcia_device *p_dev, struct net_device *dev)
+{
+        return pcmcia_loop_tuple(p_dev, CISTPL_FUNCE, pcmcia_do_get_mac, dev);
+}
+EXPORT_SYMBOL(pcmcia_get_mac_from_cis);
+
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 104e73d5d86c..ef0c5f133691 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -301,7 +301,9 @@ static int pccard_get_status(struct pcmcia_socket *s,
             (c->IntType & (INT_MEMORY_AND_IO | INT_ZOOMED_VIDEO))) {
                 u_char reg;
                 if (c->CardValues & PRESENT_PIN_REPLACE) {
+                        mutex_lock(&s->ops_mutex);
                         pcmcia_read_cis_mem(s, 1, (c->ConfigBase+CISREG_PRR)>>1, 1, &reg);
+                        mutex_unlock(&s->ops_mutex);
                         status->CardState |=
                                 (reg & PRR_WP_STATUS) ? CS_EVENT_WRITE_PROTECT : 0;
                         status->CardState |=
@@ -315,7 +317,9 @@ static int pccard_get_status(struct pcmcia_socket *s,
                         status->CardState |= CS_EVENT_READY_CHANGE;
                 }
                 if (c->CardValues & PRESENT_EXT_STATUS) {
+                        mutex_lock(&s->ops_mutex);
                         pcmcia_read_cis_mem(s, 1, (c->ConfigBase+CISREG_ESR)>>1, 1, &reg);
+                        mutex_unlock(&s->ops_mutex);
                         status->CardState |=
                                 (reg & ESR_REQ_ATTN) ? CS_EVENT_REQUEST_ATTENTION : 0;
                 }
@@ -351,7 +355,7 @@ static int pccard_get_configuration_info(struct pcmcia_socket *s,
                 if (s->state & SOCKET_CARDBUS_CONFIG) {
                         config->Attributes = CONF_VALID_CLIENT;
                         config->IntType = INT_CARDBUS;
-                        config->AssignedIRQ = s->irq.AssignedIRQ;
+                        config->AssignedIRQ = s->pcmcia_irq;
                         if (config->AssignedIRQ)
                                 config->Attributes |= CONF_ENABLE_IRQ;
                         if (s->io[0].res) {
@@ -391,7 +395,7 @@ static int pccard_get_configuration_info(struct pcmcia_socket *s,
         config->ExtStatus = c->ExtStatus;
         config->Present = config->CardValues = c->CardValues;
         config->IRQAttributes = c->irq.Attributes;
-        config->AssignedIRQ = s->irq.AssignedIRQ;
+        config->AssignedIRQ = s->pcmcia_irq;
         config->BasePort1 = c->io.BasePort1;
         config->NumPorts1 = c->io.NumPorts1;
         config->Attributes1 = c->io.Attributes1;
@@ -571,7 +575,6 @@ static struct pci_bus *pcmcia_lookup_bus(struct pcmcia_socket *s)
 
 static int get_device_info(struct pcmcia_socket *s, bind_info_t *bind_info, int first)
 {
-        dev_node_t *node;
         struct pcmcia_device *p_dev;
         struct pcmcia_driver *p_drv;
         int ret = 0;
@@ -633,21 +636,13 @@ static int get_device_info(struct pcmcia_socket *s, bind_info_t *bind_info, int
                 goto err_put;
         }
 
-        if (first)
-                node = p_dev->dev_node;
-        else
-                for (node = p_dev->dev_node; node; node = node->next)
-                        if (node == bind_info->next)
-                                break;
-        if (!node) {
+        if (!first) {
                 ret = -ENODEV;
                 goto err_put;
         }
 
-        strlcpy(bind_info->name, node->dev_name, DEV_NAME_LEN);
-        bind_info->major = node->major;
-        bind_info->minor = node->minor;
-        bind_info->next = node->next;
+        strlcpy(bind_info->name, dev_name(&p_dev->dev), DEV_NAME_LEN);
+        bind_info->next = NULL;
 
  err_put:
         pcmcia_put_dev(p_dev);
@@ -711,7 +706,7 @@ static int ds_open(struct inode *inode, struct file *file)
             warning_printed = 1;
     }
 
-    if (s->pcmcia_state.present)
+    if (atomic_read(&s->present))
         queue_event(user, CS_EVENT_CARD_INSERTION);
 out:
     unlock_kernel();
@@ -770,9 +765,6 @@ static ssize_t ds_read(struct file *file, char __user *buf,
         return -EIO;
 
     s = user->socket;
-    if (s->pcmcia_state.dead)
-        return -EIO;
-
     ret = wait_event_interruptible(s->queue, !queue_empty(user));
     if (ret == 0)
         ret = put_user(get_queued_event(user), (int __user *)buf) ? -EFAULT : 4;
@@ -838,8 +830,6 @@ static int ds_ioctl(struct inode *inode, struct file *file,
         return -EIO;
 
     s = user->socket;
-    if (s->pcmcia_state.dead)
-        return -EIO;
 
     size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
     if (size > sizeof(ds_ioctl_arg_t))
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 7c3d03bb4f30..29f91fac1dff 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -23,6 +23,8 @@
 #include <linux/netdevice.h>
 #include <linux/slab.h>
 
+#include <asm/irq.h>
+
 #include <pcmcia/cs_types.h>
 #include <pcmcia/ss.h>
 #include <pcmcia/cs.h>
@@ -38,29 +40,6 @@ static int io_speed;
 module_param(io_speed, int, 0444);
 
 
-#ifdef CONFIG_PCMCIA_PROBE
-#include <asm/irq.h>
-/* mask of IRQs already reserved by other cards, we should avoid using them */
-static u8 pcmcia_used_irq[NR_IRQS];
-#endif
-
-static int pcmcia_adjust_io_region(struct resource *res, unsigned long start,
-                                   unsigned long end, struct pcmcia_socket *s)
-{
-        if (s->resource_ops->adjust_io_region)
-                return s->resource_ops->adjust_io_region(res, start, end, s);
-        return -ENOMEM;
-}
-
-static struct resource *pcmcia_find_io_region(unsigned long base, int num,
-                                              unsigned long align,
-                                              struct pcmcia_socket *s)
-{
-        if (s->resource_ops->find_io)
-                return s->resource_ops->find_io(base, num, align, s);
-        return NULL;
-}
-
 int pcmcia_validate_mem(struct pcmcia_socket *s)
 {
         if (s->resource_ops->validate_mem)
@@ -86,8 +65,7 @@ struct resource *pcmcia_find_mem_region(u_long base, u_long num, u_long align,
 static int alloc_io_space(struct pcmcia_socket *s, u_int attr,
                           unsigned int *base, unsigned int num, u_int lines)
 {
-        int i;
-        unsigned int try, align;
+        unsigned int align;
 
         align = (*base) ? (lines ? 1<<lines : 0) : 1;
         if (align && (align < num)) {
@@ -104,50 +82,8 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr,
                        *base, align);
                 align = 0;
         }
-        if ((s->features & SS_CAP_STATIC_MAP) && s->io_offset) {
-                *base = s->io_offset | (*base & 0x0fff);
-                return 0;
-        }
-        /* Check for an already-allocated window that must conflict with
-         * what was asked for.  It is a hack because it does not catch all
-         * potential conflicts, just the most obvious ones.
-         */
-        for (i = 0; i < MAX_IO_WIN; i++)
-                if ((s->io[i].res) && *base &&
-                    ((s->io[i].res->start & (align-1)) == *base))
-                        return 1;
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                if (!s->io[i].res) {
-                        s->io[i].res = pcmcia_find_io_region(*base, num, align, s);
-                        if (s->io[i].res) {
-                                *base = s->io[i].res->start;
-                                s->io[i].res->flags = (s->io[i].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
-                                s->io[i].InUse = num;
-                                break;
-                        } else
-                                return 1;
-                } else if ((s->io[i].res->flags & IORESOURCE_BITS) != (attr & IORESOURCE_BITS))
-                        continue;
-                /* Try to extend top of window */
-                try = s->io[i].res->end + 1;
-                if ((*base == 0) || (*base == try))
-                        if (pcmcia_adjust_io_region(s->io[i].res, s->io[i].res->start,
-                                                    s->io[i].res->end + num, s) == 0) {
-                                *base = try;
-                                s->io[i].InUse += num;
-                                break;
-                        }
-                /* Try to extend bottom of window */
-                try = s->io[i].res->start - num;
-                if ((*base == 0) || (*base == try))
-                        if (pcmcia_adjust_io_region(s->io[i].res, s->io[i].res->start - num,
-                                                    s->io[i].res->end, s) == 0) {
-                                *base = try;
-                                s->io[i].InUse += num;
-                                break;
-                        }
-        }
-        return (i == MAX_IO_WIN);
+
+        return s->resource_ops->find_io(s, attr, base, num, align);
 } /* alloc_io_space */
 
 
@@ -187,6 +123,7 @@ int pcmcia_access_configuration_register(struct pcmcia_device *p_dev,
         config_t *c;
         int addr;
         u_char val;
+        int ret = 0;
 
         if (!p_dev || !p_dev->function_config)
                 return -EINVAL;
@@ -203,11 +140,10 @@ int pcmcia_access_configuration_register(struct pcmcia_device *p_dev,
         }
 
         addr = (c->ConfigBase + reg->Offset) >> 1;
-        mutex_unlock(&s->ops_mutex);
 
         switch (reg->Action) {
         case CS_READ:
-                pcmcia_read_cis_mem(s, 1, addr, 1, &val);
+                ret = pcmcia_read_cis_mem(s, 1, addr, 1, &val);
                 reg->Value = val;
                 break;
         case CS_WRITE:
@@ -216,10 +152,11 @@ int pcmcia_access_configuration_register(struct pcmcia_device *p_dev,
                 break;
         default:
                 dev_dbg(&s->dev, "Invalid conf register request\n");
-                return -EINVAL;
+                ret = -EINVAL;
                 break;
         }
-        return 0;
+        mutex_unlock(&s->ops_mutex);
+        return ret;
 } /* pcmcia_access_configuration_register */
 EXPORT_SYMBOL(pcmcia_access_configuration_register);
 
@@ -275,19 +212,9 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
                 goto unlock;
         }
 
-        if (mod->Attributes & CONF_IRQ_CHANGE_VALID) {
-                if (mod->Attributes & CONF_ENABLE_IRQ) {
-                        c->Attributes |= CONF_ENABLE_IRQ;
-                        s->socket.io_irq = s->irq.AssignedIRQ;
-                } else {
-                        c->Attributes &= ~CONF_ENABLE_IRQ;
-                        s->socket.io_irq = 0;
-                }
-                s->ops->set_socket(s, &s->socket);
-        }
-
-        if (mod->Attributes & CONF_VCC_CHANGE_VALID) {
-                dev_dbg(&s->dev, "changing Vcc is not allowed at this time\n");
+        if (mod->Attributes & (CONF_IRQ_CHANGE_VALID | CONF_VCC_CHANGE_VALID)) {
+                dev_dbg(&s->dev,
+                        "changing Vcc or IRQ is not allowed at this time\n");
                 ret = -EINVAL;
                 goto unlock;
         }
@@ -422,52 +349,6 @@ out:
 } /* pcmcia_release_io */
 
 
-static int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
-{
-        struct pcmcia_socket *s = p_dev->socket;
-        config_t *c;
-        int ret = -EINVAL;
-
-        mutex_lock(&s->ops_mutex);
-
-        c = p_dev->function_config;
-
-        if (!p_dev->_irq)
-                goto out;
-
-        p_dev->_irq = 0;
-
-        if (c->state & CONFIG_LOCKED)
-                goto out;
-
-        if (c->irq.Attributes != req->Attributes) {
-                dev_dbg(&s->dev, "IRQ attributes must match assigned ones\n");
-                goto out;
-        }
-        if (s->irq.AssignedIRQ != req->AssignedIRQ) {
-                dev_dbg(&s->dev, "IRQ must match assigned one\n");
-                goto out;
-        }
-        if (--s->irq.Config == 0) {
-                c->state &= ~CONFIG_IRQ_REQ;
-                s->irq.AssignedIRQ = 0;
-        }
-
-        if (req->Handler)
-                free_irq(req->AssignedIRQ, p_dev->priv);
-
-#ifdef CONFIG_PCMCIA_PROBE
-        pcmcia_used_irq[req->AssignedIRQ]--;
-#endif
-        ret = 0;
-
-out:
-        mutex_unlock(&s->ops_mutex);
-
-        return ret;
-} /* pcmcia_release_irq */
-
-
 int pcmcia_release_window(struct pcmcia_device *p_dev, window_handle_t wh)
 {
         struct pcmcia_socket *s = p_dev->socket;
@@ -551,12 +432,11 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         if (req->Attributes & CONF_ENABLE_SPKR)
                 s->socket.flags |= SS_SPKR_ENA;
         if (req->Attributes & CONF_ENABLE_IRQ)
-                s->socket.io_irq = s->irq.AssignedIRQ;
+                s->socket.io_irq = s->pcmcia_irq;
         else
                 s->socket.io_irq = 0;
         s->ops->set_socket(s, &s->socket);
         s->lock_count++;
-        mutex_unlock(&s->ops_mutex);
 
         /* Set up CIS configuration registers */
         base = c->ConfigBase = req->ConfigBase;
@@ -574,9 +454,9 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
                         if (req->Present & PRESENT_IOBASE_0)
                                 c->Option |= COR_ADDR_DECODE;
                 }
-                if (c->state & CONFIG_IRQ_REQ)
-                        if (!(c->irq.Attributes & IRQ_FORCED_PULSE))
-                                c->Option |= COR_LEVEL_REQ;
+                if ((req->Attributes & CONF_ENABLE_IRQ) &&
+                        !(req->Attributes & CONF_ENABLE_PULSE_IRQ))
+                        c->Option |= COR_LEVEL_REQ;
                 pcmcia_write_cis_mem(s, 1, (base + CISREG_COR)>>1, 1, &c->Option);
                 mdelay(40);
         }
@@ -605,7 +485,6 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
 
         /* Configure I/O windows */
         if (c->state & CONFIG_IO_REQ) {
-                mutex_lock(&s->ops_mutex);
                 iomap.speed = io_speed;
                 for (i = 0; i < MAX_IO_WIN; i++)
                         if (s->io[i].res) {
@@ -624,11 +503,11 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
                                 s->ops->set_io_map(s, &iomap);
                                 s->io[i].Config++;
                         }
-                mutex_unlock(&s->ops_mutex);
         }
 
         c->state |= CONFIG_LOCKED;
         p_dev->_locked = 1;
+        mutex_unlock(&s->ops_mutex);
         return 0;
 } /* pcmcia_request_configuration */
 EXPORT_SYMBOL(pcmcia_request_configuration);
@@ -706,137 +585,176 @@ out:
 EXPORT_SYMBOL(pcmcia_request_io);
 
 
-/** pcmcia_request_irq
+/**
+ * pcmcia_request_irq() - attempt to request a IRQ for a PCMCIA device
  *
- * Request_irq() reserves an irq for this client.
+ * pcmcia_request_irq() is a wrapper around request_irq which will allow
+ * the PCMCIA core to clean up the registration in pcmcia_disable_device().
+ * Drivers are free to use request_irq() directly, but then they need to
+ * call free_irq themselfves, too. Also, only IRQF_SHARED capable IRQ
+ * handlers are allowed.
+ */
+int __must_check pcmcia_request_irq(struct pcmcia_device *p_dev,
+                                    irq_handler_t handler)
+{
+        int ret;
+
+        if (!p_dev->irq)
+                return -EINVAL;
+
+        ret = request_irq(p_dev->irq, handler, IRQF_SHARED,
+                        p_dev->devname, p_dev->priv);
+        if (!ret)
+                p_dev->_irq = 1;
+
+        return ret;
+}
+EXPORT_SYMBOL(pcmcia_request_irq);
+
+
+/**
+ * pcmcia_request_exclusive_irq() - attempt to request an exclusive IRQ first
  *
- * Also, since Linux only reserves irq's when they are actually
- * hooked, we don't guarantee that an irq will still be available
- * when the configuration is locked.  Now that I think about it,
- * there might be a way to fix this using a dummy handler.
+ * pcmcia_request_exclusive_irq() is a wrapper around request_irq which
+ * attempts first to request an exclusive IRQ. If it fails, it also accepts
+ * a shared IRQ, but prints out a warning. PCMCIA drivers should allow for
+ * IRQ sharing and either use request_irq directly (then they need to call
+ * free_irq themselves, too), or the pcmcia_request_irq() function.
  */
+int __must_check
+__pcmcia_request_exclusive_irq(struct pcmcia_device *p_dev,
+                        irq_handler_t handler)
+{
+        int ret;
+
+        if (!p_dev->irq)
+                return -EINVAL;
+
+        ret = request_irq(p_dev->irq, handler, 0, p_dev->devname, p_dev->priv);
+        if (ret) {
+                ret = pcmcia_request_irq(p_dev, handler);
+                dev_printk(KERN_WARNING, &p_dev->dev, "pcmcia: "
+                        "request for exclusive IRQ could not be fulfilled.\n");
+                dev_printk(KERN_WARNING, &p_dev->dev, "pcmcia: the driver "
+                        "needs updating to supported shared IRQ lines.\n");
+        }
+        if (ret)
+                dev_printk(KERN_INFO, &p_dev->dev, "request_irq() failed\n");
+        else
+                p_dev->_irq = 1;
+
+        return ret;
+} /* pcmcia_request_exclusive_irq */
+EXPORT_SYMBOL(__pcmcia_request_exclusive_irq);
+
 
 #ifdef CONFIG_PCMCIA_PROBE
+
+/* mask of IRQs already reserved by other cards, we should avoid using them */
+static u8 pcmcia_used_irq[NR_IRQS];
+
 static irqreturn_t test_action(int cpl, void *dev_id)
 {
         return IRQ_NONE;
 }
-#endif
 
-int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
+/**
+ * pcmcia_setup_isa_irq() - determine whether an ISA IRQ can be used
+ * @p_dev - the associated PCMCIA device
+ *
+ * locking note: must be called with ops_mutex locked.
+ */
+static int pcmcia_setup_isa_irq(struct pcmcia_device *p_dev, int type)
 {
         struct pcmcia_socket *s = p_dev->socket;
-        config_t *c;
-        int ret = -EINVAL, irq = 0;
-        int type;
+        unsigned int try, irq;
+        u32 mask = s->irq_mask;
+        int ret = -ENODEV;
 
-        mutex_lock(&s->ops_mutex);
+        for (try = 0; try < 64; try++) {
+                irq = try % 32;
 
-        if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "No card present\n");
-                goto out;
-        }
-        c = p_dev->function_config;
-        if (c->state & CONFIG_LOCKED) {
-                dev_dbg(&s->dev, "Configuration is locked\n");
-                goto out;
-        }
-        if (c->state & CONFIG_IRQ_REQ) {
-                dev_dbg(&s->dev, "IRQ already configured\n");
-                goto out;
+                /* marked as available by driver, not blocked by userspace? */
+                if (!((mask >> irq) & 1))
+                        continue;
+
+                /* avoid an IRQ which is already used by another PCMCIA card */
+                if ((try < 32) && pcmcia_used_irq[irq])
+                        continue;
+
+                /* register the correct driver, if possible, to check whether
+                 * registering a dummy handle works, i.e. if the IRQ isn't
+                 * marked as used by the kernel resource management core */
+                ret = request_irq(irq, test_action, type, p_dev->devname,
+                                  p_dev);
+                if (!ret) {
+                        free_irq(irq, p_dev);
+                        p_dev->irq = s->pcmcia_irq = irq;
+                        pcmcia_used_irq[irq]++;
+                        break;
+                }
         }
 
-        /* Decide what type of interrupt we are registering */
-        type = 0;
-        if (s->functions > 1)           /* All of this ought to be handled higher up */
-                type = IRQF_SHARED;
-        else if (req->Attributes & IRQ_TYPE_DYNAMIC_SHARING)
-                type = IRQF_SHARED;
-        else
-                printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
+        return ret;
+}
 
-        /* If the interrupt is already assigned, it must be the same */
-        if (s->irq.AssignedIRQ != 0)
-                irq = s->irq.AssignedIRQ;
+void pcmcia_cleanup_irq(struct pcmcia_socket *s)
+{
+        pcmcia_used_irq[s->pcmcia_irq]--;
+        s->pcmcia_irq = 0;
+}
 
-#ifdef CONFIG_PCMCIA_PROBE
-        if (!irq) {
-                int try;
-                u32 mask = s->irq_mask;
-                void *data = p_dev; /* something unique to this device */
+#else /* CONFIG_PCMCIA_PROBE */
 
-                for (try = 0; try < 64; try++) {
-                        irq = try % 32;
+static int pcmcia_setup_isa_irq(struct pcmcia_device *p_dev, int type)
+{
+        return -EINVAL;
+}
 
-                        /* marked as available by driver, and not blocked by userspace? */
-                        if (!((mask >> irq) & 1))
-                                continue;
+void pcmcia_cleanup_irq(struct pcmcia_socket *s)
+{
+        s->pcmcia_irq = 0;
+        return;
+}
 
-                        /* avoid an IRQ which is already used by a PCMCIA card */
-                        if ((try < 32) && pcmcia_used_irq[irq])
-                                continue;
+#endif  /* CONFIG_PCMCIA_PROBE */
 
-                        /* register the correct driver, if possible, of check whether
-                         * registering a dummy handle works, i.e. if the IRQ isn't
-                         * marked as used by the kernel resource management core */
-                        ret = request_irq(irq,
-                                          (req->Handler) ? req->Handler : test_action,
-                                          type,
-                                          p_dev->devname,
-                                          (req->Handler) ? p_dev->priv : data);
-                        if (!ret) {
-                                if (!req->Handler)
-                                        free_irq(irq, data);
-                                break;
-                        }
-                }
-        }
-#endif
-        /* only assign PCI irq if no IRQ already assigned */
-        if (ret && !s->irq.AssignedIRQ) {
-                if (!s->pci_irq) {
-                        dev_printk(KERN_INFO, &s->dev, "no IRQ found\n");
-                        goto out;
-                }
-                type = IRQF_SHARED;
-                irq = s->pci_irq;
-        }
 
-        if (ret && req->Handler) {
-                ret = request_irq(irq, req->Handler, type,
-                                  p_dev->devname, p_dev->priv);
-                if (ret) {
-                        dev_printk(KERN_INFO, &s->dev,
-                                "request_irq() failed\n");
-                        goto out;
-                }
-        }
+/**
+ * pcmcia_setup_irq() - determine IRQ to be used for device
+ * @p_dev - the associated PCMCIA device
+ *
+ * locking note: must be called with ops_mutex locked.
+ */
+int pcmcia_setup_irq(struct pcmcia_device *p_dev)
+{
+        struct pcmcia_socket *s = p_dev->socket;
 
-        /* Make sure the fact the request type was overridden is passed back */
-        if (type == IRQF_SHARED && !(req->Attributes & IRQ_TYPE_DYNAMIC_SHARING)) {
-                req->Attributes |= IRQ_TYPE_DYNAMIC_SHARING;
-                dev_printk(KERN_WARNING, &p_dev->dev, "pcmcia: "
-                        "request for exclusive IRQ could not be fulfilled.\n");
-                dev_printk(KERN_WARNING, &p_dev->dev, "pcmcia: the driver "
-                        "needs updating to supported shared IRQ lines.\n");
+        if (p_dev->irq)
+                return 0;
+
+        /* already assigned? */
+        if (s->pcmcia_irq) {
+                p_dev->irq = s->pcmcia_irq;
+                return 0;
         }
-        c->irq.Attributes = req->Attributes;
-        s->irq.AssignedIRQ = req->AssignedIRQ = irq;
-        s->irq.Config++;
 
-        c->state |= CONFIG_IRQ_REQ;
-        p_dev->_irq = 1;
+        /* prefer an exclusive ISA irq */
+        if (!pcmcia_setup_isa_irq(p_dev, 0))
+                return 0;
 
-#ifdef CONFIG_PCMCIA_PROBE
-        pcmcia_used_irq[irq]++;
-#endif
+        /* but accept a shared ISA irq */
+        if (!pcmcia_setup_isa_irq(p_dev, IRQF_SHARED))
+                return 0;
 
-        ret = 0;
-out:
-        mutex_unlock(&s->ops_mutex);
-        return ret;
-} /* pcmcia_request_irq */
-EXPORT_SYMBOL(pcmcia_request_irq);
+        /* but use the PCI irq otherwise */
+        if (s->pci_irq) {
+                p_dev->irq = s->pcmcia_irq = s->pci_irq;
+                return 0;
+        }
+
+        return -EINVAL;
+}
 
 
 /** pcmcia_request_window
@@ -939,237 +857,9 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev)
 {
         pcmcia_release_configuration(p_dev);
         pcmcia_release_io(p_dev, &p_dev->io);
-        pcmcia_release_irq(p_dev, &p_dev->irq);
+        if (p_dev->_irq)
+                free_irq(p_dev->irq, p_dev->priv);
         if (p_dev->win)
                 pcmcia_release_window(p_dev, p_dev->win);
 }
 EXPORT_SYMBOL(pcmcia_disable_device);
-
-
-struct pcmcia_cfg_mem {
-        struct pcmcia_device *p_dev;
-        void *priv_data;
-        int (*conf_check) (struct pcmcia_device *p_dev,
-                           cistpl_cftable_entry_t *cfg,
-                           cistpl_cftable_entry_t *dflt,
-                           unsigned int vcc,
-                           void *priv_data);
-        cisparse_t parse;
-        cistpl_cftable_entry_t dflt;
-};
-
-/**
- * pcmcia_do_loop_config() - internal helper for pcmcia_loop_config()
- *
- * pcmcia_do_loop_config() is the internal callback for the call from
- * pcmcia_loop_config() to pccard_loop_tuple(). Data is transferred
- * by a struct pcmcia_cfg_mem.
- */
-static int pcmcia_do_loop_config(tuple_t *tuple, cisparse_t *parse, void *priv)
-{
-        cistpl_cftable_entry_t *cfg = &parse->cftable_entry;
-        struct pcmcia_cfg_mem *cfg_mem = priv;
-
-        /* default values */
-        cfg_mem->p_dev->conf.ConfigIndex = cfg->index;
-        if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
-                cfg_mem->dflt = *cfg;
-
-        return cfg_mem->conf_check(cfg_mem->p_dev, cfg, &cfg_mem->dflt,
-                                   cfg_mem->p_dev->socket->socket.Vcc,
-                                   cfg_mem->priv_data);
-}
-
-/**
- * pcmcia_loop_config() - loop over configuration options
- * @p_dev:      the struct pcmcia_device which we need to loop for.
- * @conf_check: function to call for each configuration option.
- *              It gets passed the struct pcmcia_device, the CIS data
- *              describing the configuration option, and private data
- *              being passed to pcmcia_loop_config()
- * @priv_data:  private data to be passed to the conf_check function.
- *
- * pcmcia_loop_config() loops over all configuration options, and calls
- * the driver-specific conf_check() for each one, checking whether
- * it is a valid one. Returns 0 on success or errorcode otherwise.
- */
-int pcmcia_loop_config(struct pcmcia_device *p_dev,
-                       int      (*conf_check)   (struct pcmcia_device *p_dev,
-                                                 cistpl_cftable_entry_t *cfg,
-                                                 cistpl_cftable_entry_t *dflt,
-                                                 unsigned int vcc,
-                                                 void *priv_data),
-                       void *priv_data)
-{
-        struct pcmcia_cfg_mem *cfg_mem;
-        int ret;
-
-        cfg_mem = kzalloc(sizeof(struct pcmcia_cfg_mem), GFP_KERNEL);
-        if (cfg_mem == NULL)
-                return -ENOMEM;
-
-        cfg_mem->p_dev = p_dev;
-        cfg_mem->conf_check = conf_check;
-        cfg_mem->priv_data = priv_data;
-
-        ret = pccard_loop_tuple(p_dev->socket, p_dev->func,
-                                CISTPL_CFTABLE_ENTRY, &cfg_mem->parse,
-                                cfg_mem, pcmcia_do_loop_config);
-
-        kfree(cfg_mem);
-        return ret;
-}
-EXPORT_SYMBOL(pcmcia_loop_config);
-
-
-struct pcmcia_loop_mem {
-        struct pcmcia_device *p_dev;
-        void *priv_data;
-        int (*loop_tuple) (struct pcmcia_device *p_dev,
-                           tuple_t *tuple,
-                           void *priv_data);
-};
-
-/**
- * pcmcia_do_loop_tuple() - internal helper for pcmcia_loop_config()
- *
- * pcmcia_do_loop_tuple() is the internal callback for the call from
- * pcmcia_loop_tuple() to pccard_loop_tuple(). Data is transferred
- * by a struct pcmcia_cfg_mem.
- */
-static int pcmcia_do_loop_tuple(tuple_t *tuple, cisparse_t *parse, void *priv)
-{
-        struct pcmcia_loop_mem *loop = priv;
-
-        return loop->loop_tuple(loop->p_dev, tuple, loop->priv_data);
-};
-
-/**
- * pcmcia_loop_tuple() - loop over tuples in the CIS
- * @p_dev:      the struct pcmcia_device which we need to loop for.
- * @code:       which CIS code shall we look for?
- * @priv_data:  private data to be passed to the loop_tuple function.
- * @loop_tuple: function to call for each CIS entry of type @function. IT
- *              gets passed the raw tuple and @priv_data.
- *
- * pcmcia_loop_tuple() loops over all CIS entries of type @function, and
- * calls the @loop_tuple function for each entry. If the call to @loop_tuple
- * returns 0, the loop exits. Returns 0 on success or errorcode otherwise.
- */
-int pcmcia_loop_tuple(struct pcmcia_device *p_dev, cisdata_t code,
-                      int (*loop_tuple) (struct pcmcia_device *p_dev,
-                                         tuple_t *tuple,
-                                         void *priv_data),
-                      void *priv_data)
-{
-        struct pcmcia_loop_mem loop = {
-                .p_dev = p_dev,
-                .loop_tuple = loop_tuple,
-                .priv_data = priv_data};
-
-        return pccard_loop_tuple(p_dev->socket, p_dev->func, code, NULL,
-                                 &loop, pcmcia_do_loop_tuple);
-}
-EXPORT_SYMBOL(pcmcia_loop_tuple);
-
-
-struct pcmcia_loop_get {
-        size_t len;
-        cisdata_t **buf;
-};
-
-/**
- * pcmcia_do_get_tuple() - internal helper for pcmcia_get_tuple()
- *
- * pcmcia_do_get_tuple() is the internal callback for the call from
- * pcmcia_get_tuple() to pcmcia_loop_tuple(). As we're only interested in
- * the first tuple, return 0 unconditionally. Create a memory buffer large
- * enough to hold the content of the tuple, and fill it with the tuple data.
- * The caller is responsible to free the buffer.
- */
-static int pcmcia_do_get_tuple(struct pcmcia_device *p_dev, tuple_t *tuple,
-                               void *priv)
-{
-        struct pcmcia_loop_get *get = priv;
-
-        *get->buf = kzalloc(tuple->TupleDataLen, GFP_KERNEL);
-        if (*get->buf) {
-                get->len = tuple->TupleDataLen;
-                memcpy(*get->buf, tuple->TupleData, tuple->TupleDataLen);
-        } else
-                dev_dbg(&p_dev->dev, "do_get_tuple: out of memory\n");
-        return 0;
-}
-
-/**
- * pcmcia_get_tuple() - get first tuple from CIS
- * @p_dev:      the struct pcmcia_device which we need to loop for.
- * @code:       which CIS code shall we look for?
- * @buf:        pointer to store the buffer to.
- *
- * pcmcia_get_tuple() gets the content of the first CIS entry of type @code.
- * It returns the buffer length (or zero). The caller is responsible to free
- * the buffer passed in @buf.
- */
-size_t pcmcia_get_tuple(struct pcmcia_device *p_dev, cisdata_t code,
-                        unsigned char **buf)
-{
-        struct pcmcia_loop_get get = {
-                .len = 0,
-                .buf = buf,
-        };
-
-        *get.buf = NULL;
-        pcmcia_loop_tuple(p_dev, code, pcmcia_do_get_tuple, &get);
-
-        return get.len;
-}
-EXPORT_SYMBOL(pcmcia_get_tuple);
-
-
-/**
- * pcmcia_do_get_mac() - internal helper for pcmcia_get_mac_from_cis()
- *
- * pcmcia_do_get_mac() is the internal callback for the call from
- * pcmcia_get_mac_from_cis() to pcmcia_loop_tuple(). We check whether the
- * tuple contains a proper LAN_NODE_ID of length 6, and copy the data
- * to struct net_device->dev_addr[i].
- */
-static int pcmcia_do_get_mac(struct pcmcia_device *p_dev, tuple_t *tuple,
-                             void *priv)
-{
-        struct net_device *dev = priv;
-        int i;
-
-        if (tuple->TupleData[0] != CISTPL_FUNCE_LAN_NODE_ID)
-                return -EINVAL;
-        if (tuple->TupleDataLen < ETH_ALEN + 2) {
-                dev_warn(&p_dev->dev, "Invalid CIS tuple length for "
-                        "LAN_NODE_ID\n");
-                return -EINVAL;
-        }
-
-        if (tuple->TupleData[1] != ETH_ALEN) {
-                dev_warn(&p_dev->dev, "Invalid header for LAN_NODE_ID\n");
-                return -EINVAL;
-        }
-        for (i = 0; i < 6; i++)
-                dev->dev_addr[i] = tuple->TupleData[i+2];
-        return 0;
-}
-
-/**
- * pcmcia_get_mac_from_cis() - read out MAC address from CISTPL_FUNCE
- * @p_dev:      the struct pcmcia_device for which we want the address.
- * @dev:        a properly prepared struct net_device to store the info to.
- *
- * pcmcia_get_mac_from_cis() reads out the hardware MAC address from
- * CISTPL_FUNCE and stores it into struct net_device *dev->dev_addr which
- * must be set up properly by the driver (see examples!).
- */
-int pcmcia_get_mac_from_cis(struct pcmcia_device *p_dev, struct net_device *dev)
-{
-        return pcmcia_loop_tuple(p_dev, CISTPL_FUNCE, pcmcia_do_get_mac, dev);
-}
-EXPORT_SYMBOL(pcmcia_get_mac_from_cis);
-
diff --git a/drivers/pcmcia/pxa2xx_vpac270.c b/drivers/pcmcia/pxa2xx_vpac270.c
new file mode 100644
index 000000000000..55627eccee8e
--- /dev/null
+++ b/drivers/pcmcia/pxa2xx_vpac270.c
@@ -0,0 +1,229 @@
+/*
+ * linux/drivers/pcmcia/pxa2xx_vpac270.c
+ *
+ * Driver for Voipac PXA270 PCMCIA and CF sockets
+ *
+ * Copyright (C) 2010
+ * Marek Vasut <marek.vasut@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include <asm/mach-types.h>
+
+#include <mach/gpio.h>
+#include <mach/vpac270.h>
+
+#include "soc_common.h"
+
+static struct pcmcia_irqs cd_irqs[] = {
+        {
+                .sock = 0,
+                .irq  = IRQ_GPIO(GPIO84_VPAC270_PCMCIA_CD),
+                .str  = "PCMCIA CD"
+        },
+        {
+                .sock = 1,
+                .irq  = IRQ_GPIO(GPIO17_VPAC270_CF_CD),
+                .str  = "CF CD"
+        },
+};
+
+static int vpac270_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
+{
+        int ret;
+
+        if (skt->nr == 0) {
+                ret = gpio_request(GPIO84_VPAC270_PCMCIA_CD, "PCMCIA CD");
+                if (ret)
+                        goto err1;
+                ret = gpio_direction_input(GPIO84_VPAC270_PCMCIA_CD);
+                if (ret)
+                        goto err2;
+
+                ret = gpio_request(GPIO35_VPAC270_PCMCIA_RDY, "PCMCIA RDY");
+                if (ret)
+                        goto err2;
+                ret = gpio_direction_input(GPIO35_VPAC270_PCMCIA_RDY);
+                if (ret)
+                        goto err3;
+
+                ret = gpio_request(GPIO107_VPAC270_PCMCIA_PPEN, "PCMCIA PPEN");
+                if (ret)
+                        goto err3;
+                ret = gpio_direction_output(GPIO107_VPAC270_PCMCIA_PPEN, 0);
+                if (ret)
+                        goto err4;
+
+                ret = gpio_request(GPIO11_VPAC270_PCMCIA_RESET, "PCMCIA RESET");
+                if (ret)
+                        goto err4;
+                ret = gpio_direction_output(GPIO11_VPAC270_PCMCIA_RESET, 0);
+                if (ret)
+                        goto err5;
+
+                skt->socket.pci_irq = gpio_to_irq(GPIO35_VPAC270_PCMCIA_RDY);
+
+                return soc_pcmcia_request_irqs(skt, &cd_irqs[0], 1);
+
+err5:
+                gpio_free(GPIO11_VPAC270_PCMCIA_RESET);
+err4:
+                gpio_free(GPIO107_VPAC270_PCMCIA_PPEN);
+err3:
+                gpio_free(GPIO35_VPAC270_PCMCIA_RDY);
+err2:
+                gpio_free(GPIO84_VPAC270_PCMCIA_CD);
+err1:
+                return ret;
+
+        } else {
+                ret = gpio_request(GPIO17_VPAC270_CF_CD, "CF CD");
+                if (ret)
+                        goto err6;
+                ret = gpio_direction_input(GPIO17_VPAC270_CF_CD);
+                if (ret)
+                        goto err7;
+
+                ret = gpio_request(GPIO12_VPAC270_CF_RDY, "CF RDY");
+                if (ret)
+                        goto err7;
+                ret = gpio_direction_input(GPIO12_VPAC270_CF_RDY);
+                if (ret)
+                        goto err8;
+
+                ret = gpio_request(GPIO16_VPAC270_CF_RESET, "CF RESET");
+                if (ret)
+                        goto err8;
+                ret = gpio_direction_output(GPIO16_VPAC270_CF_RESET, 0);
+                if (ret)
+                        goto err9;
+
+                skt->socket.pci_irq = gpio_to_irq(GPIO12_VPAC270_CF_RDY);
+
+                return soc_pcmcia_request_irqs(skt, &cd_irqs[1], 1);
+
+err9:
+                gpio_free(GPIO16_VPAC270_CF_RESET);
+err8:
+                gpio_free(GPIO12_VPAC270_CF_RDY);
+err7:
+                gpio_free(GPIO17_VPAC270_CF_CD);
+err6:
+                return ret;
+
+        }
+}
+
+static void vpac270_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
+{
+        gpio_free(GPIO11_VPAC270_PCMCIA_RESET);
+        gpio_free(GPIO107_VPAC270_PCMCIA_PPEN);
+        gpio_free(GPIO35_VPAC270_PCMCIA_RDY);
+        gpio_free(GPIO84_VPAC270_PCMCIA_CD);
+        gpio_free(GPIO16_VPAC270_CF_RESET);
+        gpio_free(GPIO12_VPAC270_CF_RDY);
+        gpio_free(GPIO17_VPAC270_CF_CD);
+}
+
+static void vpac270_pcmcia_socket_state(struct soc_pcmcia_socket *skt,
+                                        struct pcmcia_state *state)
+{
+        if (skt->nr == 0) {
+                state->detect = !gpio_get_value(GPIO84_VPAC270_PCMCIA_CD);
+                state->ready  = !!gpio_get_value(GPIO35_VPAC270_PCMCIA_RDY);
+        } else {
+                state->detect = !gpio_get_value(GPIO17_VPAC270_CF_CD);
+                state->ready  = !!gpio_get_value(GPIO12_VPAC270_CF_RDY);
+        }
+        state->bvd1   = 1;
+        state->bvd2   = 1;
+        state->wrprot = 0;
+        state->vs_3v  = 1;
+        state->vs_Xv  = 0;
+}
+
+static int
+vpac270_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
+                                const socket_state_t *state)
+{
+        if (skt->nr == 0) {
+                gpio_set_value(GPIO11_VPAC270_PCMCIA_RESET,
+                        (state->flags & SS_RESET));
+                gpio_set_value(GPIO107_VPAC270_PCMCIA_PPEN,
+                        !(state->Vcc == 33 || state->Vcc == 50));
+        } else {
+                gpio_set_value(GPIO16_VPAC270_CF_RESET,
+                        (state->flags & SS_RESET));
+        }
+
+        return 0;
+}
+
+static void vpac270_pcmcia_socket_init(struct soc_pcmcia_socket *skt)
+{
+}
+
+static void vpac270_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
+{
+}
+
+static struct pcmcia_low_level vpac270_pcmcia_ops = {
+        .owner                  = THIS_MODULE,
+
+        .first                  = 0,
+        .nr                     = 2,
+
+        .hw_init                = vpac270_pcmcia_hw_init,
+        .hw_shutdown            = vpac270_pcmcia_hw_shutdown,
+
+        .socket_state           = vpac270_pcmcia_socket_state,
+        .configure_socket       = vpac270_pcmcia_configure_socket,
+
+        .socket_init            = vpac270_pcmcia_socket_init,
+        .socket_suspend         = vpac270_pcmcia_socket_suspend,
+};
+
+static struct platform_device *vpac270_pcmcia_device;
+
+static int __init vpac270_pcmcia_init(void)
+{
+        int ret;
+
+        if (!machine_is_vpac270())
+                return -ENODEV;
+
+        vpac270_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
+        if (!vpac270_pcmcia_device)
+                return -ENOMEM;
+
+        ret = platform_device_add_data(vpac270_pcmcia_device,
+                &vpac270_pcmcia_ops, sizeof(vpac270_pcmcia_ops));
+
+        if (!ret)
+                ret = platform_device_add(vpac270_pcmcia_device);
+
+        if (ret)
+                platform_device_put(vpac270_pcmcia_device);
+
+        return ret;
+}
+
+static void __exit vpac270_pcmcia_exit(void)
+{
+        platform_device_unregister(vpac270_pcmcia_device);
+}
+
+module_init(vpac270_pcmcia_init);
+module_exit(vpac270_pcmcia_exit);
+
+MODULE_AUTHOR("Marek Vasut <marek.vasut@gmail.com>");
+MODULE_DESCRIPTION("PCMCIA support for Voipac PXA270");
+MODULE_ALIAS("platform:pxa2xx-pcmcia");
+MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/rsrc_iodyn.c b/drivers/pcmcia/rsrc_iodyn.c
new file mode 100644
index 000000000000..d0bf35021065
--- /dev/null
+++ b/drivers/pcmcia/rsrc_iodyn.c
@@ -0,0 +1,172 @@
+/*
+ * rsrc_iodyn.c -- Resource management routines for MEM-static sockets.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * The initial developer of the original code is David A. Hinds
+ * <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
+ * are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
+ *
+ * (C) 1999             David A. Hinds
+ */
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <pcmcia/cs_types.h>
+#include <pcmcia/ss.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include "cs_internal.h"
+
+
+struct pcmcia_align_data {
+        unsigned long   mask;
+        unsigned long   offset;
+};
+
+static resource_size_t pcmcia_align(void *align_data,
+                                const struct resource *res,
+                                resource_size_t size, resource_size_t align)
+{
+        struct pcmcia_align_data *data = align_data;
+        resource_size_t start;
+
+        start = (res->start & ~data->mask) + data->offset;
+        if (start < res->start)
+                start += data->mask + 1;
+
+#ifdef CONFIG_X86
+        if (res->flags & IORESOURCE_IO) {
+                if (start & 0x300)
+                        start = (start + 0x3ff) & ~0x3ff;
+        }
+#endif
+
+#ifdef CONFIG_M68K
+        if (res->flags & IORESOURCE_IO) {
+                if ((res->start + size - 1) >= 1024)
+                        start = res->end;
+        }
+#endif
+
+        return start;
+}
+
+
+static struct resource *__iodyn_find_io_region(struct pcmcia_socket *s,
+                                        unsigned long base, int num,
+                                        unsigned long align)
+{
+        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_IO,
+                                                dev_name(&s->dev));
+        struct pcmcia_align_data data;
+        unsigned long min = base;
+        int ret;
+
+        data.mask = align - 1;
+        data.offset = base & data.mask;
+
+#ifdef CONFIG_PCI
+        if (s->cb_dev) {
+                ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
+                                             min, 0, pcmcia_align, &data);
+        } else
+#endif
+                ret = allocate_resource(&ioport_resource, res, num, min, ~0UL,
+                                        1, pcmcia_align, &data);
+
+        if (ret != 0) {
+                kfree(res);
+                res = NULL;
+        }
+        return res;
+}
+
+static int iodyn_find_io(struct pcmcia_socket *s, unsigned int attr,
+                        unsigned int *base, unsigned int num,
+                        unsigned int align)
+{
+        int i, ret = 0;
+
+        /* Check for an already-allocated window that must conflict with
+         * what was asked for.  It is a hack because it does not catch all
+         * potential conflicts, just the most obvious ones.
+         */
+        for (i = 0; i < MAX_IO_WIN; i++) {
+                if (!s->io[i].res)
+                        continue;
+
+                if (!*base)
+                        continue;
+
+                if ((s->io[i].res->start & (align-1)) == *base)
+                        return -EBUSY;
+        }
+
+        for (i = 0; i < MAX_IO_WIN; i++) {
+                struct resource *res = s->io[i].res;
+                unsigned int try;
+
+                if (res && (res->flags & IORESOURCE_BITS) !=
+                        (attr & IORESOURCE_BITS))
+                        continue;
+
+                if (!res) {
+                        if (align == 0)
+                                align = 0x10000;
+
+                        res = s->io[i].res = __iodyn_find_io_region(s, *base,
+                                                                num, align);
+                        if (!res)
+                                return -EINVAL;
+
+                        *base = res->start;
+                        s->io[i].res->flags =
+                                ((res->flags & ~IORESOURCE_BITS) |
+                                        (attr & IORESOURCE_BITS));
+                        s->io[i].InUse = num;
+                        return 0;
+                }
+
+                /* Try to extend top of window */
+                try = res->end + 1;
+                if ((*base == 0) || (*base == try)) {
+                        if (adjust_resource(s->io[i].res, res->start,
+                                        res->end - res->start + num + 1))
+                                continue;
+                        *base = try;
+                        s->io[i].InUse += num;
+                        return 0;
+                }
+
+                /* Try to extend bottom of window */
+                try = res->start - num;
+                if ((*base == 0) || (*base == try)) {
+                        if (adjust_resource(s->io[i].res,
+                                        res->start - num,
+                                        res->end - res->start + num + 1))
+                                continue;
+                        *base = try;
+                        s->io[i].InUse += num;
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
+}
+
+
+struct pccard_resource_ops pccard_iodyn_ops = {
+        .validate_mem = NULL,
+        .find_io = iodyn_find_io,
+        .find_mem = NULL,
+        .add_io = NULL,
+        .add_mem = NULL,
+        .init = static_init,
+        .exit = NULL,
+};
+EXPORT_SYMBOL(pccard_iodyn_ops);
diff --git a/drivers/pcmcia/rsrc_mgr.c b/drivers/pcmcia/rsrc_mgr.c
index ffa5f3cae57b..142efac3c387 100644
--- a/drivers/pcmcia/rsrc_mgr.c
+++ b/drivers/pcmcia/rsrc_mgr.c
@@ -22,7 +22,7 @@
 #include <pcmcia/cistpl.h>
 #include "cs_internal.h"
 
-static int static_init(struct pcmcia_socket *s)
+int static_init(struct pcmcia_socket *s)
 {
         /* the good thing about SS_CAP_STATIC_MAP sockets is
          * that they don't need a resource database */
@@ -32,118 +32,44 @@ static int static_init(struct pcmcia_socket *s)
         return 0;
 }
 
-
-struct pccard_resource_ops pccard_static_ops = {
-        .validate_mem = NULL,
-        .adjust_io_region = NULL,
-        .find_io = NULL,
-        .find_mem = NULL,
-        .add_io = NULL,
-        .add_mem = NULL,
-        .init = static_init,
-        .exit = NULL,
-};
-EXPORT_SYMBOL(pccard_static_ops);
-
-
-#ifdef CONFIG_PCCARD_IODYN
-
-static struct resource *
-make_resource(unsigned long b, unsigned long n, int flags, char *name)
+struct resource *pcmcia_make_resource(unsigned long start, unsigned long end,
+                                int flags, const char *name)
 {
         struct resource *res = kzalloc(sizeof(*res), GFP_KERNEL);
 
         if (res) {
                 res->name = name;
-                res->start = b;
-                res->end = b + n - 1;
+                res->start = start;
+                res->end = start + end - 1;
                 res->flags = flags;
         }
         return res;
 }
 
-struct pcmcia_align_data {
-        unsigned long   mask;
-        unsigned long   offset;
-};
-
-static resource_size_t pcmcia_align(void *align_data,
-                                const struct resource *res,
-                                resource_size_t size, resource_size_t align)
+static int static_find_io(struct pcmcia_socket *s, unsigned int attr,
+                        unsigned int *base, unsigned int num,
+                        unsigned int align)
 {
-        struct pcmcia_align_data *data = align_data;
-        resource_size_t start;
+        if (!s->io_offset)
+                return -EINVAL;
+        *base = s->io_offset | (*base & 0x0fff);
 
-        start = (res->start & ~data->mask) + data->offset;
-        if (start < res->start)
-                start += data->mask + 1;
-
-#ifdef CONFIG_X86
-        if (res->flags & IORESOURCE_IO) {
-                if (start & 0x300)
-                        start = (start + 0x3ff) & ~0x3ff;
-        }
-#endif
-
-#ifdef CONFIG_M68K
-        if (res->flags & IORESOURCE_IO) {
-                if ((res->start + size - 1) >= 1024)
-                        start = res->end;
-        }
-#endif
-
-        return start;
-}
-
-
-static int iodyn_adjust_io_region(struct resource *res, unsigned long r_start,
-                                      unsigned long r_end, struct pcmcia_socket *s)
-{
-        return adjust_resource(res, r_start, r_end - r_start + 1);
+        return 0;
 }
 
 
-static struct resource *iodyn_find_io_region(unsigned long base, int num,
-                unsigned long align, struct pcmcia_socket *s)
-{
-        struct resource *res = make_resource(0, num, IORESOURCE_IO,
-                                             dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        unsigned long min = base;
-        int ret;
-
-        if (align == 0)
-                align = 0x10000;
-
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-
-#ifdef CONFIG_PCI
-        if (s->cb_dev) {
-                ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
-                                             min, 0, pcmcia_align, &data);
-        } else
-#endif
-                ret = allocate_resource(&ioport_resource, res, num, min, ~0UL,
-                                        1, pcmcia_align, &data);
-
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-
-struct pccard_resource_ops pccard_iodyn_ops = {
+struct pccard_resource_ops pccard_static_ops = {
         .validate_mem = NULL,
-        .adjust_io_region = iodyn_adjust_io_region,
-        .find_io = iodyn_find_io_region,
+        .find_io = static_find_io,
         .find_mem = NULL,
         .add_io = NULL,
         .add_mem = NULL,
         .init = static_init,
         .exit = NULL,
 };
-EXPORT_SYMBOL(pccard_iodyn_ops);
+EXPORT_SYMBOL(pccard_static_ops);
+
 
-#endif /* CONFIG_PCCARD_IODYN */
+MODULE_AUTHOR("David A. Hinds, Dominik Brodowski");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("rsrc_nonstatic");
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index a6eb7b59ba9f..dcd1a4ad3d63 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -34,8 +34,10 @@
 #include <pcmcia/cistpl.h>
 #include "cs_internal.h"
 
+/* moved to rsrc_mgr.c
 MODULE_AUTHOR("David A. Hinds, Dominik Brodowski");
 MODULE_LICENSE("GPL");
+*/
 
 /* Parameters that can be set with 'insmod' */
 
@@ -70,27 +72,13 @@ struct socket_data {
 ======================================================================*/
 
 static struct resource *
-make_resource(resource_size_t b, resource_size_t n, int flags, const char *name)
-{
-        struct resource *res = kzalloc(sizeof(*res), GFP_KERNEL);
-
-        if (res) {
-                res->name = name;
-                res->start = b;
-                res->end = b + n - 1;
-                res->flags = flags;
-        }
-        return res;
-}
-
-static struct resource *
 claim_region(struct pcmcia_socket *s, resource_size_t base,
                 resource_size_t size, int type, char *name)
 {
         struct resource *res, *parent;
 
         parent = type & IORESOURCE_MEM ? &iomem_resource : &ioport_resource;
-        res = make_resource(base, size, type | IORESOURCE_BUSY, name);
+        res = pcmcia_make_resource(base, size, type | IORESOURCE_BUSY, name);
 
         if (res) {
 #ifdef CONFIG_PCI
@@ -661,8 +649,9 @@ pcmcia_align(void *align_data, const struct resource *res,
  * Adjust an existing IO region allocation, but making sure that we don't
  * encroach outside the resources which the user supplied.
  */
-static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_start,
-                                      unsigned long r_end, struct pcmcia_socket *s)
+static int __nonstatic_adjust_io_region(struct pcmcia_socket *s,
+                                        unsigned long r_start,
+                                        unsigned long r_end)
 {
         struct resource_map *m;
         struct socket_data *s_data = s->resource_data;
@@ -675,8 +664,7 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
                 if (start > r_start || r_end > end)
                         continue;
 
-                ret = adjust_resource(res, r_start, r_end - r_start + 1);
-                break;
+                ret = 0;
         }
 
         return ret;
@@ -695,18 +683,17 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
 
 ======================================================================*/
 
-static struct resource *nonstatic_find_io_region(unsigned long base, int num,
-                   unsigned long align, struct pcmcia_socket *s)
+static struct resource *__nonstatic_find_io_region(struct pcmcia_socket *s,
+                                                unsigned long base, int num,
+                                                unsigned long align)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_IO, dev_name(&s->dev));
+        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_IO,
+                                                dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min = base;
         int ret;
 
-        if (align == 0)
-                align = 0x10000;
-
         data.mask = align - 1;
         data.offset = base & data.mask;
         data.map = &s_data->io_db;
@@ -727,10 +714,97 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
         return res;
 }
 
+static int nonstatic_find_io(struct pcmcia_socket *s, unsigned int attr,
+                        unsigned int *base, unsigned int num,
+                        unsigned int align)
+{
+        int i, ret = 0;
+
+        /* Check for an already-allocated window that must conflict with
+         * what was asked for.  It is a hack because it does not catch all
+         * potential conflicts, just the most obvious ones.
+         */
+        for (i = 0; i < MAX_IO_WIN; i++) {
+                if (!s->io[i].res)
+                        continue;
+
+                if (!*base)
+                        continue;
+
+                if ((s->io[i].res->start & (align-1)) == *base)
+                        return -EBUSY;
+        }
+
+        for (i = 0; i < MAX_IO_WIN; i++) {
+                struct resource *res = s->io[i].res;
+                unsigned int try;
+
+                if (res && (res->flags & IORESOURCE_BITS) !=
+                        (attr & IORESOURCE_BITS))
+                        continue;
+
+                if (!res) {
+                        if (align == 0)
+                                align = 0x10000;
+
+                        res = s->io[i].res = __nonstatic_find_io_region(s,
+                                                                *base, num,
+                                                                align);
+                        if (!res)
+                                return -EINVAL;
+
+                        *base = res->start;
+                        s->io[i].res->flags =
+                                ((res->flags & ~IORESOURCE_BITS) |
+                                        (attr & IORESOURCE_BITS));
+                        s->io[i].InUse = num;
+                        return 0;
+                }
+
+                /* Try to extend top of window */
+                try = res->end + 1;
+                if ((*base == 0) || (*base == try)) {
+                        ret =  __nonstatic_adjust_io_region(s, res->start,
+                                                        res->end + num);
+                        if (!ret) {
+                                ret = adjust_resource(s->io[i].res, res->start,
+                                               res->end - res->start + num + 1);
+                                if (ret)
+                                        continue;
+                                *base = try;
+                                s->io[i].InUse += num;
+                                return 0;
+                        }
+                }
+
+                /* Try to extend bottom of window */
+                try = res->start - num;
+                if ((*base == 0) || (*base == try)) {
+                        ret =  __nonstatic_adjust_io_region(s,
+                                                        res->start - num,
+                                                        res->end);
+                        if (!ret) {
+                                ret = adjust_resource(s->io[i].res,
+                                               res->start - num,
+                                               res->end - res->start + num + 1);
+                                if (ret)
+                                        continue;
+                                *base = try;
+                                s->io[i].InUse += num;
+                                return 0;
+                        }
+                }
+        }
+
+        return -EINVAL;
+}
+
+
 static struct resource *nonstatic_find_mem_region(u_long base, u_long num,
                 u_long align, int low, struct pcmcia_socket *s)
 {
-        struct resource *res = make_resource(0, num, IORESOURCE_MEM, dev_name(&s->dev));
+        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_MEM,
+                                                dev_name(&s->dev));
         struct socket_data *s_data = s->resource_data;
         struct pcmcia_align_data data;
         unsigned long min, max;
@@ -861,23 +935,42 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
                 return -ENODEV;
 
 #if defined(CONFIG_X86)
-        /* If this is the root bus, the risk of hitting
-         * some strange system devices which aren't protected
-         * by either ACPI resource tables or properly requested
-         * resources is too big. Therefore, don't do auto-adding
-         * of resources at the moment.
+        /* If this is the root bus, the risk of hitting some strange
+         * system devices is too high: If a driver isn't loaded, the
+         * resources are not claimed; even if a driver is loaded, it
+         * may not request all resources or even the wrong one. We
+         * can neither trust the rest of the kernel nor ACPI/PNP and
+         * CRS parsing to get it right. Therefore, use several
+         * safeguards:
+         *
+         * - Do not auto-add resources if the CardBus bridge is on
+         *   the PCI root bus
+         *
+         * - Avoid any I/O ports < 0x100.
+         *
+         * - On PCI-PCI bridges, only use resources which are set up
+         *   exclusively for the secondary PCI bus: the risk of hitting
+         *   system devices is quite low, as they usually aren't
+         *   connected to the secondary PCI bus.
          */
         if (s->cb_dev->bus->number == 0)
                 return -EINVAL;
-#endif
 
+        for (i = 0; i < PCI_BRIDGE_RESOURCE_NUM; i++) {
+                res = s->cb_dev->bus->resource[i];
+#else
         pci_bus_for_each_resource(s->cb_dev->bus, res, i) {
+#endif
                 if (!res)
                         continue;
 
                 if (res->flags & IORESOURCE_IO) {
+                        /* safeguard against the root resource, where the
+                         * risk of hitting any other device would be too
+                         * high */
                         if (res == &ioport_resource)
                                 continue;
+
                         dev_printk(KERN_INFO, &s->cb_dev->dev,
                                    "pcmcia: parent PCI bridge window: %pR\n",
                                    res);
@@ -887,8 +980,12 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
                 }
 
                 if (res->flags & IORESOURCE_MEM) {
+                        /* safeguard against the root resource, where the
+                         * risk of hitting any other device would be too
+                         * high */
                         if (res == &iomem_resource)
                                 continue;
+
                         dev_printk(KERN_INFO, &s->cb_dev->dev,
                                    "pcmcia: parent PCI bridge window: %pR\n",
                                    res);
@@ -956,8 +1053,7 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
 
 struct pccard_resource_ops pccard_nonstatic_ops = {
         .validate_mem = pcmcia_nonstatic_validate_mem,
-        .adjust_io_region = nonstatic_adjust_io_region,
-        .find_io = nonstatic_find_io_region,
+        .find_io = nonstatic_find_io,
         .find_mem = nonstatic_find_mem_region,
         .add_io = adjust_io,
         .add_mem = adjust_memory,
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 83ace277426c..424e576f3acb 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -1303,13 +1303,6 @@ static int yenta_dev_suspend_noirq(struct device *dev)
         pci_read_config_dword(pdev, 17*4, &socket->saved_state[1]);
         pci_disable_device(pdev);
 
-        /*
-         * Some laptops (IBM T22) do not like us putting the Cardbus
-         * bridge into D3.  At a guess, some other laptop will
-         * probably require this, so leave it commented out for now.
-         */
-        /* pci_set_power_state(dev, 3); */
-
         return 0;
 }
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 7bec4588c268..6c3320d75055 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -390,6 +390,7 @@ config EEEPC_WMI
         depends on ACPI_WMI
         depends on INPUT
         depends on EXPERIMENTAL
+        select INPUT_SPARSEKMAP
         ---help---
           Say Y here if you want to support WMI-based hotkeys on Eee PC laptops.
 
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 52262b012abb..efe8f6388906 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -79,15 +79,15 @@ static uint wapf = 1;
 module_param(wapf, uint, 0644);
 MODULE_PARM_DESC(wapf, "WAPF value");
 
-static uint wlan_status = 1;
-static uint bluetooth_status = 1;
+static int wlan_status = 1;
+static int bluetooth_status = 1;
 
-module_param(wlan_status, uint, 0644);
+module_param(wlan_status, int, 0644);
 MODULE_PARM_DESC(wlan_status, "Set the wireless status on boot "
                  "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                  "default is 1");
 
-module_param(bluetooth_status, uint, 0644);
+module_param(bluetooth_status, int, 0644);
 MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
                  "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                  "default is 1");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 6ba6c30e5bb6..66f53c3c35e8 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -217,6 +217,7 @@ static void dell_wmi_notify(u32 value, void *context)
                 if (dell_new_hk_type && (buffer_entry[1] != 0x10)) {
                         printk(KERN_INFO "dell-wmi: Received unknown WMI event"
                                          " (0x%x)\n", buffer_entry[1]);
+                        kfree(obj);
                         return;
                 }
 
@@ -234,7 +235,7 @@ static void dell_wmi_notify(u32 value, void *context)
                             key->keycode == KEY_BRIGHTNESSDOWN) && acpi_video) {
                         /* Don't report brightness notifications that will also
                          * come via ACPI */
-                        return;
+                        ;
                 } else {
                         input_report_key(dell_wmi_input_dev, key->keycode, 1);
                         input_sync(dell_wmi_input_dev);
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 54a015785ca8..0306174ba875 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -169,7 +169,6 @@ struct eeepc_laptop {
         struct backlight_device *backlight_device;
 
         struct input_dev *inputdev;
-        struct key_entry *keymap;
 
         struct rfkill *wlan_rfkill;
         struct rfkill *bluetooth_rfkill;
@@ -1204,8 +1203,8 @@ static int eeepc_input_init(struct eeepc_laptop *eeepc)
 static void eeepc_input_exit(struct eeepc_laptop *eeepc)
 {
         if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
                 input_unregister_device(eeepc->inputdev);
-                kfree(eeepc->keymap);
         }
 }
 
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 9f8822658fd7..b227eb469f49 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -23,6 +23,8 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -30,22 +32,34 @@
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
+#include <linux/fb.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
+#define EEEPC_WMI_FILE  "eeepc-wmi"
+
 MODULE_AUTHOR("Yong Wang <yong.y.wang@intel.com>");
 MODULE_DESCRIPTION("Eee PC WMI Hotkey Driver");
 MODULE_LICENSE("GPL");
 
 #define EEEPC_WMI_EVENT_GUID    "ABBC0F72-8EA1-11D1-00A0-C90629100000"
+#define EEEPC_WMI_MGMT_GUID     "97845ED0-4E6D-11DE-8A39-0800200C9A66"
 
 MODULE_ALIAS("wmi:"EEEPC_WMI_EVENT_GUID);
+MODULE_ALIAS("wmi:"EEEPC_WMI_MGMT_GUID);
 
 #define NOTIFY_BRNUP_MIN        0x11
 #define NOTIFY_BRNUP_MAX        0x1f
 #define NOTIFY_BRNDOWN_MIN      0x20
 #define NOTIFY_BRNDOWN_MAX      0x2e
 
+#define EEEPC_WMI_METHODID_DEVS 0x53564544
+#define EEEPC_WMI_METHODID_DSTS 0x53544344
+
+#define EEEPC_WMI_DEVID_BACKLIGHT       0x00050012
+
 static const struct key_entry eeepc_wmi_keymap[] = {
         /* Sleep already handled via generic ACPI code */
         { KE_KEY, 0x5d, { KEY_WLAN } },
@@ -58,18 +72,198 @@ static const struct key_entry eeepc_wmi_keymap[] = {
         { KE_END, 0},
 };
 
-static struct input_dev *eeepc_wmi_input_dev;
+struct bios_args {
+        u32     dev_id;
+        u32     ctrl_param;
+};
+
+struct eeepc_wmi {
+        struct input_dev *inputdev;
+        struct backlight_device *backlight_device;
+};
+
+static struct platform_device *platform_device;
+
+static int eeepc_wmi_input_init(struct eeepc_wmi *eeepc)
+{
+        int err;
+
+        eeepc->inputdev = input_allocate_device();
+        if (!eeepc->inputdev)
+                return -ENOMEM;
+
+        eeepc->inputdev->name = "Eee PC WMI hotkeys";
+        eeepc->inputdev->phys = EEEPC_WMI_FILE "/input0";
+        eeepc->inputdev->id.bustype = BUS_HOST;
+        eeepc->inputdev->dev.parent = &platform_device->dev;
+
+        err = sparse_keymap_setup(eeepc->inputdev, eeepc_wmi_keymap, NULL);
+        if (err)
+                goto err_free_dev;
+
+        err = input_register_device(eeepc->inputdev);
+        if (err)
+                goto err_free_keymap;
+
+        return 0;
+
+err_free_keymap:
+        sparse_keymap_free(eeepc->inputdev);
+err_free_dev:
+        input_free_device(eeepc->inputdev);
+        return err;
+}
+
+static void eeepc_wmi_input_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
+                input_unregister_device(eeepc->inputdev);
+        }
+
+        eeepc->inputdev = NULL;
+}
+
+static acpi_status eeepc_wmi_get_devstate(u32 dev_id, u32 *ctrl_param)
+{
+        struct acpi_buffer input = { (acpi_size)sizeof(u32), &dev_id };
+        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        acpi_status status;
+        u32 tmp;
+
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DSTS, &input, &output);
+
+        if (ACPI_FAILURE(status))
+                return status;
+
+        obj = (union acpi_object *)output.pointer;
+        if (obj && obj->type == ACPI_TYPE_INTEGER)
+                tmp = (u32)obj->integer.value;
+        else
+                tmp = 0;
+
+        if (ctrl_param)
+                *ctrl_param = tmp;
+
+        kfree(obj);
+
+        return status;
+
+}
+
+static acpi_status eeepc_wmi_set_devstate(u32 dev_id, u32 ctrl_param)
+{
+        struct bios_args args = {
+                .dev_id = dev_id,
+                .ctrl_param = ctrl_param,
+        };
+        struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
+        acpi_status status;
+
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DEVS, &input, NULL);
+
+        return status;
+}
+
+static int read_brightness(struct backlight_device *bd)
+{
+        static u32 ctrl_param;
+        acpi_status status;
+
+        status = eeepc_wmi_get_devstate(EEEPC_WMI_DEVID_BACKLIGHT, &ctrl_param);
+
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return ctrl_param & 0xFF;
+}
+
+static int update_bl_status(struct backlight_device *bd)
+{
+
+        static u32 ctrl_param;
+        acpi_status status;
+
+        ctrl_param = bd->props.brightness;
+
+        status = eeepc_wmi_set_devstate(EEEPC_WMI_DEVID_BACKLIGHT, ctrl_param);
+
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return 0;
+}
+
+static const struct backlight_ops eeepc_wmi_bl_ops = {
+        .get_brightness = read_brightness,
+        .update_status = update_bl_status,
+};
+
+static int eeepc_wmi_backlight_notify(struct eeepc_wmi *eeepc, int code)
+{
+        struct backlight_device *bd = eeepc->backlight_device;
+        int old = bd->props.brightness;
+        int new;
+
+        if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
+                new = code - NOTIFY_BRNUP_MIN + 1;
+        else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                new = code - NOTIFY_BRNDOWN_MIN;
+
+        bd->props.brightness = new;
+        backlight_update_status(bd);
+        backlight_force_update(bd, BACKLIGHT_UPDATE_HOTKEY);
+
+        return old;
+}
+
+static int eeepc_wmi_backlight_init(struct eeepc_wmi *eeepc)
+{
+        struct backlight_device *bd;
+        struct backlight_properties props;
+
+        memset(&props, 0, sizeof(struct backlight_properties));
+        props.max_brightness = 15;
+        bd = backlight_device_register(EEEPC_WMI_FILE,
+                                       &platform_device->dev, eeepc,
+                                       &eeepc_wmi_bl_ops, &props);
+        if (IS_ERR(bd)) {
+                pr_err("Could not register backlight device\n");
+                return PTR_ERR(bd);
+        }
+
+        eeepc->backlight_device = bd;
+
+        bd->props.brightness = read_brightness(bd);
+        bd->props.power = FB_BLANK_UNBLANK;
+        backlight_update_status(bd);
+
+        return 0;
+}
+
+static void eeepc_wmi_backlight_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->backlight_device)
+                backlight_device_unregister(eeepc->backlight_device);
+
+        eeepc->backlight_device = NULL;
+}
 
 static void eeepc_wmi_notify(u32 value, void *context)
 {
+        struct eeepc_wmi *eeepc = context;
         struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
         acpi_status status;
         int code;
+        int orig_code;
 
         status = wmi_get_event_data(value, &response);
         if (status != AE_OK) {
-                pr_err("EEEPC WMI: bad event status 0x%x\n", status);
+                pr_err("bad event status 0x%x\n", status);
                 return;
         }
 
@@ -77,81 +271,142 @@ static void eeepc_wmi_notify(u32 value, void *context)
 
         if (obj && obj->type == ACPI_TYPE_INTEGER) {
                 code = obj->integer.value;
+                orig_code = code;
 
                 if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
                         code = NOTIFY_BRNUP_MIN;
-                else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                else if (code >= NOTIFY_BRNDOWN_MIN &&
+                         code <= NOTIFY_BRNDOWN_MAX)
                         code = NOTIFY_BRNDOWN_MIN;
 
-                if (!sparse_keymap_report_event(eeepc_wmi_input_dev,
+                if (code == NOTIFY_BRNUP_MIN || code == NOTIFY_BRNDOWN_MIN) {
+                        if (!acpi_video_backlight_support())
+                                eeepc_wmi_backlight_notify(eeepc, orig_code);
+                }
+
+                if (!sparse_keymap_report_event(eeepc->inputdev,
                                                 code, 1, true))
-                        pr_info("EEEPC WMI: Unknown key %x pressed\n", code);
+                        pr_info("Unknown key %x pressed\n", code);
         }
 
         kfree(obj);
 }
 
-static int eeepc_wmi_input_setup(void)
+static int __devinit eeepc_wmi_platform_probe(struct platform_device *device)
 {
+        struct eeepc_wmi *eeepc;
         int err;
+        acpi_status status;
 
-        eeepc_wmi_input_dev = input_allocate_device();
-        if (!eeepc_wmi_input_dev)
-                return -ENOMEM;
-
-        eeepc_wmi_input_dev->name = "Eee PC WMI hotkeys";
-        eeepc_wmi_input_dev->phys = "wmi/input0";
-        eeepc_wmi_input_dev->id.bustype = BUS_HOST;
+        eeepc = platform_get_drvdata(device);
 
-        err = sparse_keymap_setup(eeepc_wmi_input_dev, eeepc_wmi_keymap, NULL);
+        err = eeepc_wmi_input_init(eeepc);
         if (err)
-                goto err_free_dev;
+                goto error_input;
 
-        err = input_register_device(eeepc_wmi_input_dev);
-        if (err)
-                goto err_free_keymap;
+        if (!acpi_video_backlight_support()) {
+                err = eeepc_wmi_backlight_init(eeepc);
+                if (err)
+                        goto error_backlight;
+        } else
+                pr_info("Backlight controlled by ACPI video driver\n");
+
+        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
+                                        eeepc_wmi_notify, eeepc);
+        if (ACPI_FAILURE(status)) {
+                pr_err("Unable to register notify handler - %d\n",
+                        status);
+                err = -ENODEV;
+                goto error_wmi;
+        }
 
         return 0;
 
-err_free_keymap:
-        sparse_keymap_free(eeepc_wmi_input_dev);
-err_free_dev:
-        input_free_device(eeepc_wmi_input_dev);
+error_wmi:
+        eeepc_wmi_backlight_exit(eeepc);
+error_backlight:
+        eeepc_wmi_input_exit(eeepc);
+error_input:
         return err;
 }
 
+static int __devexit eeepc_wmi_platform_remove(struct platform_device *device)
+{
+        struct eeepc_wmi *eeepc;
+
+        eeepc = platform_get_drvdata(device);
+        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
+        eeepc_wmi_backlight_exit(eeepc);
+        eeepc_wmi_input_exit(eeepc);
+
+        return 0;
+}
+
+static struct platform_driver platform_driver = {
+        .driver = {
+                .name = EEEPC_WMI_FILE,
+                .owner = THIS_MODULE,
+        },
+        .probe = eeepc_wmi_platform_probe,
+        .remove = __devexit_p(eeepc_wmi_platform_remove),
+};
+
 static int __init eeepc_wmi_init(void)
 {
+        struct eeepc_wmi *eeepc;
         int err;
-        acpi_status status;
 
-        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID)) {
-                pr_warning("EEEPC WMI: No known WMI GUID found\n");
+        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID) ||
+            !wmi_has_guid(EEEPC_WMI_MGMT_GUID)) {
+                pr_warning("No known WMI GUID found\n");
                 return -ENODEV;
         }
 
-        err = eeepc_wmi_input_setup();
-        if (err)
-                return err;
+        eeepc = kzalloc(sizeof(struct eeepc_wmi), GFP_KERNEL);
+        if (!eeepc)
+                return -ENOMEM;
 
-        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
-                                        eeepc_wmi_notify, NULL);
-        if (ACPI_FAILURE(status)) {
-                sparse_keymap_free(eeepc_wmi_input_dev);
-                input_unregister_device(eeepc_wmi_input_dev);
-                pr_err("EEEPC WMI: Unable to register notify handler - %d\n",
-                        status);
-                return -ENODEV;
+        platform_device = platform_device_alloc(EEEPC_WMI_FILE, -1);
+        if (!platform_device) {
+                pr_warning("Unable to allocate platform device\n");
+                err = -ENOMEM;
+                goto fail_platform;
+        }
+
+        err = platform_device_add(platform_device);
+        if (err) {
+                pr_warning("Unable to add platform device\n");
+                goto put_dev;
+        }
+
+        platform_set_drvdata(platform_device, eeepc);
+
+        err = platform_driver_register(&platform_driver);
+        if (err) {
+                pr_warning("Unable to register platform driver\n");
+                goto del_dev;
         }
 
         return 0;
+
+del_dev:
+        platform_device_del(platform_device);
+put_dev:
+        platform_device_put(platform_device);
+fail_platform:
+        kfree(eeepc);
+
+        return err;
 }
 
 static void __exit eeepc_wmi_exit(void)
 {
-        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
-        sparse_keymap_free(eeepc_wmi_input_dev);
-        input_unregister_device(eeepc_wmi_input_dev);
+        struct eeepc_wmi *eeepc;
+
+        eeepc = platform_get_drvdata(platform_device);
+        platform_driver_unregister(&platform_driver);
+        platform_device_unregister(platform_device);
+        kfree(eeepc);
 }
 
 module_init(eeepc_wmi_init);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 35bb44af49b3..100e4d9372f1 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -274,26 +274,6 @@ static void pnpacpi_parse_allocated_busresource(struct pnp_dev *dev,
         pnp_add_bus_resource(dev, start, end);
 }
 
-static u64 addr_space_length(struct pnp_dev *dev, u64 min, u64 max, u64 len)
-{
-        u64 max_len;
-
-        max_len = max - min + 1;
-        if (len <= max_len)
-                return len;
-
-        /*
-         * Per 6.4.3.5, _LEN cannot exceed _MAX - _MIN + 1, but some BIOSes
-         * don't do this correctly, e.g.,
-         * https://bugzilla.kernel.org/show_bug.cgi?id=15480
-         */
-        dev_info(&dev->dev,
-                 "resource length %#llx doesn't fit in %#llx-%#llx, trimming\n",
-                 (unsigned long long) len, (unsigned long long) min,
-                 (unsigned long long) max);
-        return max_len;
-}
-
 static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
                                                   struct acpi_resource *res)
 {
@@ -309,7 +289,8 @@ static void pnpacpi_parse_allocated_address_space(struct pnp_dev *dev,
                 return;
         }
 
-        len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+        /* Windows apparently computes length rather than using _LEN */
+        len = p->maximum - p->minimum + 1;
         window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
         if (p->resource_type == ACPI_MEMORY_RANGE)
@@ -330,7 +311,8 @@ static void pnpacpi_parse_allocated_ext_address_space(struct pnp_dev *dev,
         int window;
         u64 len;
 
-        len = addr_space_length(dev, p->minimum, p->maximum, p->address_length);
+        /* Windows apparently computes length rather than using _LEN */
+        len = p->maximum - p->minimum + 1;
         window = (p->producer_consumer == ACPI_PRODUCER) ? 1 : 0;
 
         if (p->resource_type == ACPI_MEMORY_RANGE)
diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
index 2e54e6a23c72..e3446ab8b563 100644
--- a/drivers/pnp/resource.c
+++ b/drivers/pnp/resource.c
@@ -211,6 +211,8 @@ int pnp_check_port(struct pnp_dev *dev, struct resource *res)
                         if (tres->flags & IORESOURCE_IO) {
                                 if (cannot_compare(tres->flags))
                                         continue;
+                                if (tres->flags & IORESOURCE_WINDOW)
+                                        continue;
                                 tport = &tres->start;
                                 tend = &tres->end;
                                 if (ranged_conflict(port, end, tport, tend))
@@ -271,6 +273,8 @@ int pnp_check_mem(struct pnp_dev *dev, struct resource *res)
                         if (tres->flags & IORESOURCE_MEM) {
                                 if (cannot_compare(tres->flags))
                                         continue;
+                                if (tres->flags & IORESOURCE_WINDOW)
+                                        continue;
                                 taddr = &tres->start;
                                 tend = &tres->end;
                                 if (ranged_conflict(addr, end, taddr, tend))
diff --git a/drivers/regulator/max8925-regulator.c b/drivers/regulator/max8925-regulator.c
index b6218f11c957..552cad85ae5a 100644
--- a/drivers/regulator/max8925-regulator.c
+++ b/drivers/regulator/max8925-regulator.c
@@ -109,7 +109,7 @@ static int max8925_is_enabled(struct regulator_dev *rdev)
         struct max8925_regulator_info *info = rdev_get_drvdata(rdev);
         int ret;
 
-        ret = max8925_reg_read(info->i2c, info->vol_reg);
+        ret = max8925_reg_read(info->i2c, info->enable_reg);
         if (ret < 0)
                 return ret;
 
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 6a1303759432..50ac047cd136 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -620,6 +620,16 @@ config RTC_DRV_NUC900
 
 comment "on-CPU RTC drivers"
 
+config RTC_DRV_DAVINCI
+        tristate "TI DaVinci RTC"
+        depends on ARCH_DAVINCI_DM365
+        help
+          If you say yes here you get support for the RTC on the
+          DaVinci platforms (DM365).
+
+          This driver can also be built as a module. If so, the module
+          will be called rtc-davinci.
+
 config RTC_DRV_OMAP
         tristate "TI OMAP1"
         depends on ARCH_OMAP15XX || ARCH_OMAP16XX || ARCH_OMAP730 || ARCH_DAVINCI_DA8XX
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 44ef194a9573..245311a1348f 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_RTC_DRV_BQ32K)	+= rtc-bq32k.o
 obj-$(CONFIG_RTC_DRV_BQ4802)    += rtc-bq4802.o
 obj-$(CONFIG_RTC_DRV_CMOS)      += rtc-cmos.o
 obj-$(CONFIG_RTC_DRV_COH901331) += rtc-coh901331.o
+obj-$(CONFIG_RTC_DRV_DAVINCI)   += rtc-davinci.o
 obj-$(CONFIG_RTC_DRV_DM355EVM)  += rtc-dm355evm.o
 obj-$(CONFIG_RTC_DRV_DS1216)    += rtc-ds1216.o
 obj-$(CONFIG_RTC_DRV_DS1286)    += rtc-ds1286.o
diff --git a/drivers/rtc/rtc-davinci.c b/drivers/rtc/rtc-davinci.c
new file mode 100644
index 000000000000..92a8f6cacda9
--- /dev/null
+++ b/drivers/rtc/rtc-davinci.c
@@ -0,0 +1,673 @@
+/*
+ * DaVinci Power Management and Real Time Clock Driver for TI platforms
+ *
+ * Copyright (C) 2009 Texas Instruments, Inc
+ *
+ * Author: Miguel Aguilar <miguel.aguilar@ridgerun.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/rtc.h>
+#include <linux/bcd.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+/*
+ * The DaVinci RTC is a simple RTC with the following
+ * Sec: 0 - 59 : BCD count
+ * Min: 0 - 59 : BCD count
+ * Hour: 0 - 23 : BCD count
+ * Day: 0 - 0x7FFF(32767) : Binary count ( Over 89 years )
+ */
+
+/* PRTC interface registers */
+#define DAVINCI_PRTCIF_PID              0x00
+#define PRTCIF_CTLR                     0x04
+#define PRTCIF_LDATA                    0x08
+#define PRTCIF_UDATA                    0x0C
+#define PRTCIF_INTEN                    0x10
+#define PRTCIF_INTFLG                   0x14
+
+/* PRTCIF_CTLR bit fields */
+#define PRTCIF_CTLR_BUSY                BIT(31)
+#define PRTCIF_CTLR_SIZE                BIT(25)
+#define PRTCIF_CTLR_DIR                 BIT(24)
+#define PRTCIF_CTLR_BENU_MSB            BIT(23)
+#define PRTCIF_CTLR_BENU_3RD_BYTE       BIT(22)
+#define PRTCIF_CTLR_BENU_2ND_BYTE       BIT(21)
+#define PRTCIF_CTLR_BENU_LSB            BIT(20)
+#define PRTCIF_CTLR_BENU_MASK           (0x00F00000)
+#define PRTCIF_CTLR_BENL_MSB            BIT(19)
+#define PRTCIF_CTLR_BENL_3RD_BYTE       BIT(18)
+#define PRTCIF_CTLR_BENL_2ND_BYTE       BIT(17)
+#define PRTCIF_CTLR_BENL_LSB            BIT(16)
+#define PRTCIF_CTLR_BENL_MASK           (0x000F0000)
+
+/* PRTCIF_INTEN bit fields */
+#define PRTCIF_INTEN_RTCSS              BIT(1)
+#define PRTCIF_INTEN_RTCIF              BIT(0)
+#define PRTCIF_INTEN_MASK               (PRTCIF_INTEN_RTCSS \
+                                        | PRTCIF_INTEN_RTCIF)
+
+/* PRTCIF_INTFLG bit fields */
+#define PRTCIF_INTFLG_RTCSS             BIT(1)
+#define PRTCIF_INTFLG_RTCIF             BIT(0)
+#define PRTCIF_INTFLG_MASK              (PRTCIF_INTFLG_RTCSS \
+                                        | PRTCIF_INTFLG_RTCIF)
+
+/* PRTC subsystem registers */
+#define PRTCSS_RTC_INTC_EXTENA1         (0x0C)
+#define PRTCSS_RTC_CTRL                 (0x10)
+#define PRTCSS_RTC_WDT                  (0x11)
+#define PRTCSS_RTC_TMR0                 (0x12)
+#define PRTCSS_RTC_TMR1                 (0x13)
+#define PRTCSS_RTC_CCTRL                (0x14)
+#define PRTCSS_RTC_SEC                  (0x15)
+#define PRTCSS_RTC_MIN                  (0x16)
+#define PRTCSS_RTC_HOUR                 (0x17)
+#define PRTCSS_RTC_DAY0                 (0x18)
+#define PRTCSS_RTC_DAY1                 (0x19)
+#define PRTCSS_RTC_AMIN                 (0x1A)
+#define PRTCSS_RTC_AHOUR                (0x1B)
+#define PRTCSS_RTC_ADAY0                (0x1C)
+#define PRTCSS_RTC_ADAY1                (0x1D)
+#define PRTCSS_RTC_CLKC_CNT             (0x20)
+
+/* PRTCSS_RTC_INTC_EXTENA1 */
+#define PRTCSS_RTC_INTC_EXTENA1_MASK    (0x07)
+
+/* PRTCSS_RTC_CTRL bit fields */
+#define PRTCSS_RTC_CTRL_WDTBUS          BIT(7)
+#define PRTCSS_RTC_CTRL_WEN             BIT(6)
+#define PRTCSS_RTC_CTRL_WDRT            BIT(5)
+#define PRTCSS_RTC_CTRL_WDTFLG          BIT(4)
+#define PRTCSS_RTC_CTRL_TE              BIT(3)
+#define PRTCSS_RTC_CTRL_TIEN            BIT(2)
+#define PRTCSS_RTC_CTRL_TMRFLG          BIT(1)
+#define PRTCSS_RTC_CTRL_TMMD            BIT(0)
+
+/* PRTCSS_RTC_CCTRL bit fields */
+#define PRTCSS_RTC_CCTRL_CALBUSY        BIT(7)
+#define PRTCSS_RTC_CCTRL_DAEN           BIT(5)
+#define PRTCSS_RTC_CCTRL_HAEN           BIT(4)
+#define PRTCSS_RTC_CCTRL_MAEN           BIT(3)
+#define PRTCSS_RTC_CCTRL_ALMFLG         BIT(2)
+#define PRTCSS_RTC_CCTRL_AIEN           BIT(1)
+#define PRTCSS_RTC_CCTRL_CAEN           BIT(0)
+
+static DEFINE_SPINLOCK(davinci_rtc_lock);
+
+struct davinci_rtc {
+        struct rtc_device               *rtc;
+        void __iomem                    *base;
+        resource_size_t                 pbase;
+        size_t                          base_size;
+        int                             irq;
+};
+
+static inline void rtcif_write(struct davinci_rtc *davinci_rtc,
+                               u32 val, u32 addr)
+{
+        writel(val, davinci_rtc->base + addr);
+}
+
+static inline u32 rtcif_read(struct davinci_rtc *davinci_rtc, u32 addr)
+{
+        return readl(davinci_rtc->base + addr);
+}
+
+static inline void rtcif_wait(struct davinci_rtc *davinci_rtc)
+{
+        while (rtcif_read(davinci_rtc, PRTCIF_CTLR) & PRTCIF_CTLR_BUSY)
+                cpu_relax();
+}
+
+static inline void rtcss_write(struct davinci_rtc *davinci_rtc,
+                               unsigned long val, u8 addr)
+{
+        rtcif_wait(davinci_rtc);
+
+        rtcif_write(davinci_rtc, PRTCIF_CTLR_BENL_LSB | addr, PRTCIF_CTLR);
+        rtcif_write(davinci_rtc, val, PRTCIF_LDATA);
+
+        rtcif_wait(davinci_rtc);
+}
+
+static inline u8 rtcss_read(struct davinci_rtc *davinci_rtc, u8 addr)
+{
+        rtcif_wait(davinci_rtc);
+
+        rtcif_write(davinci_rtc, PRTCIF_CTLR_DIR | PRTCIF_CTLR_BENL_LSB | addr,
+                    PRTCIF_CTLR);
+
+        rtcif_wait(davinci_rtc);
+
+        return rtcif_read(davinci_rtc, PRTCIF_LDATA);
+}
+
+static inline void davinci_rtcss_calendar_wait(struct davinci_rtc *davinci_rtc)
+{
+        while (rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL) &
+               PRTCSS_RTC_CCTRL_CALBUSY)
+                cpu_relax();
+}
+
+static irqreturn_t davinci_rtc_interrupt(int irq, void *class_dev)
+{
+        struct davinci_rtc *davinci_rtc = class_dev;
+        unsigned long events = 0;
+        u32 irq_flg;
+        u8 alm_irq, tmr_irq;
+        u8 rtc_ctrl, rtc_cctrl;
+        int ret = IRQ_NONE;
+
+        irq_flg = rtcif_read(davinci_rtc, PRTCIF_INTFLG) &
+                  PRTCIF_INTFLG_RTCSS;
+
+        alm_irq = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL) &
+                  PRTCSS_RTC_CCTRL_ALMFLG;
+
+        tmr_irq = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL) &
+                  PRTCSS_RTC_CTRL_TMRFLG;
+
+        if (irq_flg) {
+                if (alm_irq) {
+                        events |= RTC_IRQF | RTC_AF;
+                        rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+                        rtc_cctrl |=  PRTCSS_RTC_CCTRL_ALMFLG;
+                        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+                } else if (tmr_irq) {
+                        events |= RTC_IRQF | RTC_PF;
+                        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+                        rtc_ctrl |=  PRTCSS_RTC_CTRL_TMRFLG;
+                        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+                }
+
+                rtcif_write(davinci_rtc, PRTCIF_INTFLG_RTCSS,
+                                    PRTCIF_INTFLG);
+                rtc_update_irq(davinci_rtc->rtc, 1, events);
+
+                ret = IRQ_HANDLED;
+        }
+
+        return ret;
+}
+
+static int
+davinci_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u8 rtc_ctrl;
+        unsigned long flags;
+        int ret = 0;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+
+        switch (cmd) {
+        case RTC_WIE_ON:
+                rtc_ctrl |= PRTCSS_RTC_CTRL_WEN | PRTCSS_RTC_CTRL_WDTFLG;
+                break;
+        case RTC_WIE_OFF:
+                rtc_ctrl &= ~PRTCSS_RTC_CTRL_WEN;
+                break;
+        case RTC_UIE_OFF:
+        case RTC_UIE_ON:
+                ret = -ENOTTY;
+                break;
+        default:
+                ret = -ENOIOCTLCMD;
+        }
+
+        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return ret;
+}
+
+static int convertfromdays(u16 days, struct rtc_time *tm)
+{
+        int tmp_days, year, mon;
+
+        for (year = 2000;; year++) {
+                tmp_days = rtc_year_days(1, 12, year);
+                if (days >= tmp_days)
+                        days -= tmp_days;
+                else {
+                        for (mon = 0;; mon++) {
+                                tmp_days = rtc_month_days(mon, year);
+                                if (days >= tmp_days) {
+                                        days -= tmp_days;
+                                } else {
+                                        tm->tm_year = year - 1900;
+                                        tm->tm_mon = mon;
+                                        tm->tm_mday = days + 1;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+        }
+        return 0;
+}
+
+static int convert2days(u16 *days, struct rtc_time *tm)
+{
+        int i;
+        *days = 0;
+
+        /* epoch == 1900 */
+        if (tm->tm_year < 100 || tm->tm_year > 199)
+                return -EINVAL;
+
+        for (i = 2000; i < 1900 + tm->tm_year; i++)
+                *days += rtc_year_days(1, 12, i);
+
+        *days += rtc_year_days(tm->tm_mday, tm->tm_mon, 1900 + tm->tm_year);
+
+        return 0;
+}
+
+static int davinci_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days = 0;
+        u8 day0, day1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_sec = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_SEC));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_min = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_MIN));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        tm->tm_hour = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_HOUR));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day0 = rtcss_read(davinci_rtc, PRTCSS_RTC_DAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day1 = rtcss_read(davinci_rtc, PRTCSS_RTC_DAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        days |= day1;
+        days <<= 8;
+        days |= day0;
+
+        if (convertfromdays(days, tm) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int davinci_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days;
+        u8 rtc_cctrl;
+        unsigned long flags;
+
+        if (convert2days(&days, tm) < 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_sec), PRTCSS_RTC_SEC);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_min), PRTCSS_RTC_MIN);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(tm->tm_hour), PRTCSS_RTC_HOUR);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, days & 0xFF, PRTCSS_RTC_DAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, (days & 0xFF00) >> 8, PRTCSS_RTC_DAY1);
+
+        rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+        rtc_cctrl |= PRTCSS_RTC_CCTRL_CAEN;
+        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_alarm_irq_enable(struct device *dev,
+                                        unsigned int enabled)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u8 rtc_cctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CCTRL);
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        if (enabled)
+                rtc_cctrl |= PRTCSS_RTC_CCTRL_DAEN |
+                             PRTCSS_RTC_CCTRL_HAEN |
+                             PRTCSS_RTC_CCTRL_MAEN |
+                             PRTCSS_RTC_CCTRL_ALMFLG |
+                             PRTCSS_RTC_CCTRL_AIEN;
+        else
+                rtc_cctrl &= ~PRTCSS_RTC_CCTRL_AIEN;
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, rtc_cctrl, PRTCSS_RTC_CCTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        u16 days = 0;
+        u8 day0, day1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        alm->time.tm_min = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_AMIN));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        alm->time.tm_hour = bcd2bin(rtcss_read(davinci_rtc, PRTCSS_RTC_AHOUR));
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day0 = rtcss_read(davinci_rtc, PRTCSS_RTC_ADAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        day1 = rtcss_read(davinci_rtc, PRTCSS_RTC_ADAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+        days |= day1;
+        days <<= 8;
+        days |= day0;
+
+        if (convertfromdays(days, &alm->time) < 0)
+                return -EINVAL;
+
+        alm->pending = !!(rtcss_read(davinci_rtc,
+                          PRTCSS_RTC_CCTRL) &
+                        PRTCSS_RTC_CCTRL_AIEN);
+        alm->enabled = alm->pending && device_may_wakeup(dev);
+
+        return 0;
+}
+
+static int davinci_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u16 days;
+
+        if (alm->time.tm_mday <= 0 && alm->time.tm_mon < 0
+            && alm->time.tm_year < 0) {
+                struct rtc_time tm;
+                unsigned long now, then;
+
+                davinci_rtc_read_time(dev, &tm);
+                rtc_tm_to_time(&tm, &now);
+
+                alm->time.tm_mday = tm.tm_mday;
+                alm->time.tm_mon = tm.tm_mon;
+                alm->time.tm_year = tm.tm_year;
+                rtc_tm_to_time(&alm->time, &then);
+
+                if (then < now) {
+                        rtc_time_to_tm(now + 24 * 60 * 60, &tm);
+                        alm->time.tm_mday = tm.tm_mday;
+                        alm->time.tm_mon = tm.tm_mon;
+                        alm->time.tm_year = tm.tm_year;
+                }
+        }
+
+        if (convert2days(&days, &alm->time) < 0)
+                return -EINVAL;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(alm->time.tm_min), PRTCSS_RTC_AMIN);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, bin2bcd(alm->time.tm_hour), PRTCSS_RTC_AHOUR);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, days & 0xFF, PRTCSS_RTC_ADAY0);
+
+        davinci_rtcss_calendar_wait(davinci_rtc);
+        rtcss_write(davinci_rtc, (days & 0xFF00) >> 8, PRTCSS_RTC_ADAY1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_irq_set_state(struct device *dev, int enabled)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u8 rtc_ctrl;
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtc_ctrl = rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL);
+
+        if (enabled) {
+                while (rtcss_read(davinci_rtc, PRTCSS_RTC_CTRL)
+                       & PRTCSS_RTC_CTRL_WDTBUS)
+                        cpu_relax();
+
+                rtc_ctrl |= PRTCSS_RTC_CTRL_TE;
+                rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+                rtcss_write(davinci_rtc, 0x0, PRTCSS_RTC_CLKC_CNT);
+
+                rtc_ctrl |= PRTCSS_RTC_CTRL_TIEN |
+                            PRTCSS_RTC_CTRL_TMMD |
+                            PRTCSS_RTC_CTRL_TMRFLG;
+        } else
+                rtc_ctrl &= ~PRTCSS_RTC_CTRL_TIEN;
+
+        rtcss_write(davinci_rtc, rtc_ctrl, PRTCSS_RTC_CTRL);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static int davinci_rtc_irq_set_freq(struct device *dev, int freq)
+{
+        struct davinci_rtc *davinci_rtc = dev_get_drvdata(dev);
+        unsigned long flags;
+        u16 tmr_counter = (0x8000 >> (ffs(freq) - 1));
+
+        spin_lock_irqsave(&davinci_rtc_lock, flags);
+
+        rtcss_write(davinci_rtc, tmr_counter & 0xFF, PRTCSS_RTC_TMR0);
+        rtcss_write(davinci_rtc, (tmr_counter & 0xFF00) >> 8, PRTCSS_RTC_TMR1);
+
+        spin_unlock_irqrestore(&davinci_rtc_lock, flags);
+
+        return 0;
+}
+
+static struct rtc_class_ops davinci_rtc_ops = {
+        .ioctl                  = davinci_rtc_ioctl,
+        .read_time              = davinci_rtc_read_time,
+        .set_time               = davinci_rtc_set_time,
+        .alarm_irq_enable       = davinci_rtc_alarm_irq_enable,
+        .read_alarm             = davinci_rtc_read_alarm,
+        .set_alarm              = davinci_rtc_set_alarm,
+        .irq_set_state          = davinci_rtc_irq_set_state,
+        .irq_set_freq           = davinci_rtc_irq_set_freq,
+};
+
+static int __init davinci_rtc_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct davinci_rtc *davinci_rtc;
+        struct resource *res, *mem;
+        int ret = 0;
+
+        davinci_rtc = kzalloc(sizeof(struct davinci_rtc), GFP_KERNEL);
+        if (!davinci_rtc) {
+                dev_dbg(dev, "could not allocate memory for private data\n");
+                return -ENOMEM;
+        }
+
+        davinci_rtc->irq = platform_get_irq(pdev, 0);
+        if (davinci_rtc->irq < 0) {
+                dev_err(dev, "no RTC irq\n");
+                ret = davinci_rtc->irq;
+                goto fail1;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(dev, "no mem resource\n");
+                ret = -EINVAL;
+                goto fail1;
+        }
+
+        davinci_rtc->pbase = res->start;
+        davinci_rtc->base_size = resource_size(res);
+
+        mem = request_mem_region(davinci_rtc->pbase, davinci_rtc->base_size,
+                                 pdev->name);
+        if (!mem) {
+                dev_err(dev, "RTC registers at %08x are not free\n",
+                        davinci_rtc->pbase);
+                ret = -EBUSY;
+                goto fail1;
+        }
+
+        davinci_rtc->base = ioremap(davinci_rtc->pbase, davinci_rtc->base_size);
+        if (!davinci_rtc->base) {
+                dev_err(dev, "unable to ioremap MEM resource\n");
+                ret = -ENOMEM;
+                goto fail2;
+        }
+
+        davinci_rtc->rtc = rtc_device_register(pdev->name, &pdev->dev,
+                                    &davinci_rtc_ops, THIS_MODULE);
+        if (IS_ERR(davinci_rtc->rtc)) {
+                dev_err(dev, "unable to register RTC device, err %ld\n",
+                                PTR_ERR(davinci_rtc->rtc));
+                goto fail3;
+        }
+
+        rtcif_write(davinci_rtc, PRTCIF_INTFLG_RTCSS, PRTCIF_INTFLG);
+        rtcif_write(davinci_rtc, 0, PRTCIF_INTEN);
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_INTC_EXTENA1);
+
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_CTRL);
+        rtcss_write(davinci_rtc, 0, PRTCSS_RTC_CCTRL);
+
+        ret = request_irq(davinci_rtc->irq, davinci_rtc_interrupt,
+                          IRQF_DISABLED, "davinci_rtc", davinci_rtc);
+        if (ret < 0) {
+                dev_err(dev, "unable to register davinci RTC interrupt\n");
+                goto fail4;
+        }
+
+        /* Enable interrupts */
+        rtcif_write(davinci_rtc, PRTCIF_INTEN_RTCSS, PRTCIF_INTEN);
+        rtcss_write(davinci_rtc, PRTCSS_RTC_INTC_EXTENA1_MASK,
+                            PRTCSS_RTC_INTC_EXTENA1);
+
+        rtcss_write(davinci_rtc, PRTCSS_RTC_CCTRL_CAEN, PRTCSS_RTC_CCTRL);
+
+        platform_set_drvdata(pdev, davinci_rtc);
+
+        device_init_wakeup(&pdev->dev, 0);
+
+        return 0;
+
+fail4:
+        rtc_device_unregister(davinci_rtc->rtc);
+fail3:
+        iounmap(davinci_rtc->base);
+fail2:
+        release_mem_region(davinci_rtc->pbase, davinci_rtc->base_size);
+fail1:
+        kfree(davinci_rtc);
+
+        return ret;
+}
+
+static int __devexit davinci_rtc_remove(struct platform_device *pdev)
+{
+        struct davinci_rtc *davinci_rtc = platform_get_drvdata(pdev);
+
+        device_init_wakeup(&pdev->dev, 0);
+
+        rtcif_write(davinci_rtc, 0, PRTCIF_INTEN);
+
+        free_irq(davinci_rtc->irq, davinci_rtc);
+
+        rtc_device_unregister(davinci_rtc->rtc);
+
+        iounmap(davinci_rtc->base);
+        release_mem_region(davinci_rtc->pbase, davinci_rtc->base_size);
+
+        platform_set_drvdata(pdev, NULL);
+
+        kfree(davinci_rtc);
+
+        return 0;
+}
+
+static struct platform_driver davinci_rtc_driver = {
+        .probe          = davinci_rtc_probe,
+        .remove         = __devexit_p(davinci_rtc_remove),
+        .driver         = {
+                .name = "rtc_davinci",
+                .owner = THIS_MODULE,
+        },
+};
+
+static int __init rtc_init(void)
+{
+        return platform_driver_probe(&davinci_rtc_driver, davinci_rtc_probe);
+}
+module_init(rtc_init);
+
+static void __exit rtc_exit(void)
+{
+        platform_driver_unregister(&davinci_rtc_driver);
+}
+module_exit(rtc_exit);
+
+MODULE_AUTHOR("Miguel Aguilar <miguel.aguilar@ridgerun.com>");
+MODULE_DESCRIPTION("Texas Instruments DaVinci PRTC Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index acf222f91f5a..0e86247d791e 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -37,6 +37,9 @@
  */
 #define DASD_CHANQ_MAX_SIZE 4
 
+#define DASD_SLEEPON_START_TAG  (void *) 1
+#define DASD_SLEEPON_END_TAG    (void *) 2
+
 /*
  * SECTION: exported variables of dasd.c
  */
@@ -62,6 +65,7 @@ static void dasd_device_tasklet(struct dasd_device *);
 static void dasd_block_tasklet(struct dasd_block *);
 static void do_kick_device(struct work_struct *);
 static void do_restore_device(struct work_struct *);
+static void do_reload_device(struct work_struct *);
 static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
 static void dasd_device_timeout(unsigned long);
 static void dasd_block_timeout(unsigned long);
@@ -112,6 +116,7 @@ struct dasd_device *dasd_alloc_device(void)
         device->timer.data = (unsigned long) device;
         INIT_WORK(&device->kick_work, do_kick_device);
         INIT_WORK(&device->restore_device, do_restore_device);
+        INIT_WORK(&device->reload_device, do_reload_device);
         device->state = DASD_STATE_NEW;
         device->target = DASD_STATE_NEW;
         mutex_init(&device->state_mutex);
@@ -518,6 +523,26 @@ void dasd_kick_device(struct dasd_device *device)
 }
 
 /*
+ * dasd_reload_device will schedule a call do do_reload_device to the kernel
+ * event daemon.
+ */
+static void do_reload_device(struct work_struct *work)
+{
+        struct dasd_device *device = container_of(work, struct dasd_device,
+                                                  reload_device);
+        device->discipline->reload(device);
+        dasd_put_device(device);
+}
+
+void dasd_reload_device(struct dasd_device *device)
+{
+        dasd_get_device(device);
+        /* queue call to dasd_reload_device to the kernel event daemon. */
+        schedule_work(&device->reload_device);
+}
+EXPORT_SYMBOL(dasd_reload_device);
+
+/*
  * dasd_restore_device will schedule a call do do_restore_device to the kernel
  * event daemon.
  */
@@ -1472,7 +1497,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
  */
 static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
 {
-        wake_up((wait_queue_head_t *) data);
+        spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        cqr->callback_data = DASD_SLEEPON_END_TAG;
+        spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        wake_up(&generic_waitq);
 }
 
 static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
@@ -1482,10 +1510,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
 
         device = cqr->startdev;
         spin_lock_irq(get_ccwdev_lock(device->cdev));
-        rc = ((cqr->status == DASD_CQR_DONE ||
-               cqr->status == DASD_CQR_NEED_ERP ||
-               cqr->status == DASD_CQR_TERMINATED) &&
-              list_empty(&cqr->devlist));
+        rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         return rc;
 }
@@ -1573,7 +1598,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                         wait_event(generic_waitq, !(device->stopped));
 
                 cqr->callback = dasd_wakeup_cb;
-                cqr->callback_data = (void *) &generic_waitq;
+                cqr->callback_data = DASD_SLEEPON_START_TAG;
                 dasd_add_request_tail(cqr);
                 if (interruptible) {
                         rc = wait_event_interruptible(
@@ -1652,7 +1677,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
         }
 
         cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &generic_waitq;
+        cqr->callback_data = DASD_SLEEPON_START_TAG;
         cqr->status = DASD_CQR_QUEUED;
         list_add(&cqr->devlist, &device->ccw_queue);
 
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index 6632649dd6aa..85bfd8794856 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -1418,9 +1418,29 @@ static struct dasd_ccw_req *dasd_3990_erp_inspect_alias(
                                                 struct dasd_ccw_req *erp)
 {
         struct dasd_ccw_req *cqr = erp->refers;
+        char *sense;
 
         if (cqr->block &&
             (cqr->block->base != cqr->startdev)) {
+
+                sense = dasd_get_sense(&erp->refers->irb);
+                /*
+                 * dynamic pav may have changed base alias mapping
+                 */
+                if (!test_bit(DASD_FLAG_OFFLINE, &cqr->startdev->flags) && sense
+                    && (sense[0] == 0x10) && (sense[7] == 0x0F)
+                    && (sense[8] == 0x67)) {
+                        /*
+                         * remove device from alias handling to prevent new
+                         * requests from being scheduled on the
+                         * wrong alias device
+                         */
+                        dasd_alias_remove_device(cqr->startdev);
+
+                        /* schedule worker to reload device */
+                        dasd_reload_device(cqr->startdev);
+                }
+
                 if (cqr->startdev->features & DASD_FEATURE_ERPLOG) {
                         DBF_DEV_EVENT(DBF_ERR, cqr->startdev,
                                     "ERP on alias device for request %p,"
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 8c4814258e93..4155805dcdff 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -190,20 +190,21 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
         struct alias_server *server, *newserver;
         struct alias_lcu *lcu, *newlcu;
         int is_lcu_known;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+
+        device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&aliastree.lock, flags);
         is_lcu_known = 1;
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (!server) {
                 spin_unlock_irqrestore(&aliastree.lock, flags);
-                newserver = _allocate_server(uid);
+                newserver = _allocate_server(&uid);
                 if (IS_ERR(newserver))
                         return PTR_ERR(newserver);
                 spin_lock_irqsave(&aliastree.lock, flags);
-                server = _find_server(uid);
+                server = _find_server(&uid);
                 if (!server) {
                         list_add(&newserver->server, &aliastree.serverlist);
                         server = newserver;
@@ -214,14 +215,14 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
                 }
         }
 
-        lcu = _find_lcu(server, uid);
+        lcu = _find_lcu(server, &uid);
         if (!lcu) {
                 spin_unlock_irqrestore(&aliastree.lock, flags);
-                newlcu = _allocate_lcu(uid);
+                newlcu = _allocate_lcu(&uid);
                 if (IS_ERR(newlcu))
                         return PTR_ERR(newlcu);
                 spin_lock_irqsave(&aliastree.lock, flags);
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
                 if (!lcu) {
                         list_add(&newlcu->lcu, &server->lculist);
                         lcu = newlcu;
@@ -256,20 +257,20 @@ void dasd_alias_lcu_setup_complete(struct dasd_device *device)
         unsigned long flags;
         struct alias_server *server;
         struct alias_lcu *lcu;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+        device->discipline->get_uid(device, &uid);
         lcu = NULL;
         spin_lock_irqsave(&aliastree.lock, flags);
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (server)
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
         spin_unlock_irqrestore(&aliastree.lock, flags);
         if (!lcu) {
                 DBF_EVENT_DEVID(DBF_ERR, device->cdev,
                                 "could not find lcu for %04x %02x",
-                                uid->ssid, uid->real_unit_addr);
+                                uid.ssid, uid.real_unit_addr);
                 WARN_ON(1);
                 return;
         }
@@ -282,20 +283,20 @@ void dasd_alias_wait_for_lcu_setup(struct dasd_device *device)
         unsigned long flags;
         struct alias_server *server;
         struct alias_lcu *lcu;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
+        device->discipline->get_uid(device, &uid);
         lcu = NULL;
         spin_lock_irqsave(&aliastree.lock, flags);
-        server = _find_server(uid);
+        server = _find_server(&uid);
         if (server)
-                lcu = _find_lcu(server, uid);
+                lcu = _find_lcu(server, &uid);
         spin_unlock_irqrestore(&aliastree.lock, flags);
         if (!lcu) {
                 DBF_EVENT_DEVID(DBF_ERR, device->cdev,
                                 "could not find lcu for %04x %02x",
-                                uid->ssid, uid->real_unit_addr);
+                                uid.ssid, uid.real_unit_addr);
                 WARN_ON(1);
                 return;
         }
@@ -314,9 +315,11 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
         struct alias_lcu *lcu;
         struct alias_server *server;
         int was_pending;
+        struct dasd_uid uid;
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&lcu->lock, flags);
         list_del_init(&device->alias_list);
         /* make sure that the workers don't use this device */
@@ -353,7 +356,7 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                         _schedule_lcu_update(lcu, NULL);
                 spin_unlock(&lcu->lock);
         }
-        server = _find_server(&private->uid);
+        server = _find_server(&uid);
         if (server && list_empty(&server->lculist)) {
                 list_del(&server->server);
                 _free_server(server);
@@ -366,19 +369,30 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
  * in the lcu is up to date and will update the device uid before
  * adding it to a pav group.
  */
+
 static int _add_device_to_lcu(struct alias_lcu *lcu,
-                              struct dasd_device *device)
+                              struct dasd_device *device,
+                              struct dasd_device *pos)
 {
 
         struct dasd_eckd_private *private;
         struct alias_pav_group *group;
-        struct dasd_uid *uid;
+        struct dasd_uid uid;
+        unsigned long flags;
 
         private = (struct dasd_eckd_private *) device->private;
-        uid = &private->uid;
-        uid->type = lcu->uac->unit[uid->real_unit_addr].ua_type;
-        uid->base_unit_addr = lcu->uac->unit[uid->real_unit_addr].base_ua;
-        dasd_set_uid(device->cdev, &private->uid);
+
+        /* only lock if not already locked */
+        if (device != pos)
+                spin_lock_irqsave_nested(get_ccwdev_lock(device->cdev), flags,
+                                         CDEV_NESTED_SECOND);
+        private->uid.type = lcu->uac->unit[private->uid.real_unit_addr].ua_type;
+        private->uid.base_unit_addr =
+                lcu->uac->unit[private->uid.real_unit_addr].base_ua;
+        uid = private->uid;
+
+        if (device != pos)
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 
         /* if we have no PAV anyway, we don't need to bother with PAV groups */
         if (lcu->pav == NO_PAV) {
@@ -386,25 +400,25 @@ static int _add_device_to_lcu(struct alias_lcu *lcu,
                 return 0;
         }
 
-        group = _find_group(lcu, uid);
+        group = _find_group(lcu, &uid);
         if (!group) {
                 group = kzalloc(sizeof(*group), GFP_ATOMIC);
                 if (!group)
                         return -ENOMEM;
-                memcpy(group->uid.vendor, uid->vendor, sizeof(uid->vendor));
-                memcpy(group->uid.serial, uid->serial, sizeof(uid->serial));
-                group->uid.ssid = uid->ssid;
-                if (uid->type == UA_BASE_DEVICE)
-                        group->uid.base_unit_addr = uid->real_unit_addr;
+                memcpy(group->uid.vendor, uid.vendor, sizeof(uid.vendor));
+                memcpy(group->uid.serial, uid.serial, sizeof(uid.serial));
+                group->uid.ssid = uid.ssid;
+                if (uid.type == UA_BASE_DEVICE)
+                        group->uid.base_unit_addr = uid.real_unit_addr;
                 else
-                        group->uid.base_unit_addr = uid->base_unit_addr;
-                memcpy(group->uid.vduit, uid->vduit, sizeof(uid->vduit));
+                        group->uid.base_unit_addr = uid.base_unit_addr;
+                memcpy(group->uid.vduit, uid.vduit, sizeof(uid.vduit));
                 INIT_LIST_HEAD(&group->group);
                 INIT_LIST_HEAD(&group->baselist);
                 INIT_LIST_HEAD(&group->aliaslist);
                 list_add(&group->group, &lcu->grouplist);
         }
-        if (uid->type == UA_BASE_DEVICE)
+        if (uid.type == UA_BASE_DEVICE)
                 list_move(&device->alias_list, &group->baselist);
         else
                 list_move(&device->alias_list, &group->aliaslist);
@@ -525,7 +539,10 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
         if (rc)
                 return rc;
 
-        spin_lock_irqsave(&lcu->lock, flags);
+        /* need to take cdev lock before lcu lock */
+        spin_lock_irqsave_nested(get_ccwdev_lock(refdev->cdev), flags,
+                                 CDEV_NESTED_FIRST);
+        spin_lock(&lcu->lock);
         lcu->pav = NO_PAV;
         for (i = 0; i < MAX_DEVICES_PER_LCU; ++i) {
                 switch (lcu->uac->unit[i].ua_type) {
@@ -542,9 +559,10 @@ static int _lcu_update(struct dasd_device *refdev, struct alias_lcu *lcu)
 
         list_for_each_entry_safe(device, tempdev, &lcu->active_devices,
                                  alias_list) {
-                _add_device_to_lcu(lcu, device);
+                _add_device_to_lcu(lcu, device, refdev);
         }
-        spin_unlock_irqrestore(&lcu->lock, flags);
+        spin_unlock(&lcu->lock);
+        spin_unlock_irqrestore(get_ccwdev_lock(refdev->cdev), flags);
         return 0;
 }
 
@@ -628,9 +646,12 @@ int dasd_alias_add_device(struct dasd_device *device)
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
         rc = 0;
-        spin_lock_irqsave(&lcu->lock, flags);
+
+        /* need to take cdev lock before lcu lock */
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+        spin_lock(&lcu->lock);
         if (!(lcu->flags & UPDATE_PENDING)) {
-                rc = _add_device_to_lcu(lcu, device);
+                rc = _add_device_to_lcu(lcu, device, device);
                 if (rc)
                         lcu->flags |= UPDATE_PENDING;
         }
@@ -638,10 +659,19 @@ int dasd_alias_add_device(struct dasd_device *device)
                 list_move(&device->alias_list, &lcu->active_devices);
                 _schedule_lcu_update(lcu, device);
         }
-        spin_unlock_irqrestore(&lcu->lock, flags);
+        spin_unlock(&lcu->lock);
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         return rc;
 }
 
+int dasd_alias_update_add_device(struct dasd_device *device)
+{
+        struct dasd_eckd_private *private;
+        private = (struct dasd_eckd_private *) device->private;
+        private->lcu->flags |= UPDATE_PENDING;
+        return dasd_alias_add_device(device);
+}
+
 int dasd_alias_remove_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
@@ -740,19 +770,30 @@ static void _restart_all_base_devices_on_lcu(struct alias_lcu *lcu)
         struct alias_pav_group *pavgroup;
         struct dasd_device *device;
         struct dasd_eckd_private *private;
+        unsigned long flags;
 
         /* active and inactive list can contain alias as well as base devices */
         list_for_each_entry(device, &lcu->active_devices, alias_list) {
                 private = (struct dasd_eckd_private *) device->private;
-                if (private->uid.type != UA_BASE_DEVICE)
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                if (private->uid.type != UA_BASE_DEVICE) {
+                        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
+                                               flags);
                         continue;
+                }
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
                 dasd_schedule_block_bh(device->block);
                 dasd_schedule_device_bh(device);
         }
         list_for_each_entry(device, &lcu->inactive_devices, alias_list) {
                 private = (struct dasd_eckd_private *) device->private;
-                if (private->uid.type != UA_BASE_DEVICE)
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                if (private->uid.type != UA_BASE_DEVICE) {
+                        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
+                                               flags);
                         continue;
+                }
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
                 dasd_schedule_block_bh(device->block);
                 dasd_schedule_device_bh(device);
         }
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index eff9c812c5c2..34d51dd4c539 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -49,7 +49,6 @@ struct dasd_devmap {
         unsigned int devindex;
         unsigned short features;
         struct dasd_device *device;
-        struct dasd_uid uid;
 };
 
 /*
@@ -936,42 +935,46 @@ dasd_device_status_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR(status, 0444, dasd_device_status_show, NULL);
 
-static ssize_t
-dasd_alias_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t dasd_alias_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
-        int alias;
+        struct dasd_device *device;
+        struct dasd_uid uid;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (IS_ERR(devmap) || strlen(devmap->uid.vendor) == 0) {
-                spin_unlock(&dasd_devmap_lock);
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        if (IS_ERR(device))
                 return sprintf(buf, "0\n");
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid)) {
+                if (uid.type == UA_BASE_PAV_ALIAS ||
+                    uid.type == UA_HYPER_PAV_ALIAS)
+                        return sprintf(buf, "1\n");
         }
-        if (devmap->uid.type == UA_BASE_PAV_ALIAS ||
-            devmap->uid.type == UA_HYPER_PAV_ALIAS)
-                alias = 1;
-        else
-                alias = 0;
-        spin_unlock(&dasd_devmap_lock);
-        return sprintf(buf, alias ? "1\n" : "0\n");
+        dasd_put_device(device);
+
+        return sprintf(buf, "0\n");
 }
 
 static DEVICE_ATTR(alias, 0444, dasd_alias_show, NULL);
 
-static ssize_t
-dasd_vendor_show(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t dasd_vendor_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
+        struct dasd_device *device;
+        struct dasd_uid uid;
         char *vendor;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
-                vendor = devmap->uid.vendor;
-        else
-                vendor = "";
-        spin_unlock(&dasd_devmap_lock);
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        vendor = "";
+        if (IS_ERR(device))
+                return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid))
+                        vendor = uid.vendor;
+
+        dasd_put_device(device);
 
         return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
 }
@@ -985,48 +988,51 @@ static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL);
 static ssize_t
 dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        struct dasd_devmap *devmap;
+        struct dasd_device *device;
+        struct dasd_uid uid;
         char uid_string[UID_STRLEN];
         char ua_string[3];
-        struct dasd_uid *uid;
 
-        devmap = dasd_find_busid(dev_name(dev));
-        spin_lock(&dasd_devmap_lock);
-        if (IS_ERR(devmap) || strlen(devmap->uid.vendor) == 0) {
-                spin_unlock(&dasd_devmap_lock);
-                return sprintf(buf, "\n");
-        }
-        uid = &devmap->uid;
-        switch (uid->type) {
-        case UA_BASE_DEVICE:
-                sprintf(ua_string, "%02x", uid->real_unit_addr);
-                break;
-        case UA_BASE_PAV_ALIAS:
-                sprintf(ua_string, "%02x", uid->base_unit_addr);
-                break;
-        case UA_HYPER_PAV_ALIAS:
-                sprintf(ua_string, "xx");
-                break;
-        default:
-                /* should not happen, treat like base device */
-                sprintf(ua_string, "%02x", uid->real_unit_addr);
-                break;
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        uid_string[0] = 0;
+        if (IS_ERR(device))
+                return snprintf(buf, PAGE_SIZE, "%s\n", uid_string);
+
+        if (device->discipline && device->discipline->get_uid &&
+            !device->discipline->get_uid(device, &uid)) {
+                switch (uid.type) {
+                case UA_BASE_DEVICE:
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.real_unit_addr);
+                        break;
+                case UA_BASE_PAV_ALIAS:
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.base_unit_addr);
+                        break;
+                case UA_HYPER_PAV_ALIAS:
+                        snprintf(ua_string, sizeof(ua_string), "xx");
+                        break;
+                default:
+                        /* should not happen, treat like base device */
+                        snprintf(ua_string, sizeof(ua_string), "%02x",
+                                 uid.real_unit_addr);
+                        break;
+                }
+
+                if (strlen(uid.vduit) > 0)
+                        snprintf(uid_string, sizeof(uid_string),
+                                 "%s.%s.%04x.%s.%s",
+                                 uid.vendor, uid.serial, uid.ssid, ua_string,
+                                 uid.vduit);
+                else
+                        snprintf(uid_string, sizeof(uid_string),
+                                 "%s.%s.%04x.%s",
+                                 uid.vendor, uid.serial, uid.ssid, ua_string);
         }
-        if (strlen(uid->vduit) > 0)
-                snprintf(uid_string, sizeof(uid_string),
-                         "%s.%s.%04x.%s.%s",
-                         uid->vendor, uid->serial,
-                         uid->ssid, ua_string,
-                         uid->vduit);
-        else
-                snprintf(uid_string, sizeof(uid_string),
-                         "%s.%s.%04x.%s",
-                         uid->vendor, uid->serial,
-                         uid->ssid, ua_string);
-        spin_unlock(&dasd_devmap_lock);
+        dasd_put_device(device);
+
         return snprintf(buf, PAGE_SIZE, "%s\n", uid_string);
 }
-
 static DEVICE_ATTR(uid, 0444, dasd_uid_show, NULL);
 
 /*
@@ -1094,50 +1100,6 @@ static struct attribute_group dasd_attr_group = {
 };
 
 /*
- * Return copy of the device unique identifier.
- */
-int
-dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
-{
-        struct dasd_devmap *devmap;
-
-        devmap = dasd_find_busid(dev_name(&cdev->dev));
-        if (IS_ERR(devmap))
-                return PTR_ERR(devmap);
-        spin_lock(&dasd_devmap_lock);
-        *uid = devmap->uid;
-        spin_unlock(&dasd_devmap_lock);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dasd_get_uid);
-
-/*
- * Register the given device unique identifier into devmap struct.
- * In addition check if the related storage server subsystem ID is already
- * contained in the dasd_server_ssid_list. If subsystem ID is not contained,
- * create new entry.
- * Return 0 if server was already in serverlist,
- *        1 if the server was added successful
- *       <0 in case of error.
- */
-int
-dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
-{
-        struct dasd_devmap *devmap;
-
-        devmap = dasd_find_busid(dev_name(&cdev->dev));
-        if (IS_ERR(devmap))
-                return PTR_ERR(devmap);
-
-        spin_lock(&dasd_devmap_lock);
-        devmap->uid = *uid;
-        spin_unlock(&dasd_devmap_lock);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dasd_set_uid);
-
-/*
  * Return value of the specified feature.
  */
 int
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 0cb233116855..5b1cd8d6e971 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -692,18 +692,20 @@ dasd_eckd_cdl_reclen(int recid)
 /*
  * Generate device unique id that specifies the physical device.
  */
-static int dasd_eckd_generate_uid(struct dasd_device *device,
-                                  struct dasd_uid *uid)
+static int dasd_eckd_generate_uid(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
+        struct dasd_uid *uid;
         int count;
+        unsigned long flags;
 
         private = (struct dasd_eckd_private *) device->private;
         if (!private)
                 return -ENODEV;
         if (!private->ned || !private->gneq)
                 return -ENODEV;
-
+        uid = &private->uid;
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
         memset(uid, 0, sizeof(struct dasd_uid));
         memcpy(uid->vendor, private->ned->HDA_manufacturer,
                sizeof(uid->vendor) - 1);
@@ -726,9 +728,25 @@ static int dasd_eckd_generate_uid(struct dasd_device *device,
                                 private->vdsneq->uit[count]);
                 }
         }
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         return 0;
 }
 
+static int dasd_eckd_get_uid(struct dasd_device *device, struct dasd_uid *uid)
+{
+        struct dasd_eckd_private *private;
+        unsigned long flags;
+
+        if (device->private) {
+                private = (struct dasd_eckd_private *)device->private;
+                spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+                *uid = private->uid;
+                spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+                return 0;
+        }
+        return -EINVAL;
+}
+
 static struct dasd_ccw_req *dasd_eckd_build_rcd_lpm(struct dasd_device *device,
                                                     void *rcd_buffer,
                                                     struct ciw *ciw, __u8 lpm)
@@ -1088,6 +1106,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
         struct dasd_block *block;
+        struct dasd_uid temp_uid;
         int is_known, rc;
         int readonly;
 
@@ -1124,13 +1143,13 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
         if (rc)
                 goto out_err1;
 
-        /* Generate device unique id and register in devmap */
-        rc = dasd_eckd_generate_uid(device, &private->uid);
+        /* Generate device unique id */
+        rc = dasd_eckd_generate_uid(device);
         if (rc)
                 goto out_err1;
-        dasd_set_uid(device->cdev, &private->uid);
 
-        if (private->uid.type == UA_BASE_DEVICE) {
+        dasd_eckd_get_uid(device, &temp_uid);
+        if (temp_uid.type == UA_BASE_DEVICE) {
                 block = dasd_alloc_block();
                 if (IS_ERR(block)) {
                         DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
@@ -1451,6 +1470,7 @@ static int dasd_eckd_ready_to_online(struct dasd_device *device)
 
 static int dasd_eckd_online_to_ready(struct dasd_device *device)
 {
+        cancel_work_sync(&device->reload_device);
         return dasd_alias_remove_device(device);
 };
 
@@ -1709,10 +1729,27 @@ static void dasd_eckd_handle_unsolicited_interrupt(struct dasd_device *device,
 {
         char mask;
         char *sense = NULL;
+        struct dasd_eckd_private *private;
 
+        private = (struct dasd_eckd_private *) device->private;
         /* first of all check for state change pending interrupt */
         mask = DEV_STAT_ATTENTION | DEV_STAT_DEV_END | DEV_STAT_UNIT_EXCEP;
         if ((scsw_dstat(&irb->scsw) & mask) == mask) {
+                /* for alias only and not in offline processing*/
+                if (!device->block && private->lcu &&
+                    !test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+                        /*
+                         * the state change could be caused by an alias
+                         * reassignment remove device from alias handling
+                         * to prevent new requests from being scheduled on
+                         * the wrong alias device
+                         */
+                        dasd_alias_remove_device(device);
+
+                        /* schedule worker to reload device */
+                        dasd_reload_device(device);
+                }
+
                 dasd_generic_handle_state_change(device);
                 return;
         }
@@ -3259,7 +3296,7 @@ static void dasd_eckd_dump_sense(struct dasd_device *device,
                 dasd_eckd_dump_sense_ccw(device, req, irb);
 }
 
-int dasd_eckd_pm_freeze(struct dasd_device *device)
+static int dasd_eckd_pm_freeze(struct dasd_device *device)
 {
         /*
          * the device should be disconnected from our LCU structure
@@ -3272,7 +3309,7 @@ int dasd_eckd_pm_freeze(struct dasd_device *device)
         return 0;
 }
 
-int dasd_eckd_restore_device(struct dasd_device *device)
+static int dasd_eckd_restore_device(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
         struct dasd_eckd_characteristics temp_rdc_data;
@@ -3287,15 +3324,16 @@ int dasd_eckd_restore_device(struct dasd_device *device)
         if (rc)
                 goto out_err;
 
-        /* Generate device unique id and register in devmap */
-        rc = dasd_eckd_generate_uid(device, &private->uid);
-        dasd_get_uid(device->cdev, &temp_uid);
+        dasd_eckd_get_uid(device, &temp_uid);
+        /* Generate device unique id */
+        rc = dasd_eckd_generate_uid(device);
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
         if (memcmp(&private->uid, &temp_uid, sizeof(struct dasd_uid)) != 0)
                 dev_err(&device->cdev->dev, "The UID of the DASD has "
                         "changed\n");
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
         if (rc)
                 goto out_err;
-        dasd_set_uid(device->cdev, &private->uid);
 
         /* register lcu with alias handling, enable PAV if this is a new lcu */
         is_known = dasd_alias_make_device_known_to_lcu(device);
@@ -3336,6 +3374,56 @@ out_err:
         return -1;
 }
 
+static int dasd_eckd_reload_device(struct dasd_device *device)
+{
+        struct dasd_eckd_private *private;
+        int rc, old_base;
+        char print_uid[60];
+        struct dasd_uid uid;
+        unsigned long flags;
+
+        private = (struct dasd_eckd_private *) device->private;
+
+        spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+        old_base = private->uid.base_unit_addr;
+        spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+
+        /* Read Configuration Data */
+        rc = dasd_eckd_read_conf(device);
+        if (rc)
+                goto out_err;
+
+        rc = dasd_eckd_generate_uid(device);
+        if (rc)
+                goto out_err;
+        /*
+         * update unit address configuration and
+         * add device to alias management
+         */
+        dasd_alias_update_add_device(device);
+
+        dasd_eckd_get_uid(device, &uid);
+
+        if (old_base != uid.base_unit_addr) {
+                if (strlen(uid.vduit) > 0)
+                        snprintf(print_uid, sizeof(print_uid),
+                                 "%s.%s.%04x.%02x.%s", uid.vendor, uid.serial,
+                                 uid.ssid, uid.base_unit_addr, uid.vduit);
+                else
+                        snprintf(print_uid, sizeof(print_uid),
+                                 "%s.%s.%04x.%02x", uid.vendor, uid.serial,
+                                 uid.ssid, uid.base_unit_addr);
+
+                dev_info(&device->cdev->dev,
+                         "An Alias device was reassigned to a new base device "
+                         "with UID: %s\n", print_uid);
+        }
+        return 0;
+
+out_err:
+        return -1;
+}
+
 static struct ccw_driver dasd_eckd_driver = {
         .name        = "dasd-eckd",
         .owner       = THIS_MODULE,
@@ -3389,6 +3477,8 @@ static struct dasd_discipline dasd_eckd_discipline = {
         .ioctl = dasd_eckd_ioctl,
         .freeze = dasd_eckd_pm_freeze,
         .restore = dasd_eckd_restore_device,
+        .reload = dasd_eckd_reload_device,
+        .get_uid = dasd_eckd_get_uid,
 };
 
 static int __init
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index 864d53c04201..dd6385a5af14 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -426,7 +426,6 @@ struct alias_pav_group {
         struct dasd_device *next;
 };
 
-
 struct dasd_eckd_private {
         struct dasd_eckd_characteristics rdc_data;
         u8 *conf_data;
@@ -463,4 +462,5 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *, struct irb *);
 void dasd_eckd_reset_ccw_to_base_io(struct dasd_ccw_req *);
 void dasd_alias_lcu_setup_complete(struct dasd_device *);
 void dasd_alias_wait_for_lcu_setup(struct dasd_device *);
+int dasd_alias_update_add_device(struct dasd_device *);
 #endif                          /* DASD_ECKD_H */
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index a91d4a97d4f2..32fac186ba3f 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -81,6 +81,10 @@ struct dasd_block;
 #define DASD_SIM_MSG_TO_OP 0x03
 #define DASD_SIM_LOG 0x0C
 
+/* lock class for nested cdev lock */
+#define CDEV_NESTED_FIRST 1
+#define CDEV_NESTED_SECOND 2
+
 /*
  * SECTION: MACROs for klogd and s390 debug feature (dbf)
  */
@@ -229,6 +233,24 @@ struct dasd_ccw_req {
 typedef struct dasd_ccw_req *(*dasd_erp_fn_t) (struct dasd_ccw_req *);
 
 /*
+ * Unique identifier for dasd device.
+ */
+#define UA_NOT_CONFIGURED  0x00
+#define UA_BASE_DEVICE     0x01
+#define UA_BASE_PAV_ALIAS  0x02
+#define UA_HYPER_PAV_ALIAS 0x03
+
+struct dasd_uid {
+        __u8 type;
+        char vendor[4];
+        char serial[15];
+        __u16 ssid;
+        __u8 real_unit_addr;
+        __u8 base_unit_addr;
+        char vduit[33];
+};
+
+/*
  * the struct dasd_discipline is
  * sth like a table of virtual functions, if you think of dasd_eckd
  * inheriting dasd...
@@ -312,28 +334,15 @@ struct dasd_discipline {
         /* suspend/resume functions */
         int (*freeze) (struct dasd_device *);
         int (*restore) (struct dasd_device *);
-};
 
-extern struct dasd_discipline *dasd_diag_discipline_pointer;
-
-/*
- * Unique identifier for dasd device.
- */
-#define UA_NOT_CONFIGURED  0x00
-#define UA_BASE_DEVICE     0x01
-#define UA_BASE_PAV_ALIAS  0x02
-#define UA_HYPER_PAV_ALIAS 0x03
+        /* reload device after state change */
+        int (*reload) (struct dasd_device *);
 
-struct dasd_uid {
-        __u8 type;
-        char vendor[4];
-        char serial[15];
-        __u16 ssid;
-        __u8 real_unit_addr;
-        __u8 base_unit_addr;
-        char vduit[33];
+        int (*get_uid) (struct dasd_device *, struct dasd_uid *);
 };
 
+extern struct dasd_discipline *dasd_diag_discipline_pointer;
+
 /*
  * Notification numbers for extended error reporting notifications:
  * The DASD_EER_DISABLE notification is sent before a dasd_device (and it's
@@ -386,6 +395,7 @@ struct dasd_device {
         struct tasklet_struct tasklet;
         struct work_struct kick_work;
         struct work_struct restore_device;
+        struct work_struct reload_device;
         struct timer_list timer;
 
         debug_info_t *debug_area;
@@ -582,6 +592,7 @@ void dasd_enable_device(struct dasd_device *);
 void dasd_set_target_state(struct dasd_device *, int);
 void dasd_kick_device(struct dasd_device *);
 void dasd_restore_device(struct dasd_device *);
+void dasd_reload_device(struct dasd_device *);
 
 void dasd_add_request_head(struct dasd_ccw_req *);
 void dasd_add_request_tail(struct dasd_ccw_req *);
@@ -629,8 +640,6 @@ void dasd_devmap_exit(void);
 struct dasd_device *dasd_create_device(struct ccw_device *);
 void dasd_delete_device(struct dasd_device *);
 
-int dasd_get_uid(struct ccw_device *, struct dasd_uid *);
-int dasd_set_uid(struct ccw_device *, struct dasd_uid *);
 int dasd_get_feature(struct ccw_device *, int);
 int dasd_set_feature(struct ccw_device *, int, int);
 
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index 4e34d3686c23..40834f18754c 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -148,13 +148,12 @@ config VMLOGRDR
           This driver depends on the IUCV support driver.
 
 config VMCP
-        tristate "Support for the z/VM CP interface (VM only)"
+        bool "Support for the z/VM CP interface"
         depends on S390
         help
           Select this option if you want to be able to interact with the control
           program on z/VM
 
-
 config MONREADER
         tristate "API for reading z/VM monitor service records"
         depends on IUCV
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 0eabcca3c92d..857dfcb7b359 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -484,6 +484,7 @@ fs3270_open(struct inode *inode, struct file *filp)
                 raw3270_del_view(&fp->view);
                 goto out;
         }
+        nonseekable_open(inode, filp);
         filp->private_data = fp;
 out:
         mutex_unlock(&fs3270_mutex);
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index cb6bffe7141a..18d9a497863b 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -49,7 +49,7 @@ static unsigned char ret_diacr[NR_DEAD] = {
 struct kbd_data *
 kbd_alloc(void) {
         struct kbd_data *kbd;
-        int i, len;
+        int i;
 
         kbd = kzalloc(sizeof(struct kbd_data), GFP_KERNEL);
         if (!kbd)
@@ -59,12 +59,11 @@ kbd_alloc(void) {
                 goto out_kbd;
         for (i = 0; i < ARRAY_SIZE(key_maps); i++) {
                 if (key_maps[i]) {
-                        kbd->key_maps[i] =
-                                kmalloc(sizeof(u_short)*NR_KEYS, GFP_KERNEL);
+                        kbd->key_maps[i] = kmemdup(key_maps[i],
+                                                   sizeof(u_short) * NR_KEYS,
+                                                   GFP_KERNEL);
                         if (!kbd->key_maps[i])
                                 goto out_maps;
-                        memcpy(kbd->key_maps[i], key_maps[i],
-                               sizeof(u_short)*NR_KEYS);
                 }
         }
         kbd->func_table = kzalloc(sizeof(func_table), GFP_KERNEL);
@@ -72,23 +71,21 @@ kbd_alloc(void) {
                 goto out_maps;
         for (i = 0; i < ARRAY_SIZE(func_table); i++) {
                 if (func_table[i]) {
-                        len = strlen(func_table[i]) + 1;
-                        kbd->func_table[i] = kmalloc(len, GFP_KERNEL);
+                        kbd->func_table[i] = kstrdup(func_table[i],
+                                                     GFP_KERNEL);
                         if (!kbd->func_table[i])
                                 goto out_func;
-                        memcpy(kbd->func_table[i], func_table[i], len);
                 }
         }
         kbd->fn_handler =
                 kzalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
         if (!kbd->fn_handler)
                 goto out_func;
-        kbd->accent_table =
-                kmalloc(sizeof(struct kbdiacruc)*MAX_DIACR, GFP_KERNEL);
+        kbd->accent_table = kmemdup(accent_table,
+                                    sizeof(struct kbdiacruc) * MAX_DIACR,
+                                    GFP_KERNEL);
         if (!kbd->accent_table)
                 goto out_fn_handler;
-        memcpy(kbd->accent_table, accent_table,
-               sizeof(struct kbdiacruc)*MAX_DIACR);
         kbd->accent_table_size = accent_table_size;
         return kbd;
 
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 5bb59d36a6d4..04e532eec032 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -1,24 +1,20 @@
 /*
- * Copyright IBM Corp. 2004,2007
+ * Copyright IBM Corp. 2004,2010
  * Interface implementation for communication with the z/VM control program
- * Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
  *
+ * Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
  *
  * z/VMs CP offers the possibility to issue commands via the diagnose code 8
  * this driver implements a character device that issues these commands and
  * returns the answer of CP.
-
+ *
  * The idea of this driver is based on cpint from Neale Ferguson and #CP in CMS
  */
 
-#define KMSG_COMPONENT "vmcp"
-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
-
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
-#include <linux/module.h>
 #include <linux/slab.h>
 #include <asm/compat.h>
 #include <asm/cpcmd.h>
@@ -26,10 +22,6 @@
 #include <asm/uaccess.h>
 #include "vmcp.h"
 
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Christian Borntraeger <borntraeger@de.ibm.com>");
-MODULE_DESCRIPTION("z/VM CP interface");
-
 static debug_info_t *vmcp_debug;
 
 static int vmcp_open(struct inode *inode, struct file *file)
@@ -197,11 +189,8 @@ static int __init vmcp_init(void)
 {
         int ret;
 
-        if (!MACHINE_IS_VM) {
-                pr_warning("The z/VM CP interface device driver cannot be "
-                           "loaded without z/VM\n");
-                return -ENODEV;
-        }
+        if (!MACHINE_IS_VM)
+                return 0;
 
         vmcp_debug = debug_register("vmcp", 1, 1, 240);
         if (!vmcp_debug)
@@ -214,19 +203,8 @@ static int __init vmcp_init(void)
         }
 
         ret = misc_register(&vmcp_dev);
-        if (ret) {
+        if (ret)
                 debug_unregister(vmcp_debug);
-                return ret;
-        }
-
-        return 0;
-}
-
-static void __exit vmcp_exit(void)
-{
-        misc_deregister(&vmcp_dev);
-        debug_unregister(vmcp_debug);
+        return ret;
 }
-
-module_init(vmcp_init);
-module_exit(vmcp_exit);
+device_initcall(vmcp_init);
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 7217966f7d31..f5ea3384a4b9 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -445,7 +445,7 @@ static int zcore_memmap_open(struct inode *inode, struct file *filp)
         }
         kfree(chunk_array);
         filp->private_data = buf;
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int zcore_memmap_release(struct inode *inode, struct file *filp)
@@ -473,7 +473,7 @@ static ssize_t zcore_reipl_write(struct file *filp, const char __user *buf,
 
 static int zcore_reipl_open(struct inode *inode, struct file *filp)
 {
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 static int zcore_reipl_release(struct inode *inode, struct file *filp)
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 3b6f4adc5094..a83877c664a6 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -803,6 +803,7 @@ static long chsc_ioctl(struct file *filp, unsigned int cmd,
 
 static const struct file_operations chsc_fops = {
         .owner = THIS_MODULE,
+        .open = nonseekable_open,
         .unlocked_ioctl = chsc_ioctl,
         .compat_ioctl = chsc_ioctl,
 };
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 5feea1a371e1..f4e6cf3aceb8 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -616,7 +616,8 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
         struct pt_regs *old_regs;
 
         old_regs = set_irq_regs(regs);
-        s390_idle_check();
+        s390_idle_check(regs, S390_lowcore.int_clock,
+                        S390_lowcore.async_enter_timer);
         irq_enter();
         __get_cpu_var(s390_idle).nohz_delay = 1;
         if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 511649115bd7..ac94ac751459 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -648,6 +648,8 @@ static void css_process_crw(struct crw *crw0, struct crw *crw1, int overflow)
 static void __init
 css_generate_pgid(struct channel_subsystem *css, u32 tod_high)
 {
+        struct cpuid cpu_id;
+
         if (css_general_characteristics.mcss) {
                 css->global_pgid.pgid_high.ext_cssid.version = 0x80;
                 css->global_pgid.pgid_high.ext_cssid.cssid = css->cssid;
@@ -658,8 +660,9 @@ css_generate_pgid(struct channel_subsystem *css, u32 tod_high)
                 css->global_pgid.pgid_high.cpu_addr = 0;
 #endif
         }
-        css->global_pgid.cpu_id = S390_lowcore.cpu_id.ident;
-        css->global_pgid.cpu_model = S390_lowcore.cpu_id.machine;
+        get_cpu_id(&cpu_id);
+        css->global_pgid.cpu_id = cpu_id.ident;
+        css->global_pgid.cpu_model = cpu_id.machine;
         css->global_pgid.tod_high = tod_high;
 
 }
@@ -1062,6 +1065,7 @@ static ssize_t cio_settle_write(struct file *file, const char __user *buf,
 }
 
 static const struct file_operations cio_settle_proc_fops = {
+        .open = nonseekable_open,
         .write = cio_settle_write,
 };
 
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 48aa0647432b..f0037eefd44e 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -13,8 +13,8 @@
 #include <asm/debug.h>
 #include "chsc.h"
 
-#define QDIO_BUSY_BIT_PATIENCE          100     /* 100 microseconds */
-#define QDIO_INPUT_THRESHOLD            500     /* 500 microseconds */
+#define QDIO_BUSY_BIT_PATIENCE          (100 << 12)     /* 100 microseconds */
+#define QDIO_INPUT_THRESHOLD            (500 << 12)     /* 500 microseconds */
 
 /*
  * if an asynchronous HiperSockets queue runs full, the 10 seconds timer wait
@@ -296,10 +296,8 @@ struct qdio_q {
         struct qdio_irq *irq_ptr;
         struct sl *sl;
         /*
-         * Warning: Leave this member at the end so it won't be cleared in
-         * qdio_fill_qs. A page is allocated under this pointer and used for
-         * slib and sl. slib is 2048 bytes big and sl points to offset
-         * PAGE_SIZE / 2.
+         * A page is allocated under this pointer and used for slib and sl.
+         * slib is 2048 bytes big and sl points to offset PAGE_SIZE / 2.
          */
         struct slib *slib;
 } __attribute__ ((aligned(256)));
@@ -372,11 +370,6 @@ static inline int multicast_outbound(struct qdio_q *q)
                (q->nr == q->irq_ptr->nr_output_qs - 1);
 }
 
-static inline unsigned long long get_usecs(void)
-{
-        return monotonic_clock() >> 12;
-}
-
 #define pci_out_supported(q) \
         (q->irq_ptr->qib.ac & QIB_AC_OUTBOUND_PCI_SUPPORTED)
 #define is_qebsm(q)                     (q->irq_ptr->sch_token != 0)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 88be7b9ea6e1..00520f9a7a8e 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -336,10 +336,10 @@ again:
                 WARN_ON(queue_type(q) != QDIO_IQDIO_QFMT || cc != 2);
 
                 if (!start_time) {
-                        start_time = get_usecs();
+                        start_time = get_clock();
                         goto again;
                 }
-                if ((get_usecs() - start_time) < QDIO_BUSY_BIT_PATIENCE)
+                if ((get_clock() - start_time) < QDIO_BUSY_BIT_PATIENCE)
                         goto again;
         }
         return cc;
@@ -536,7 +536,7 @@ static int qdio_inbound_q_moved(struct qdio_q *q)
         if ((bufnr != q->last_move) || q->qdio_error) {
                 q->last_move = bufnr;
                 if (!is_thinint_irq(q->irq_ptr) && MACHINE_IS_LPAR)
-                        q->u.in.timestamp = get_usecs();
+                        q->u.in.timestamp = get_clock();
                 return 1;
         } else
                 return 0;
@@ -567,7 +567,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
          * At this point we know, that inbound first_to_check
          * has (probably) not moved (see qdio_inbound_processing).
          */
-        if (get_usecs() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
+        if (get_clock() > q->u.in.timestamp + QDIO_INPUT_THRESHOLD) {
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "in done:%02x",
                               q->first_to_check);
                 return 1;
@@ -606,7 +606,7 @@ static void qdio_kick_handler(struct qdio_q *q)
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
         qperf_inc(q, tasklet_inbound);
-again:
+
         if (!qdio_inbound_q_moved(q))
                 return;
 
@@ -615,7 +615,10 @@ again:
         if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
                 qperf_inc(q, tasklet_inbound_resched);
-                goto again;
+                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
+                        tasklet_schedule(&q->tasklet);
+                        return;
+                }
         }
 
         qdio_stop_polling(q);
@@ -625,7 +628,8 @@ again:
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                goto again;
+                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
+                        tasklet_schedule(&q->tasklet);
         }
 }
 
@@ -955,6 +959,9 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                 return;
         }
 
+        if (irq_ptr->perf_stat_enabled)
+                irq_ptr->perf_stat.qdio_int++;
+
         if (IS_ERR(irb)) {
                 switch (PTR_ERR(irb)) {
                 case -EIO:
@@ -1016,30 +1023,6 @@ int qdio_get_ssqd_desc(struct ccw_device *cdev,
 }
 EXPORT_SYMBOL_GPL(qdio_get_ssqd_desc);
 
-/**
- * qdio_cleanup - shutdown queues and free data structures
- * @cdev: associated ccw device
- * @how: use halt or clear to shutdown
- *
- * This function calls qdio_shutdown() for @cdev with method @how.
- * and qdio_free(). The qdio_free() return value is ignored since
- * !irq_ptr is already checked.
- */
-int qdio_cleanup(struct ccw_device *cdev, int how)
-{
-        struct qdio_irq *irq_ptr = cdev->private->qdio_data;
-        int rc;
-
-        if (!irq_ptr)
-                return -ENODEV;
-
-        rc = qdio_shutdown(cdev, how);
-
-        qdio_free(cdev);
-        return rc;
-}
-EXPORT_SYMBOL_GPL(qdio_cleanup);
-
 static void qdio_shutdown_queues(struct ccw_device *cdev)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
@@ -1157,28 +1140,6 @@ int qdio_free(struct ccw_device *cdev)
 EXPORT_SYMBOL_GPL(qdio_free);
 
 /**
- * qdio_initialize - allocate and establish queues for a qdio subchannel
- * @init_data: initialization data
- *
- * This function first allocates queues via qdio_allocate() and on success
- * establishes them via qdio_establish().
- */
-int qdio_initialize(struct qdio_initialize *init_data)
-{
-        int rc;
-
-        rc = qdio_allocate(init_data);
-        if (rc)
-                return rc;
-
-        rc = qdio_establish(init_data);
-        if (rc)
-                qdio_free(init_data->cdev);
-        return rc;
-}
-EXPORT_SYMBOL_GPL(qdio_initialize);
-
-/**
  * qdio_allocate - allocate qdio queues and associated data
  * @init_data: initialization data
  */
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 7f4a75465140..6326b67c45d2 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -106,10 +106,12 @@ int qdio_allocate_qs(struct qdio_irq *irq_ptr, int nr_input_qs, int nr_output_qs
 static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr,
                               qdio_handler_t *handler, int i)
 {
-        /* must be cleared by every qdio_establish */
-        memset(q, 0, ((char *)&q->slib) - ((char *)q));
-        memset(q->slib, 0, PAGE_SIZE);
+        struct slib *slib = q->slib;
 
+        /* queue must be cleared for qdio_establish */
+        memset(q, 0, sizeof(*q));
+        memset(slib, 0, PAGE_SIZE);
+        q->slib = slib;
         q->irq_ptr = irq_ptr;
         q->mask = 1 << (31 - i);
         q->nr = i;
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index ce5f8910ff83..8daf1b99f153 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -95,7 +95,7 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr)
         for_each_input_queue(irq_ptr, q, i)
                 list_add_rcu(&q->entry, &tiq_list);
         mutex_unlock(&tiq_list_lock);
-        xchg(irq_ptr->dsci, 1);
+        xchg(irq_ptr->dsci, 1 << 7);
 }
 
 void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
@@ -173,7 +173,7 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
 
                 /* prevent racing */
                 if (*tiqdio_alsi)
-                        xchg(&q_indicators[TIQDIO_SHARED_IND].ind, 1);
+                        xchg(&q_indicators[TIQDIO_SHARED_IND].ind, 1 << 7);
         }
 }
 
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 304caf549973..41e0aaefafd5 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -302,7 +302,7 @@ static ssize_t zcrypt_write(struct file *filp, const char __user *buf,
 static int zcrypt_open(struct inode *inode, struct file *filp)
 {
         atomic_inc(&zcrypt_open_count);
-        return 0;
+        return nonseekable_open(inode, filp);
 }
 
 /**
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 3ba738b2e271..28f71349fdec 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1292,13 +1292,14 @@ int qeth_qdio_clear_card(struct qeth_card *card, int use_halt)
                 QETH_QDIO_CLEANING)) {
         case QETH_QDIO_ESTABLISHED:
                 if (card->info.type == QETH_CARD_TYPE_IQD)
-                        rc = qdio_cleanup(CARD_DDEV(card),
+                        rc = qdio_shutdown(CARD_DDEV(card),
                                 QDIO_FLAG_CLEANUP_USING_HALT);
                 else
-                        rc = qdio_cleanup(CARD_DDEV(card),
+                        rc = qdio_shutdown(CARD_DDEV(card),
                                 QDIO_FLAG_CLEANUP_USING_CLEAR);
                 if (rc)
                         QETH_DBF_TEXT_(TRACE, 3, "1err%d", rc);
+                qdio_free(CARD_DDEV(card));
                 atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
                 break;
         case QETH_QDIO_CLEANING:
@@ -3810,10 +3811,18 @@ static int qeth_qdio_establish(struct qeth_card *card)
 
         if (atomic_cmpxchg(&card->qdio.state, QETH_QDIO_ALLOCATED,
                 QETH_QDIO_ESTABLISHED) == QETH_QDIO_ALLOCATED) {
-                rc = qdio_initialize(&init_data);
-                if (rc)
+                rc = qdio_allocate(&init_data);
+                if (rc) {
+                        atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                        goto out;
+                }
+                rc = qdio_establish(&init_data);
+                if (rc) {
                         atomic_set(&card->qdio.state, QETH_QDIO_ALLOCATED);
+                        qdio_free(CARD_DDEV(card));
+                }
         }
+out:
         kfree(out_sbal_ptrs);
         kfree(in_sbal_ptrs);
         kfree(qib_param_field);
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 25d9e0ae9c57..1a2db0a35737 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -254,6 +254,7 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
 }
 
 static const struct file_operations zfcp_cfdc_fops = {
+        .open = nonseekable_open,
         .unlocked_ioctl = zfcp_cfdc_dev_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = zfcp_cfdc_dev_ioctl
diff --git a/drivers/sbus/char/flash.c b/drivers/sbus/char/flash.c
index 19f255b97c86..d3b62eb0fba7 100644
--- a/drivers/sbus/char/flash.c
+++ b/drivers/sbus/char/flash.c
@@ -105,9 +105,9 @@ static ssize_t
 flash_read(struct file * file, char __user * buf,
            size_t count, loff_t *ppos)
 {
-        unsigned long p = file->f_pos;
+        loff_t p = *ppos;
         int i;
-        
+
         if (count > flash.read_size - p)
                 count = flash.read_size - p;
 
@@ -118,7 +118,7 @@ flash_read(struct file * file, char __user * buf,
                 buf++;
         }
 
-        file->f_pos += count;
+        *ppos += count;
         return count;
 }
 
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 9201afe65609..7f87979da22d 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -4724,6 +4724,10 @@ static ushort AscInitMicroCodeVar(ASC_DVC_VAR *asc_dvc)
         BUG_ON((unsigned long)asc_dvc->overrun_buf & 7);
         asc_dvc->overrun_dma = dma_map_single(board->dev, asc_dvc->overrun_buf,
                                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(board->dev, asc_dvc->overrun_dma)) {
+                warn_code = -ENOMEM;
+                goto err_dma_map;
+        }
         phy_addr = cpu_to_le32(asc_dvc->overrun_dma);
         AscMemDWordCopyPtrToLram(iop_base, ASCV_OVERRUN_PADDR_D,
                                  (uchar *)&phy_addr, 1);
@@ -4739,14 +4743,23 @@ static ushort AscInitMicroCodeVar(ASC_DVC_VAR *asc_dvc)
         AscSetPCAddr(iop_base, ASC_MCODE_START_ADDR);
         if (AscGetPCAddr(iop_base) != ASC_MCODE_START_ADDR) {
                 asc_dvc->err_code |= ASC_IERR_SET_PC_ADDR;
-                return warn_code;
+                warn_code = UW_ERR;
+                goto err_mcode_start;
         }
         if (AscStartChip(iop_base) != 1) {
                 asc_dvc->err_code |= ASC_IERR_START_STOP_CHIP;
-                return warn_code;
+                warn_code = UW_ERR;
+                goto err_mcode_start;
         }
 
         return warn_code;
+
+err_mcode_start:
+        dma_unmap_single(board->dev, asc_dvc->overrun_dma,
+                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+err_dma_map:
+        asc_dvc->overrun_dma = 0;
+        return warn_code;
 }
 
 static ushort AscInitAsc1000Driver(ASC_DVC_VAR *asc_dvc)
@@ -4802,6 +4815,8 @@ static ushort AscInitAsc1000Driver(ASC_DVC_VAR *asc_dvc)
         }
         release_firmware(fw);
         warn_code |= AscInitMicroCodeVar(asc_dvc);
+        if (!asc_dvc->overrun_dma)
+                return warn_code;
         asc_dvc->init_state |= ASC_INIT_STATE_END_LOAD_MC;
         AscEnableInterrupt(iop_base);
         return warn_code;
@@ -7978,9 +7993,10 @@ static int advansys_reset(struct scsi_cmnd *scp)
                 status = AscInitAsc1000Driver(asc_dvc);
 
                 /* Refer to ASC_IERR_* definitions for meaning of 'err_code'. */
-                if (asc_dvc->err_code) {
+                if (asc_dvc->err_code || !asc_dvc->overrun_dma) {
                         scmd_printk(KERN_INFO, scp, "SCSI bus reset error: "
-                                    "0x%x\n", asc_dvc->err_code);
+                                    "0x%x, status: 0x%x\n", asc_dvc->err_code,
+                                    status);
                         ret = FAILED;
                 } else if (status) {
                         scmd_printk(KERN_INFO, scp, "SCSI bus reset warning: "
@@ -12311,7 +12327,7 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                 asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
                 if (!asc_dvc_varp->overrun_buf) {
                         ret = -ENOMEM;
-                        goto err_free_wide_mem;
+                        goto err_free_irq;
                 }
                 warn_code = AscInitAsc1000Driver(asc_dvc_varp);
 
@@ -12320,30 +12336,36 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                                         "warn 0x%x, error 0x%x\n",
                                         asc_dvc_varp->init_state, warn_code,
                                         asc_dvc_varp->err_code);
-                        if (asc_dvc_varp->err_code) {
+                        if (!asc_dvc_varp->overrun_dma) {
                                 ret = -ENODEV;
-                                kfree(asc_dvc_varp->overrun_buf);
+                                goto err_free_mem;
                         }
                 }
         } else {
-                if (advansys_wide_init_chip(shost))
+                if (advansys_wide_init_chip(shost)) {
                         ret = -ENODEV;
+                        goto err_free_mem;
+                }
         }
 
-        if (ret)
-                goto err_free_wide_mem;
-
         ASC_DBG_PRT_SCSI_HOST(2, shost);
 
         ret = scsi_add_host(shost, boardp->dev);
         if (ret)
-                goto err_free_wide_mem;
+                goto err_free_mem;
 
         scsi_scan_host(shost);
         return 0;
 
- err_free_wide_mem:
-        advansys_wide_free_mem(boardp);
+ err_free_mem:
+        if (ASC_NARROW_BOARD(boardp)) {
+                if (asc_dvc_varp->overrun_dma)
+                        dma_unmap_single(boardp->dev, asc_dvc_varp->overrun_dma,
+                                         ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+                kfree(asc_dvc_varp->overrun_buf);
+        } else
+                advansys_wide_free_mem(boardp);
+ err_free_irq:
         free_irq(boardp->irq, shost);
  err_free_dma:
 #ifdef CONFIG_ISA
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 6d5ae4474bb3..633e09036357 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -471,12 +471,12 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
 
         WARN_ON(hdrlength >= 256);
         hdr->hlength = hdrlength & 0xFF;
+        hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
 
         if (session->tt->init_task && session->tt->init_task(task))
                 return -EIO;
 
         task->state = ISCSI_TASK_RUNNING;
-        hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
         session->cmdsn++;
 
         conn->scsicmd_pdus_cnt++;
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index b00efd19aadb..88f744672576 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -395,11 +395,15 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev,
 void sas_ata_task_abort(struct sas_task *task)
 {
         struct ata_queued_cmd *qc = task->uldd_task;
+        struct request_queue *q = qc->scsicmd->device->request_queue;
         struct completion *waiting;
+        unsigned long flags;
 
         /* Bounce SCSI-initiated commands to the SCSI EH */
         if (qc->scsicmd) {
+                spin_lock_irqsave(q->queue_lock, flags);
                 blk_abort_request(qc->scsicmd->request);
+                spin_unlock_irqrestore(q->queue_lock, flags);
                 scsi_schedule_eh(qc->scsicmd->device->host);
                 return;
         }
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 2660e1b4569a..822835055cef 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -1030,6 +1030,8 @@ int __sas_task_abort(struct sas_task *task)
 void sas_task_abort(struct sas_task *task)
 {
         struct scsi_cmnd *sc = task->uldd_task;
+        struct request_queue *q = sc->device->request_queue;
+        unsigned long flags;
 
         /* Escape for libsas internal commands */
         if (!sc) {
@@ -1044,7 +1046,9 @@ void sas_task_abort(struct sas_task *task)
                 return;
         }
 
+        spin_lock_irqsave(q->queue_lock, flags);
         blk_abort_request(sc->request);
+        spin_unlock_irqrestore(q->queue_lock, flags);
         scsi_schedule_eh(sc->device->host);
 }
 
diff --git a/drivers/scsi/pcmcia/aha152x_stub.c b/drivers/scsi/pcmcia/aha152x_stub.c
index 528733b4a392..9d70aef99227 100644
--- a/drivers/scsi/pcmcia/aha152x_stub.c
+++ b/drivers/scsi/pcmcia/aha152x_stub.c
@@ -80,7 +80,6 @@ MODULE_LICENSE("Dual MPL/GPL");
 
 typedef struct scsi_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     struct Scsi_Host    *host;
 } scsi_info_t;
 
@@ -105,7 +104,6 @@ static int aha152x_probe(struct pcmcia_device *link)
     link->io.NumPorts1 = 0x20;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.IOAddrLines = 10;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.Present = PRESENT_OPTION;
@@ -160,8 +158,7 @@ static int aha152x_config_cs(struct pcmcia_device *link)
     if (ret)
             goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
 
     ret = pcmcia_request_configuration(link, &link->conf);
@@ -172,7 +169,7 @@ static int aha152x_config_cs(struct pcmcia_device *link)
     memset(&s, 0, sizeof(s));
     s.conf        = "PCMCIA setup";
     s.io_port     = link->io.BasePort1;
-    s.irq         = link->irq.AssignedIRQ;
+    s.irq         = link->irq;
     s.scsiid      = host_id;
     s.reconnect   = reconnect;
     s.parity      = parity;
@@ -187,8 +184,6 @@ static int aha152x_config_cs(struct pcmcia_device *link)
         goto failed;
     }
 
-    sprintf(info->node.dev_name, "scsi%d", host->host_no);
-    link->dev_node = &info->node;
     info->host = host;
 
     return 0;
diff --git a/drivers/scsi/pcmcia/fdomain_stub.c b/drivers/scsi/pcmcia/fdomain_stub.c
index 914040684079..21b141151dfc 100644
--- a/drivers/scsi/pcmcia/fdomain_stub.c
+++ b/drivers/scsi/pcmcia/fdomain_stub.c
@@ -63,7 +63,6 @@ MODULE_LICENSE("Dual MPL/GPL");
 
 typedef struct scsi_info_t {
         struct pcmcia_device    *p_dev;
-    dev_node_t          node;
     struct Scsi_Host    *host;
 } scsi_info_t;
 
@@ -88,7 +87,6 @@ static int fdomain_probe(struct pcmcia_device *link)
         link->io.NumPorts1 = 0x10;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
         link->io.IOAddrLines = 10;
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.Present = PRESENT_OPTION;
@@ -133,8 +131,7 @@ static int fdomain_config(struct pcmcia_device *link)
     if (ret)
             goto failed;
 
-    ret = pcmcia_request_irq(link, &link->irq);
-    if (ret)
+    if (!link->irq)
             goto failed;
     ret = pcmcia_request_configuration(link, &link->conf);
     if (ret)
@@ -144,7 +141,7 @@ static int fdomain_config(struct pcmcia_device *link)
     release_region(link->io.BasePort1, link->io.NumPorts1);
 
     /* Set configuration options for the fdomain driver */
-    sprintf(str, "%d,%d", link->io.BasePort1, link->irq.AssignedIRQ);
+    sprintf(str, "%d,%d", link->io.BasePort1, link->irq);
     fdomain_setup(str);
 
     host = __fdomain_16x0_detect(&fdomain_driver_template);
@@ -157,8 +154,6 @@ static int fdomain_config(struct pcmcia_device *link)
             goto failed;
     scsi_scan_host(host);
 
-    sprintf(info->node.dev_name, "scsi%d", host->host_no);
-    link->dev_node = &info->node;
     info->host = host;
 
     return 0;
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index 021246454872..0f0e112c3f8e 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -1563,13 +1563,6 @@ static int nsp_cs_probe(struct pcmcia_device *link)
         link->io.Attributes1     = IO_DATA_PATH_WIDTH_AUTO;
         link->io.IOAddrLines     = 10;  /* not used */
 
-        /* Interrupt setup */
-        link->irq.Attributes     = IRQ_TYPE_EXCLUSIVE;
-
-        /* Interrupt handler */
-        link->irq.Handler        = &nspintr;
-        link->irq.Attributes     |= IRQF_SHARED;
-
         /* General socket configuration */
         link->conf.Attributes    = CONF_ENABLE_IRQ;
         link->conf.IntType       = INT_MEMORY_AND_IO;
@@ -1646,8 +1639,7 @@ static int nsp_cs_config_check(struct pcmcia_device *p_dev,
                 }
 
                 /* Do we need to allocate an interrupt? */
-                if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
                 /* IO window settings */
                 p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -1720,10 +1712,8 @@ static int nsp_cs_config(struct pcmcia_device *link)
         if (ret)
                 goto cs_failed;
 
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                if (pcmcia_request_irq(link, &link->irq))
-                        goto cs_failed;
-        }
+        if (pcmcia_request_irq(link, nspintr))
+                goto cs_failed;
 
         ret = pcmcia_request_configuration(link, &link->conf);
         if (ret)
@@ -1741,7 +1731,7 @@ static int nsp_cs_config(struct pcmcia_device *link)
         /* Set port and IRQ */
         data->BaseAddress = link->io.BasePort1;
         data->NumAddress  = link->io.NumPorts1;
-        data->IrqNumber   = link->irq.AssignedIRQ;
+        data->IrqNumber   = link->irq;
 
         nsp_dbg(NSP_DEBUG_INIT, "I/O[0x%x+0x%x] IRQ %d",
                 data->BaseAddress, data->NumAddress, data->IrqNumber);
@@ -1764,8 +1754,6 @@ static int nsp_cs_config(struct pcmcia_device *link)
 
         scsi_scan_host(host);
 
-        snprintf(info->node.dev_name, sizeof(info->node.dev_name), "scsi%d", host->host_no);
-        link->dev_node  = &info->node;
         info->host = host;
 
         /* Finally, report what we've done */
@@ -1775,7 +1763,7 @@ static int nsp_cs_config(struct pcmcia_device *link)
                 printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
         }
         if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                printk(", irq %d", link->irq.AssignedIRQ);
+                printk(", irq %d", link->irq);
         }
         if (link->io.NumPorts1) {
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
@@ -1823,7 +1811,6 @@ static void nsp_cs_release(struct pcmcia_device *link)
         if (info->host != NULL) {
                 scsi_remove_host(info->host);
         }
-        link->dev_node = NULL;
 
         if (link->win) {
                 if (data != NULL) {
diff --git a/drivers/scsi/pcmcia/nsp_cs.h b/drivers/scsi/pcmcia/nsp_cs.h
index 8c61a4fe1db9..d68c9f267c5e 100644
--- a/drivers/scsi/pcmcia/nsp_cs.h
+++ b/drivers/scsi/pcmcia/nsp_cs.h
@@ -224,7 +224,6 @@
 typedef struct scsi_info_t {
         struct pcmcia_device    *p_dev;
         struct Scsi_Host      *host;
-        dev_node_t             node;
         int                    stop;
 } scsi_info_t;
 
diff --git a/drivers/scsi/pcmcia/qlogic_stub.c b/drivers/scsi/pcmcia/qlogic_stub.c
index f85f094870b4..f0fc6baed9fc 100644
--- a/drivers/scsi/pcmcia/qlogic_stub.c
+++ b/drivers/scsi/pcmcia/qlogic_stub.c
@@ -82,7 +82,6 @@ static struct scsi_host_template qlogicfas_driver_template = {
 
 typedef struct scsi_info_t {
         struct pcmcia_device    *p_dev;
-        dev_node_t node;
         struct Scsi_Host *host;
         unsigned short manf_id;
 } scsi_info_t;
@@ -161,7 +160,6 @@ static int qlogic_probe(struct pcmcia_device *link)
         link->io.NumPorts1 = 16;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
         link->io.IOAddrLines = 10;
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.Present = PRESENT_OPTION;
@@ -209,8 +207,7 @@ static int qlogic_config(struct pcmcia_device * link)
         if (ret)
                 goto failed;
 
-        ret = pcmcia_request_irq(link, &link->irq);
-        if (ret)
+        if (!link->irq)
                 goto failed;
 
         ret = pcmcia_request_configuration(link, &link->conf);
@@ -227,18 +224,16 @@ static int qlogic_config(struct pcmcia_device * link)
         /* The KXL-810AN has a bigger IO port window */
         if (link->io.NumPorts1 == 32)
                 host = qlogic_detect(&qlogicfas_driver_template, link,
-                        link->io.BasePort1 + 16, link->irq.AssignedIRQ);
+                        link->io.BasePort1 + 16, link->irq);
         else
                 host = qlogic_detect(&qlogicfas_driver_template, link,
-                        link->io.BasePort1, link->irq.AssignedIRQ);
+                        link->io.BasePort1, link->irq);
         
         if (!host) {
                 printk(KERN_INFO "%s: no SCSI devices found\n", qlogic_name);
                 goto failed;
         }
 
-        sprintf(info->node.dev_name, "scsi%d", host->host_no);
-        link->dev_node = &info->node;
         info->host = host;
 
         return 0;
@@ -258,7 +253,7 @@ static void qlogic_release(struct pcmcia_device *link)
 
         scsi_remove_host(info->host);
 
-        free_irq(link->irq.AssignedIRQ, info->host);
+        free_irq(link->irq, info->host);
         pcmcia_disable_device(link);
 
         scsi_host_put(info->host);
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index e7564d8f0cbf..a51164171179 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -191,7 +191,6 @@
 
 struct scsi_info_t {
         struct pcmcia_device    *p_dev;
-        dev_node_t node;
         struct Scsi_Host *host;
         unsigned short manf_id;
 };
@@ -719,8 +718,7 @@ SYM53C500_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        ret = pcmcia_request_irq(link, &link->irq);
-        if (ret)
+        if (!link->irq)
                 goto failed;
 
         ret = pcmcia_request_configuration(link, &link->conf);
@@ -752,7 +750,7 @@ SYM53C500_config(struct pcmcia_device *link)
         *       0x320, 0x330, 0x340, 0x350
         */
         port_base = link->io.BasePort1;
-        irq_level = link->irq.AssignedIRQ;
+        irq_level = link->irq;
 
         DEB(printk("SYM53C500: port_base=0x%x, irq=%d, fast_pio=%d\n",
             port_base, irq_level, USE_FAST_PIO);)
@@ -793,8 +791,6 @@ SYM53C500_config(struct pcmcia_device *link)
         */
         data->fast_pio = USE_FAST_PIO;
 
-        sprintf(info->node.dev_name, "scsi%d", host->host_no);
-        link->dev_node = &info->node;
         info->host = host;
 
         if (scsi_add_host(host, NULL))
@@ -866,7 +862,6 @@ SYM53C500_probe(struct pcmcia_device *link)
         link->io.NumPorts1 = 16;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
         link->io.IOAddrLines = 10;
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 09d6d4b76f39..caeb7d10ae04 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -467,7 +467,7 @@ int qla4xxx_get_fwddb_entry(struct scsi_qla_host *ha,
         if (conn_err_detail)
                 *conn_err_detail = mbox_sts[5];
         if (tcp_source_port_num)
-                *tcp_source_port_num = (uint16_t) mbox_sts[6] >> 16;
+                *tcp_source_port_num = (uint16_t) (mbox_sts[6] >> 16);
         if (connection_id)
                 *connection_id = (uint16_t) mbox_sts[6] & 0x00FF;
         status = QLA_SUCCESS;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 3e10c306de94..3a5bfd10b2cb 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -957,7 +957,8 @@ static int resp_start_stop(struct scsi_cmnd * scp,
 static sector_t get_sdebug_capacity(void)
 {
         if (scsi_debug_virtual_gb > 0)
-                return 2048 * 1024 * (sector_t)scsi_debug_virtual_gb;
+                return (sector_t)scsi_debug_virtual_gb *
+                        (1073741824 / scsi_debug_sector_size);
         else
                 return sdebug_store_sectors;
 }
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index d45c69ca5737..7ad53fa42766 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -302,7 +302,20 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
                 if (scmd->device->allow_restart &&
                     (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
                         return FAILED;
-                return SUCCESS;
+
+                if (blk_barrier_rq(scmd->request))
+                        /*
+                         * barrier requests should always retry on UA
+                         * otherwise block will get a spurious error
+                         */
+                        return NEEDS_RETRY;
+                else
+                        /*
+                         * for normal (non barrier) commands, pass the
+                         * UA upwards for a determination in the
+                         * completion functions
+                         */
+                        return SUCCESS;
 
                 /* these three are not supported */
         case COPY_ABORTED:
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 8b827f37b03e..de6c60320f6f 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1040,6 +1040,7 @@ static void sd_prepare_flush(struct request_queue *q, struct request *rq)
 {
         rq->cmd_type = REQ_TYPE_BLOCK_PC;
         rq->timeout = SD_TIMEOUT;
+        rq->retries = SD_MAX_RETRIES;
         rq->cmd[0] = SYNCHRONIZE_CACHE;
         rq->cmd_len = 10;
 }
diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c
index 105449c15fa9..e17764d71476 100644
--- a/drivers/scsi/zorro7xx.c
+++ b/drivers/scsi/zorro7xx.c
@@ -69,6 +69,7 @@ static struct zorro_device_id zorro7xx_zorro_tbl[] __devinitdata = {
         },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, zorro7xx_zorro_tbl);
 
 static int __devinit zorro7xx_init_one(struct zorro_dev *z,
                                        const struct zorro_device_id *ent)
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index 24485cc62ff8..4822cb50cd0f 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {       "FUJ02E6",              0       },
         /* Fujitsu Wacom 2FGT Tablet PC device */
         {       "FUJ02E7",              0       },
+        /* Fujitsu Wacom 1FGT Tablet PC device */
+        {       "FUJ02E9",              0       },
         /*
          * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
          * disguise)
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index f55c49475a8c..302836a80693 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -518,12 +518,13 @@ config SERIAL_S3C2412
           Serial port support for the Samsung S3C2412 and S3C2413 SoC
 
 config SERIAL_S3C2440
-        tristate "Samsung S3C2440/S3C2442 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C2440 || CPU_S3C2442)
+        tristate "Samsung S3C2440/S3C2442/S3C2416 Serial port support"
+        depends on SERIAL_SAMSUNG && (CPU_S3C2440 || CPU_S3C2442 || CPU_S3C2416)
         default y if CPU_S3C2440
         default y if CPU_S3C2442
+        select SERIAL_SAMSUNG_UARTS_4 if CPU_S3C2416
         help
-          Serial port support for the Samsung S3C2440 and S3C2442 SoC
+          Serial port support for the Samsung S3C2440, S3C2416 and S3C2442 SoC
 
 config SERIAL_S3C24A0
         tristate "Samsung S3C24A0 Serial port support"
@@ -533,21 +534,13 @@ config SERIAL_S3C24A0
           Serial port support for the Samsung S3C24A0 SoC
 
 config SERIAL_S3C6400
-        tristate "Samsung S3C6400/S3C6410/S5P6440 Seria port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440)
+        tristate "Samsung S3C6400/S3C6410/S5P6440/S5PC100 Serial port support"
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410 || CPU_S5P6440 || CPU_S5PC100)
         select SERIAL_SAMSUNG_UARTS_4
         default y
         help
-          Serial port support for the Samsung S3C6400, S3C6410 and S5P6440
-          SoCs
-
-config SERIAL_S5PC100
-        tristate "Samsung S5PC100 Serial port support"
-        depends on SERIAL_SAMSUNG && CPU_S5PC100
-        select SERIAL_SAMSUNG_UARTS_4
-        default y
-        help
-          Serial port support for the Samsung S5PC100 SoCs
+          Serial port support for the Samsung S3C6400, S3C6410, S5P6440
+          and S5PC100 SoCs
 
 config SERIAL_S5PV210
         tristate "Samsung S5PV210 Serial port support"
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index 6aa4723b74ee..328f107346c4 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -44,7 +44,6 @@ obj-$(CONFIG_SERIAL_S3C2412) += s3c2412.o
 obj-$(CONFIG_SERIAL_S3C2440) += s3c2440.o
 obj-$(CONFIG_SERIAL_S3C24A0) += s3c24a0.o
 obj-$(CONFIG_SERIAL_S3C6400) += s3c6400.o
-obj-$(CONFIG_SERIAL_S5PC100) += s3c6400.o
 obj-$(CONFIG_SERIAL_S5PV210) += s5pv210.o
 obj-$(CONFIG_SERIAL_MAX3100) += max3100.o
 obj-$(CONFIG_SERIAL_IP22_ZILOG) += ip22zilog.o
diff --git a/drivers/serial/atmel_serial.c b/drivers/serial/atmel_serial.c
index 2c9bf9b68327..eed3c2d8dd1c 100644
--- a/drivers/serial/atmel_serial.c
+++ b/drivers/serial/atmel_serial.c
@@ -38,6 +38,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/atmel_pdc.h>
 #include <linux/atmel_serial.h>
+#include <linux/uaccess.h>
 
 #include <asm/io.h>
 
@@ -59,6 +60,9 @@
 
 #include <linux/serial_core.h>
 
+static void atmel_start_rx(struct uart_port *port);
+static void atmel_stop_rx(struct uart_port *port);
+
 #ifdef CONFIG_SERIAL_ATMEL_TTYAT
 
 /* Use device name ttyAT, major 204 and minor 154-169.  This is necessary if we
@@ -93,6 +97,7 @@
 #define UART_GET_BRGR(port)     __raw_readl((port)->membase + ATMEL_US_BRGR)
 #define UART_PUT_BRGR(port,v)   __raw_writel(v, (port)->membase + ATMEL_US_BRGR)
 #define UART_PUT_RTOR(port,v)   __raw_writel(v, (port)->membase + ATMEL_US_RTOR)
+#define UART_PUT_TTGR(port, v)  __raw_writel(v, (port)->membase + ATMEL_US_TTGR)
 
  /* PDC registers */
 #define UART_PUT_PTCR(port,v)   __raw_writel(v, (port)->membase + ATMEL_PDC_PTCR)
@@ -147,6 +152,9 @@ struct atmel_uart_port {
         unsigned int            irq_status_prev;
 
         struct circ_buf         rx_ring;
+
+        struct serial_rs485     rs485;          /* rs485 settings */
+        unsigned int            tx_done_mask;
 };
 
 static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
@@ -187,6 +195,46 @@ static bool atmel_use_dma_tx(struct uart_port *port)
 }
 #endif
 
+/* Enable or disable the rs485 support */
+void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+{
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+        unsigned int mode;
+
+        spin_lock(&port->lock);
+
+        /* Disable interrupts */
+        UART_PUT_IDR(port, atmel_port->tx_done_mask);
+
+        mode = UART_GET_MR(port);
+
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        atmel_port->rs485 = *rs485conf;
+
+        if (rs485conf->flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+                UART_PUT_TTGR(port, rs485conf->delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+                if (atmel_use_dma_tx(port))
+                        atmel_port->tx_done_mask = ATMEL_US_ENDTX |
+                                ATMEL_US_TXBUFE;
+                else
+                        atmel_port->tx_done_mask = ATMEL_US_TXRDY;
+        }
+        UART_PUT_MR(port, mode);
+
+        /* Enable interrupts */
+        UART_PUT_IER(port, atmel_port->tx_done_mask);
+
+        spin_unlock(&port->lock);
+
+}
+
 /*
  * Return TIOCSER_TEMT when transmitter FIFO and Shift register is empty.
  */
@@ -202,6 +250,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
 {
         unsigned int control = 0;
         unsigned int mode;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
 #ifdef CONFIG_ARCH_AT91RM9200
         if (cpu_is_at91rm9200()) {
@@ -236,6 +285,17 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
                 mode |= ATMEL_US_CHMODE_LOC_LOOP;
         else
                 mode |= ATMEL_US_CHMODE_NORMAL;
+
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+        }
         UART_PUT_MR(port, mode);
 }
 
@@ -268,12 +328,17 @@ static u_int atmel_get_mctrl(struct uart_port *port)
  */
 static void atmel_stop_tx(struct uart_port *port)
 {
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
         if (atmel_use_dma_tx(port)) {
                 /* disable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTDIS);
-                UART_PUT_IDR(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
-        } else
-                UART_PUT_IDR(port, ATMEL_US_TXRDY);
+        }
+        /* Disable interrupts */
+        UART_PUT_IDR(port, atmel_port->tx_done_mask);
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                atmel_start_rx(port);
 }
 
 /*
@@ -281,17 +346,39 @@ static void atmel_stop_tx(struct uart_port *port)
  */
 static void atmel_start_tx(struct uart_port *port)
 {
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
         if (atmel_use_dma_tx(port)) {
                 if (UART_GET_PTSR(port) & ATMEL_PDC_TXTEN)
                         /* The transmitter is already running.  Yes, we
                            really need this.*/
                         return;
 
-                UART_PUT_IER(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
+                if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                        atmel_stop_rx(port);
+
                 /* re-enable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTEN);
-        } else
-                UART_PUT_IER(port, ATMEL_US_TXRDY);
+        }
+        /* Enable interrupts */
+        UART_PUT_IER(port, atmel_port->tx_done_mask);
+}
+
+/*
+ * start receiving - port is in process of being opened.
+ */
+static void atmel_start_rx(struct uart_port *port)
+{
+        UART_PUT_CR(port, ATMEL_US_RSTSTA);  /* reset status and receiver */
+
+        if (atmel_use_dma_rx(port)) {
+                /* enable PDC controller */
+                UART_PUT_IER(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT |
+                        port->read_status_mask);
+                UART_PUT_PTCR(port, ATMEL_PDC_RXTEN);
+        } else {
+                UART_PUT_IER(port, ATMEL_US_RXRDY);
+        }
 }
 
 /*
@@ -302,9 +389,11 @@ static void atmel_stop_rx(struct uart_port *port)
         if (atmel_use_dma_rx(port)) {
                 /* disable PDC receive */
                 UART_PUT_PTCR(port, ATMEL_PDC_RXTDIS);
-                UART_PUT_IDR(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT);
-        } else
+                UART_PUT_IDR(port, ATMEL_US_ENDRX | ATMEL_US_TIMEOUT |
+                        port->read_status_mask);
+        } else {
                 UART_PUT_IDR(port, ATMEL_US_RXRDY);
+        }
 }
 
 /*
@@ -428,8 +517,9 @@ static void atmel_rx_chars(struct uart_port *port)
 static void atmel_tx_chars(struct uart_port *port)
 {
         struct circ_buf *xmit = &port->state->xmit;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
-        if (port->x_char && UART_GET_CSR(port) & ATMEL_US_TXRDY) {
+        if (port->x_char && UART_GET_CSR(port) & atmel_port->tx_done_mask) {
                 UART_PUT_CHAR(port, port->x_char);
                 port->icount.tx++;
                 port->x_char = 0;
@@ -437,7 +527,7 @@ static void atmel_tx_chars(struct uart_port *port)
         if (uart_circ_empty(xmit) || uart_tx_stopped(port))
                 return;
 
-        while (UART_GET_CSR(port) & ATMEL_US_TXRDY) {
+        while (UART_GET_CSR(port) & atmel_port->tx_done_mask) {
                 UART_PUT_CHAR(port, xmit->buf[xmit->tail]);
                 xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
                 port->icount.tx++;
@@ -449,7 +539,8 @@ static void atmel_tx_chars(struct uart_port *port)
                 uart_write_wakeup(port);
 
         if (!uart_circ_empty(xmit))
-                UART_PUT_IER(port, ATMEL_US_TXRDY);
+                /* Enable interrupts */
+                UART_PUT_IER(port, atmel_port->tx_done_mask);
 }
 
 /*
@@ -501,18 +592,10 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
 {
         struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
-        if (atmel_use_dma_tx(port)) {
-                /* PDC transmit */
-                if (pending & (ATMEL_US_ENDTX | ATMEL_US_TXBUFE)) {
-                        UART_PUT_IDR(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
-                        tasklet_schedule(&atmel_port->tasklet);
-                }
-        } else {
-                /* Interrupt transmit */
-                if (pending & ATMEL_US_TXRDY) {
-                        UART_PUT_IDR(port, ATMEL_US_TXRDY);
-                        tasklet_schedule(&atmel_port->tasklet);
-                }
+        if (pending & atmel_port->tx_done_mask) {
+                /* Either PDC or interrupt transmission */
+                UART_PUT_IDR(port, atmel_port->tx_done_mask);
+                tasklet_schedule(&atmel_port->tasklet);
         }
 }
 
@@ -590,9 +673,15 @@ static void atmel_tx_dma(struct uart_port *port)
 
                 UART_PUT_TPR(port, pdc->dma_addr + xmit->tail);
                 UART_PUT_TCR(port, count);
-                /* re-enable PDC transmit and interrupts */
+                /* re-enable PDC transmit */
                 UART_PUT_PTCR(port, ATMEL_PDC_TXTEN);
-                UART_PUT_IER(port, ATMEL_US_ENDTX | ATMEL_US_TXBUFE);
+                /* Enable interrupts */
+                UART_PUT_IER(port, atmel_port->tx_done_mask);
+        } else {
+                if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                        /* DMA done, stop TX, start RX for RS485 */
+                        atmel_start_rx(port);
+                }
         }
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
@@ -1017,6 +1106,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
 {
         unsigned long flags;
         unsigned int mode, imr, quot, baud;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
         /* Get current mode register */
         mode = UART_GET_MR(port) & ~(ATMEL_US_USCLKS | ATMEL_US_CHRL
@@ -1115,6 +1205,17 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
         /* disable receiver and transmitter */
         UART_PUT_CR(port, ATMEL_US_TXDIS | ATMEL_US_RXDIS);
 
+        /* Resetting serial mode to RS232 (0x0) */
+        mode &= ~ATMEL_US_USMODE;
+
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+                dev_dbg(port->dev, "Setting UART to RS485\n");
+                UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_before_send);
+                mode |= ATMEL_US_USMODE_RS485;
+        } else {
+                dev_dbg(port->dev, "Setting UART to RS232\n");
+        }
+
         /* set the parity, stop bits and data size */
         UART_PUT_MR(port, mode);
 
@@ -1231,6 +1332,35 @@ static void atmel_poll_put_char(struct uart_port *port, unsigned char ch)
 }
 #endif
 
+static int
+atmel_ioctl(struct uart_port *port, unsigned int cmd, unsigned long arg)
+{
+        struct serial_rs485 rs485conf;
+
+        switch (cmd) {
+        case TIOCSRS485:
+                if (copy_from_user(&rs485conf, (struct serial_rs485 *) arg,
+                                        sizeof(rs485conf)))
+                        return -EFAULT;
+
+                atmel_config_rs485(port, &rs485conf);
+                break;
+
+        case TIOCGRS485:
+                if (copy_to_user((struct serial_rs485 *) arg,
+                                        &(to_atmel_uart_port(port)->rs485),
+                                        sizeof(rs485conf)))
+                        return -EFAULT;
+                break;
+
+        default:
+                return -ENOIOCTLCMD;
+        }
+        return 0;
+}
+
+
+
 static struct uart_ops atmel_pops = {
         .tx_empty       = atmel_tx_empty,
         .set_mctrl      = atmel_set_mctrl,
@@ -1250,6 +1380,7 @@ static struct uart_ops atmel_pops = {
         .config_port    = atmel_config_port,
         .verify_port    = atmel_verify_port,
         .pm             = atmel_serial_pm,
+        .ioctl          = atmel_ioctl,
 #ifdef CONFIG_CONSOLE_POLL
         .poll_get_char  = atmel_poll_get_char,
         .poll_put_char  = atmel_poll_put_char,
@@ -1265,13 +1396,12 @@ static void __devinit atmel_init_port(struct atmel_uart_port *atmel_port,
         struct uart_port *port = &atmel_port->uart;
         struct atmel_uart_data *data = pdev->dev.platform_data;
 
-        port->iotype    = UPIO_MEM;
-        port->flags     = UPF_BOOT_AUTOCONF;
-        port->ops       = &atmel_pops;
-        port->fifosize  = 1;
-        port->line      = pdev->id;
-        port->dev       = &pdev->dev;
-
+        port->iotype            = UPIO_MEM;
+        port->flags             = UPF_BOOT_AUTOCONF;
+        port->ops               = &atmel_pops;
+        port->fifosize          = 1;
+        port->line              = pdev->id;
+        port->dev               = &pdev->dev;
         port->mapbase   = pdev->resource[0].start;
         port->irq       = pdev->resource[1].start;
 
@@ -1299,8 +1429,16 @@ static void __devinit atmel_init_port(struct atmel_uart_port *atmel_port,
 
         atmel_port->use_dma_rx = data->use_dma_rx;
         atmel_port->use_dma_tx = data->use_dma_tx;
-        if (atmel_use_dma_tx(port))
+        atmel_port->rs485       = data->rs485;
+        /* Use TXEMPTY for interrupt when rs485 else TXRDY or ENDTX|TXBUFE */
+        if (atmel_port->rs485.flags & SER_RS485_ENABLED)
+                atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+        else if (atmel_use_dma_tx(port)) {
                 port->fifosize = PDC_BUFFER_SIZE;
+                atmel_port->tx_done_mask = ATMEL_US_ENDTX | ATMEL_US_TXBUFE;
+        } else {
+                atmel_port->tx_done_mask = ATMEL_US_TXRDY;
+        }
 }
 
 /*
@@ -1334,6 +1472,7 @@ static void atmel_console_putchar(struct uart_port *port, int ch)
 static void atmel_console_write(struct console *co, const char *s, u_int count)
 {
         struct uart_port *port = &atmel_ports[co->index].uart;
+        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
         unsigned int status, imr;
         unsigned int pdc_tx;
 
@@ -1341,7 +1480,7 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
          * First, save IMR and then disable interrupts
          */
         imr = UART_GET_IMR(port);
-        UART_PUT_IDR(port, ATMEL_US_RXRDY | ATMEL_US_TXRDY);
+        UART_PUT_IDR(port, ATMEL_US_RXRDY | atmel_port->tx_done_mask);
 
         /* Store PDC transmit status and disable it */
         pdc_tx = UART_GET_PTSR(port) & ATMEL_PDC_TXTEN;
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4315b23590bd..eacb588a9345 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -120,7 +120,8 @@
 #define  MX2_UCR3_RXDMUXSEL      (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
 #define  UCR4_INVR       (1<<9)  /* Inverted infrared reception */
 #define  UCR4_ENIRI      (1<<8)  /* Serial infrared interrupt enable */
 #define  UCR4_WKEN       (1<<7)  /* Wake interrupt enable */
@@ -591,6 +592,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
         return 0;
 }
 
+/* half the RX buffer size */
+#define CTSTL 16
+
 static int imx_startup(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
@@ -607,6 +611,10 @@ static int imx_startup(struct uart_port *port)
         if (USE_IRDA(sport))
                 temp |= UCR4_IRSC;
 
+        /* set the trigger level for CTS */
+        temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
+        temp |= CTSTL<<  UCR4_CTSTL_SHF;
+
         writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
 
         if (USE_IRDA(sport)) {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 3119fddaedb5..02469c31bf0b 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -29,39 +29,6 @@
  * kind, whether express or implied.
  */
 
-/* Platform device Usage :
- *
- * Since PSCs can have multiple function, the correct driver for each one
- * is selected by calling mpc52xx_match_psc_function(...). The function
- * handled by this driver is "uart".
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- *
- * The idx field must be equal to the PSC index (e.g. 0 for PSC1, 1 for PSC2,
- * and so on). So the PSC1 is mapped to /dev/ttyPSC0, PSC2 to /dev/ttyPSC1 and
- * so on. But be warned, it's an ABSOLUTE REQUIREMENT ! This is needed mainly
- * fpr the console code : without this 1:1 mapping, at early boot time, when we
- * are parsing the kernel args console=ttyPSC?, we wouldn't know which PSC it
- * will be mapped to.
- */
-
-/* OF Platform device Usage :
- *
- * This driver is only used for PSCs configured in uart mode.  The device
- * tree will have a node for each PSC with "mpc52xx-psc-uart" in the compatible
- * list.
- *
- * By default, PSC devices are enumerated in the order they are found.  However
- * a particular PSC number can be forces by adding 'device_no = <port#>'
- * to the device node.
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- */
-
 #undef DEBUG
 
 #include <linux/device.h>
@@ -1500,7 +1467,7 @@ mpc52xx_uart_init(void)
         /*
          * Map the PSC FIFO Controller and init if on MPC512x.
          */
-        if (psc_ops->fifoc_init) {
+        if (psc_ops && psc_ops->fifoc_init) {
                 ret = psc_ops->fifoc_init();
                 if (ret)
                         return ret;
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 4eaa043ca2a8..700e10833bf9 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -752,8 +752,10 @@ static void pmz_break_ctl(struct uart_port *port, int break_state)
                 uap->curregs[R5] = new_reg;
 
                 /* NOTE: Not subject to 'transmitter active' rule. */
-                if (ZS_IS_ASLEEP(uap))
+                if (ZS_IS_ASLEEP(uap)) {
+                        spin_unlock_irqrestore(&port->lock, flags);
                         return;
+                }
                 write_zsreg(uap, R5, uap->curregs[R5]);
         }
 
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 8cfa5b12ea7a..dadd686c9801 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -89,7 +89,6 @@ struct serial_info {
         int                     manfid;
         int                     prodid;
         int                     c950ctrl;
-        dev_node_t              node[4];
         int                     line[4];
         const struct serial_quirk *quirk;
 };
@@ -289,8 +288,6 @@ static void serial_remove(struct pcmcia_device *link)
         for (i = 0; i < info->ndev; i++)
                 serial8250_unregister_port(info->line[i]);
 
-        info->p_dev->dev_node = NULL;
-
         if (!info->slave)
                 pcmcia_disable_device(link);
 }
@@ -343,7 +340,6 @@ static int serial_probe(struct pcmcia_device *link)
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
         link->io.NumPorts1 = 8;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         if (do_sound) {
                 link->conf.Attributes |= CONF_ENABLE_SPKR;
@@ -411,11 +407,6 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info * info,
         }
 
         info->line[info->ndev] = line;
-        sprintf(info->node[info->ndev].dev_name, "ttyS%d", line);
-        info->node[info->ndev].major = TTY_MAJOR;
-        info->node[info->ndev].minor = 0x40 + line;
-        if (info->ndev > 0)
-                info->node[info->ndev - 1].next = &info->node[info->ndev];
         info->ndev++;
 
         return 0;
@@ -486,7 +477,7 @@ static int simple_config(struct pcmcia_device *link)
                 }
                 if (info->slave) {
                         return setup_serial(link, info, port,
-                                            link->irq.AssignedIRQ);
+                                            link->irq);
                 }
         }
 
@@ -507,10 +498,6 @@ static int simple_config(struct pcmcia_device *link)
         return -1;
 
 found_port:
-        i = pcmcia_request_irq(link, &link->irq);
-        if (i != 0)
-                link->irq.AssignedIRQ = 0;
-
         if (info->multi && (info->manfid == MANFID_3COM))
                 link->conf.ConfigIndex &= ~(0x08);
 
@@ -523,7 +510,7 @@ found_port:
         i = pcmcia_request_configuration(link, &link->conf);
         if (i != 0)
                 return -1;
-        return setup_serial(link, info, link->io.BasePort1, link->irq.AssignedIRQ);
+        return setup_serial(link, info, link->io.BasePort1, link->irq);
 }
 
 static int multi_config_check(struct pcmcia_device *p_dev,
@@ -586,13 +573,9 @@ static int multi_config(struct pcmcia_device *link)
                 }
         }
 
-        i = pcmcia_request_irq(link, &link->irq);
-        if (i != 0) {
-                /* FIXME: comment does not fit, error handling does not fit */
-                printk(KERN_NOTICE
-                       "serial_cs: no usable port range found, giving up\n");
-                link->irq.AssignedIRQ = 0;
-        }
+        if (!link->irq)
+                dev_warn(&link->dev,
+                        "serial_cs: no usable IRQ found, continuing...\n");
 
         /*
          * Apply any configuration quirks.
@@ -615,11 +598,11 @@ static int multi_config(struct pcmcia_device *link)
                 if (link->conf.ConfigIndex == 1 ||
                     link->conf.ConfigIndex == 3) {
                         err = setup_serial(link, info, base2,
-                                        link->irq.AssignedIRQ);
+                                        link->irq);
                         base2 = link->io.BasePort1;
                 } else {
                         err = setup_serial(link, info, link->io.BasePort1,
-                                        link->irq.AssignedIRQ);
+                                        link->irq);
                 }
                 info->c950ctrl = base2;
 
@@ -633,10 +616,10 @@ static int multi_config(struct pcmcia_device *link)
                 return 0;
         }
 
-        setup_serial(link, info, link->io.BasePort1, link->irq.AssignedIRQ);
+        setup_serial(link, info, link->io.BasePort1, link->irq);
         for (i = 0; i < info->multi - 1; i++)
                 setup_serial(link, info, base2 + (8 * i),
-                                link->irq.AssignedIRQ);
+                                link->irq);
         return 0;
 }
 
@@ -720,7 +703,6 @@ static int serial_config(struct pcmcia_device * link)
                 if (info->quirk->post(link))
                         goto failed;
 
-        link->dev_node = &info->node[0];
         return 0;
 
 failed:
diff --git a/drivers/serial/serial_ks8695.c b/drivers/serial/serial_ks8695.c
index 2e71bbc04dac..b1962025b1aa 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/serial/serial_ks8695.c
@@ -650,6 +650,7 @@ static struct console ks8695_console = {
 
 static int __init ks8695_console_init(void)
 {
+        add_preferred_console(SERIAL_KS8695_DEVNAME, 0, NULL);
         register_console(&ks8695_console);
         return 0;
 }
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 8eb094c1f61b..8d993c4cceac 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -83,16 +83,16 @@ struct sci_port {
 
         /* Interface clock */
         struct clk              *iclk;
-        /* Data clock */
-        struct clk              *dclk;
+        /* Function clock */
+        struct clk              *fclk;
 
         struct list_head        node;
         struct dma_chan                 *chan_tx;
         struct dma_chan                 *chan_rx;
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
         struct device                   *dma_dev;
-        enum sh_dmae_slave_chan_id      slave_tx;
-        enum sh_dmae_slave_chan_id      slave_rx;
+        unsigned int                    slave_tx;
+        unsigned int                    slave_rx;
         struct dma_async_tx_descriptor  *desc_tx;
         struct dma_async_tx_descriptor  *desc_rx[2];
         dma_cookie_t                    cookie_tx;
@@ -107,6 +107,7 @@ struct sci_port {
         struct work_struct              work_tx;
         struct work_struct              work_rx;
         struct timer_list               rx_timer;
+        unsigned int                    rx_timeout;
 #endif
 };
 
@@ -674,22 +675,22 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
         struct sci_port *s = to_sci_port(port);
 
         if (s->chan_rx) {
-                unsigned long tout;
                 u16 scr = sci_in(port, SCSCR);
                 u16 ssr = sci_in(port, SCxSR);
 
                 /* Disable future Rx interrupts */
-                sci_out(port, SCSCR, scr & ~SCI_CTRL_FLAGS_RIE);
+                if (port->type == PORT_SCIFA) {
+                        disable_irq_nosync(irq);
+                        scr |= 0x4000;
+                } else {
+                        scr &= ~SCI_CTRL_FLAGS_RIE;
+                }
+                sci_out(port, SCSCR, scr);
                 /* Clear current interrupt */
                 sci_out(port, SCxSR, ssr & ~(1 | SCxSR_RDxF(port)));
-                /* Calculate delay for 1.5 DMA buffers */
-                tout = (port->timeout - HZ / 50) * s->buf_len_rx * 3 /
-                        port->fifosize / 2;
-                dev_dbg(port->dev, "Rx IRQ: setup timeout in %lu ms\n",
-                        tout * 1000 / HZ);
-                if (tout < 2)
-                        tout = 2;
-                mod_timer(&s->rx_timer, jiffies + tout);
+                dev_dbg(port->dev, "Rx IRQ %lu: setup t-out in %u jiffies\n",
+                        jiffies, s->rx_timeout);
+                mod_timer(&s->rx_timer, jiffies + s->rx_timeout);
 
                 return IRQ_HANDLED;
         }
@@ -799,7 +800,7 @@ static int sci_notifier(struct notifier_block *self,
             (phase == CPUFREQ_RESUMECHANGE)) {
                 spin_lock_irqsave(&priv->lock, flags);
                 list_for_each_entry(sci_port, &priv->ports, node)
-                        sci_port->port.uartclk = clk_get_rate(sci_port->dclk);
+                        sci_port->port.uartclk = clk_get_rate(sci_port->iclk);
                 spin_unlock_irqrestore(&priv->lock, flags);
         }
 
@@ -810,21 +811,17 @@ static void sci_clk_enable(struct uart_port *port)
 {
         struct sci_port *sci_port = to_sci_port(port);
 
-        clk_enable(sci_port->dclk);
-        sci_port->port.uartclk = clk_get_rate(sci_port->dclk);
-
-        if (sci_port->iclk)
-                clk_enable(sci_port->iclk);
+        clk_enable(sci_port->iclk);
+        sci_port->port.uartclk = clk_get_rate(sci_port->iclk);
+        clk_enable(sci_port->fclk);
 }
 
 static void sci_clk_disable(struct uart_port *port)
 {
         struct sci_port *sci_port = to_sci_port(port);
 
-        if (sci_port->iclk)
-                clk_disable(sci_port->iclk);
-
-        clk_disable(sci_port->dclk);
+        clk_disable(sci_port->fclk);
+        clk_disable(sci_port->iclk);
 }
 
 static int sci_request_irq(struct sci_port *port)
@@ -913,22 +910,26 @@ static void sci_dma_tx_complete(void *arg)
 
         spin_lock_irqsave(&port->lock, flags);
 
-        xmit->tail += s->sg_tx.length;
+        xmit->tail += sg_dma_len(&s->sg_tx);
         xmit->tail &= UART_XMIT_SIZE - 1;
 
-        port->icount.tx += s->sg_tx.length;
+        port->icount.tx += sg_dma_len(&s->sg_tx);
 
         async_tx_ack(s->desc_tx);
         s->cookie_tx = -EINVAL;
         s->desc_tx = NULL;
 
-        spin_unlock_irqrestore(&port->lock, flags);
-
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
                 uart_write_wakeup(port);
 
-        if (uart_circ_chars_pending(xmit))
+        if (!uart_circ_empty(xmit)) {
                 schedule_work(&s->work_tx);
+        } else if (port->type == PORT_SCIFA) {
+                u16 ctrl = sci_in(port, SCSCR);
+                sci_out(port, SCSCR, ctrl & ~SCI_CTRL_FLAGS_TIE);
+        }
+
+        spin_unlock_irqrestore(&port->lock, flags);
 }
 
 /* Locking: called with port lock held */
@@ -972,13 +973,13 @@ static void sci_dma_rx_complete(void *arg)
         unsigned long flags;
         int count;
 
-        dev_dbg(port->dev, "%s(%d)\n", __func__, port->line);
+        dev_dbg(port->dev, "%s(%d) active #%d\n", __func__, port->line, s->active_rx);
 
         spin_lock_irqsave(&port->lock, flags);
 
         count = sci_dma_rx_push(s, tty, s->buf_len_rx);
 
-        mod_timer(&s->rx_timer, jiffies + msecs_to_jiffies(5));
+        mod_timer(&s->rx_timer, jiffies + s->rx_timeout);
 
         spin_unlock_irqrestore(&port->lock, flags);
 
@@ -1050,6 +1051,8 @@ static void sci_submit_rx(struct sci_port *s)
                         sci_rx_dma_release(s, true);
                         return;
                 }
+                dev_dbg(s->port.dev, "%s(): cookie %d to #%d\n", __func__,
+                        s->cookie_rx[i], i);
         }
 
         s->active_rx = s->cookie_rx[0];
@@ -1107,10 +1110,10 @@ static void work_fn_rx(struct work_struct *work)
                 return;
         }
 
-        dev_dbg(port->dev, "%s: cookie %d #%d\n", __func__,
-                s->cookie_rx[new], new);
-
         s->active_rx = s->cookie_rx[!new];
+
+        dev_dbg(port->dev, "%s: cookie %d #%d, new active #%d\n", __func__,
+                s->cookie_rx[new], new, s->active_rx);
 }
 
 static void work_fn_tx(struct work_struct *work)
@@ -1131,14 +1134,13 @@ static void work_fn_tx(struct work_struct *work)
          */
         spin_lock_irq(&port->lock);
         sg->offset = xmit->tail & (UART_XMIT_SIZE - 1);
-        sg->dma_address = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
+        sg_dma_address(sg) = (sg_dma_address(sg) & ~(UART_XMIT_SIZE - 1)) +
                 sg->offset;
-        sg->length = min((int)CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
+        sg_dma_len(sg) = min((int)CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
                 CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
-        sg->dma_length = sg->length;
         spin_unlock_irq(&port->lock);
 
-        BUG_ON(!sg->length);
+        BUG_ON(!sg_dma_len(sg));
 
         desc = chan->device->device_prep_slave_sg(chan,
                         sg, s->sg_len_tx, DMA_TO_DEVICE,
@@ -1173,23 +1175,28 @@ static void work_fn_tx(struct work_struct *work)
 
 static void sci_start_tx(struct uart_port *port)
 {
+        struct sci_port *s = to_sci_port(port);
         unsigned short ctrl;
 
 #ifdef CONFIG_SERIAL_SH_SCI_DMA
-        struct sci_port *s = to_sci_port(port);
-
-        if (s->chan_tx) {
-                if (!uart_circ_empty(&s->port.state->xmit) && s->cookie_tx < 0)
-                        schedule_work(&s->work_tx);
-
-                return;
+        if (port->type == PORT_SCIFA) {
+                u16 new, scr = sci_in(port, SCSCR);
+                if (s->chan_tx)
+                        new = scr | 0x8000;
+                else
+                        new = scr & ~0x8000;
+                if (new != scr)
+                        sci_out(port, SCSCR, new);
         }
+        if (s->chan_tx && !uart_circ_empty(&s->port.state->xmit) &&
+            s->cookie_tx < 0)
+                schedule_work(&s->work_tx);
 #endif
-
-        /* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
-        ctrl = sci_in(port, SCSCR);
-        ctrl |= SCI_CTRL_FLAGS_TIE;
-        sci_out(port, SCSCR, ctrl);
+        if (!s->chan_tx || port->type == PORT_SCIFA) {
+                /* Set TIE (Transmit Interrupt Enable) bit in SCSCR */
+                ctrl = sci_in(port, SCSCR);
+                sci_out(port, SCSCR, ctrl | SCI_CTRL_FLAGS_TIE);
+        }
 }
 
 static void sci_stop_tx(struct uart_port *port)
@@ -1198,6 +1205,8 @@ static void sci_stop_tx(struct uart_port *port)
 
         /* Clear TIE (Transmit Interrupt Enable) bit in SCSCR */
         ctrl = sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x8000;
         ctrl &= ~SCI_CTRL_FLAGS_TIE;
         sci_out(port, SCSCR, ctrl);
 }
@@ -1208,6 +1217,8 @@ static void sci_start_rx(struct uart_port *port)
 
         /* Set RIE (Receive Interrupt Enable) bit in SCSCR */
         ctrl |= sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x4000;
         sci_out(port, SCSCR, ctrl);
 }
 
@@ -1217,6 +1228,8 @@ static void sci_stop_rx(struct uart_port *port)
 
         /* Clear RIE (Receive Interrupt Enable) bit in SCSCR */
         ctrl = sci_in(port, SCSCR);
+        if (port->type == PORT_SCIFA)
+                ctrl &= ~0x4000;
         ctrl &= ~(SCI_CTRL_FLAGS_RIE | SCI_CTRL_FLAGS_REIE);
         sci_out(port, SCSCR, ctrl);
 }
@@ -1251,8 +1264,12 @@ static void rx_timer_fn(unsigned long arg)
 {
         struct sci_port *s = (struct sci_port *)arg;
         struct uart_port *port = &s->port;
-
         u16 scr = sci_in(port, SCSCR);
+
+        if (port->type == PORT_SCIFA) {
+                scr &= ~0x4000;
+                enable_irq(s->irqs[1]);
+        }
         sci_out(port, SCSCR, scr | SCI_CTRL_FLAGS_RIE);
         dev_dbg(port->dev, "DMA Rx timed out\n");
         schedule_work(&s->work_rx);
@@ -1339,8 +1356,7 @@ static void sci_request_dma(struct uart_port *port)
                         sg_init_table(sg, 1);
                         sg_set_page(sg, virt_to_page(buf[i]), s->buf_len_rx,
                                     (int)buf[i] & ~PAGE_MASK);
-                        sg->dma_address = dma[i];
-                        sg->dma_length = sg->length;
+                        sg_dma_address(sg) = dma[i];
                 }
 
                 INIT_WORK(&s->work_rx, work_fn_rx);
@@ -1403,8 +1419,12 @@ static void sci_shutdown(struct uart_port *port)
 static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
                             struct ktermios *old)
 {
+#ifdef CONFIG_SERIAL_SH_SCI_DMA
+        struct sci_port *s = to_sci_port(port);
+#endif
         unsigned int status, baud, smr_val, max_baud;
         int t = -1;
+        u16 scfcr = 0;
 
         /*
          * earlyprintk comes here early on with port->uartclk set to zero.
@@ -1427,7 +1447,7 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
         sci_out(port, SCSCR, 0x00);     /* TE=0, RE=0, CKE1=0 */
 
         if (port->type != PORT_SCI)
-                sci_out(port, SCFCR, SCFCR_RFRST | SCFCR_TFRST);
+                sci_out(port, SCFCR, scfcr | SCFCR_RFRST | SCFCR_TFRST);
 
         smr_val = sci_in(port, SCSMR) & 3;
         if ((termios->c_cflag & CSIZE) == CS7)
@@ -1458,10 +1478,32 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
         }
 
         sci_init_pins(port, termios->c_cflag);
-        sci_out(port, SCFCR, (termios->c_cflag & CRTSCTS) ? SCFCR_MCE : 0);
+        sci_out(port, SCFCR, scfcr | ((termios->c_cflag & CRTSCTS) ? SCFCR_MCE : 0));
 
         sci_out(port, SCSCR, SCSCR_INIT(port));
 
+#ifdef CONFIG_SERIAL_SH_SCI_DMA
+        /*
+         * Calculate delay for 1.5 DMA buffers: see
+         * drivers/serial/serial_core.c::uart_update_timeout(). With 10 bits
+         * (CS8), 250Hz, 115200 baud and 64 bytes FIFO, the above function
+         * calculates 1 jiffie for the data plus 5 jiffies for the "slop(e)."
+         * Then below we calculate 3 jiffies (12ms) for 1.5 DMA buffers (3 FIFO
+         * sizes), but it has been found out experimentally, that this is not
+         * enough: the driver too often needlessly runs on a DMA timeout. 20ms
+         * as a minimum seem to work perfectly.
+         */
+        if (s->chan_rx) {
+                s->rx_timeout = (port->timeout - HZ / 50) * s->buf_len_rx * 3 /
+                        port->fifosize / 2;
+                dev_dbg(port->dev,
+                        "DMA Rx t-out %ums, tty t-out %u jiffies\n",
+                        s->rx_timeout * 1000 / HZ, port->timeout);
+                if (s->rx_timeout < msecs_to_jiffies(20))
+                        s->rx_timeout = msecs_to_jiffies(20);
+        }
+#endif
+
         if ((termios->c_cflag & CREAD) != 0)
                 sci_start_rx(port);
 }
@@ -1553,10 +1595,10 @@ static struct uart_ops sci_uart_ops = {
 #endif
 };
 
-static void __devinit sci_init_single(struct platform_device *dev,
-                                      struct sci_port *sci_port,
-                                      unsigned int index,
-                                      struct plat_sci_port *p)
+static int __devinit sci_init_single(struct platform_device *dev,
+                                     struct sci_port *sci_port,
+                                     unsigned int index,
+                                     struct plat_sci_port *p)
 {
         struct uart_port *port = &sci_port->port;
 
@@ -1577,8 +1619,23 @@ static void __devinit sci_init_single(struct platform_device *dev,
         }
 
         if (dev) {
-                sci_port->iclk = p->clk ? clk_get(&dev->dev, p->clk) : NULL;
-                sci_port->dclk = clk_get(&dev->dev, "peripheral_clk");
+                sci_port->iclk = clk_get(&dev->dev, "sci_ick");
+                if (IS_ERR(sci_port->iclk)) {
+                        sci_port->iclk = clk_get(&dev->dev, "peripheral_clk");
+                        if (IS_ERR(sci_port->iclk)) {
+                                dev_err(&dev->dev, "can't get iclk\n");
+                                return PTR_ERR(sci_port->iclk);
+                        }
+                }
+
+                /*
+                 * The function clock is optional, ignore it if we can't
+                 * find it.
+                 */
+                sci_port->fclk = clk_get(&dev->dev, "sci_fck");
+                if (IS_ERR(sci_port->fclk))
+                        sci_port->fclk = NULL;
+
                 sci_port->enable = sci_clk_enable;
                 sci_port->disable = sci_clk_disable;
                 port->dev = &dev->dev;
@@ -1605,6 +1662,7 @@ static void __devinit sci_init_single(struct platform_device *dev,
 #endif
 
         memcpy(&sci_port->irqs, &p->irqs, sizeof(p->irqs));
+        return 0;
 }
 
 #ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
@@ -1754,8 +1812,11 @@ static int sci_remove(struct platform_device *dev)
         cpufreq_unregister_notifier(&priv->clk_nb, CPUFREQ_TRANSITION_NOTIFIER);
 
         spin_lock_irqsave(&priv->lock, flags);
-        list_for_each_entry(p, &priv->ports, node)
+        list_for_each_entry(p, &priv->ports, node) {
                 uart_remove_one_port(&sci_uart_driver, &p->port);
+                clk_put(p->iclk);
+                clk_put(p->fclk);
+        }
         spin_unlock_irqrestore(&priv->lock, flags);
 
         kfree(priv);
@@ -1781,7 +1842,9 @@ static int __devinit sci_probe_single(struct platform_device *dev,
                 return 0;
         }
 
-        sci_init_single(dev, sciport, index, p);
+        ret = sci_init_single(dev, sciport, index, p);
+        if (ret)
+                return ret;
 
         ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
         if (ret)
diff --git a/drivers/sh/Kconfig b/drivers/sh/Kconfig
new file mode 100644
index 000000000000..a54de0b9b3df
--- /dev/null
+++ b/drivers/sh/Kconfig
@@ -0,0 +1,24 @@
+config INTC_USERIMASK
+        bool "Userspace interrupt masking support"
+        depends on ARCH_SHMOBILE || (SUPERH && CPU_SH4A)
+        help
+          This enables support for hardware-assisted userspace hardirq
+          masking.
+
+          SH-4A and newer interrupt blocks all support a special shadowed
+          page with all non-masking registers obscured when mapped in to
+          userspace. This is primarily for use by userspace device
+          drivers that are using special priority levels.
+
+          If in doubt, say N.
+
+config INTC_BALANCING
+        bool "Hardware IRQ balancing support"
+        depends on SMP && SUPERH && CPU_SUBTYPE_SH7786
+        help
+          This enables support for IRQ auto-distribution mode on SH-X3
+          SMP parts. All of the balancing and CPU wakeup decisions are
+          taken care of automatically by hardware for distributed
+          vectors.
+
+          If in doubt, say N.
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index 4956bf1f2134..78bb5127abd0 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -4,4 +4,6 @@
 obj-$(CONFIG_SUPERHYWAY)        += superhyway/
 obj-$(CONFIG_MAPLE)             += maple/
 obj-$(CONFIG_GENERIC_GPIO)      += pfc.o
+obj-$(CONFIG_SUPERH)            += clk.o
+obj-$(CONFIG_SH_CLK_CPG)        += clk-cpg.o
 obj-y                           += intc.o
diff --git a/drivers/sh/clk-cpg.c b/drivers/sh/clk-cpg.c
new file mode 100644
index 000000000000..f5c80ba9ab1c
--- /dev/null
+++ b/drivers/sh/clk-cpg.c
@@ -0,0 +1,298 @@
+#include <linux/clk.h>
+#include <linux/compiler.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/sh_clk.h>
+
+static int sh_clk_mstp32_enable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) & ~(1 << clk->enable_bit),
+                     clk->enable_reg);
+        return 0;
+}
+
+static void sh_clk_mstp32_disable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) | (1 << clk->enable_bit),
+                     clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_mstp32_clk_ops = {
+        .enable         = sh_clk_mstp32_enable,
+        .disable        = sh_clk_mstp32_disable,
+        .recalc         = followparent_recalc,
+};
+
+int __init sh_clk_mstp32_register(struct clk *clks, int nr)
+{
+        struct clk *clkp;
+        int ret = 0;
+        int k;
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+                clkp->ops = &sh_clk_mstp32_clk_ops;
+                ret |= clk_register(clkp);
+        }
+
+        return ret;
+}
+
+static long sh_clk_div_round_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_rate_table_round(clk, clk->freq_table, rate);
+}
+
+static int sh_clk_div6_divisors[64] = {
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+        17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+        33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48,
+        49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64
+};
+
+static struct clk_div_mult_table sh_clk_div6_table = {
+        .divisors = sh_clk_div6_divisors,
+        .nr_divisors = ARRAY_SIZE(sh_clk_div6_divisors),
+};
+
+static unsigned long sh_clk_div6_recalc(struct clk *clk)
+{
+        struct clk_div_mult_table *table = &sh_clk_div6_table;
+        unsigned int idx;
+
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, NULL);
+
+        idx = __raw_readl(clk->enable_reg) & 0x003f;
+
+        return clk->freq_table[idx].frequency;
+}
+
+static int sh_clk_div6_set_rate(struct clk *clk,
+                                unsigned long rate, int algo_id)
+{
+        unsigned long value;
+        int idx;
+
+        idx = clk_rate_table_find(clk, clk->freq_table, rate);
+        if (idx < 0)
+                return idx;
+
+        value = __raw_readl(clk->enable_reg);
+        value &= ~0x3f;
+        value |= idx;
+        __raw_writel(value, clk->enable_reg);
+        return 0;
+}
+
+static int sh_clk_div6_enable(struct clk *clk)
+{
+        unsigned long value;
+        int ret;
+
+        ret = sh_clk_div6_set_rate(clk, clk->rate, 0);
+        if (ret == 0) {
+                value = __raw_readl(clk->enable_reg);
+                value &= ~0x100; /* clear stop bit to enable clock */
+                __raw_writel(value, clk->enable_reg);
+        }
+        return ret;
+}
+
+static void sh_clk_div6_disable(struct clk *clk)
+{
+        unsigned long value;
+
+        value = __raw_readl(clk->enable_reg);
+        value |= 0x100; /* stop clock */
+        value |= 0x3f; /* VDIV bits must be non-zero, overwrite divider */
+        __raw_writel(value, clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_div6_clk_ops = {
+        .recalc         = sh_clk_div6_recalc,
+        .round_rate     = sh_clk_div_round_rate,
+        .set_rate       = sh_clk_div6_set_rate,
+        .enable         = sh_clk_div6_enable,
+        .disable        = sh_clk_div6_disable,
+};
+
+int __init sh_clk_div6_register(struct clk *clks, int nr)
+{
+        struct clk *clkp;
+        void *freq_table;
+        int nr_divs = sh_clk_div6_table.nr_divisors;
+        int freq_table_size = sizeof(struct cpufreq_frequency_table);
+        int ret = 0;
+        int k;
+
+        freq_table_size *= (nr_divs + 1);
+        freq_table = kzalloc(freq_table_size * nr, GFP_KERNEL);
+        if (!freq_table) {
+                pr_err("sh_clk_div6_register: unable to alloc memory\n");
+                return -ENOMEM;
+        }
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+
+                clkp->ops = &sh_clk_div6_clk_ops;
+                clkp->id = -1;
+                clkp->freq_table = freq_table + (k * freq_table_size);
+                clkp->freq_table[nr_divs].frequency = CPUFREQ_TABLE_END;
+
+                ret = clk_register(clkp);
+        }
+
+        return ret;
+}
+
+static unsigned long sh_clk_div4_recalc(struct clk *clk)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        struct clk_div_mult_table *table = d4t->div_mult_table;
+        unsigned int idx;
+
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, &clk->arch_flags);
+
+        idx = (__raw_readl(clk->enable_reg) >> clk->enable_bit) & 0x000f;
+
+        return clk->freq_table[idx].frequency;
+}
+
+static int sh_clk_div4_set_parent(struct clk *clk, struct clk *parent)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        struct clk_div_mult_table *table = d4t->div_mult_table;
+        u32 value;
+        int ret;
+
+        /* we really need a better way to determine parent index, but for
+         * now assume internal parent comes with CLK_ENABLE_ON_INIT set,
+         * no CLK_ENABLE_ON_INIT means external clock...
+         */
+
+        if (parent->flags & CLK_ENABLE_ON_INIT)
+                value = __raw_readl(clk->enable_reg) & ~(1 << 7);
+        else
+                value = __raw_readl(clk->enable_reg) | (1 << 7);
+
+        ret = clk_reparent(clk, parent);
+        if (ret < 0)
+                return ret;
+
+        __raw_writel(value, clk->enable_reg);
+
+        /* Rebiuld the frequency table */
+        clk_rate_table_build(clk, clk->freq_table, table->nr_divisors,
+                             table, &clk->arch_flags);
+
+        return 0;
+}
+
+static int sh_clk_div4_set_rate(struct clk *clk, unsigned long rate, int algo_id)
+{
+        struct clk_div4_table *d4t = clk->priv;
+        unsigned long value;
+        int idx = clk_rate_table_find(clk, clk->freq_table, rate);
+        if (idx < 0)
+                return idx;
+
+        value = __raw_readl(clk->enable_reg);
+        value &= ~(0xf << clk->enable_bit);
+        value |= (idx << clk->enable_bit);
+        __raw_writel(value, clk->enable_reg);
+
+        if (d4t->kick)
+                d4t->kick(clk);
+
+        return 0;
+}
+
+static int sh_clk_div4_enable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) & ~(1 << 8), clk->enable_reg);
+        return 0;
+}
+
+static void sh_clk_div4_disable(struct clk *clk)
+{
+        __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
+}
+
+static struct clk_ops sh_clk_div4_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+};
+
+static struct clk_ops sh_clk_div4_enable_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+        .enable         = sh_clk_div4_enable,
+        .disable        = sh_clk_div4_disable,
+};
+
+static struct clk_ops sh_clk_div4_reparent_clk_ops = {
+        .recalc         = sh_clk_div4_recalc,
+        .set_rate       = sh_clk_div4_set_rate,
+        .round_rate     = sh_clk_div_round_rate,
+        .enable         = sh_clk_div4_enable,
+        .disable        = sh_clk_div4_disable,
+        .set_parent     = sh_clk_div4_set_parent,
+};
+
+static int __init sh_clk_div4_register_ops(struct clk *clks, int nr,
+                        struct clk_div4_table *table, struct clk_ops *ops)
+{
+        struct clk *clkp;
+        void *freq_table;
+        int nr_divs = table->div_mult_table->nr_divisors;
+        int freq_table_size = sizeof(struct cpufreq_frequency_table);
+        int ret = 0;
+        int k;
+
+        freq_table_size *= (nr_divs + 1);
+        freq_table = kzalloc(freq_table_size * nr, GFP_KERNEL);
+        if (!freq_table) {
+                pr_err("sh_clk_div4_register: unable to alloc memory\n");
+                return -ENOMEM;
+        }
+
+        for (k = 0; !ret && (k < nr); k++) {
+                clkp = clks + k;
+
+                clkp->ops = ops;
+                clkp->id = -1;
+                clkp->priv = table;
+
+                clkp->freq_table = freq_table + (k * freq_table_size);
+                clkp->freq_table[nr_divs].frequency = CPUFREQ_TABLE_END;
+
+                ret = clk_register(clkp);
+        }
+
+        return ret;
+}
+
+int __init sh_clk_div4_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table, &sh_clk_div4_clk_ops);
+}
+
+int __init sh_clk_div4_enable_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table,
+                                        &sh_clk_div4_enable_clk_ops);
+}
+
+int __init sh_clk_div4_reparent_register(struct clk *clks, int nr,
+                                struct clk_div4_table *table)
+{
+        return sh_clk_div4_register_ops(clks, nr, table,
+                                        &sh_clk_div4_reparent_clk_ops);
+}
diff --git a/drivers/sh/clk.c b/drivers/sh/clk.c
new file mode 100644
index 000000000000..5d84adac9ec4
--- /dev/null
+++ b/drivers/sh/clk.c
@@ -0,0 +1,545 @@
+/*
+ * drivers/sh/clk.c - SuperH clock framework
+ *
+ *  Copyright (C) 2005 - 2009  Paul Mundt
+ *
+ * This clock framework is derived from the OMAP version by:
+ *
+ *      Copyright (C) 2004 - 2008 Nokia Corporation
+ *      Written by Tuukka Tikkanen <tuukka.tikkanen@elektrobit.com>
+ *
+ *  Modified for omap shared clock framework by Tony Lindgren <tony@atomide.com>
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/kobject.h>
+#include <linux/sysdev.h>
+#include <linux/seq_file.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/debugfs.h>
+#include <linux/cpufreq.h>
+#include <linux/clk.h>
+#include <linux/sh_clk.h>
+
+static LIST_HEAD(clock_list);
+static DEFINE_SPINLOCK(clock_lock);
+static DEFINE_MUTEX(clock_list_sem);
+
+void clk_rate_table_build(struct clk *clk,
+                          struct cpufreq_frequency_table *freq_table,
+                          int nr_freqs,
+                          struct clk_div_mult_table *src_table,
+                          unsigned long *bitmap)
+{
+        unsigned long mult, div;
+        unsigned long freq;
+        int i;
+
+        for (i = 0; i < nr_freqs; i++) {
+                div = 1;
+                mult = 1;
+
+                if (src_table->divisors && i < src_table->nr_divisors)
+                        div = src_table->divisors[i];
+
+                if (src_table->multipliers && i < src_table->nr_multipliers)
+                        mult = src_table->multipliers[i];
+
+                if (!div || !mult || (bitmap && !test_bit(i, bitmap)))
+                        freq = CPUFREQ_ENTRY_INVALID;
+                else
+                        freq = clk->parent->rate * mult / div;
+
+                freq_table[i].index = i;
+                freq_table[i].frequency = freq;
+        }
+
+        /* Termination entry */
+        freq_table[i].index = i;
+        freq_table[i].frequency = CPUFREQ_TABLE_END;
+}
+
+long clk_rate_table_round(struct clk *clk,
+                          struct cpufreq_frequency_table *freq_table,
+                          unsigned long rate)
+{
+        unsigned long rate_error, rate_error_prev = ~0UL;
+        unsigned long rate_best_fit = rate;
+        unsigned long highest, lowest;
+        int i;
+
+        highest = lowest = 0;
+
+        for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++) {
+                unsigned long freq = freq_table[i].frequency;
+
+                if (freq == CPUFREQ_ENTRY_INVALID)
+                        continue;
+
+                if (freq > highest)
+                        highest = freq;
+                if (freq < lowest)
+                        lowest = freq;
+
+                rate_error = abs(freq - rate);
+                if (rate_error < rate_error_prev) {
+                        rate_best_fit = freq;
+                        rate_error_prev = rate_error;
+                }
+
+                if (rate_error == 0)
+                        break;
+        }
+
+        if (rate >= highest)
+                rate_best_fit = highest;
+        if (rate <= lowest)
+                rate_best_fit = lowest;
+
+        return rate_best_fit;
+}
+
+int clk_rate_table_find(struct clk *clk,
+                        struct cpufreq_frequency_table *freq_table,
+                        unsigned long rate)
+{
+        int i;
+
+        for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++) {
+                unsigned long freq = freq_table[i].frequency;
+
+                if (freq == CPUFREQ_ENTRY_INVALID)
+                        continue;
+
+                if (freq == rate)
+                        return i;
+        }
+
+        return -ENOENT;
+}
+
+/* Used for clocks that always have same value as the parent clock */
+unsigned long followparent_recalc(struct clk *clk)
+{
+        return clk->parent ? clk->parent->rate : 0;
+}
+
+int clk_reparent(struct clk *child, struct clk *parent)
+{
+        list_del_init(&child->sibling);
+        if (parent)
+                list_add(&child->sibling, &parent->children);
+        child->parent = parent;
+
+        /* now do the debugfs renaming to reattach the child
+           to the proper parent */
+
+        return 0;
+}
+
+/* Propagate rate to children */
+void propagate_rate(struct clk *tclk)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &tclk->children, sibling) {
+                if (clkp->ops && clkp->ops->recalc)
+                        clkp->rate = clkp->ops->recalc(clkp);
+
+                propagate_rate(clkp);
+        }
+}
+
+static void __clk_disable(struct clk *clk)
+{
+        if (WARN(!clk->usecount, "Trying to disable clock %s with 0 usecount\n",
+                 clk->name))
+                return;
+
+        if (!(--clk->usecount)) {
+                if (likely(clk->ops && clk->ops->disable))
+                        clk->ops->disable(clk);
+                if (likely(clk->parent))
+                        __clk_disable(clk->parent);
+        }
+}
+
+void clk_disable(struct clk *clk)
+{
+        unsigned long flags;
+
+        if (!clk)
+                return;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        __clk_disable(clk);
+        spin_unlock_irqrestore(&clock_lock, flags);
+}
+EXPORT_SYMBOL_GPL(clk_disable);
+
+static int __clk_enable(struct clk *clk)
+{
+        int ret = 0;
+
+        if (clk->usecount++ == 0) {
+                if (clk->parent) {
+                        ret = __clk_enable(clk->parent);
+                        if (unlikely(ret))
+                                goto err;
+                }
+
+                if (clk->ops && clk->ops->enable) {
+                        ret = clk->ops->enable(clk);
+                        if (ret) {
+                                if (clk->parent)
+                                        __clk_disable(clk->parent);
+                                goto err;
+                        }
+                }
+        }
+
+        return ret;
+err:
+        clk->usecount--;
+        return ret;
+}
+
+int clk_enable(struct clk *clk)
+{
+        unsigned long flags;
+        int ret;
+
+        if (!clk)
+                return -EINVAL;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        ret = __clk_enable(clk);
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_enable);
+
+static LIST_HEAD(root_clks);
+
+/**
+ * recalculate_root_clocks - recalculate and propagate all root clocks
+ *
+ * Recalculates all root clocks (clocks with no parent), which if the
+ * clock's .recalc is set correctly, should also propagate their rates.
+ * Called at init.
+ */
+void recalculate_root_clocks(void)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &root_clks, sibling) {
+                if (clkp->ops && clkp->ops->recalc)
+                        clkp->rate = clkp->ops->recalc(clkp);
+                propagate_rate(clkp);
+        }
+}
+
+int clk_register(struct clk *clk)
+{
+        if (clk == NULL || IS_ERR(clk))
+                return -EINVAL;
+
+        /*
+         * trap out already registered clocks
+         */
+        if (clk->node.next || clk->node.prev)
+                return 0;
+
+        mutex_lock(&clock_list_sem);
+
+        INIT_LIST_HEAD(&clk->children);
+        clk->usecount = 0;
+
+        if (clk->parent)
+                list_add(&clk->sibling, &clk->parent->children);
+        else
+                list_add(&clk->sibling, &root_clks);
+
+        list_add(&clk->node, &clock_list);
+        if (clk->ops && clk->ops->init)
+                clk->ops->init(clk);
+        mutex_unlock(&clock_list_sem);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(clk_register);
+
+void clk_unregister(struct clk *clk)
+{
+        mutex_lock(&clock_list_sem);
+        list_del(&clk->sibling);
+        list_del(&clk->node);
+        mutex_unlock(&clock_list_sem);
+}
+EXPORT_SYMBOL_GPL(clk_unregister);
+
+void clk_enable_init_clocks(void)
+{
+        struct clk *clkp;
+
+        list_for_each_entry(clkp, &clock_list, node)
+                if (clkp->flags & CLK_ENABLE_ON_INIT)
+                        clk_enable(clkp);
+}
+
+unsigned long clk_get_rate(struct clk *clk)
+{
+        return clk->rate;
+}
+EXPORT_SYMBOL_GPL(clk_get_rate);
+
+int clk_set_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_set_rate_ex(clk, rate, 0);
+}
+EXPORT_SYMBOL_GPL(clk_set_rate);
+
+int clk_set_rate_ex(struct clk *clk, unsigned long rate, int algo_id)
+{
+        int ret = -EOPNOTSUPP;
+        unsigned long flags;
+
+        spin_lock_irqsave(&clock_lock, flags);
+
+        if (likely(clk->ops && clk->ops->set_rate)) {
+                ret = clk->ops->set_rate(clk, rate, algo_id);
+                if (ret != 0)
+                        goto out_unlock;
+        } else {
+                clk->rate = rate;
+                ret = 0;
+        }
+
+        if (clk->ops && clk->ops->recalc)
+                clk->rate = clk->ops->recalc(clk);
+
+        propagate_rate(clk);
+
+out_unlock:
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_set_rate_ex);
+
+int clk_set_parent(struct clk *clk, struct clk *parent)
+{
+        unsigned long flags;
+        int ret = -EINVAL;
+
+        if (!parent || !clk)
+                return ret;
+        if (clk->parent == parent)
+                return 0;
+
+        spin_lock_irqsave(&clock_lock, flags);
+        if (clk->usecount == 0) {
+                if (clk->ops->set_parent)
+                        ret = clk->ops->set_parent(clk, parent);
+                else
+                        ret = clk_reparent(clk, parent);
+
+                if (ret == 0) {
+                        pr_debug("clock: set parent of %s to %s (new rate %ld)\n",
+                                 clk->name, clk->parent->name, clk->rate);
+                        if (clk->ops->recalc)
+                                clk->rate = clk->ops->recalc(clk);
+                        propagate_rate(clk);
+                }
+        } else
+                ret = -EBUSY;
+        spin_unlock_irqrestore(&clock_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(clk_set_parent);
+
+struct clk *clk_get_parent(struct clk *clk)
+{
+        return clk->parent;
+}
+EXPORT_SYMBOL_GPL(clk_get_parent);
+
+long clk_round_rate(struct clk *clk, unsigned long rate)
+{
+        if (likely(clk->ops && clk->ops->round_rate)) {
+                unsigned long flags, rounded;
+
+                spin_lock_irqsave(&clock_lock, flags);
+                rounded = clk->ops->round_rate(clk, rate);
+                spin_unlock_irqrestore(&clock_lock, flags);
+
+                return rounded;
+        }
+
+        return clk_get_rate(clk);
+}
+EXPORT_SYMBOL_GPL(clk_round_rate);
+
+#ifdef CONFIG_PM
+static int clks_sysdev_suspend(struct sys_device *dev, pm_message_t state)
+{
+        static pm_message_t prev_state;
+        struct clk *clkp;
+
+        switch (state.event) {
+        case PM_EVENT_ON:
+                /* Resumeing from hibernation */
+                if (prev_state.event != PM_EVENT_FREEZE)
+                        break;
+
+                list_for_each_entry(clkp, &clock_list, node) {
+                        if (likely(clkp->ops)) {
+                                unsigned long rate = clkp->rate;
+
+                                if (likely(clkp->ops->set_parent))
+                                        clkp->ops->set_parent(clkp,
+                                                clkp->parent);
+                                if (likely(clkp->ops->set_rate))
+                                        clkp->ops->set_rate(clkp,
+                                                rate, NO_CHANGE);
+                                else if (likely(clkp->ops->recalc))
+                                        clkp->rate = clkp->ops->recalc(clkp);
+                        }
+                }
+                break;
+        case PM_EVENT_FREEZE:
+                break;
+        case PM_EVENT_SUSPEND:
+                break;
+        }
+
+        prev_state = state;
+        return 0;
+}
+
+static int clks_sysdev_resume(struct sys_device *dev)
+{
+        return clks_sysdev_suspend(dev, PMSG_ON);
+}
+
+static struct sysdev_class clks_sysdev_class = {
+        .name = "clks",
+};
+
+static struct sysdev_driver clks_sysdev_driver = {
+        .suspend = clks_sysdev_suspend,
+        .resume = clks_sysdev_resume,
+};
+
+static struct sys_device clks_sysdev_dev = {
+        .cls = &clks_sysdev_class,
+};
+
+static int __init clk_sysdev_init(void)
+{
+        sysdev_class_register(&clks_sysdev_class);
+        sysdev_driver_register(&clks_sysdev_class, &clks_sysdev_driver);
+        sysdev_register(&clks_sysdev_dev);
+
+        return 0;
+}
+subsys_initcall(clk_sysdev_init);
+#endif
+
+/*
+ *      debugfs support to trace clock tree hierarchy and attributes
+ */
+static struct dentry *clk_debugfs_root;
+
+static int clk_debugfs_register_one(struct clk *c)
+{
+        int err;
+        struct dentry *d, *child, *child_tmp;
+        struct clk *pa = c->parent;
+        char s[255];
+        char *p = s;
+
+        p += sprintf(p, "%s", c->name);
+        if (c->id >= 0)
+                sprintf(p, ":%d", c->id);
+        d = debugfs_create_dir(s, pa ? pa->dentry : clk_debugfs_root);
+        if (!d)
+                return -ENOMEM;
+        c->dentry = d;
+
+        d = debugfs_create_u8("usecount", S_IRUGO, c->dentry, (u8 *)&c->usecount);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        d = debugfs_create_u32("rate", S_IRUGO, c->dentry, (u32 *)&c->rate);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        d = debugfs_create_x32("flags", S_IRUGO, c->dentry, (u32 *)&c->flags);
+        if (!d) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+        return 0;
+
+err_out:
+        d = c->dentry;
+        list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
+                debugfs_remove(child);
+        debugfs_remove(c->dentry);
+        return err;
+}
+
+static int clk_debugfs_register(struct clk *c)
+{
+        int err;
+        struct clk *pa = c->parent;
+
+        if (pa && !pa->dentry) {
+                err = clk_debugfs_register(pa);
+                if (err)
+                        return err;
+        }
+
+        if (!c->dentry && c->name) {
+                err = clk_debugfs_register_one(c);
+                if (err)
+                        return err;
+        }
+        return 0;
+}
+
+static int __init clk_debugfs_init(void)
+{
+        struct clk *c;
+        struct dentry *d;
+        int err;
+
+        d = debugfs_create_dir("clock", NULL);
+        if (!d)
+                return -ENOMEM;
+        clk_debugfs_root = d;
+
+        list_for_each_entry(c, &clock_list, node) {
+                err = clk_debugfs_register(c);
+                if (err)
+                        goto err_out;
+        }
+        return 0;
+err_out:
+        debugfs_remove_recursive(clk_debugfs_root);
+        return err;
+}
+late_initcall(clk_debugfs_init);
diff --git a/drivers/sh/intc.c b/drivers/sh/intc.c
index 94ad6bd86a00..c585574b9aed 100644
--- a/drivers/sh/intc.c
+++ b/drivers/sh/intc.c
@@ -28,6 +28,7 @@
 #include <linux/topology.h>
 #include <linux/bitmap.h>
 #include <linux/cpumask.h>
+#include <asm/sizes.h>
 
 #define _INTC_MK(fn, mode, addr_e, addr_d, width, shift) \
         ((shift) | ((width) << 5) | ((fn) << 9) | ((mode) << 13) | \
@@ -45,6 +46,12 @@ struct intc_handle_int {
         unsigned long handle;
 };
 
+struct intc_window {
+        phys_addr_t phys;
+        void __iomem *virt;
+        unsigned long size;
+};
+
 struct intc_desc_int {
         struct list_head list;
         struct sys_device sysdev;
@@ -58,6 +65,8 @@ struct intc_desc_int {
         unsigned int nr_prio;
         struct intc_handle_int *sense;
         unsigned int nr_sense;
+        struct intc_window *window;
+        unsigned int nr_windows;
         struct irq_chip chip;
 };
 
@@ -87,8 +96,12 @@ static DEFINE_SPINLOCK(vector_lock);
 #define SMP_NR(d, x) 1
 #endif
 
-static unsigned int intc_prio_level[NR_IRQS]; /* for now */
+static unsigned int intc_prio_level[NR_IRQS];   /* for now */
+static unsigned int default_prio_level = 2;     /* 2 - 16 */
 static unsigned long ack_handle[NR_IRQS];
+#ifdef CONFIG_INTC_BALANCING
+static unsigned long dist_handle[NR_IRQS];
+#endif
 
 static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
 {
@@ -96,6 +109,47 @@ static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
         return container_of(chip, struct intc_desc_int, chip);
 }
 
+static unsigned long intc_phys_to_virt(struct intc_desc_int *d,
+                                       unsigned long address)
+{
+        struct intc_window *window;
+        int k;
+
+        /* scan through physical windows and convert address */
+        for (k = 0; k < d->nr_windows; k++) {
+                window = d->window + k;
+
+                if (address < window->phys)
+                        continue;
+
+                if (address >= (window->phys + window->size))
+                        continue;
+
+                address -= window->phys;
+                address += (unsigned long)window->virt;
+
+                return address;
+        }
+
+        /* no windows defined, register must be 1:1 mapped virt:phys */
+        return address;
+}
+
+static unsigned int intc_get_reg(struct intc_desc_int *d, unsigned long address)
+{
+        unsigned int k;
+
+        address = intc_phys_to_virt(d, address);
+
+        for (k = 0; k < d->nr_reg; k++) {
+                if (d->reg[k] == address)
+                        return k;
+        }
+
+        BUG();
+        return 0;
+}
+
 static inline unsigned int set_field(unsigned int value,
                                      unsigned int field_value,
                                      unsigned int handle)
@@ -229,6 +283,85 @@ static void (*intc_disable_fns[])(unsigned long addr,
         [MODE_PCLR_REG] = intc_mode_field,
 };
 
+#ifdef CONFIG_INTC_BALANCING
+static inline void intc_balancing_enable(unsigned int irq)
+{
+        struct intc_desc_int *d = get_intc_desc(irq);
+        unsigned long handle = dist_handle[irq];
+        unsigned long addr;
+
+        if (irq_balancing_disabled(irq) || !handle)
+                return;
+
+        addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+        intc_reg_fns[_INTC_FN(handle)](addr, handle, 1);
+}
+
+static inline void intc_balancing_disable(unsigned int irq)
+{
+        struct intc_desc_int *d = get_intc_desc(irq);
+        unsigned long handle = dist_handle[irq];
+        unsigned long addr;
+
+        if (irq_balancing_disabled(irq) || !handle)
+                return;
+
+        addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
+        intc_reg_fns[_INTC_FN(handle)](addr, handle, 0);
+}
+
+static unsigned int intc_dist_data(struct intc_desc *desc,
+                                   struct intc_desc_int *d,
+                                   intc_enum enum_id)
+{
+        struct intc_mask_reg *mr = desc->hw.mask_regs;
+        unsigned int i, j, fn, mode;
+        unsigned long reg_e, reg_d;
+
+        for (i = 0; mr && enum_id && i < desc->hw.nr_mask_regs; i++) {
+                mr = desc->hw.mask_regs + i;
+
+                /*
+                 * Skip this entry if there's no auto-distribution
+                 * register associated with it.
+                 */
+                if (!mr->dist_reg)
+                        continue;
+
+                for (j = 0; j < ARRAY_SIZE(mr->enum_ids); j++) {
+                        if (mr->enum_ids[j] != enum_id)
+                                continue;
+
+                        fn = REG_FN_MODIFY_BASE;
+                        mode = MODE_ENABLE_REG;
+                        reg_e = mr->dist_reg;
+                        reg_d = mr->dist_reg;
+
+                        fn += (mr->reg_width >> 3) - 1;
+                        return _INTC_MK(fn, mode,
+                                        intc_get_reg(d, reg_e),
+                                        intc_get_reg(d, reg_d),
+                                        1,
+                                        (mr->reg_width - 1) - j);
+                }
+        }
+
+        /*
+         * It's possible we've gotten here with no distribution options
+         * available for the IRQ in question, so we just skip over those.
+         */
+        return 0;
+}
+#else
+static inline void intc_balancing_enable(unsigned int irq)
+{
+}
+
+static inline void intc_balancing_disable(unsigned int irq)
+{
+}
+#endif
+
 static inline void _intc_enable(unsigned int irq, unsigned long handle)
 {
         struct intc_desc_int *d = get_intc_desc(irq);
@@ -244,6 +377,8 @@ static inline void _intc_enable(unsigned int irq, unsigned long handle)
                 intc_enable_fns[_INTC_MODE(handle)](addr, handle, intc_reg_fns\
                                                     [_INTC_FN(handle)], irq);
         }
+
+        intc_balancing_enable(irq);
 }
 
 static void intc_enable(unsigned int irq)
@@ -254,10 +389,12 @@ static void intc_enable(unsigned int irq)
 static void intc_disable(unsigned int irq)
 {
         struct intc_desc_int *d = get_intc_desc(irq);
-        unsigned long handle = (unsigned long) get_irq_chip_data(irq);
+        unsigned long handle = (unsigned long)get_irq_chip_data(irq);
         unsigned long addr;
         unsigned int cpu;
 
+        intc_balancing_disable(irq);
+
         for (cpu = 0; cpu < SMP_NR(d, _INTC_ADDR_D(handle)); cpu++) {
 #ifdef CONFIG_SMP
                 if (!cpumask_test_cpu(cpu, irq_to_desc(irq)->affinity))
@@ -336,8 +473,7 @@ static void intc_mask_ack(unsigned int irq)
 
         intc_disable(irq);
 
-        /* read register and write zero only to the assocaited bit */
-
+        /* read register and write zero only to the associated bit */
         if (handle) {
                 addr = INTC_REG(d, _INTC_ADDR_D(handle), 0);
                 switch (_INTC_FN(handle)) {
@@ -366,7 +502,8 @@ static struct intc_handle_int *intc_find_irq(struct intc_handle_int *hp,
 {
         int i;
 
-        /* this doesn't scale well, but...
+        /*
+         * this doesn't scale well, but...
          *
          * this function should only be used for cerain uncommon
          * operations such as intc_set_priority() and intc_set_sense()
@@ -377,7 +514,6 @@ static struct intc_handle_int *intc_find_irq(struct intc_handle_int *hp,
          * memory footprint down is to make sure the array is sorted
          * and then perform a bisect to lookup the irq.
          */
-
         for (i = 0; i < nr_hp; i++) {
                 if ((hp + i)->irq != irq)
                         continue;
@@ -408,7 +544,6 @@ int intc_set_priority(unsigned int irq, unsigned int prio)
                  * primary masking method is using intc_prio_level[irq]
                  * priority level will be set during next enable()
                  */
-
                 if (_INTC_FN(ihp->handle) != REG_FN_ERR)
                         _intc_enable(irq, ihp->handle);
         }
@@ -447,20 +582,6 @@ static int intc_set_sense(unsigned int irq, unsigned int type)
         return 0;
 }
 
-static unsigned int __init intc_get_reg(struct intc_desc_int *d,
-                                 unsigned long address)
-{
-        unsigned int k;
-
-        for (k = 0; k < d->nr_reg; k++) {
-                if (d->reg[k] == address)
-                        return k;
-        }
-
-        BUG();
-        return 0;
-}
-
 static intc_enum __init intc_grp_id(struct intc_desc *desc,
                                     intc_enum enum_id)
 {
@@ -718,13 +839,14 @@ static void __init intc_register_irq(struct intc_desc *desc,
          */
         set_bit(irq, intc_irq_map);
 
-        /* Prefer single interrupt source bitmap over other combinations:
+        /*
+         * Prefer single interrupt source bitmap over other combinations:
+         *
          * 1. bitmap, single interrupt source
          * 2. priority, single interrupt source
          * 3. bitmap, multiple interrupt sources (groups)
          * 4. priority, multiple interrupt sources (groups)
          */
-
         data[0] = intc_mask_data(desc, d, enum_id, 0);
         data[1] = intc_prio_data(desc, d, enum_id, 0);
 
@@ -749,10 +871,11 @@ static void __init intc_register_irq(struct intc_desc *desc,
                                       handle_level_irq, "level");
         set_irq_chip_data(irq, (void *)data[primary]);
 
-        /* set priority level
+        /*
+         * set priority level
          * - this needs to be at least 2 for 5-bit priorities on 7780
          */
-        intc_prio_level[irq] = 2;
+        intc_prio_level[irq] = default_prio_level;
 
         /* enable secondary masking method if present */
         if (data[!primary])
@@ -769,7 +892,6 @@ static void __init intc_register_irq(struct intc_desc *desc,
                          * only secondary priority should access registers, so
                          * set _INTC_FN(h) = REG_FN_ERR for intc_set_priority()
                          */
-
                         hp->handle &= ~_INTC_MK(0x0f, 0, 0, 0, 0, 0);
                         hp->handle |= _INTC_MK(REG_FN_ERR, 0, 0, 0, 0, 0);
                 }
@@ -790,6 +912,11 @@ static void __init intc_register_irq(struct intc_desc *desc,
         if (desc->hw.ack_regs)
                 ack_handle[irq] = intc_ack_data(desc, d, enum_id);
 
+#ifdef CONFIG_INTC_BALANCING
+        if (desc->hw.mask_regs)
+                dist_handle[irq] = intc_dist_data(desc, d, enum_id);
+#endif
+
 #ifdef CONFIG_ARM
         set_irq_flags(irq, IRQF_VALID); /* Enable IRQ on ARM systems */
 #endif
@@ -801,6 +928,8 @@ static unsigned int __init save_reg(struct intc_desc_int *d,
                                     unsigned int smp)
 {
         if (value) {
+                value = intc_phys_to_virt(d, value);
+
                 d->reg[cnt] = value;
 #ifdef CONFIG_SMP
                 d->smp[cnt] = smp;
@@ -816,25 +945,59 @@ static void intc_redirect_irq(unsigned int irq, struct irq_desc *desc)
         generic_handle_irq((unsigned int)get_irq_data(irq));
 }
 
-void __init register_intc_controller(struct intc_desc *desc)
+int __init register_intc_controller(struct intc_desc *desc)
 {
         unsigned int i, k, smp;
         struct intc_hw_desc *hw = &desc->hw;
         struct intc_desc_int *d;
+        struct resource *res;
+
+        pr_info("intc: Registered controller '%s' with %u IRQs\n",
+                desc->name, hw->nr_vectors);
 
         d = kzalloc(sizeof(*d), GFP_NOWAIT);
+        if (!d)
+                goto err0;
 
         INIT_LIST_HEAD(&d->list);
         list_add(&d->list, &intc_list);
 
+        if (desc->num_resources) {
+                d->nr_windows = desc->num_resources;
+                d->window = kzalloc(d->nr_windows * sizeof(*d->window),
+                                    GFP_NOWAIT);
+                if (!d->window)
+                        goto err1;
+
+                for (k = 0; k < d->nr_windows; k++) {
+                        res = desc->resource + k;
+                        WARN_ON(resource_type(res) != IORESOURCE_MEM);
+                        d->window[k].phys = res->start;
+                        d->window[k].size = resource_size(res);
+                        d->window[k].virt = ioremap_nocache(res->start,
+                                                         resource_size(res));
+                        if (!d->window[k].virt)
+                                goto err2;
+                }
+        }
+
         d->nr_reg = hw->mask_regs ? hw->nr_mask_regs * 2 : 0;
+#ifdef CONFIG_INTC_BALANCING
+        if (d->nr_reg)
+                d->nr_reg += hw->nr_mask_regs;
+#endif
         d->nr_reg += hw->prio_regs ? hw->nr_prio_regs * 2 : 0;
         d->nr_reg += hw->sense_regs ? hw->nr_sense_regs : 0;
         d->nr_reg += hw->ack_regs ? hw->nr_ack_regs : 0;
 
         d->reg = kzalloc(d->nr_reg * sizeof(*d->reg), GFP_NOWAIT);
+        if (!d->reg)
+                goto err2;
+
 #ifdef CONFIG_SMP
         d->smp = kzalloc(d->nr_reg * sizeof(*d->smp), GFP_NOWAIT);
+        if (!d->smp)
+                goto err3;
 #endif
         k = 0;
 
@@ -843,12 +1006,17 @@ void __init register_intc_controller(struct intc_desc *desc)
                         smp = IS_SMP(hw->mask_regs[i]);
                         k += save_reg(d, k, hw->mask_regs[i].set_reg, smp);
                         k += save_reg(d, k, hw->mask_regs[i].clr_reg, smp);
+#ifdef CONFIG_INTC_BALANCING
+                        k += save_reg(d, k, hw->mask_regs[i].dist_reg, 0);
+#endif
                 }
         }
 
         if (hw->prio_regs) {
                 d->prio = kzalloc(hw->nr_vectors * sizeof(*d->prio),
                                   GFP_NOWAIT);
+                if (!d->prio)
+                        goto err4;
 
                 for (i = 0; i < hw->nr_prio_regs; i++) {
                         smp = IS_SMP(hw->prio_regs[i]);
@@ -860,6 +1028,8 @@ void __init register_intc_controller(struct intc_desc *desc)
         if (hw->sense_regs) {
                 d->sense = kzalloc(hw->nr_vectors * sizeof(*d->sense),
                                    GFP_NOWAIT);
+                if (!d->sense)
+                        goto err5;
 
                 for (i = 0; i < hw->nr_sense_regs; i++)
                         k += save_reg(d, k, hw->sense_regs[i].reg, 0);
@@ -906,7 +1076,7 @@ void __init register_intc_controller(struct intc_desc *desc)
 
                 irq_desc = irq_to_desc_alloc_node(irq, numa_node_id());
                 if (unlikely(!irq_desc)) {
-                        pr_info("can't get irq_desc for %d\n", irq);
+                        pr_err("can't get irq_desc for %d\n", irq);
                         continue;
                 }
 
@@ -926,7 +1096,7 @@ void __init register_intc_controller(struct intc_desc *desc)
                          */
                         irq_desc = irq_to_desc_alloc_node(irq2, numa_node_id());
                         if (unlikely(!irq_desc)) {
-                                pr_info("can't get irq_desc for %d\n", irq2);
+                                pr_err("can't get irq_desc for %d\n", irq2);
                                 continue;
                         }
 
@@ -942,8 +1112,100 @@ void __init register_intc_controller(struct intc_desc *desc)
         /* enable bits matching force_enable after registering irqs */
         if (desc->force_enable)
                 intc_enable_disable_enum(desc, d, desc->force_enable, 1);
+
+        return 0;
+err5:
+        kfree(d->prio);
+err4:
+#ifdef CONFIG_SMP
+        kfree(d->smp);
+err3:
+#endif
+        kfree(d->reg);
+err2:
+        for (k = 0; k < d->nr_windows; k++)
+                if (d->window[k].virt)
+                        iounmap(d->window[k].virt);
+
+        kfree(d->window);
+err1:
+        kfree(d);
+err0:
+        pr_err("unable to allocate INTC memory\n");
+
+        return -ENOMEM;
+}
+
+#ifdef CONFIG_INTC_USERIMASK
+static void __iomem *uimask;
+
+int register_intc_userimask(unsigned long addr)
+{
+        if (unlikely(uimask))
+                return -EBUSY;
+
+        uimask = ioremap_nocache(addr, SZ_4K);
+        if (unlikely(!uimask))
+                return -ENOMEM;
+
+        pr_info("intc: userimask support registered for levels 0 -> %d\n",
+                default_prio_level - 1);
+
+        return 0;
+}
+
+static ssize_t
+show_intc_userimask(struct sysdev_class *cls,
+                    struct sysdev_class_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", (__raw_readl(uimask) >> 4) & 0xf);
+}
+
+static ssize_t
+store_intc_userimask(struct sysdev_class *cls,
+                     struct sysdev_class_attribute *attr,
+                     const char *buf, size_t count)
+{
+        unsigned long level;
+
+        level = simple_strtoul(buf, NULL, 10);
+
+        /*
+         * Minimal acceptable IRQ levels are in the 2 - 16 range, but
+         * these are chomped so as to not interfere with normal IRQs.
+         *
+         * Level 1 is a special case on some CPUs in that it's not
+         * directly settable, but given that USERIMASK cuts off below a
+         * certain level, we don't care about this limitation here.
+         * Level 0 on the other hand equates to user masking disabled.
+         *
+         * We use default_prio_level as a cut off so that only special
+         * case opt-in IRQs can be mangled.
+         */
+        if (level >= default_prio_level)
+                return -EINVAL;
+
+        __raw_writel(0xa5 << 24 | level << 4, uimask);
+
+        return count;
 }
 
+static SYSDEV_CLASS_ATTR(userimask, S_IRUSR | S_IWUSR,
+                         show_intc_userimask, store_intc_userimask);
+#endif
+
+static ssize_t
+show_intc_name(struct sys_device *dev, struct sysdev_attribute *attr, char *buf)
+{
+        struct intc_desc_int *d;
+
+        d = container_of(dev, struct intc_desc_int, sysdev);
+
+        return sprintf(buf, "%s\n", d->chip.name);
+}
+
+static SYSDEV_ATTR(name, S_IRUGO, show_intc_name, NULL);
+
 static int intc_suspend(struct sys_device *dev, pm_message_t state)
 {
         struct intc_desc_int *d;
@@ -1003,19 +1265,28 @@ static int __init register_intc_sysdevs(void)
         int id = 0;
 
         error = sysdev_class_register(&intc_sysdev_class);
+#ifdef CONFIG_INTC_USERIMASK
+        if (!error && uimask)
+                error = sysdev_class_create_file(&intc_sysdev_class,
+                                                 &attr_userimask);
+#endif
         if (!error) {
                 list_for_each_entry(d, &intc_list, list) {
                         d->sysdev.id = id;
                         d->sysdev.cls = &intc_sysdev_class;
                         error = sysdev_register(&d->sysdev);
+                        if (error == 0)
+                                error = sysdev_create_file(&d->sysdev,
+                                                           &attr_name);
                         if (error)
                                 break;
+
                         id++;
                 }
         }
 
         if (error)
-                pr_warning("intc: sysdev registration error\n");
+                pr_err("intc: sysdev registration error\n");
 
         return error;
 }
@@ -1048,7 +1319,7 @@ unsigned int create_irq_nr(unsigned int irq_want, int node)
 
         desc = irq_to_desc_alloc_node(new, node);
         if (unlikely(!desc)) {
-                pr_info("can't get irq_desc for %d\n", new);
+                pr_err("can't get irq_desc for %d\n", new);
                 goto out_unlock;
         }
 
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index d8356af118a8..e0de0d0eedea 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -204,6 +204,7 @@ static inline void mcspi_write_chconf0(const struct spi_device *spi, u32 val)
 
         cs->chconf0 = val;
         mcspi_write_cs_reg(spi, OMAP2_MCSPI_CHCONF0, val);
+        mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHCONF0);
 }
 
 static void omap2_mcspi_set_dma_req(const struct spi_device *spi,
@@ -532,7 +533,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                         goto out;
                                 }
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "write-%d %04x\n",
+                                dev_dbg(&spi->dev, "write-%d %08x\n",
                                                 word_len, *tx);
 #endif
                                 __raw_writel(*tx++, tx_reg);
@@ -550,7 +551,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                         mcspi_write_chconf0(spi, l);
                                 *rx++ = __raw_readl(rx_reg);
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "read-%d %04x\n",
+                                dev_dbg(&spi->dev, "read-%d %08x\n",
                                                 word_len, *(rx - 1));
 #endif
                         }
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 36828358a4d8..e76b1afafe07 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -36,8 +36,7 @@
 #include <asm/delay.h>
 
 #include <mach/dma.h>
-#include <mach/regs-ssp.h>
-#include <mach/ssp.h>
+#include <plat/ssp.h>
 #include <mach/pxa2xx_spi.h>
 
 MODULE_AUTHOR("Stephen Street");
@@ -1318,14 +1317,14 @@ static int setup(struct spi_device *spi)
         /* NOTE:  PXA25x_SSP _could_ use external clocking ... */
         if (drv_data->ssp_type != PXA25x_SSP)
                 dev_dbg(&spi->dev, "%ld Hz actual, %s\n",
-                                clk_get_rate(ssp->clk)
-                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
-                                chip->enable_dma ? "DMA" : "PIO");
+                        clk_get_rate(ssp->clk)
+                                / (1 + ((chip->cr0 & SSCR0_SCR(0xfff)) >> 8)),
+                        chip->enable_dma ? "DMA" : "PIO");
         else
                 dev_dbg(&spi->dev, "%ld Hz actual, %s\n",
-                                clk_get_rate(ssp->clk) / 2
-                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
-                                chip->enable_dma ? "DMA" : "PIO");
+                        clk_get_rate(ssp->clk) / 2
+                                / (1 + ((chip->cr0 & SSCR0_SCR(0x0ff)) >> 8)),
+                        chip->enable_dma ? "DMA" : "PIO");
 
         if (spi->bits_per_word <= 8) {
                 chip->n_bytes = 1;
@@ -1466,7 +1465,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
 
         platform_info = dev->platform_data;
 
-        ssp = ssp_request(pdev->id, pdev->name);
+        ssp = pxa_ssp_request(pdev->id, pdev->name);
         if (ssp == NULL) {
                 dev_err(&pdev->dev, "failed to request SSP%d\n", pdev->id);
                 return -ENODEV;
@@ -1476,7 +1475,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
         master = spi_alloc_master(dev, sizeof(struct driver_data) + 16);
         if (!master) {
                 dev_err(&pdev->dev, "cannot alloc spi_master\n");
-                ssp_free(ssp);
+                pxa_ssp_free(ssp);
                 return -ENOMEM;
         }
         drv_data = spi_master_get_devdata(master);
@@ -1558,7 +1557,7 @@ static int __init pxa2xx_spi_probe(struct platform_device *pdev)
         write_SSCR1(SSCR1_RxTresh(RX_THRESH_DFLT) |
                                 SSCR1_TxTresh(TX_THRESH_DFLT),
                                 drv_data->ioaddr);
-        write_SSCR0(SSCR0_SerClkDiv(2)
+        write_SSCR0(SSCR0_SCR(2)
                         | SSCR0_Motorola
                         | SSCR0_DataSize(8),
                         drv_data->ioaddr);
@@ -1605,7 +1604,7 @@ out_error_irq_alloc:
 
 out_error_master_alloc:
         spi_master_put(master);
-        ssp_free(ssp);
+        pxa_ssp_free(ssp);
         return status;
 }
 
@@ -1649,7 +1648,7 @@ static int pxa2xx_spi_remove(struct platform_device *pdev)
         free_irq(ssp->irq, drv_data);
 
         /* Release SSP */
-        ssp_free(ssp);
+        pxa_ssp_free(ssp);
 
         /* Disconnect from the SPI framework */
         spi_unregister_master(drv_data->master);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9ffb0fdbd6fe..b3a1f9259b62 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -41,7 +41,7 @@ static void spidev_release(struct device *dev)
                 spi->master->cleanup(spi);
 
         spi_master_put(spi->master);
-        kfree(dev);
+        kfree(spi);
 }
 
 static ssize_t
@@ -257,6 +257,7 @@ int spi_add_device(struct spi_device *spi)
 {
         static DEFINE_MUTEX(spi_add_lock);
         struct device *dev = spi->master->dev.parent;
+        struct device *d;
         int status;
 
         /* Chipselects are numbered 0..max; validate. */
@@ -278,10 +279,11 @@ int spi_add_device(struct spi_device *spi)
          */
         mutex_lock(&spi_add_lock);
 
-        if (bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev))
-                        != NULL) {
+        d = bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev));
+        if (d != NULL) {
                 dev_err(dev, "chipselect %d already in use\n",
                                 spi->chip_select);
+                put_device(d);
                 status = -EBUSY;
                 goto done;
         }
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 80ff7d9e60de..bc9bdb277bec 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -490,7 +490,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                         break;
                 case SSB_BUSTYPE_PCMCIA:
 #ifdef CONFIG_SSB_PCMCIAHOST
-                        sdev->irq = bus->host_pcmcia->irq.AssignedIRQ;
+                        sdev->irq = bus->host_pcmcia->irq;
                         dev->parent = &bus->host_pcmcia->dev;
 #endif
                         break;
diff --git a/drivers/staging/comedi/drivers/cb_das16_cs.c b/drivers/staging/comedi/drivers/cb_das16_cs.c
index 5632991760af..30b522c0bf2c 100644
--- a/drivers/staging/comedi/drivers/cb_das16_cs.c
+++ b/drivers/staging/comedi/drivers/cb_das16_cs.c
@@ -180,12 +180,12 @@ static int das16cs_attach(struct comedi_device *dev,
         }
         printk("\n");
 
-        ret = request_irq(link->irq.AssignedIRQ, das16cs_interrupt,
+        ret = request_irq(link->irq, das16cs_interrupt,
                           IRQF_SHARED, "cb_das16_cs", dev);
         if (ret < 0) {
                 return ret;
         }
-        dev->irq = link->irq.AssignedIRQ;
+        dev->irq = link->irq;
         printk("irq=%u ", dev->irq);
 
         dev->board_ptr = das16cs_probe(dev, link);
@@ -671,7 +671,6 @@ static dev_info_t dev_info = "cb_das16_cs";
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         struct bus_operations *bus;
 };
@@ -702,10 +701,6 @@ static int das16cs_pcmcia_attach(struct pcmcia_device *link)
         link->priv = local;
 
         /* Initialize the pcmcia_device structure */
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = NULL;
-
         link->conf.Attributes = 0;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -720,10 +715,8 @@ static void das16cs_pcmcia_detach(struct pcmcia_device *link)
 {
         dev_dbg(&link->dev, "das16cs_pcmcia_detach\n");
 
-        if (link->dev_node) {
-                ((struct local_info_t *)link->priv)->stop = 1;
-                das16cs_pcmcia_release(link);
-        }
+        ((struct local_info_t *)link->priv)->stop = 1;
+        das16cs_pcmcia_release(link);
         /* This points to the parent struct local_info_t struct */
         if (link->priv)
                 kfree(link->priv);
@@ -740,8 +733,7 @@ static int das16cs_pcmcia_config_loop(struct pcmcia_device *p_dev,
                 return -EINVAL;
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -769,7 +761,6 @@ static int das16cs_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void das16cs_pcmcia_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         int ret;
 
         dev_dbg(&link->dev, "das16cs_pcmcia_config\n");
@@ -780,16 +771,9 @@ static void das16cs_pcmcia_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-           Allocate an interrupt line.  Note that this does not assign a
-           handler to the interrupt, unless the 'Handler' member of the
-           irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
+
         /*
            This actually configures the PCMCIA socket -- setting up
            the I/O windows and the interrupt mapping, and putting the
@@ -799,19 +783,10 @@ static void das16cs_pcmcia_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        sprintf(dev->node.dev_name, "cb_das16_cs");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %u", link->irq.AssignedIRQ);
+                printk(", irq %u", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/comedi/drivers/das08_cs.c b/drivers/staging/comedi/drivers/das08_cs.c
index 9164ce158dcd..896d25bc85b5 100644
--- a/drivers/staging/comedi/drivers/das08_cs.c
+++ b/drivers/staging/comedi/drivers/das08_cs.c
@@ -142,7 +142,6 @@ static const dev_info_t dev_info = "pcm-das08";
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         struct bus_operations *bus;
 };
@@ -172,10 +171,6 @@ static int das08_pcmcia_attach(struct pcmcia_device *link)
         local->link = link;
         link->priv = local;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-        link->irq.Handler = NULL;
-
         /*
            General socket configuration defaults can go here.  In this
            client, we assume very little, and rely on the CIS for almost
@@ -207,10 +202,8 @@ static void das08_pcmcia_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "das08_pcmcia_detach\n");
 
-        if (link->dev_node) {
-                ((struct local_info_t *)link->priv)->stop = 1;
-                das08_pcmcia_release(link);
-        }
+        ((struct local_info_t *)link->priv)->stop = 1;
+        das08_pcmcia_release(link);
 
         /* This points to the parent struct local_info_t struct */
         if (link->priv)
@@ -229,8 +222,7 @@ static int das08_pcmcia_config_loop(struct pcmcia_device *p_dev,
                 return -ENODEV;
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -266,7 +258,6 @@ static int das08_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void das08_pcmcia_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         int ret;
 
         dev_dbg(&link->dev, "das08_pcmcia_config\n");
@@ -277,11 +268,8 @@ static void das08_pcmcia_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
 
         /*
            This actually configures the PCMCIA socket -- setting up
@@ -292,19 +280,10 @@ static void das08_pcmcia_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        sprintf(dev->node.dev_name, "pcm-das08");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %u", link->irq.AssignedIRQ);
+                printk(", irq %u", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c
index 7ea64538e055..06dd44ff1a95 100644
--- a/drivers/staging/comedi/drivers/ni_daq_700.c
+++ b/drivers/staging/comedi/drivers/ni_daq_700.c
@@ -380,7 +380,7 @@ static int dio700_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                         return -EIO;
                 iobase = link->io.BasePort1;
 #ifdef incomplete
-                irq = link->irq.AssignedIRQ;
+                irq = link->irq;
 #endif
                 break;
         default:
@@ -470,7 +470,6 @@ static const dev_info_t dev_info = "ni_daq_700";
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         struct bus_operations *bus;
 };
@@ -502,10 +501,6 @@ static int dio700_cs_attach(struct pcmcia_device *link)
         local->link = link;
         link->priv = local;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = NULL;
-
         /*
            General socket configuration defaults can go here.  In this
            client, we assume very little, and rely on the CIS for almost
@@ -539,10 +534,8 @@ static void dio700_cs_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "dio700_cs_detach\n");
 
-        if (link->dev_node) {
-                ((struct local_info_t *)link->priv)->stop = 1;
-                dio700_release(link);
-        }
+        ((struct local_info_t *)link->priv)->stop = 1;
+        dio700_release(link);
 
         /* This points to the parent struct local_info_t struct */
         if (link->priv)
@@ -577,8 +570,7 @@ static int dio700_pcmcia_config_loop(struct pcmcia_device *p_dev,
         }
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -625,7 +617,6 @@ static int dio700_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void dio700_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         win_req_t req;
         int ret;
 
@@ -639,16 +630,8 @@ static void dio700_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-           Allocate an interrupt line.  Note that this does not assign a
-           handler to the interrupt, unless the 'Handler' member of the
-           irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
 
         /*
            This actually configures the PCMCIA socket -- setting up
@@ -659,19 +642,10 @@ static void dio700_config(struct pcmcia_device *link)
         if (ret != 0)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        sprintf(dev->node.dev_name, "ni_daq_700");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %d", link->irq.AssignedIRQ);
+                printk(", irq %d", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/comedi/drivers/ni_daq_dio24.c b/drivers/staging/comedi/drivers/ni_daq_dio24.c
index ddc312b5d20d..7bfe08b01fe9 100644
--- a/drivers/staging/comedi/drivers/ni_daq_dio24.c
+++ b/drivers/staging/comedi/drivers/ni_daq_dio24.c
@@ -131,7 +131,7 @@ static int dio24_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                         return -EIO;
                 iobase = link->io.BasePort1;
 #ifdef incomplete
-                irq = link->irq.AssignedIRQ;
+                irq = link->irq;
 #endif
                 break;
         default:
@@ -221,7 +221,6 @@ static const dev_info_t dev_info = "ni_daq_dio24";
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         struct bus_operations *bus;
 };
@@ -253,10 +252,6 @@ static int dio24_cs_attach(struct pcmcia_device *link)
         local->link = link;
         link->priv = local;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = NULL;
-
         /*
            General socket configuration defaults can go here.  In this
            client, we assume very little, and rely on the CIS for almost
@@ -290,10 +285,8 @@ static void dio24_cs_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "dio24_cs_detach\n");
 
-        if (link->dev_node) {
-                ((struct local_info_t *)link->priv)->stop = 1;
-                dio24_release(link);
-        }
+        ((struct local_info_t *)link->priv)->stop = 1;
+        dio24_release(link);
 
         /* This points to the parent local_info_t struct */
         if (link->priv)
@@ -328,8 +321,7 @@ static int dio24_pcmcia_config_loop(struct pcmcia_device *p_dev,
         }
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -376,7 +368,6 @@ static int dio24_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void dio24_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         int ret;
         win_req_t req;
 
@@ -390,16 +381,8 @@ static void dio24_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-           Allocate an interrupt line.  Note that this does not assign a
-           handler to the interrupt, unless the 'Handler' member of the
-           irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
 
         /*
            This actually configures the PCMCIA socket -- setting up
@@ -410,19 +393,10 @@ static void dio24_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        sprintf(dev->node.dev_name, "ni_daq_dio24");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %d", link->irq.AssignedIRQ);
+                printk(", irq %d", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/comedi/drivers/ni_labpc_cs.c b/drivers/staging/comedi/drivers/ni_labpc_cs.c
index 8ad1055a5cc1..fd8d3e9520a0 100644
--- a/drivers/staging/comedi/drivers/ni_labpc_cs.c
+++ b/drivers/staging/comedi/drivers/ni_labpc_cs.c
@@ -144,7 +144,7 @@ static int labpc_attach(struct comedi_device *dev, struct comedi_devconfig *it)
                 if (!link)
                         return -EIO;
                 iobase = link->io.BasePort1;
-                irq = link->irq.AssignedIRQ;
+                irq = link->irq;
                 break;
         default:
                 printk("bug! couldn't determine board type\n");
@@ -199,7 +199,6 @@ static const dev_info_t dev_info = "daqcard-1200";
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         struct bus_operations *bus;
 };
@@ -229,10 +228,6 @@ static int labpc_cs_attach(struct pcmcia_device *link)
         local->link = link;
         link->priv = local;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_FORCED_PULSE;
-        link->irq.Handler = NULL;
-
         /*
            General socket configuration defaults can go here.  In this
            client, we assume very little, and rely on the CIS for almost
@@ -269,10 +264,8 @@ static void labpc_cs_detach(struct pcmcia_device *link)
            the release() function is called, that will trigger a proper
            detach().
          */
-        if (link->dev_node) {
-                ((struct local_info_t *)link->priv)->stop = 1;
-                labpc_release(link);
-        }
+        ((struct local_info_t *)link->priv)->stop = 1;
+        labpc_release(link);
 
         /* This points to the parent local_info_t struct (may be null) */
         kfree(link->priv);
@@ -306,8 +299,7 @@ static int labpc_pcmcia_config_loop(struct pcmcia_device *p_dev,
         }
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ | CONF_ENABLE_PULSE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -355,7 +347,6 @@ static int labpc_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void labpc_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         int ret;
         win_req_t req;
 
@@ -367,16 +358,8 @@ static void labpc_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-           Allocate an interrupt line.  Note that this does not assign a
-           handler to the interrupt, unless the 'Handler' member of the
-           irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        if (!link->irq)
+                goto failed;
 
         /*
            This actually configures the PCMCIA socket -- setting up
@@ -387,19 +370,10 @@ static void labpc_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        sprintf(dev->node.dev_name, "daqcard-1200");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %d", link->irq.AssignedIRQ);
+                printk(", irq %d", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/comedi/drivers/ni_mio_cs.c b/drivers/staging/comedi/drivers/ni_mio_cs.c
index dc4849a40c97..1e8aebae8ae8 100644
--- a/drivers/staging/comedi/drivers/ni_mio_cs.c
+++ b/drivers/staging/comedi/drivers/ni_mio_cs.c
@@ -262,17 +262,11 @@ static void cs_detach(struct pcmcia_device *);
 
 static struct pcmcia_device *cur_dev = NULL;
 static const dev_info_t dev_info = "ni_mio_cs";
-static dev_node_t dev_node = {
-        "ni_mio_cs",
-        COMEDI_MAJOR, 0,
-        NULL
-};
 
 static int cs_attach(struct pcmcia_device *link)
 {
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
         link->io.NumPorts1 = 16;
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
@@ -292,8 +286,7 @@ static void cs_detach(struct pcmcia_device *link)
 {
         DPRINTK("cs_detach(link=%p)\n", link);
 
-        if (link->dev_node)
-                cs_release(link);
+        cs_release(link);
 }
 
 static int mio_cs_suspend(struct pcmcia_device *link)
@@ -344,14 +337,10 @@ static void mio_cs_config(struct pcmcia_device *link)
                 return;
         }
 
-        ret = pcmcia_request_irq(link, &link->irq);
-        if (ret) {
-                printk("pcmcia_request_irq() returned error: %i\n", ret);
-        }
+        if (!link->irq)
+                dev_info(&link->dev, "no IRQ available\n");
 
         ret = pcmcia_request_configuration(link, &link->conf);
-
-        link->dev_node = &dev_node;
 }
 
 static int mio_cs_attach(struct comedi_device *dev, struct comedi_devconfig *it)
@@ -369,7 +358,7 @@ static int mio_cs_attach(struct comedi_device *dev, struct comedi_devconfig *it)
         dev->driver = &driver_ni_mio_cs;
         dev->iobase = link->io.BasePort1;
 
-        irq = link->irq.AssignedIRQ;
+        irq = link->irq;
 
         printk("comedi%d: %s: DAQCard: io 0x%04lx, irq %u, ",
                dev->minor, dev->driver->driver_name, dev->iobase, irq);
diff --git a/drivers/staging/comedi/drivers/quatech_daqp_cs.c b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
index 3325f24448b5..1786db2f3378 100644
--- a/drivers/staging/comedi/drivers/quatech_daqp_cs.c
+++ b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
@@ -60,7 +60,6 @@ Devices: [Quatech] DAQP-208 (daqp), DAQP-308
 
 struct local_info_t {
         struct pcmcia_device *link;
-        dev_node_t node;
         int stop;
         int table_index;
         char board_name[32];
@@ -1040,10 +1039,6 @@ static int daqp_cs_attach(struct pcmcia_device *link)
         local->link = link;
         link->priv = local;
 
-        /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-        link->irq.Handler = daqp_interrupt;
-
         /*
            General socket configuration defaults can go here.  In this
            client, we assume very little, and rely on the CIS for almost
@@ -1074,10 +1069,8 @@ static void daqp_cs_detach(struct pcmcia_device *link)
 
         dev_dbg(&link->dev, "daqp_cs_detach\n");
 
-        if (link->dev_node) {
-                dev->stop = 1;
-                daqp_cs_release(link);
-        }
+        dev->stop = 1;
+        daqp_cs_release(link);
 
         /* Unlink device structure, and free it */
         dev_table[dev->table_index] = NULL;
@@ -1105,8 +1098,7 @@ static int daqp_pcmcia_config_loop(struct pcmcia_device *p_dev,
                 return -ENODEV;
 
         /* Do we need to allocate an interrupt? */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -1133,7 +1125,6 @@ static int daqp_pcmcia_config_loop(struct pcmcia_device *p_dev,
 
 static void daqp_cs_config(struct pcmcia_device *link)
 {
-        struct local_info_t *dev = link->priv;
         int ret;
 
         dev_dbg(&link->dev, "daqp_cs_config\n");
@@ -1144,16 +1135,9 @@ static void daqp_cs_config(struct pcmcia_device *link)
                 goto failed;
         }
 
-        /*
-           Allocate an interrupt line.  Note that this does not assign a
-           handler to the interrupt, unless the 'Handler' member of the
-           irq structure is initialized.
-         */
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        }
+        ret = pcmcia_request_irq(link, daqp_interrupt);
+        if (ret)
+                goto failed;
 
         /*
            This actually configures the PCMCIA socket -- setting up
@@ -1164,23 +1148,10 @@ static void daqp_cs_config(struct pcmcia_device *link)
         if (ret)
                 goto failed;
 
-        /*
-           At this point, the dev_node_t structure(s) need to be
-           initialized and arranged in a linked list at link->dev.
-         */
-        /* Comedi's PCMCIA script uses this device name (extracted
-         * from /var/lib/pcmcia/stab) to pass to comedi_config
-         */
-        /* sprintf(dev->node.dev_name, "daqp%d", dev->table_index); */
-        sprintf(dev->node.dev_name, "quatech_daqp_cs");
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x", link->conf.ConfigIndex);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                printk(", irq %u", link->irq.AssignedIRQ);
+                printk(", irq %u", link->irq);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                        link->io.BasePort1 + link->io.NumPorts1 - 1);
diff --git a/drivers/staging/dt3155/dt3155_drv.c b/drivers/staging/dt3155/dt3155_drv.c
index e2c44ec6fc45..7ac2c6d8e9a3 100644
--- a/drivers/staging/dt3155/dt3155_drv.c
+++ b/drivers/staging/dt3155/dt3155_drv.c
@@ -464,9 +464,9 @@ static void dt3155_init_isr(int minor)
   /* 50/60 Hz should be set before this point but let's make sure it is */
   /* right anyway */
 
-  ReadI2C(dt3155_lbase[ minor ], CONFIG, &i2c_csr2.reg);
+  ReadI2C(dt3155_lbase[ minor ], CSR2, &i2c_csr2.reg);
   i2c_csr2.fld.HZ50 = FORMAT50HZ;
-  WriteI2C(dt3155_lbase[ minor ], CONFIG, i2c_config.reg);
+  WriteI2C(dt3155_lbase[ minor ], CSR2, i2c_csr2.reg);
 
   /* enable busmaster chip, clear flags */
 
diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
index 5d53889fb4a4..3a1112d29aeb 100644
--- a/drivers/staging/hv/Hv.c
+++ b/drivers/staging/hv/Hv.c
@@ -306,9 +306,9 @@ void HvCleanup(void)
         DPRINT_ENTER(VMBUS);
 
         if (gHvContext.SignalEventBuffer) {
+                kfree(gHvContext.SignalEventBuffer);
                 gHvContext.SignalEventBuffer = NULL;
                 gHvContext.SignalEventParam = NULL;
-                kfree(gHvContext.SignalEventBuffer);
         }
 
         if (gHvContext.HypercallPage) {
diff --git a/drivers/staging/hv/RndisFilter.c b/drivers/staging/hv/RndisFilter.c
index cd2930de2176..6704f64c93f0 100644
--- a/drivers/staging/hv/RndisFilter.c
+++ b/drivers/staging/hv/RndisFilter.c
@@ -751,6 +751,7 @@ static int RndisFilterOpenDevice(struct rndis_device *Device)
 
         ret = RndisFilterSetPacketFilter(Device,
                                          NDIS_PACKET_TYPE_BROADCAST |
+                                         NDIS_PACKET_TYPE_ALL_MULTICAST |
                                          NDIS_PACKET_TYPE_DIRECTED);
         if (ret == 0)
                 Device->State = RNDIS_DEV_DATAINITIALIZED;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 2ccb6b93fe47..ab27d9a4446d 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -403,8 +403,7 @@ static int netvsc_probe(struct device *device)
         if (!net_drv_obj->Base.OnDeviceAdd)
                 return -1;
 
-        net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
-                           ether_setup);
+        net = alloc_etherdev(sizeof(struct net_device_context));
         if (!net)
                 return -1;
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_core.c b/drivers/staging/iio/accel/lis3l02dq_core.c
index ea76902797bb..82e43588e8a5 100644
--- a/drivers/staging/iio/accel/lis3l02dq_core.c
+++ b/drivers/staging/iio/accel/lis3l02dq_core.c
@@ -618,7 +618,7 @@ static int lis3l02dq_thresh_handler_th(struct iio_dev *dev_info,
 static void lis3l02dq_thresh_handler_bh_no_check(struct work_struct *work_s)
 {
         struct iio_work_cont *wc
-                = container_of(work_s, struct iio_work_cont, ws_nocheck);
+                = container_of(work_s, struct iio_work_cont, ws);
         struct lis3l02dq_state *st = wc->st;
         u8 t;
 
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 93712430e579..a4d97ea0df3d 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -493,6 +493,9 @@ int lis3l02dq_probe_trigger(struct iio_dev *indio_dev)
         struct lis3l02dq_state *state = indio_dev->dev_data;
 
         state->trig = iio_allocate_trigger();
+        if (!state->trig)
+                return -ENOMEM;
+
         state->trig->name = kmalloc(IIO_TRIGGER_NAME_LENGTH, GFP_KERNEL);
         if (!state->trig->name) {
                 ret = -ENOMEM;
diff --git a/drivers/staging/iio/adc/max1363_core.c b/drivers/staging/iio/adc/max1363_core.c
index 790d1cc9cdc3..773f1d1d9c6e 100644
--- a/drivers/staging/iio/adc/max1363_core.c
+++ b/drivers/staging/iio/adc/max1363_core.c
@@ -557,6 +557,7 @@ error_put_reg:
         if (!IS_ERR(st->reg))
                 regulator_put(st->reg);
 error_free_st:
+        i2c_set_clientdata(client, NULL);
         kfree(st);
 
 error_ret:
@@ -574,6 +575,7 @@ static int max1363_remove(struct i2c_client *client)
                 regulator_disable(st->reg);
                 regulator_put(st->reg);
         }
+        i2c_set_clientdata(client, NULL);
         kfree(st);
 
         return 0;
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
index 37f58f66e491..1d77082c8531 100644
--- a/drivers/staging/iio/industrialio-core.c
+++ b/drivers/staging/iio/industrialio-core.c
@@ -537,6 +537,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *dev_info)
         sysfs_remove_group(&dev_info->dev.kobj, dev_info->attrs);
 }
 
+/* Return a negative errno on failure */
 int iio_get_new_idr_val(struct idr *this_idr)
 {
         int ret;
@@ -660,7 +661,7 @@ static int iio_device_register_eventset(struct iio_dev *dev_info)
         for (i = 0; i < dev_info->num_interrupt_lines; i++) {
                 dev_info->event_interfaces[i].owner = dev_info->driver_module;
                 ret = iio_get_new_idr_val(&iio_event_idr);
-                if (ret)
+                if (ret < 0)
                         goto error_free_setup_ev_ints;
                 else
                         dev_info->event_interfaces[i].id = ret;
diff --git a/drivers/staging/iio/light/tsl2563.c b/drivers/staging/iio/light/tsl2563.c
index 1ba4aa392f6e..8770a00e3652 100644
--- a/drivers/staging/iio/light/tsl2563.c
+++ b/drivers/staging/iio/light/tsl2563.c
@@ -682,6 +682,7 @@ static int __devinit tsl2563_probe(struct i2c_client *client,
 fail2:
         iio_device_unregister(chip->indio_dev);
 fail1:
+        i2c_set_clientdata(client, NULL);
         kfree(chip);
         return err;
 }
@@ -692,6 +693,7 @@ static int tsl2563_remove(struct i2c_client *client)
 
         iio_device_unregister(chip->indio_dev);
 
+        i2c_set_clientdata(client, NULL);
         kfree(chip);
         return 0;
 }
diff --git a/drivers/staging/iio/ring_sw.c b/drivers/staging/iio/ring_sw.c
index b104c3d9c35e..cf22c091668c 100644
--- a/drivers/staging/iio/ring_sw.c
+++ b/drivers/staging/iio/ring_sw.c
@@ -293,7 +293,7 @@ again:
                 return -EAGAIN;
         memcpy(data, last_written_p_copy, ring->buf.bpd);
 
-        if (unlikely(ring->last_written_p >= last_written_p_copy))
+        if (unlikely(ring->last_written_p != last_written_p_copy))
                 goto again;
 
         iio_unmark_sw_rb_in_use(&ring->buf);
diff --git a/drivers/staging/netwave/netwave_cs.c b/drivers/staging/netwave/netwave_cs.c
index 3875a722d12b..f1ee2cbc8407 100644
--- a/drivers/staging/netwave/netwave_cs.c
+++ b/drivers/staging/netwave/netwave_cs.c
@@ -61,7 +61,6 @@
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ds.h>
-#include <pcmcia/mem_op.h>
 
 #include <asm/system.h>
 #include <asm/io.h>
@@ -382,10 +381,6 @@ static int netwave_probe(struct pcmcia_device *link)
        link->io.Attributes2 = IO_DATA_PATH_WIDTH_16; */
     link->io.IOAddrLines = 5;
     
-    /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-    link->irq.Handler = &netwave_interrupt;
-    
     /* General socket configuration */
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
@@ -732,7 +727,7 @@ static int netwave_pcmcia_config(struct pcmcia_device *link) {
      *  Now allocate an interrupt line.  Note that this does not
      *  actually assign a handler to the interrupt.
      */
-    ret = pcmcia_request_irq(link, &link->irq);
+    ret = pcmcia_request_irq(link, netwave_interrupt);
     if (ret)
             goto failed;
 
@@ -767,7 +762,7 @@ static int netwave_pcmcia_config(struct pcmcia_device *link) {
     ramBase = ioremap(req.Base, 0x8000);
     priv->ramBase = ramBase;
 
-    dev->irq = link->irq.AssignedIRQ;
+    dev->irq = link->irq;
     dev->base_addr = link->io.BasePort1;
     SET_NETDEV_DEV(dev, &link->dev);
 
diff --git a/drivers/staging/octeon/cvmx-helper-board.c b/drivers/staging/octeon/cvmx-helper-board.c
index 3085e38a6f99..00a555b83354 100644
--- a/drivers/staging/octeon/cvmx-helper-board.c
+++ b/drivers/staging/octeon/cvmx-helper-board.c
@@ -153,6 +153,14 @@ int cvmx_helper_board_get_mii_address(int ipd_port)
                  * through switch.
                  */
                 return -1;
+
+        case CVMX_BOARD_TYPE_CUST_WSX16:
+                if (ipd_port >= 0 && ipd_port <= 3)
+                        return ipd_port;
+                else if (ipd_port >= 16 && ipd_port <= 19)
+                        return ipd_port - 16 + 4;
+                else
+                        return -1;
         }
 
         /* Some unknown board. Somebody forgot to update this function... */
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index 1873a79bb033..740db0c1ac01 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -63,6 +63,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x07D1, 0x3C11)},   /* D-Link */
         {USB_DEVICE(0x14B2, 0x3C07)},   /* AL */
         {USB_DEVICE(0x050D, 0x8053)},   /* Belkin */
+        {USB_DEVICE(0x050D, 0x825B)},   /* Belkin */
         {USB_DEVICE(0x14B2, 0x3C23)},   /* Airlink */
         {USB_DEVICE(0x14B2, 0x3C27)},   /* Airlink */
         {USB_DEVICE(0x07AA, 0x002F)},   /* Corega */
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index e16256fe595a..04d9b85f3d4c 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -113,14 +113,17 @@ u32 rt_global_debug_component = \
 
 static const struct usb_device_id rtl8192_usb_id_tbl[] = {
         /* Realtek */
+        {USB_DEVICE(0x0bda, 0x8171)},
         {USB_DEVICE(0x0bda, 0x8192)},
         {USB_DEVICE(0x0bda, 0x8709)},
         /* Corega */
         {USB_DEVICE(0x07aa, 0x0043)},
         /* Belkin */
         {USB_DEVICE(0x050d, 0x805E)},
+        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x0031)},
+        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
         /* EnGenius */
         {USB_DEVICE(0x1740, 0x9201)},
         /* Dlink */
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
index 6da1021e8a65..a2566f1075d5 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/staging/usbip/usbip_event.c
@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device *ud)
 {
         struct usbip_task *eh = &ud->eh;
 
+        if (eh->thread == current)
+                return; /* do not wait for myself */
+
         wait_for_completion(&eh->thread_done);
         usbip_dbg_eh("usbip_eh has finished\n");
 }
diff --git a/drivers/staging/vme/bridges/vme_tsi148.c b/drivers/staging/vme/bridges/vme_tsi148.c
index 68f24425977f..783051f59f19 100644
--- a/drivers/staging/vme/bridges/vme_tsi148.c
+++ b/drivers/staging/vme/bridges/vme_tsi148.c
@@ -2455,9 +2455,10 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         dev_info(&pdev->dev, "VME Write and flush and error check is %s\n",
                 err_chk ? "enabled" : "disabled");
 
-        if (tsi148_crcsr_init(tsi148_bridge, pdev))
+        if (tsi148_crcsr_init(tsi148_bridge, pdev)) {
                 dev_err(&pdev->dev, "CR/CSR configuration failed.\n");
                 goto err_crcsr;
+        }
 
         retval = vme_register_bridge(tsi148_bridge);
         if (retval != 0) {
diff --git a/drivers/staging/wavelan/wavelan_cs.c b/drivers/staging/wavelan/wavelan_cs.c
index 04f691d127b4..37fa85517a58 100644
--- a/drivers/staging/wavelan/wavelan_cs.c
+++ b/drivers/staging/wavelan/wavelan_cs.c
@@ -3850,12 +3850,8 @@ wv_pcmcia_config(struct pcmcia_device *	link)
       if (i != 0)
           break;
 
-      /*
-       * Now allocate an interrupt line.  Note that this does not
-       * actually assign a handler to the interrupt.
-       */
-      i = pcmcia_request_irq(link, &link->irq);
-      if (i != 0)
+      i = pcmcia_request_interrupt(link, wavelan_interrupt);
+      if (!i)
           break;
 
       /*
@@ -3890,7 +3886,7 @@ wv_pcmcia_config(struct pcmcia_device *	link)
           break;
 
       /* Feed device with this info... */
-      dev->irq = link->irq.AssignedIRQ;
+      dev->irq = link->irq;
       dev->base_addr = link->io.BasePort1;
       netif_start_queue(dev);
 
@@ -4437,10 +4433,6 @@ wavelan_probe(struct pcmcia_device *p_dev)
   p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
   p_dev->io.IOAddrLines = 3;
 
-  /* Interrupt setup */
-  p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
-  p_dev->irq.Handler = wavelan_interrupt;
-
   /* General socket configuration */
   p_dev->conf.Attributes = CONF_ENABLE_IRQ;
   p_dev->conf.IntType = INT_MEMORY_AND_IO;
@@ -4487,7 +4479,6 @@ wavelan_probe(struct pcmcia_device *p_dev)
 
   ret = wv_hw_config(dev);
   if (ret) {
-          dev->irq = 0;
           pcmcia_disable_device(p_dev);
           return ret;
   }
diff --git a/drivers/staging/wlags49_h2/wl_cs.c b/drivers/staging/wlags49_h2/wl_cs.c
index 9da42e66085e..c9d99d88b786 100644
--- a/drivers/staging/wlags49_h2/wl_cs.c
+++ b/drivers/staging/wlags49_h2/wl_cs.c
@@ -156,15 +156,12 @@ static int wl_adapter_attach(struct pcmcia_device *link)
     link->io.NumPorts1      = HCF_NUM_IO_PORTS;
     link->io.Attributes1    = IO_DATA_PATH_WIDTH_16;
     link->io.IOAddrLines    = 6;
-    link->irq.Attributes    = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
-    link->irq.IRQInfo1      = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
-    link->irq.Handler       = &wl_isr;
     link->conf.Attributes   = CONF_ENABLE_IRQ;
     link->conf.IntType      = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex  = 5;
     link->conf.Present      = PRESENT_OPTION;
 
-    link->priv = link->irq.Instance = dev;
+    link->priv = dev;
     lp = wl_priv(dev);
     lp->link = link;
 
@@ -318,11 +315,11 @@ void wl_adapter_insert( struct pcmcia_device *link )
     link->conf.Attributes |= CONF_ENABLE_IRQ;
 
     CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, wl_isr));
     CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
 
-    dev->irq        = link->irq.AssignedIRQ;
+    dev->irq        = link->irq;
     dev->base_addr  = link->io.BasePort1;
 
     SET_NETDEV_DEV(dev, &handle_to_dev(link));
diff --git a/drivers/telephony/ixj_pcmcia.c b/drivers/telephony/ixj_pcmcia.c
index d442fd35620a..99cb2246ac72 100644
--- a/drivers/telephony/ixj_pcmcia.c
+++ b/drivers/telephony/ixj_pcmcia.c
@@ -22,7 +22,6 @@
 
 typedef struct ixj_info_t {
         int ndev;
-        dev_node_t node;
         struct ixj *port;
 } ixj_info_t;
 
@@ -155,8 +154,6 @@ static int ixj_config(struct pcmcia_device * link)
         j = ixj_pcmcia_probe(link->io.BasePort1, link->io.BasePort1 + 0x10);
 
         info->ndev = 1;
-        info->node.major = PHONE_MAJOR;
-        link->dev_node = &info->node;
         ixj_get_serial(link, j);
         return 0;
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index be6331e2c276..5e1a253b08a0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1542,6 +1542,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
         },
+        { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
 
         /* Nokia S60 phones expose two ACM channels. The first is
          * a modem and is picked up by the standard AT-command
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 97a819c23ef3..7e594449600e 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -109,7 +109,7 @@ config USB_SUSPEND
 config USB_OTG
         bool
         depends on USB && EXPERIMENTAL
-        select USB_SUSPEND
+        depends on USB_SUSPEND
         default n
 
 
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 6a3b5cae3a6e..2f3dc4cdf79b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -301,7 +301,7 @@ static int usb_probe_interface(struct device *dev)
 
         intf->condition = USB_INTERFACE_BINDING;
 
-        /* Bound interfaces are initially active.  They are
+        /* Probed interfaces are initially active.  They are
          * runtime-PM-enabled only if the driver has autosuspend support.
          * They are sensitive to their children's power states.
          */
@@ -437,11 +437,11 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 
         iface->condition = USB_INTERFACE_BOUND;
 
-        /* Bound interfaces are initially active.  They are
+        /* Claimed interfaces are initially inactive (suspended).  They are
          * runtime-PM-enabled only if the driver has autosuspend support.
          * They are sensitive to their children's power states.
          */
-        pm_runtime_set_active(dev);
+        pm_runtime_set_suspended(dev);
         pm_suspend_ignore_children(dev, false);
         if (driver->supports_autosuspend)
                 pm_runtime_enable(dev);
@@ -1170,7 +1170,7 @@ done:
 static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
 {
         int                     status = 0;
-        int                     i = 0;
+        int                     i = 0, n = 0;
         struct usb_interface    *intf;
 
         if (udev->state == USB_STATE_NOTATTACHED ||
@@ -1179,7 +1179,8 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
 
         /* Suspend all the interfaces and then udev itself */
         if (udev->actconfig) {
-                for (; i < udev->actconfig->desc.bNumInterfaces; i++) {
+                n = udev->actconfig->desc.bNumInterfaces;
+                for (i = n - 1; i >= 0; --i) {
                         intf = udev->actconfig->interface[i];
                         status = usb_suspend_interface(udev, intf, msg);
                         if (status != 0)
@@ -1192,7 +1193,7 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
         /* If the suspend failed, resume interfaces that did get suspended */
         if (status != 0) {
                 msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
-                while (--i >= 0) {
+                while (++i < n) {
                         intf = udev->actconfig->interface[i];
                         usb_resume_interface(udev, intf, msg, 0);
                 }
@@ -1263,13 +1264,47 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
         return status;
 }
 
+static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
+{
+        int                     w, i;
+        struct usb_interface    *intf;
+
+        /* Remote wakeup is needed only when we actually go to sleep.
+         * For things like FREEZE and QUIESCE, if the device is already
+         * autosuspended then its current wakeup setting is okay.
+         */
+        if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_QUIESCE) {
+                if (udev->state != USB_STATE_SUSPENDED)
+                        udev->do_remote_wakeup = 0;
+                return;
+        }
+
+        /* If remote wakeup is permitted, see whether any interface drivers
+         * actually want it.
+         */
+        w = 0;
+        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
+                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
+                        intf = udev->actconfig->interface[i];
+                        w |= intf->needs_remote_wakeup;
+                }
+        }
+
+        /* If the device is autosuspended with the wrong wakeup setting,
+         * autoresume now so the setting can be changed.
+         */
+        if (udev->state == USB_STATE_SUSPENDED && w != udev->do_remote_wakeup)
+                pm_runtime_resume(&udev->dev);
+        udev->do_remote_wakeup = w;
+}
+
 /* The device lock is held by the PM core */
 int usb_suspend(struct device *dev, pm_message_t msg)
 {
         struct usb_device       *udev = to_usb_device(dev);
 
         do_unbind_rebind(udev, DO_UNBIND);
-        udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
+        choose_wakeup(udev, msg);
         return usb_suspend_both(udev, msg);
 }
 
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index bdf87a8414a1..2c95153c0f24 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_device *udev)
                  * than a vendor-specific driver. */
                 else if (udev->descriptor.bDeviceClass !=
                                                 USB_CLASS_VENDOR_SPEC &&
-                                (!desc || desc->bInterfaceClass !=
+                                (desc && desc->bInterfaceClass !=
                                                 USB_CLASS_VENDOR_SPEC)) {
                         best = c;
                         break;
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 97b40ce133f0..111a01a747fc 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -380,6 +380,7 @@ static int usbfs_rmdir(struct inode *dir, struct dentry *dentry)
         mutex_lock(&inode->i_mutex);
         dentry_unhash(dentry);
         if (usbfs_empty(dentry)) {
+                dont_mount(dentry);
                 drop_nlink(dentry->d_inode);
                 drop_nlink(dentry->d_inode);
                 dput(dentry);
@@ -515,13 +516,13 @@ static int fs_create_by_name (const char *name, mode_t mode,
         *dentry = NULL;
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                 if ((mode & S_IFMT) == S_IFDIR)
                         error = usbfs_mkdir (parent->d_inode, *dentry, mode);
                 else 
                         error = usbfs_create (parent->d_inode, *dentry, mode);
         } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         return error;
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 1297e9b16a51..0561430f2ede 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -718,7 +718,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
 EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
 
 /**
- * usb_buffer_alloc - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
+ * usb_alloc_coherent - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
  * @dev: device the buffer will be used with
  * @size: requested buffer size
  * @mem_flags: affect whether allocation may block
@@ -737,30 +737,30 @@ EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
  * architectures where CPU caches are not DMA-coherent.  On systems without
  * bus-snooping caches, these buffers are uncached.
  *
- * When the buffer is no longer used, free it with usb_buffer_free().
+ * When the buffer is no longer used, free it with usb_free_coherent().
  */
-void *usb_buffer_alloc(struct usb_device *dev, size_t size, gfp_t mem_flags,
-                       dma_addr_t *dma)
+void *usb_alloc_coherent(struct usb_device *dev, size_t size, gfp_t mem_flags,
+                         dma_addr_t *dma)
 {
         if (!dev || !dev->bus)
                 return NULL;
         return hcd_buffer_alloc(dev->bus, size, mem_flags, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_alloc);
+EXPORT_SYMBOL_GPL(usb_alloc_coherent);
 
 /**
- * usb_buffer_free - free memory allocated with usb_buffer_alloc()
+ * usb_free_coherent - free memory allocated with usb_alloc_coherent()
  * @dev: device the buffer was used with
  * @size: requested buffer size
  * @addr: CPU address of buffer
  * @dma: DMA address of buffer
  *
  * This reclaims an I/O buffer, letting it be reused.  The memory must have
- * been allocated using usb_buffer_alloc(), and the parameters must match
+ * been allocated using usb_alloc_coherent(), and the parameters must match
  * those provided in that allocation request.
  */
-void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
-                     dma_addr_t dma)
+void usb_free_coherent(struct usb_device *dev, size_t size, void *addr,
+                       dma_addr_t dma)
 {
         if (!dev || !dev->bus)
                 return;
@@ -768,7 +768,7 @@ void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
                 return;
         hcd_buffer_free(dev->bus, size, addr, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_free);
+EXPORT_SYMBOL_GPL(usb_free_coherent);
 
 /**
  * usb_buffer_map - create DMA mapping(s) for an urb
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index df1bae9b048e..eaa79c8a9b8c 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -366,6 +366,13 @@ rescan:
         if (is_done)
                 done(ep, req, 0);
         else if (ep->is_pingpong) {
+                /*
+                 * One dummy read to delay the code because of a HW glitch:
+                 * CSR returns bad RXCOUNT when read too soon after updating
+                 * RX_DATA_BK flags.
+                 */
+                csr = __raw_readl(creg);
+
                 bufferspace -= count;
                 buf += count;
                 goto rescan;
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 124a8ccfdcda..1f73b485732d 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2145,6 +2145,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         u32 epctrl;
         u32 mps;
         int dir_in;
+        int ret = 0;
 
         dev_dbg(hsotg->dev,
                 "%s: ep %s: a 0x%02x, attr 0x%02x, mps 0x%04x, intr %d\n",
@@ -2196,7 +2197,8 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
         case USB_ENDPOINT_XFER_ISOC:
                 dev_err(hsotg->dev, "no current ISOC support\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
 
         case USB_ENDPOINT_XFER_BULK:
                 epctrl |= S3C_DxEPCTL_EPType_Bulk;
@@ -2235,8 +2237,9 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         /* enable the endpoint interrupt */
         s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
 
+out:
         spin_unlock_irqrestore(&hs_ep->lock, flags);
-        return 0;
+        return ret;
 }
 
 static int s3c_hsotg_ep_disable(struct usb_ep *ep)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 207e7a85aeb0..13ead00aecd5 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -543,6 +543,7 @@ static int ehci_init(struct usb_hcd *hcd)
          */
         ehci->periodic_size = DEFAULT_I_TDPS;
         INIT_LIST_HEAD(&ehci->cached_itd_list);
+        INIT_LIST_HEAD(&ehci->cached_sitd_list);
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 19372673bf09..c7178bcde67a 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -801,7 +801,7 @@ static int ehci_hub_control (
                          * this bit; seems too long to spin routinely...
                          */
                         retval = handshake(ehci, status_reg,
-                                        PORT_RESET, 0, 750);
+                                        PORT_RESET, 0, 1000);
                         if (retval != 0) {
                                 ehci_err (ehci, "port %d reset error %d\n",
                                         wIndex + 1, retval);
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index aeda96e0af67..1f3f01eacaf0 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -136,7 +136,7 @@ static inline void qh_put (struct ehci_qh *qh)
 
 static void ehci_mem_cleanup (struct ehci_hcd *ehci)
 {
-        free_cached_itd_list(ehci);
+        free_cached_lists(ehci);
         if (ehci->async)
                 qh_put (ehci->async);
         ehci->async = NULL;
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index bed6de342ecc..0cd6c7795d90 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -629,11 +629,13 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                 }
                 snprintf(supply, sizeof(supply), "hsusb%d", i);
                 omap->regulator[i] = regulator_get(omap->dev, supply);
-                if (IS_ERR(omap->regulator[i]))
+                if (IS_ERR(omap->regulator[i])) {
+                        omap->regulator[i] = NULL;
                         dev_dbg(&pdev->dev,
                         "failed to get ehci port%d regulator\n", i);
-                else
+                } else {
                         regulator_enable(omap->regulator[i]);
+                }
         }
 
         ret = omap_start_ehc(omap, hcd);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a0aaaaff2560..805ec633a652 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -510,7 +510,7 @@ static int disable_periodic (struct ehci_hcd *ehci)
         ehci_writel(ehci, cmd, &ehci->regs->command);
         /* posted write ... */
 
-        free_cached_itd_list(ehci);
+        free_cached_lists(ehci);
 
         ehci->next_uframe = -1;
         return 0;
@@ -2139,13 +2139,27 @@ sitd_complete (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
         }
         iso_stream_put (ehci, stream);
-        /* OK to recycle this SITD now that its completion callback ran. */
+
 done:
         sitd->urb = NULL;
-        sitd->stream = NULL;
-        list_move(&sitd->sitd_list, &stream->free_list);
-        iso_stream_put(ehci, stream);
-
+        if (ehci->clock_frame != sitd->frame) {
+                /* OK to recycle this SITD now. */
+                sitd->stream = NULL;
+                list_move(&sitd->sitd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        } else {
+                /* HW might remember this SITD, so we can't recycle it yet.
+                 * Move it to a safe place until a new frame starts.
+                 */
+                list_move(&sitd->sitd_list, &ehci->cached_sitd_list);
+                if (stream->refcount == 2) {
+                        /* If iso_stream_put() were called here, stream
+                         * would be freed.  Instead, just prevent reuse.
+                         */
+                        stream->ep->hcpriv = NULL;
+                        stream->ep = NULL;
+                }
+        }
         return retval;
 }
 
@@ -2211,9 +2225,10 @@ done:
 
 /*-------------------------------------------------------------------------*/
 
-static void free_cached_itd_list(struct ehci_hcd *ehci)
+static void free_cached_lists(struct ehci_hcd *ehci)
 {
         struct ehci_itd *itd, *n;
+        struct ehci_sitd *sitd, *sn;
 
         list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
                 struct ehci_iso_stream  *stream = itd->stream;
@@ -2221,6 +2236,13 @@ static void free_cached_itd_list(struct ehci_hcd *ehci)
                 list_move(&itd->itd_list, &stream->free_list);
                 iso_stream_put(ehci, stream);
         }
+
+        list_for_each_entry_safe(sitd, sn, &ehci->cached_sitd_list, sitd_list) {
+                struct ehci_iso_stream  *stream = sitd->stream;
+                sitd->stream = NULL;
+                list_move(&sitd->sitd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        }
 }
 
 /*-------------------------------------------------------------------------*/
@@ -2247,7 +2269,7 @@ scan_periodic (struct ehci_hcd *ehci)
                 clock_frame = -1;
         }
         if (ehci->clock_frame != clock_frame) {
-                free_cached_itd_list(ehci);
+                free_cached_lists(ehci);
                 ehci->clock_frame = clock_frame;
         }
         clock %= mod;
@@ -2414,7 +2436,7 @@ restart:
                         clock = now;
                         clock_frame = clock >> 3;
                         if (ehci->clock_frame != clock_frame) {
-                                free_cached_itd_list(ehci);
+                                free_cached_lists(ehci);
                                 ehci->clock_frame = clock_frame;
                         }
                 } else {
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index b1dce96dd621..556c0b48f3ab 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -87,8 +87,9 @@ struct ehci_hcd {			/* one per controller */
         int                     next_uframe;    /* scan periodic, start here */
         unsigned                periodic_sched; /* periodic activity count */
 
-        /* list of itds completed while clock_frame was still active */
+        /* list of itds & sitds completed while clock_frame was still active */
         struct list_head        cached_itd_list;
+        struct list_head        cached_sitd_list;
         unsigned                clock_frame;
 
         /* per root hub port */
@@ -195,7 +196,7 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action)
         clear_bit (action, &ehci->actions);
 }
 
-static void free_cached_itd_list(struct ehci_hcd *ehci);
+static void free_cached_lists(struct ehci_hcd *ehci);
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 68b83ab70719..944291e10f97 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -331,6 +331,8 @@ ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
          */
         if (at91_suspend_entering_slow_clock()) {
                 ohci_usb_reset (ohci);
+                /* flush the writes */
+                (void) ohci_readl (ohci, &ohci->regs->control);
                 at91_stop_clock();
         }
 
diff --git a/drivers/usb/host/ohci-da8xx.c b/drivers/usb/host/ohci-da8xx.c
index 4aa08d36d077..d22fb4d577b7 100644
--- a/drivers/usb/host/ohci-da8xx.c
+++ b/drivers/usb/host/ohci-da8xx.c
@@ -23,7 +23,7 @@
 #error "This file is DA8xx bus glue.  Define CONFIG_ARCH_DAVINCI_DA8XX."
 #endif
 
-#define CFGCHIP2        DA8XX_SYSCFG_VIRT(DA8XX_CFGCHIP2_REG)
+#define CFGCHIP2        DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP2_REG)
 
 static struct clk *usb11_clk;
 static struct clk *usb20_clk;
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 32bbce9718f0..65cac8cc8921 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -697,7 +697,7 @@ static int ohci_hub_control (
         u16             wLength
 ) {
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
-        int             ports = hcd_to_bus (hcd)->root_hub->maxchild;
+        int             ports = ohci->num_ports;
         u32             temp;
         int             retval = 0;
 
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 50f57f468836..e62b30b3e429 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -660,13 +660,13 @@ static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
                 if (qh->dummy == NULL) {
                         oxu_dbg(oxu, "no dummy td\n");
                         oxu->qh_used[i] = 0;
-
-                        return NULL;
+                        qh = NULL;
+                        goto unlock;
                 }
 
                 oxu->qh_used[i] = 1;
         }
-
+unlock:
         spin_unlock(&oxu->mem_lock);
 
         return qh;
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index e11cc3aa4b82..3b867a8af7b2 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -720,10 +720,10 @@ retry:
                 /* port status seems weird until after reset, so
                  * force the reset and make khubd clean up later.
                  */
-                if (sl811->stat_insrmv & 1)
-                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
-                else
+                if (irqstat & SL11H_INTMASK_RD)
                         sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
+                else
+                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
 
                 sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
 
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 39d253e841f6..58cb73c8420a 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -47,7 +47,6 @@ static const char driver_name[DEV_NAME_LEN]  = "sl811_cs";
 
 typedef struct local_info_t {
         struct pcmcia_device    *p_dev;
-        dev_node_t              node;
 } local_info_t;
 
 static void sl811_cs_release(struct pcmcia_device * link);
@@ -163,8 +162,7 @@ static int sl811_cs_config_check(struct pcmcia_device *p_dev,
                         dflt->vpp1.param[CISTPL_POWER_VNOM]/10000;
 
         /* we need an interrupt */
-        if (cfg->irq.IRQInfo1 || dflt->irq.IRQInfo1)
-                p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
+        p_dev->conf.Attributes |= CONF_ENABLE_IRQ;
 
         /* IO window settings */
         p_dev->io.NumPorts1 = p_dev->io.NumPorts2 = 0;
@@ -186,7 +184,6 @@ static int sl811_cs_config_check(struct pcmcia_device *p_dev,
 static int sl811_cs_config(struct pcmcia_device *link)
 {
         struct device           *parent = &link->dev;
-        local_info_t            *dev = link->priv;
         int                     ret;
 
         dev_dbg(&link->dev, "sl811_cs_config\n");
@@ -197,31 +194,24 @@ static int sl811_cs_config(struct pcmcia_device *link)
         /* require an IRQ and two registers */
         if (!link->io.NumPorts1 || link->io.NumPorts1 < 2)
                 goto failed;
-        if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                ret = pcmcia_request_irq(link, &link->irq);
-                if (ret)
-                        goto failed;
-        } else
+
+        if (!link->irq)
                 goto failed;
 
         ret = pcmcia_request_configuration(link, &link->conf);
         if (ret)
                 goto failed;
 
-        sprintf(dev->node.dev_name, driver_name);
-        dev->node.major = dev->node.minor = 0;
-        link->dev_node = &dev->node;
-
-        printk(KERN_INFO "%s: index 0x%02x: ",
-               dev->node.dev_name, link->conf.ConfigIndex);
+        dev_info(&link->dev, "index 0x%02x: ",
+                link->conf.ConfigIndex);
         if (link->conf.Vpp)
                 printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
-        printk(", irq %d", link->irq.AssignedIRQ);
+        printk(", irq %d", link->irq);
         printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                link->io.BasePort1+link->io.NumPorts1-1);
         printk("\n");
 
-        if (sl811_hc_init(parent, link->io.BasePort1, link->irq.AssignedIRQ)
+        if (sl811_hc_init(parent, link->io.BasePort1, link->irq)
                         < 0) {
 failed:
                 printk(KERN_WARNING "sl811_cs_config failed\n");
@@ -241,10 +231,6 @@ static int sl811_cs_probe(struct pcmcia_device *link)
         local->p_dev = link;
         link->priv = local;
 
-        /* Initialize */
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-        link->irq.Handler = NULL;
-
         link->conf.Attributes = 0;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c09539bad1ee..d64f5724bfc4 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -582,6 +582,19 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
         return EP_INTERVAL(interval);
 }
 
+/* The "Mult" field in the endpoint context is only set for SuperSpeed devices.
+ * High speed endpoint descriptors can define "the number of additional
+ * transaction opportunities per microframe", but that goes in the Max Burst
+ * endpoint context field.
+ */
+static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp)
+                return 0;
+        return ep->ss_ep_comp->desc.bmAttributes;
+}
+
 static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
@@ -612,6 +625,36 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
         return type;
 }
 
+/* Return the maximum endpoint service interval time (ESIT) payload.
+ * Basically, this is the maxpacket size, multiplied by the burst size
+ * and mult size.
+ */
+static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
+                struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        int max_burst;
+        int max_packet;
+
+        /* Only applies for interrupt or isochronous endpoints */
+        if (usb_endpoint_xfer_control(&ep->desc) ||
+                        usb_endpoint_xfer_bulk(&ep->desc))
+                return 0;
+
+        if (udev->speed == USB_SPEED_SUPER) {
+                if (ep->ss_ep_comp)
+                        return ep->ss_ep_comp->desc.wBytesPerInterval;
+                xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
+                /* Assume no bursts, no multiple opportunities to send. */
+                return ep->desc.wMaxPacketSize;
+        }
+
+        max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+        max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
+        /* A 0 in max burst means 1 transfer per ESIT */
+        return max_packet * (max_burst + 1);
+}
+
 int xhci_endpoint_init(struct xhci_hcd *xhci,
                 struct xhci_virt_device *virt_dev,
                 struct usb_device *udev,
@@ -623,6 +666,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         struct xhci_ring *ep_ring;
         unsigned int max_packet;
         unsigned int max_burst;
+        u32 max_esit_payload;
 
         ep_index = xhci_get_endpoint_index(&ep->desc);
         ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
@@ -644,6 +688,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
         ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
+        ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep));
 
         /* FIXME dig Mult and streams info out of ep companion desc */
 
@@ -689,6 +734,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         default:
                 BUG();
         }
+        max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
+        ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload);
+
+        /*
+         * XXX no idea how to calculate the average TRB buffer length for bulk
+         * endpoints, as the driver gives us no clue how big each scatter gather
+         * list entry (or buffer) is going to be.
+         *
+         * For isochronous and interrupt endpoints, we set it to the max
+         * available, until we have new API in the USB core to allow drivers to
+         * declare how much bandwidth they actually need.
+         *
+         * Normally, it would be calculated by taking the total of the buffer
+         * lengths in the TD and then dividing by the number of TRBs in a TD,
+         * including link TRBs, No-op TRBs, and Event data TRBs.  Since we don't
+         * use Event Data TRBs, and we don't chain in a link TRB on short
+         * transfers, we're basically dividing by 1.
+         */
+        ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload);
+
         /* FIXME Debug endpoint context */
         return 0;
 }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e5eb09b2f38e..ea389e9a4931 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -609,6 +609,10 @@ struct xhci_ep_ctx {
 #define MAX_PACKET_MASK         (0xffff << 16)
 #define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
 
+/* tx_info bitmasks */
+#define AVG_TRB_LENGTH_FOR_EP(p)        ((p) & 0xffff)
+#define MAX_ESIT_PAYLOAD_FOR_EP(p)      (((p) & 0xffff) << 16)
+
 
 /**
  * struct xhci_input_control_context
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index a9555cb901a1..de8ef945b536 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -49,6 +49,7 @@ struct usb_sevsegdev {
         u16 textlength;
 
         u8 shadow_power; /* for PM */
+        u8 has_interface_pm;
 };
 
 /* sysfs_streq can't replace this completely
@@ -68,12 +69,16 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
 {
         int rc;
 
-        if (!mydev->shadow_power && mydev->powered) {
+        if (mydev->powered && !mydev->has_interface_pm) {
                 rc = usb_autopm_get_interface(mydev->intf);
                 if (rc < 0)
                         return;
+                mydev->has_interface_pm = 1;
         }
 
+        if (mydev->shadow_power != 1)
+                return;
+
         rc = usb_control_msg(mydev->udev,
                         usb_sndctrlpipe(mydev->udev, 0),
                         0x12,
@@ -86,8 +91,10 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
         if (rc < 0)
                 dev_dbg(&mydev->udev->dev, "power retval = %d\n", rc);
 
-        if (mydev->shadow_power && !mydev->powered)
+        if (!mydev->powered && mydev->has_interface_pm) {
                 usb_autopm_put_interface(mydev->intf);
+                mydev->has_interface_pm = 0;
+        }
 }
 
 static void update_display_mode(struct usb_sevsegdev *mydev)
@@ -351,6 +358,10 @@ static int sevseg_probe(struct usb_interface *interface,
         mydev->intf = interface;
         usb_set_intfdata(interface, mydev);
 
+        /* PM */
+        mydev->shadow_power = 1; /* currently active */
+        mydev->has_interface_pm = 0; /* have not issued autopm_get */
+
         /*set defaults */
         mydev->textmode = 0x02; /* ascii mode */
         mydev->mode_msb = 0x06; /* 6 characters */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index b4c783c284ba..07fe490b44d8 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -42,7 +42,7 @@ config USB_MUSB_SOC
         default y if (BF52x && !BF522 && !BF523)
 
 comment "DaVinci 35x and 644x USB support"
-        depends on USB_MUSB_HDRC && ARCH_DAVINCI
+        depends on USB_MUSB_HDRC && ARCH_DAVINCI_DMx
 
 comment "OMAP 243x high speed USB support"
         depends on USB_MUSB_HDRC && ARCH_OMAP2430
diff --git a/drivers/usb/musb/Makefile b/drivers/usb/musb/Makefile
index 85710ccc1887..3a485dabebbb 100644
--- a/drivers/usb/musb/Makefile
+++ b/drivers/usb/musb/Makefile
@@ -6,7 +6,7 @@ musb_hdrc-objs := musb_core.o
 
 obj-$(CONFIG_USB_MUSB_HDRC)     += musb_hdrc.o
 
-ifeq ($(CONFIG_ARCH_DAVINCI),y)
+ifeq ($(CONFIG_ARCH_DAVINCI_DMx),y)
         musb_hdrc-objs  += davinci.o
 endif
 
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 719a22d664ef..ec8d324237f6 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -172,13 +172,7 @@ static irqreturn_t blackfin_interrupt(int irq, void *__hci)
 
         spin_unlock_irqrestore(&musb->lock, flags);
 
-        /* REVISIT we sometimes get spurious IRQs on g_ep0
-         * not clear why... fall in BF54x too.
-         */
-        if (retval != IRQ_HANDLED)
-                DBG(5, "spurious?\n");
-
-        return IRQ_HANDLED;
+        return retval;
 }
 
 static void musb_conn_timer_handler(unsigned long _musb)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 29bce5c0fd10..ce2e16fee0df 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -444,6 +444,8 @@ int __init musb_platform_init(struct musb *musb)
         return 0;
 
 fail:
+        clk_disable(musb->clock);
+
         usb_nop_xceiv_unregister();
         return -ENODEV;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0e8b8ab1d168..705cc4ad8737 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -965,10 +965,8 @@ static void musb_shutdown(struct platform_device *pdev)
         spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
         musb_generic_disable(musb);
-        if (musb->clock) {
+        if (musb->clock)
                 clk_put(musb->clock);
-                musb->clock = NULL;
-        }
         spin_unlock_irqrestore(&musb->lock, flags);
 
         /* FIXME power down */
@@ -1853,15 +1851,6 @@ static void musb_free(struct musb *musb)
         put_device(musb->xceiv->dev);
 #endif
 
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-        musb_platform_exit(musb);
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-
-        if (musb->clock) {
-                clk_disable(musb->clock);
-                clk_put(musb->clock);
-        }
-
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
         usb_put_hcd(musb_to_hcd(musb));
 #else
@@ -1889,8 +1878,10 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
          */
         if (!plat) {
                 dev_dbg(dev, "no platform_data?\n");
-                return -ENODEV;
+                status = -ENODEV;
+                goto fail0;
         }
+
         switch (plat->mode) {
         case MUSB_HOST:
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
@@ -1912,13 +1903,16 @@ bad_config:
 #endif
         default:
                 dev_err(dev, "incompatible Kconfig role setting\n");
-                return -EINVAL;
+                status = -EINVAL;
+                goto fail0;
         }
 
         /* allocate */
         musb = allocate_instance(dev, plat->config, ctrl);
-        if (!musb)
-                return -ENOMEM;
+        if (!musb) {
+                status = -ENOMEM;
+                goto fail0;
+        }
 
         spin_lock_init(&musb->lock);
         musb->board_mode = plat->mode;
@@ -1936,7 +1930,7 @@ bad_config:
                 if (IS_ERR(musb->clock)) {
                         status = PTR_ERR(musb->clock);
                         musb->clock = NULL;
-                        goto fail;
+                        goto fail1;
                 }
         }
 
@@ -1955,12 +1949,12 @@ bad_config:
          */
         musb->isr = generic_interrupt;
         status = musb_platform_init(musb);
-
         if (status < 0)
-                goto fail;
+                goto fail2;
+
         if (!musb->isr) {
                 status = -ENODEV;
-                goto fail2;
+                goto fail3;
         }
 
 #ifndef CONFIG_MUSB_PIO_ONLY
@@ -1986,7 +1980,7 @@ bad_config:
                         ? MUSB_CONTROLLER_MHDRC
                         : MUSB_CONTROLLER_HDRC, musb);
         if (status < 0)
-                goto fail2;
+                goto fail3;
 
 #ifdef CONFIG_USB_MUSB_OTG
         setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
@@ -1999,7 +1993,7 @@ bad_config:
         if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                 dev_err(dev, "request_irq %d failed!\n", nIrq);
                 status = -ENODEV;
-                goto fail2;
+                goto fail3;
         }
         musb->nIrq = nIrq;
 /* FIXME this handles wakeup irqs wrong */
@@ -2039,8 +2033,6 @@ bad_config:
                 musb->xceiv->state = OTG_STATE_A_IDLE;
 
                 status = usb_add_hcd(musb_to_hcd(musb), -1, 0);
-                if (status)
-                        goto fail;
 
                 DBG(1, "%s mode, status %d, devctl %02x %c\n",
                         "HOST", status,
@@ -2055,8 +2047,6 @@ bad_config:
                 musb->xceiv->state = OTG_STATE_B_IDLE;
 
                 status = musb_gadget_setup(musb);
-                if (status)
-                        goto fail;
 
                 DBG(1, "%s mode, status %d, dev%02x\n",
                         is_otg_enabled(musb) ? "OTG" : "PERIPHERAL",
@@ -2064,12 +2054,14 @@ bad_config:
                         musb_readb(musb->mregs, MUSB_DEVCTL));
 
         }
+        if (status < 0)
+                goto fail3;
 
 #ifdef CONFIG_SYSFS
         status = sysfs_create_group(&musb->controller->kobj, &musb_attr_group);
-#endif
         if (status)
-                goto fail2;
+                goto fail4;
+#endif
 
         dev_info(dev, "USB %s mode controller at %p using %s, IRQ %d\n",
                         ({char *s;
@@ -2085,17 +2077,29 @@ bad_config:
 
         return 0;
 
-fail2:
+fail4:
+        if (!is_otg_enabled(musb) && is_host_enabled(musb))
+                usb_remove_hcd(musb_to_hcd(musb));
+        else
+                musb_gadget_cleanup(musb);
+
+fail3:
+        if (musb->irq_wake)
+                device_init_wakeup(dev, 0);
         musb_platform_exit(musb);
-fail:
-        dev_err(musb->controller,
-                "musb_init_controller failed with status %d\n", status);
 
+fail2:
         if (musb->clock)
                 clk_put(musb->clock);
-        device_init_wakeup(dev, 0);
+
+fail1:
+        dev_err(musb->controller,
+                "musb_init_controller failed with status %d\n", status);
+
         musb_free(musb);
 
+fail0:
+
         return status;
 
 }
@@ -2132,7 +2136,6 @@ static int __init musb_probe(struct platform_device *pdev)
         /* clobbered by use_dma=n */
         orig_dma_mask = dev->dma_mask;
 #endif
-
         status = musb_init_controller(dev, irq, base);
         if (status < 0)
                 iounmap(base);
@@ -2155,6 +2158,10 @@ static int __exit musb_remove(struct platform_device *pdev)
         if (musb->board_mode == MUSB_HOST)
                 usb_remove_hcd(musb_to_hcd(musb));
 #endif
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+        musb_platform_exit(musb);
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+
         musb_free(musb);
         iounmap(ctrl_base);
         device_init_wakeup(&pdev->dev, 0);
@@ -2176,6 +2183,7 @@ void musb_save_context(struct musb *musb)
         if (is_host_enabled(musb)) {
                 musb_context.frame = musb_readw(musb_base, MUSB_FRAME);
                 musb_context.testmode = musb_readb(musb_base, MUSB_TESTMODE);
+                musb_context.busctl = musb_read_ulpi_buscontrol(musb->mregs);
         }
         musb_context.power = musb_readb(musb_base, MUSB_POWER);
         musb_context.intrtxe = musb_readw(musb_base, MUSB_INTRTXE);
@@ -2247,6 +2255,7 @@ void musb_restore_context(struct musb *musb)
         if (is_host_enabled(musb)) {
                 musb_writew(musb_base, MUSB_FRAME, musb_context.frame);
                 musb_writeb(musb_base, MUSB_TESTMODE, musb_context.testmode);
+                musb_write_ulpi_buscontrol(musb->mregs, musb_context.busctl);
         }
         musb_writeb(musb_base, MUSB_POWER, musb_context.power);
         musb_writew(musb_base, MUSB_INTRTXE, musb_context.intrtxe);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index cd9f4a9a06c6..ac17b004909b 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -478,7 +478,7 @@ struct musb_context_registers {
         u16 frame;
         u8 index, testmode;
 
-        u8 devctl, misc;
+        u8 devctl, busctl, misc;
 
         struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index dec896e888db..877d20b1dff9 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2042,6 +2042,7 @@ static int musb_urb_enqueue(
                  * odd, rare, error prone, but legal.
                  */
                 kfree(qh);
+                qh = NULL;
                 ret = 0;
         } else
                 ret = musb_schedule(musb, qh,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 490cdf15ccb6..82592633502f 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -331,8 +331,5 @@ int musb_platform_exit(struct musb *musb)
 
         musb_platform_suspend(musb);
 
-        clk_put(musb->clock);
-        musb->clock = NULL;
-
         return 0;
 }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index ab776a8d98ca..60d3938cafcf 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -29,6 +29,19 @@ static void tusb_source_power(struct musb *musb, int is_on);
 #define TUSB_REV_MAJOR(reg_val)         ((reg_val >> 4) & 0xf)
 #define TUSB_REV_MINOR(reg_val)         (reg_val & 0xf)
 
+#ifdef CONFIG_PM
+/* REVISIT: These should be only needed if somebody implements off idle */
+void musb_platform_save_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+
+void musb_platform_restore_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+#endif
+
 /*
  * Checks the revision. We need to use the DMA register as 3.0 does not
  * have correct versions for TUSB_PRCM_REV or TUSB_INT_CTRL_REV.
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 5afa070d7dc9..c061a88f2b0f 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -39,7 +39,7 @@ struct tusb_omap_dma_ch {
 
         struct tusb_omap_dma    *tusb_dma;
 
-        void __iomem            *dma_addr;
+        dma_addr_t              dma_addr;
 
         u32                     len;
         u16                     packet_sz;
@@ -126,6 +126,7 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
         struct tusb_omap_dma_ch *chdat = to_chdat(channel);
         struct tusb_omap_dma    *tusb_dma = chdat->tusb_dma;
         struct musb             *musb = chdat->musb;
+        struct device           *dev = musb->controller;
         struct musb_hw_ep       *hw_ep = chdat->hw_ep;
         void __iomem            *ep_conf = hw_ep->conf;
         void __iomem            *mbase = musb->mregs;
@@ -173,13 +174,15 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
                 DBG(3, "Using PIO for remaining %lu bytes\n", pio);
                 buf = phys_to_virt((u32)chdat->dma_addr) + chdat->transfer_len;
                 if (chdat->tx) {
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
-                                        chdat->transfer_len, DMA_TO_DEVICE);
+                        dma_unmap_single(dev, chdat->dma_addr,
+                                                chdat->transfer_len,
+                                                DMA_TO_DEVICE);
                         musb_write_fifo(hw_ep, pio, buf);
                 } else {
+                        dma_unmap_single(dev, chdat->dma_addr,
+                                                chdat->transfer_len,
+                                                DMA_FROM_DEVICE);
                         musb_read_fifo(hw_ep, pio, buf);
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
-                                        chdat->transfer_len, DMA_FROM_DEVICE);
                 }
                 channel->actual_len += pio;
         }
@@ -224,6 +227,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         struct tusb_omap_dma_ch         *chdat = to_chdat(channel);
         struct tusb_omap_dma            *tusb_dma = chdat->tusb_dma;
         struct musb                     *musb = chdat->musb;
+        struct device                   *dev = musb->controller;
         struct musb_hw_ep               *hw_ep = chdat->hw_ep;
         void __iomem                    *mbase = musb->mregs;
         void __iomem                    *ep_conf = hw_ep->conf;
@@ -299,14 +303,16 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         chdat->packet_sz = packet_sz;
         chdat->len = len;
         channel->actual_len = 0;
-        chdat->dma_addr = (void __iomem *)dma_addr;
+        chdat->dma_addr = dma_addr;
         channel->status = MUSB_DMA_STATUS_BUSY;
 
         /* Since we're recycling dma areas, we need to clean or invalidate */
         if (chdat->tx)
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_TO_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_TO_DEVICE);
         else
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_FROM_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_FROM_DEVICE);
 
         /* Use 16-bit transfer if dma_addr is not 32-bit aligned */
         if ((dma_addr & 0x3) == 0) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ca9d866672aa..84d0edad8e4f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -305,6 +305,11 @@ static int  option_resume(struct usb_serial *serial);
 #define ZTE_PRODUCT_CDMA_TECH                   0xfffe
 #define ZTE_PRODUCT_AC8710                      0xfff1
 #define ZTE_PRODUCT_AC2726                      0xfff5
+#define ZTE_PRODUCT_AC8710T                     0xffff
+
+/* ZTE PRODUCTS -- alternate vendor ID */
+#define ZTE_VENDOR_ID2                          0x1d6b
+#define ZTE_PRODUCT_MF_330                      0x0002
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -373,6 +378,8 @@ static int  option_resume(struct usb_serial *serial);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
 
+#define CINTERION_VENDOR_ID                     0x0681
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -679,6 +686,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
+        { USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
@@ -716,6 +725,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
 
+        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 73d5f346d3e0..c28b1607eacc 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -59,6 +59,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
@@ -97,6 +98,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
         { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
         { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+        { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index d640dc951568..23c09b38b9ec 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -20,6 +20,7 @@
 #define PL2303_PRODUCT_ID_ALDIGA        0x0611
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
+#define PL2303_PRODUCT_ID_HCR331        0x331a
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
@@ -134,3 +135,7 @@
 /* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
 #define SANWA_VENDOR_ID         0x11ad
 #define SANWA_PRODUCT_ID        0x0001
+
+/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
+#define ADLINK_VENDOR_ID        0x0b63
+#define ADLINK_ND6530_PRODUCT_ID       0x6530
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 0b9362061713..7e3bea23600b 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -42,6 +42,14 @@
 #define CMOTECH_PRODUCT_CDU550                  0x5553
 #define CMOTECH_PRODUCT_CDX650                  0x6512
 
+/* LG devices */
+#define LG_VENDOR_ID                            0x1004
+#define LG_PRODUCT_VX4400_6000                  0x6000 /* VX4400/VX6000/Rumor */
+
+/* Sanyo devices */
+#define SANYO_VENDOR_ID                         0x0474
+#define SANYO_PRODUCT_KATANA_LX                 0x0754 /* SCP-3800 (Katana LX) */
+
 static struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5740, 0xff, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5750, 0xff, 0x00, 0x00) },
@@ -51,6 +59,8 @@ static struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_UM175_ALLTEL, 0xff, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU550, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDX650, 0xff, 0xff, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 9202f94505e6..ef0bdb08d788 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -230,6 +230,7 @@ static const struct sierra_iface_info direct_ip_interface_blacklist = {
 static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
         { USB_DEVICE(0x03F0, 0x1B1D) }, /* HP ev2200 a.k.a MC5720 */
+        { USB_DEVICE(0x03F0, 0x211D) }, /* HP ev2210 a.k.a MC5725 */
         { USB_DEVICE(0x03F0, 0x1E1D) }, /* HP hs2300 a.k.a MC8775 */
 
         { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 0afe5c71c17e..e1bfda33f5b9 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -172,7 +172,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -180,6 +180,9 @@ static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(MTS_VENDOR_ID, MTS_CDMA_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234MU_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBA_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBAOLD_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
@@ -192,7 +195,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -200,6 +203,9 @@ static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1]
         { USB_DEVICE(MTS_VENDOR_ID, MTS_CDMA_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234MU_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBA_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBAOLD_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
@@ -287,6 +293,8 @@ MODULE_FIRMWARE("ti_5052.fw");
 MODULE_FIRMWARE("mts_cdma.fw");
 MODULE_FIRMWARE("mts_gsm.fw");
 MODULE_FIRMWARE("mts_edge.fw");
+MODULE_FIRMWARE("mts_mt9234mu.fw");
+MODULE_FIRMWARE("mts_mt9234zba.fw");
 
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Enable debugging, 0=no, 1=yes");
@@ -1687,6 +1695,7 @@ static int ti_download_firmware(struct ti_device *tdev)
         const struct firmware *fw_p;
         char buf[32];
 
+        dbg("%s\n", __func__);
         /* try ID specific firmware first, then try generic firmware */
         sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor,
             dev->descriptor.idProduct);
@@ -1703,7 +1712,15 @@ static int ti_download_firmware(struct ti_device *tdev)
                         case MTS_EDGE_PRODUCT_ID:
                                 strcpy(buf, "mts_edge.fw");
                                 break;
-                        }
+                        case MTS_MT9234MU_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234mu.fw");
+                                break;
+                        case MTS_MT9234ZBA_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234zba.fw");
+                                break;
+                        case MTS_MT9234ZBAOLD_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234zba.fw");
+                                break;                  }
                 }
                 if (buf[0] == '\0') {
                         if (tdev->td_is_3410)
@@ -1718,7 +1735,7 @@ static int ti_download_firmware(struct ti_device *tdev)
                 return -ENOENT;
         }
         if (fw_p->size > TI_FIRMWARE_BUF_SIZE) {
-                dev_err(&dev->dev, "%s - firmware too large\n", __func__);
+                dev_err(&dev->dev, "%s - firmware too large %zu\n", __func__, fw_p->size);
                 return -ENOENT;
         }
 
@@ -1730,6 +1747,7 @@ static int ti_download_firmware(struct ti_device *tdev)
                 status = ti_do_download(dev, pipe, buffer, fw_p->size);
                 kfree(buffer);
         } else {
+                dbg("%s ENOMEM\n", __func__);
                 status = -ENOMEM;
         }
         release_firmware(fw_p);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index f323c6025858..2aac1953993b 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -45,6 +45,9 @@
 #define MTS_CDMA_PRODUCT_ID             0xF110
 #define MTS_GSM_PRODUCT_ID              0xF111
 #define MTS_EDGE_PRODUCT_ID             0xF112
+#define MTS_MT9234MU_PRODUCT_ID         0xF114
+#define MTS_MT9234ZBA_PRODUCT_ID        0xF115
+#define MTS_MT9234ZBAOLD_PRODUCT_ID     0x0319
 
 /* Commands */
 #define TI_GET_VERSION                  0x01
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 46e79d349498..7ec24e46b34b 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -438,7 +438,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
         old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
         keep_alives = 0;
         for (cnt = 0;
-             keep_alives <= WUIE_ELT_MAX && cnt < wusbhc->ports_max;
+             keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
              cnt++) {
                 unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
 
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index e69d238c5af0..49fa953aaf6e 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1035,7 +1035,12 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 /* This actually signals the guest, using eventfd. */
 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
-        __u16 flags = 0;
+        __u16 flags;
+        /* Flush out used index updates. This is paired
+         * with the barrier that the Guest executes when enabling
+         * interrupts. */
+        smp_mb();
+
         if (get_user(flags, &vq->avail->flags)) {
                 vq_err(vq, "Failed to get flags");
                 return;
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index dca48df98444..e5d6b56d4447 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -50,8 +50,9 @@
 #include <linux/fb.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
-
+#include <linux/platform_device.h>
 #include <linux/uaccess.h>
+
 #include <asm/system.h>
 #include <asm/irq.h>
 #include <asm/amigahw.h>
@@ -1135,7 +1136,7 @@ static int amifb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg
          * Interface to the low level console driver
          */
 
-static void amifb_deinit(void);
+static void amifb_deinit(struct platform_device *pdev);
 
         /*
          * Internal routines
@@ -2246,7 +2247,7 @@ static inline void chipfree(void)
          * Initialisation
          */
 
-static int __init amifb_init(void)
+static int __init amifb_probe(struct platform_device *pdev)
 {
         int tag, i, err = 0;
         u_long chipptr;
@@ -2261,16 +2262,6 @@ static int __init amifb_init(void)
         }
         amifb_setup(option);
 #endif
-        if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(AMI_VIDEO))
-                return -ENODEV;
-
-        /*
-         * We request all registers starting from bplpt[0]
-         */
-        if (!request_mem_region(CUSTOM_PHYSADDR+0xe0, 0x120,
-                                "amifb [Denise/Lisa]"))
-                return -EBUSY;
-
         custom.dmacon = DMAF_ALL | DMAF_MASTER;
 
         switch (amiga_chipset) {
@@ -2377,6 +2368,7 @@ default_chipset:
         fb_info.fbops = &amifb_ops;
         fb_info.par = &currentpar;
         fb_info.flags = FBINFO_DEFAULT;
+        fb_info.device = &pdev->dev;
 
         if (!fb_find_mode(&fb_info.var, &fb_info, mode_option, ami_modedb,
                           NUM_TOTAL_MODES, &ami_modedb[defmode], 4)) {
@@ -2451,18 +2443,18 @@ default_chipset:
         return 0;
 
 amifb_error:
-        amifb_deinit();
+        amifb_deinit(pdev);
         return err;
 }
 
-static void amifb_deinit(void)
+static void amifb_deinit(struct platform_device *pdev)
 {
         if (fb_info.cmap.len)
                 fb_dealloc_cmap(&fb_info.cmap);
+        fb_dealloc_cmap(&fb_info.cmap);
         chipfree();
         if (videomemory)
                 iounmap((void*)videomemory);
-        release_mem_region(CUSTOM_PHYSADDR+0xe0, 0x120);
         custom.dmacon = DMAF_ALL | DMAF_MASTER;
 }
 
@@ -3794,14 +3786,35 @@ static void ami_rebuild_copper(void)
         }
 }
 
-static void __exit amifb_exit(void)
+static int __exit amifb_remove(struct platform_device *pdev)
 {
         unregister_framebuffer(&fb_info);
-        amifb_deinit();
+        amifb_deinit(pdev);
         amifb_video_off();
+        return 0;
+}
+
+static struct platform_driver amifb_driver = {
+        .remove = __exit_p(amifb_remove),
+        .driver   = {
+                .name   = "amiga-video",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init amifb_init(void)
+{
+        return platform_driver_probe(&amifb_driver, amifb_probe);
 }
 
 module_init(amifb_init);
+
+static void __exit amifb_exit(void)
+{
+        platform_driver_unregister(&amifb_driver);
+}
+
 module_exit(amifb_exit);
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:amiga-video");
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 44e49c28b2a7..c2ec3dcd4e91 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -488,9 +488,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
         fbinfo->fbops = &bfin_t350mcqb_fb_ops;
         fbinfo->flags = FBINFO_FLAG_DEFAULT;
 
-        info->fb_buffer =
-            dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
-                               GFP_KERNEL);
+        info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
+                                ACTIVE_VIDEO_MEM_OFFSET,
+                                &info->dma_handle, GFP_KERNEL);
 
         if (NULL == info->fb_buffer) {
                 printk(KERN_ERR DRIVER_NAME
@@ -568,8 +568,8 @@ out7:
 out6:
         fb_dealloc_cmap(&fbinfo->cmap);
 out4:
-        dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                          info->dma_handle);
+        dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
+                         info->fb_buffer, info->dma_handle);
 out3:
         framebuffer_release(fbinfo);
 out2:
@@ -592,8 +592,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
         free_irq(info->irq, info);
 
         if (info->fb_buffer != NULL)
-                dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
-                                  info->dma_handle);
+                dma_free_coherent(NULL, fbinfo->fix.smem_len +
+                        ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
+                        info->dma_handle);
 
         fb_dealloc_cmap(&fbinfo->cmap);
 
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 8d8dfda2f868..6df7c54db0a3 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -299,6 +299,7 @@ static const struct zorro_device_id cirrusfb_zorro_table[] = {
         },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, cirrusfb_zorro_table);
 
 static const struct {
         zorro_id id2;
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 581d2dbf675a..ecf405562f5c 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -49,6 +49,7 @@ enum {
         M_MBP_2,        /* MacBook Pro 2nd gen */
         M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
         M_MBP_4,        /* MacBook Pro, 4th gen */
+        M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
         M_UNKNOWN       /* placeholder */
 };
 
@@ -70,6 +71,7 @@ static struct efifb_dmi_info {
         [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
         [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
         [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
         [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
 
@@ -106,6 +108,7 @@ static struct dmi_system_id __initdata dmi_system_table[] = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
         {},
 };
 
diff --git a/drivers/video/fm2fb.c b/drivers/video/fm2fb.c
index 6c91c61cdb63..1b0feb8e7244 100644
--- a/drivers/video/fm2fb.c
+++ b/drivers/video/fm2fb.c
@@ -219,6 +219,7 @@ static struct zorro_device_id fm2fb_devices[] __devinitdata = {
         { ZORRO_PROD_HELFRICH_RAINBOW_II },
         { 0 }
 };
+MODULE_DEVICE_TABLE(zorro, fm2fb_devices);
 
 static struct zorro_driver fm2fb_driver = {
         .name           = "fm2fb",
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index e14bd0749129..e8c769944812 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -695,6 +695,7 @@ static int sh_mobile_lcdc_setup_clocks(struct platform_device *pdev,
          * 1) Enable Runtime PM
          * 2) Force Runtime PM Resume since hardware is accessed from probe()
          */
+        priv->dev = &pdev->dev;
         pm_runtime_enable(priv->dev);
         pm_runtime_resume(priv->dev);
         return 0;
@@ -957,25 +958,24 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
 
         if (!pdev->dev.platform_data) {
                 dev_err(&pdev->dev, "no platform data defined\n");
-                error = -EINVAL;
-                goto err0;
+                return -EINVAL;
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         i = platform_get_irq(pdev, 0);
         if (!res || i < 0) {
                 dev_err(&pdev->dev, "cannot get platform resources\n");
-                error = -ENOENT;
-                goto err0;
+                return -ENOENT;
         }
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 dev_err(&pdev->dev, "cannot allocate device data\n");
-                error = -ENOMEM;
-                goto err0;
+                return -ENOMEM;
         }
 
+        platform_set_drvdata(pdev, priv);
+
         error = request_irq(i, sh_mobile_lcdc_irq, IRQF_DISABLED,
                             dev_name(&pdev->dev), priv);
         if (error) {
@@ -984,8 +984,6 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
         }
 
         priv->irq = i;
-        priv->dev = &pdev->dev;
-        platform_set_drvdata(pdev, priv);
         pdata = pdev->dev.platform_data;
 
         j = 0;
@@ -1099,9 +1097,9 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
                 info = ch->info;
 
                 if (info->fbdefio) {
-                        priv->ch->sglist = vmalloc(sizeof(struct scatterlist) *
+                        ch->sglist = vmalloc(sizeof(struct scatterlist) *
                                         info->fix.smem_len >> PAGE_SHIFT);
-                        if (!priv->ch->sglist) {
+                        if (!ch->sglist) {
                                 dev_err(&pdev->dev, "cannot allocate sglist\n");
                                 goto err1;
                         }
@@ -1126,9 +1124,9 @@ static int __devinit sh_mobile_lcdc_probe(struct platform_device *pdev)
         }
 
         return 0;
- err1:
+err1:
         sh_mobile_lcdc_remove(pdev);
- err0:
+
         return error;
 }
 
@@ -1139,7 +1137,7 @@ static int sh_mobile_lcdc_remove(struct platform_device *pdev)
         int i;
 
         for (i = 0; i < ARRAY_SIZE(priv->ch); i++)
-                if (priv->ch[i].info->dev)
+                if (priv->ch[i].info && priv->ch[i].info->dev)
                         unregister_framebuffer(priv->ch[i].info);
 
         sh_mobile_lcdc_stop(priv);
@@ -1162,7 +1160,8 @@ static int sh_mobile_lcdc_remove(struct platform_device *pdev)
         if (priv->dot_clk)
                 clk_put(priv->dot_clk);
 
-        pm_runtime_disable(priv->dev);
+        if (priv->dev)
+                pm_runtime_disable(priv->dev);
 
         if (priv->base)
                 iounmap(priv->base);
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index ef36fca2eed4..3a7e9ff8a746 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 
 #include <asm/irq.h>
 #include <mach/hardware.h>
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1ed3d554e372..17726a05a0a6 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -115,9 +115,8 @@ static struct w1_therm_family_converter w1_therm_families[] = {
 
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-        int t = ((s16)rom[1] << 8) | rom[0];
-        t = t*1000/16;
-        return t;
+        s16 t = le16_to_cpup((__le16 *)rom);
+        return t*1000/16;
 }
 
 static inline int w1_DS18S20_convert_temp(u8 rom[9])
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0bf5020d0d32..b87ba23442d2 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -175,7 +175,7 @@ config SA1100_WATCHDOG
 
 config MPCORE_WATCHDOG
         tristate "MPcore watchdog"
-        depends on ARM_MPCORE_PLATFORM && LOCAL_TIMERS
+        depends on HAVE_ARM_TWD
         help
           Watchdog timer embedded into the MPcore system.
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 500d38342e1e..801ead191499 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -121,7 +121,7 @@ static ssize_t booke_wdt_write(struct file *file, const char __user *buf,
         return count;
 }
 
-static const struct watchdog_info ident = {
+static struct watchdog_info ident = {
         .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
         .identity = "PowerPC Book-E Watchdog",
 };
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 88ed54e50f74..59359c9a5e01 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -244,7 +244,7 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started");
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout,
         "Watchdog timeout in seconds. (1<=timeout<=3600, default="
-                                __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
+                                __MODULE_STRING(WDT_TIMEOUT) ")");
 
 MODULE_AUTHOR("Ray Lehtiniemi <rayl@mail.com>,"
                 "Alessandro Zummo <a.zummo@towertech.it>");
diff --git a/drivers/watchdog/mpcore_wdt.c b/drivers/watchdog/mpcore_wdt.c
index 016c6a791cab..b8ec7aca3c8e 100644
--- a/drivers/watchdog/mpcore_wdt.c
+++ b/drivers/watchdog/mpcore_wdt.c
@@ -31,8 +31,9 @@
 #include <linux/platform_device.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
+#include <linux/io.h>
 
-#include <asm/hardware/arm_twd.h>
+#include <asm/smp_twd.h>
 
 struct mpcore_wdt {
         unsigned long   timer_alive;
@@ -44,7 +45,7 @@ struct mpcore_wdt {
 };
 
 static struct platform_device *mpcore_wdt_dev;
-extern unsigned int mpcore_timer_rate;
+static DEFINE_SPINLOCK(wdt_lock);
 
 #define TIMER_MARGIN    60
 static int mpcore_margin = TIMER_MARGIN;
@@ -94,13 +95,15 @@ static irqreturn_t mpcore_wdt_fire(int irq, void *arg)
  */
 static void mpcore_wdt_keepalive(struct mpcore_wdt *wdt)
 {
-        unsigned int count;
+        unsigned long count;
 
+        spin_lock(&wdt_lock);
         /* Assume prescale is set to 256 */
-        count = (mpcore_timer_rate / 256) * mpcore_margin;
+        count =  __raw_readl(wdt->base + TWD_WDOG_COUNTER);
+        count = (0xFFFFFFFFU - count) * (HZ / 5);
+        count = (count / 256) * mpcore_margin;
 
         /* Reload the counter */
-        spin_lock(&wdt_lock);
         writel(count + wdt->perturb, wdt->base + TWD_WDOG_LOAD);
         wdt->perturb = wdt->perturb ? 0 : 1;
         spin_unlock(&wdt_lock);
@@ -119,7 +122,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
 {
         dev_printk(KERN_INFO, wdt->dev, "enabling watchdog.\n");
 
-        spin_lock(&wdt_lock);
         /* This loads the count register but does NOT start the count yet */
         mpcore_wdt_keepalive(wdt);
 
@@ -130,7 +132,6 @@ static void mpcore_wdt_start(struct mpcore_wdt *wdt)
                 /* Enable watchdog - prescale=256, watchdog mode=1, enable=1 */
                 writel(0x0000FF09, wdt->base + TWD_WDOG_CONTROL);
         }
-        spin_unlock(&wdt_lock);
 }
 
 static int mpcore_wdt_set_heartbeat(int t)
@@ -360,7 +361,7 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         mpcore_wdt_miscdev.parent = &dev->dev;
         ret = misc_register(&mpcore_wdt_miscdev);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register miscdev on minor=%d (err=%d)\n",
                                                         WATCHDOG_MINOR, ret);
                 goto err_misc;
@@ -369,13 +370,13 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
         ret = request_irq(wdt->irq, mpcore_wdt_fire, IRQF_DISABLED,
                                                         "mpcore_wdt", wdt);
         if (ret) {
-                dev_printk(KERN_ERR, _dev,
+                dev_printk(KERN_ERR, wdt->dev,
                         "cannot register IRQ%d for watchdog\n", wdt->irq);
                 goto err_irq;
         }
 
         mpcore_wdt_stop(wdt);
-        platform_set_drvdata(&dev->dev, wdt);
+        platform_set_drvdata(dev, wdt);
         mpcore_wdt_dev = dev;
 
         return 0;
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index c8eadd478175..88c83aa57303 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -67,8 +67,8 @@ static DEFINE_SPINLOCK(sbwd_lock);
 void sbwdog_set(char __iomem *wdog, unsigned long t)
 {
         spin_lock(&sbwd_lock);
-        __raw_writeb(0, wdog - 0x10);
-        __raw_writeq(t & 0x7fffffUL, wdog);
+        __raw_writeb(0, wdog);
+        __raw_writeq(t & 0x7fffffUL, wdog - 0x10);
         spin_unlock(&sbwd_lock);
 }
 
diff --git a/drivers/watchdog/sbc_fitpc2_wdt.c b/drivers/watchdog/sbc_fitpc2_wdt.c
index 8d44c9b6fb5b..c7d67e9a7465 100644
--- a/drivers/watchdog/sbc_fitpc2_wdt.c
+++ b/drivers/watchdog/sbc_fitpc2_wdt.c
@@ -30,7 +30,7 @@
 static int nowayout = WATCHDOG_NOWAYOUT;
 static unsigned int margin = 60;        /* (secs) Default is 1 minute */
 static unsigned long wdt_status;
-static DEFINE_SPINLOCK(wdt_lock);
+static DEFINE_MUTEX(wdt_lock);
 
 #define WDT_IN_USE              0
 #define WDT_OK_TO_CLOSE         1
@@ -45,26 +45,26 @@ static DEFINE_SPINLOCK(wdt_lock);
 
 static void wdt_send_data(unsigned char command, unsigned char data)
 {
-        outb(command, COMMAND_PORT);
-        msleep(100);
         outb(data, DATA_PORT);
         msleep(200);
+        outb(command, COMMAND_PORT);
+        msleep(100);
 }
 
 static void wdt_enable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
         wdt_send_data(IFACE_ON_COMMAND, 1);
         wdt_send_data(REBOOT_COMMAND, margin);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 
 static void wdt_disable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
         wdt_send_data(IFACE_ON_COMMAND, 0);
         wdt_send_data(REBOOT_COMMAND, 0);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 
 static int fitpc2_wdt_open(struct inode *inode, struct file *file)
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 2ac4440e7b08..8943b8ccee1a 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -80,12 +80,6 @@ static void do_suspend(void)
 
         shutting_down = SHUTDOWN_SUSPEND;
 
-        err = stop_machine_create();
-        if (err) {
-                printk(KERN_ERR "xen suspend: failed to setup stop_machine %d\n", err);
-                goto out;
-        }
-
 #ifdef CONFIG_PREEMPT
         /* If the kernel is preemptible, we need to freeze all the processes
            to prevent them from being in the middle of a pagetable update
@@ -93,7 +87,7 @@ static void do_suspend(void)
         err = freeze_processes();
         if (err) {
                 printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
-                goto out_destroy_sm;
+                goto out;
         }
 #endif
 
@@ -136,12 +130,8 @@ out_resume:
 out_thaw:
 #ifdef CONFIG_PREEMPT
         thaw_processes();
-
-out_destroy_sm:
-#endif
-        stop_machine_destroy();
-
 out:
+#endif
         shutting_down = SHUTDOWN_INVALID;
 }
 #endif  /* CONFIG_PM_SLEEP */
diff --git a/drivers/zorro/proc.c b/drivers/zorro/proc.c
index d47c47fc048f..3c7046d79654 100644
--- a/drivers/zorro/proc.c
+++ b/drivers/zorro/proc.c
@@ -97,7 +97,7 @@ static void zorro_seq_stop(struct seq_file *m, void *v)
 
 static int zorro_seq_show(struct seq_file *m, void *v)
 {
-        u_int slot = *(loff_t *)v;
+        unsigned int slot = *(loff_t *)v;
         struct zorro_dev *z = &zorro_autocon[slot];
 
         seq_printf(m, "%02x\t%08x\t%08lx\t%08lx\t%02x\n", slot, z->id,
@@ -129,7 +129,7 @@ static const struct file_operations zorro_devices_proc_fops = {
 
 static struct proc_dir_entry *proc_bus_zorro_dir;
 
-static int __init zorro_proc_attach_device(u_int slot)
+static int __init zorro_proc_attach_device(unsigned int slot)
 {
         struct proc_dir_entry *entry;
         char name[4];
@@ -146,7 +146,7 @@ static int __init zorro_proc_attach_device(u_int slot)
 
 static int __init zorro_proc_init(void)
 {
-        u_int slot;
+        unsigned int slot;
 
         if (MACH_IS_AMIGA && AMIGAHW_PRESENT(ZORRO)) {
                 proc_bus_zorro_dir = proc_mkdir("bus/zorro", NULL);
diff --git a/drivers/zorro/zorro-driver.c b/drivers/zorro/zorro-driver.c
index 53180a37cc9a..7ee2b6e71786 100644
--- a/drivers/zorro/zorro-driver.c
+++ b/drivers/zorro/zorro-driver.c
@@ -137,10 +137,34 @@ static int zorro_bus_match(struct device *dev, struct device_driver *drv)
         return 0;
 }
 
+static int zorro_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+#ifdef CONFIG_HOTPLUG
+        struct zorro_dev *z;
+
+        if (!dev)
+                return -ENODEV;
+
+        z = to_zorro_dev(dev);
+        if (!z)
+                return -ENODEV;
+
+        if (add_uevent_var(env, "ZORRO_ID=%08X", z->id) ||
+            add_uevent_var(env, "ZORRO_SLOT_NAME=%s", dev_name(dev)) ||
+            add_uevent_var(env, "ZORRO_SLOT_ADDR=%04X", z->slotaddr) ||
+            add_uevent_var(env, "MODALIAS=" ZORRO_DEVICE_MODALIAS_FMT, z->id))
+                return -ENOMEM;
+
+        return 0;
+#else /* !CONFIG_HOTPLUG */
+        return -ENODEV;
+#endif /* !CONFIG_HOTPLUG */
+}
 
 struct bus_type zorro_bus_type = {
         .name   = "zorro",
         .match  = zorro_bus_match,
+        .uevent = zorro_uevent,
         .probe  = zorro_device_probe,
         .remove = zorro_device_remove,
 };
diff --git a/drivers/zorro/zorro-sysfs.c b/drivers/zorro/zorro-sysfs.c
index 1d2a772ea14c..eb924e0a64ce 100644
--- a/drivers/zorro/zorro-sysfs.c
+++ b/drivers/zorro/zorro-sysfs.c
@@ -77,6 +77,16 @@ static struct bin_attribute zorro_config_attr = {
         .read = zorro_read_config,
 };
 
+static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        struct zorro_dev *z = to_zorro_dev(dev);
+
+        return sprintf(buf, ZORRO_DEVICE_MODALIAS_FMT "\n", z->id);
+}
+
+static DEVICE_ATTR(modalias, S_IRUGO, modalias_show, NULL);
+
 int zorro_create_sysfs_dev_files(struct zorro_dev *z)
 {
         struct device *dev = &z->dev;
@@ -89,6 +99,7 @@ int zorro_create_sysfs_dev_files(struct zorro_dev *z)
             (error = device_create_file(dev, &dev_attr_slotaddr)) ||
             (error = device_create_file(dev, &dev_attr_slotsize)) ||
             (error = device_create_file(dev, &dev_attr_resource)) ||
+            (error = device_create_file(dev, &dev_attr_modalias)) ||
             (error = sysfs_create_bin_file(&dev->kobj, &zorro_config_attr)))
                 return error;
 
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index d45fb34e2d23..6455f3a244c5 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -15,6 +15,8 @@
 #include <linux/zorro.h>
 #include <linux/bitops.h>
 #include <linux/string.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
 
 #include <asm/setup.h>
 #include <asm/amigahw.h>
@@ -26,24 +28,17 @@
      *  Zorro Expansion Devices
      */
 
-u_int zorro_num_autocon = 0;
+unsigned int zorro_num_autocon;
 struct zorro_dev zorro_autocon[ZORRO_NUM_AUTO];
 
 
     /*
-     *  Single Zorro bus
+     *  Zorro bus
      */
 
-struct zorro_bus zorro_bus = {\
-    .resources = {
-        /* Zorro II regions (on Zorro II/III) */
-        { .name = "Zorro II exp", .start = 0x00e80000, .end = 0x00efffff },
-        { .name = "Zorro II mem", .start = 0x00200000, .end = 0x009fffff },
-        /* Zorro III regions (on Zorro III only) */
-        { .name = "Zorro III exp", .start = 0xff000000, .end = 0xffffffff },
-        { .name = "Zorro III cfg", .start = 0x40000000, .end = 0x7fffffff }
-    },
-    .name = "Zorro bus"
+struct zorro_bus {
+        struct list_head devices;       /* list of devices on this bus */
+        struct device dev;
 };
 
 
@@ -53,18 +48,19 @@ struct zorro_bus zorro_bus = {\
 
 struct zorro_dev *zorro_find_device(zorro_id id, struct zorro_dev *from)
 {
-    struct zorro_dev *z;
+        struct zorro_dev *z;
 
-    if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(ZORRO))
-        return NULL;
+        if (!zorro_num_autocon)
+                return NULL;
 
-    for (z = from ? from+1 : &zorro_autocon[0];
-         z < zorro_autocon+zorro_num_autocon;
-         z++)
-        if (id == ZORRO_WILDCARD || id == z->id)
-            return z;
-    return NULL;
+        for (z = from ? from+1 : &zorro_autocon[0];
+             z < zorro_autocon+zorro_num_autocon;
+             z++)
+                if (id == ZORRO_WILDCARD || id == z->id)
+                        return z;
+        return NULL;
 }
+EXPORT_SYMBOL(zorro_find_device);
 
 
     /*
@@ -83,121 +79,138 @@ struct zorro_dev *zorro_find_device(zorro_id id, struct zorro_dev *from)
      */
 
 DECLARE_BITMAP(zorro_unused_z2ram, 128);
+EXPORT_SYMBOL(zorro_unused_z2ram);
 
 
 static void __init mark_region(unsigned long start, unsigned long end,
                                int flag)
 {
-    if (flag)
-        start += Z2RAM_CHUNKMASK;
-    else
-        end += Z2RAM_CHUNKMASK;
-    start &= ~Z2RAM_CHUNKMASK;
-    end &= ~Z2RAM_CHUNKMASK;
-
-    if (end <= Z2RAM_START || start >= Z2RAM_END)
-        return;
-    start = start < Z2RAM_START ? 0x00000000 : start-Z2RAM_START;
-    end = end > Z2RAM_END ? Z2RAM_SIZE : end-Z2RAM_START;
-    while (start < end) {
-        u32 chunk = start>>Z2RAM_CHUNKSHIFT;
         if (flag)
-            set_bit(chunk, zorro_unused_z2ram);
+                start += Z2RAM_CHUNKMASK;
         else
-            clear_bit(chunk, zorro_unused_z2ram);
-        start += Z2RAM_CHUNKSIZE;
-    }
+                end += Z2RAM_CHUNKMASK;
+        start &= ~Z2RAM_CHUNKMASK;
+        end &= ~Z2RAM_CHUNKMASK;
+
+        if (end <= Z2RAM_START || start >= Z2RAM_END)
+                return;
+        start = start < Z2RAM_START ? 0x00000000 : start-Z2RAM_START;
+        end = end > Z2RAM_END ? Z2RAM_SIZE : end-Z2RAM_START;
+        while (start < end) {
+                u32 chunk = start>>Z2RAM_CHUNKSHIFT;
+                if (flag)
+                        set_bit(chunk, zorro_unused_z2ram);
+                else
+                        clear_bit(chunk, zorro_unused_z2ram);
+                start += Z2RAM_CHUNKSIZE;
+        }
 }
 
 
-static struct resource __init *zorro_find_parent_resource(struct zorro_dev *z)
+static struct resource __init *zorro_find_parent_resource(
+        struct platform_device *bridge, struct zorro_dev *z)
 {
-    int i;
+        int i;
 
-    for (i = 0; i < zorro_bus.num_resources; i++)
-        if (zorro_resource_start(z) >= zorro_bus.resources[i].start &&
-            zorro_resource_end(z) <= zorro_bus.resources[i].end)
-                return &zorro_bus.resources[i];
-    return &iomem_resource;
+        for (i = 0; i < bridge->num_resources; i++) {
+                struct resource *r = &bridge->resource[i];
+                if (zorro_resource_start(z) >= r->start &&
+                    zorro_resource_end(z) <= r->end)
+                        return r;
+        }
+        return &iomem_resource;
 }
 
 
-    /*
-     *  Initialization
-     */
 
-static int __init zorro_init(void)
+static int __init amiga_zorro_probe(struct platform_device *pdev)
 {
-    struct zorro_dev *z;
-    unsigned int i;
-    int error;
-
-    if (!MACH_IS_AMIGA || !AMIGAHW_PRESENT(ZORRO))
-        return 0;
-
-    pr_info("Zorro: Probing AutoConfig expansion devices: %d device%s\n",
-           zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
-
-    /* Initialize the Zorro bus */
-    INIT_LIST_HEAD(&zorro_bus.devices);
-    dev_set_name(&zorro_bus.dev, "zorro");
-    error = device_register(&zorro_bus.dev);
-    if (error) {
-        pr_err("Zorro: Error registering zorro_bus\n");
-        return error;
-    }
-
-    /* Request the resources */
-    zorro_bus.num_resources = AMIGAHW_PRESENT(ZORRO3) ? 4 : 2;
-    for (i = 0; i < zorro_bus.num_resources; i++)
-        request_resource(&iomem_resource, &zorro_bus.resources[i]);
-
-    /* Register all devices */
-    for (i = 0; i < zorro_num_autocon; i++) {
-        z = &zorro_autocon[i];
-        z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
-        if (z->id == ZORRO_PROD_GVP_EPC_BASE) {
-            /* GVP quirk */
-            unsigned long magic = zorro_resource_start(z)+0x8000;
-            z->id |= *(u16 *)ZTWO_VADDR(magic) & GVP_PRODMASK;
-        }
-        sprintf(z->name, "Zorro device %08x", z->id);
-        zorro_name_device(z);
-        z->resource.name = z->name;
-        if (request_resource(zorro_find_parent_resource(z), &z->resource))
-            pr_err("Zorro: Address space collision on device %s %pR\n",
-                   z->name, &z->resource);
-        dev_set_name(&z->dev, "%02x", i);
-        z->dev.parent = &zorro_bus.dev;
-        z->dev.bus = &zorro_bus_type;
-        error = device_register(&z->dev);
+        struct zorro_bus *bus;
+        struct zorro_dev *z;
+        struct resource *r;
+        unsigned int i;
+        int error;
+
+        /* Initialize the Zorro bus */
+        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
+        if (!bus)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&bus->devices);
+        bus->dev.parent = &pdev->dev;
+        dev_set_name(&bus->dev, "zorro");
+        error = device_register(&bus->dev);
         if (error) {
-            pr_err("Zorro: Error registering device %s\n", z->name);
-            continue;
+                pr_err("Zorro: Error registering zorro_bus\n");
+                kfree(bus);
+                return error;
         }
-        error = zorro_create_sysfs_dev_files(z);
-        if (error)
-            dev_err(&z->dev, "Error creating sysfs files\n");
-    }
-
-    /* Mark all available Zorro II memory */
-    zorro_for_each_dev(z) {
-        if (z->rom.er_Type & ERTF_MEMLIST)
-            mark_region(zorro_resource_start(z), zorro_resource_end(z)+1, 1);
-    }
-
-    /* Unmark all used Zorro II memory */
-    for (i = 0; i < m68k_num_memory; i++)
-        if (m68k_memory[i].addr < 16*1024*1024)
-            mark_region(m68k_memory[i].addr,
-                        m68k_memory[i].addr+m68k_memory[i].size, 0);
-
-    return 0;
+        platform_set_drvdata(pdev, bus);
+
+        /* Register all devices */
+        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
+                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
+                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
+                if (z->id == ZORRO_PROD_GVP_EPC_BASE) {
+                        /* GVP quirk */
+                        unsigned long magic = zorro_resource_start(z)+0x8000;
+                        z->id |= *(u16 *)ZTWO_VADDR(magic) & GVP_PRODMASK;
+                }
+                sprintf(z->name, "Zorro device %08x", z->id);
+                zorro_name_device(z);
+                z->resource.name = z->name;
+                r = zorro_find_parent_resource(pdev, z);
+                error = request_resource(r, &z->resource);
+                if (error)
+                        dev_err(&bus->dev,
+                                "Address space collision on device %s %pR\n",
+                                z->name, &z->resource);
+                dev_set_name(&z->dev, "%02x", i);
+                z->dev.parent = &bus->dev;
+                z->dev.bus = &zorro_bus_type;
+                error = device_register(&z->dev);
+                if (error) {
+                        dev_err(&bus->dev, "Error registering device %s\n",
+                                z->name);
+                        continue;
+                }
+                error = zorro_create_sysfs_dev_files(z);
+                if (error)
+                        dev_err(&z->dev, "Error creating sysfs files\n");
+        }
+
+        /* Mark all available Zorro II memory */
+        zorro_for_each_dev(z) {
+                if (z->rom.er_Type & ERTF_MEMLIST)
+                        mark_region(zorro_resource_start(z),
+                                    zorro_resource_end(z)+1, 1);
+        }
+
+        /* Unmark all used Zorro II memory */
+        for (i = 0; i < m68k_num_memory; i++)
+                if (m68k_memory[i].addr < 16*1024*1024)
+                        mark_region(m68k_memory[i].addr,
+                                    m68k_memory[i].addr+m68k_memory[i].size,
+                                    0);
+
+        return 0;
 }
 
-subsys_initcall(zorro_init);
+static struct platform_driver amiga_zorro_driver = {
+        .driver   = {
+                .name   = "amiga-zorro",
+                .owner  = THIS_MODULE,
+        },
+};
 
-EXPORT_SYMBOL(zorro_find_device);
-EXPORT_SYMBOL(zorro_unused_z2ram);
+static int __init amiga_zorro_init(void)
+{
+        return platform_driver_probe(&amiga_zorro_driver, amiga_zorro_probe);
+}
+
+module_init(amiga_zorro_init);
 
 MODULE_LICENSE("GPL");