380 files changed, 8248 insertions, 7595 deletions

diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 0ae8b9310cbf..589b98b7b216 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -758,7 +758,8 @@ static void acpi_thermal_check(void *data)
                         del_timer(&(tz->timer));
         } else {
                 if (timer_pending(&(tz->timer)))
-                        mod_timer(&(tz->timer), (HZ * sleep_time) / 1000);
+                        mod_timer(&(tz->timer),
+                                        jiffies + (HZ * sleep_time) / 1000);
                 else {
                         tz->timer.data = (unsigned long)tz;
                         tz->timer.function = acpi_thermal_run;
diff --git a/drivers/ata/pata_sis.c b/drivers/ata/pata_sis.c
index f48207865930..8dc3bc4f5863 100644
--- a/drivers/ata/pata_sis.c
+++ b/drivers/ata/pata_sis.c
@@ -878,6 +878,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         struct ata_port_info *port;
         struct pci_dev *host = NULL;
         struct sis_chipset *chipset = NULL;
+        struct sis_chipset *sets;
 
         static struct sis_chipset sis_chipsets[] = {
 
@@ -932,10 +933,11 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 
         /* We have to find the bridge first */
 
-        for (chipset = &sis_chipsets[0]; chipset->device; chipset++) {
-                host = pci_get_device(PCI_VENDOR_ID_SI, chipset->device, NULL);
+        for (sets = &sis_chipsets[0]; sets->device; sets++) {
+                host = pci_get_device(PCI_VENDOR_ID_SI, sets->device, NULL);
                 if (host != NULL) {
-                        if (chipset->device == 0x630) { /* SIS630 */
+                        chipset = sets;                 /* Match found */
+                        if (sets->device == 0x630) {    /* SIS630 */
                                 u8 host_rev;
                                 pci_read_config_byte(host, PCI_REVISION_ID, &host_rev);
                                 if (host_rev >= 0x30)   /* 630 ET */
@@ -946,7 +948,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         /* Look for concealed bridges */
-        if (host == NULL) {
+        if (chipset == NULL) {
                 /* Second check */
                 u32 idemisc;
                 u16 trueid;
diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index 3c372e08f77d..59651abfa4f8 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -821,7 +821,7 @@ static inline void fill_rx_pool (amb_dev * dev, unsigned char pool,
     }
     // cast needed as there is no %? for pointer differences
     PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
-            skb, skb->head, (long) (skb->end - skb->head));
+            skb, skb->head, (long) (skb_end_pointer(skb) - skb->head));
     rx.handle = virt_to_bus (skb);
     rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
     if (rx_give (dev, &rx, pool))
diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index fc518d85543d..02ad83d6b562 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -221,7 +221,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
         hdr->vpi = htons(vcc->vpi);
         hdr->vci = htons(vcc->vci);
         hdr->length = htonl(skb->len);
-        memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
+        skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
         if (vcc->pop) vcc->pop(vcc,skb);
         else dev_kfree_skb(skb);
         out_vcc->push(out_vcc,new_skb);
@@ -310,7 +310,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
                 goto done;
         }
         __net_timestamp(new_skb);
-        memcpy(skb_put(new_skb,skb->len),skb->data,skb->len);
+        skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
         out_vcc->push(out_vcc,new_skb);
         atomic_inc(&vcc->stats->tx);
         atomic_inc(&out_vcc->stats->rx);
@@ -352,7 +352,7 @@ static struct atm_dev atmtcp_control_dev = {
         .ops            = &atmtcp_c_dev_ops,
         .type           = "atmtcp",
         .number         = 999,
-        .lock           = SPIN_LOCK_UNLOCKED
+        .lock           = __SPIN_LOCK_UNLOCKED(atmtcp_control_dev.lock)
 };
 
 
diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
index 8fccf018f165..0d3a38b1cb0b 100644
--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@@ -536,7 +536,7 @@ static int rx_aal0(struct atm_vcc *vcc)
                 return 0;
         }
         skb_put(skb,length);
-        skb_set_timestamp(skb, &eni_vcc->timestamp);
+        skb->tstamp = eni_vcc->timestamp;
         DPRINTK("got len %ld\n",length);
         if (do_rx_dma(vcc,skb,1,length >> 2,length >> 2)) return 1;
         eni_vcc->rxing++;
@@ -701,7 +701,7 @@ static void get_service(struct atm_dev *dev)
                         DPRINTK("Grr, servicing VCC %ld twice\n",vci);
                         continue;
                 }
-                do_gettimeofday(&ENI_VCC(vcc)->timestamp);
+                ENI_VCC(vcc)->timestamp = ktime_get_real();
                 ENI_VCC(vcc)->next = NULL;
                 if (vcc->qos.rxtp.traffic_class == ATM_CBR) {
                         if (eni_dev->fast)
diff --git a/drivers/atm/eni.h b/drivers/atm/eni.h
index 385090c2a580..d04fefb0841f 100644
--- a/drivers/atm/eni.h
+++ b/drivers/atm/eni.h
@@ -59,7 +59,7 @@ struct eni_vcc {
         int rxing;                      /* number of pending PDUs */
         int servicing;                  /* number of waiting VCs (0 or 1) */
         int txing;                      /* number of pending TX bytes */
-        struct timeval timestamp;       /* for RX timing */
+        ktime_t timestamp;              /* for RX timing */
         struct atm_vcc *next;           /* next pending RX */
         struct sk_buff *last;           /* last PDU being DMAed (used to carry
                                            discard information) */
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index a7c0ed3107e3..405ee5e09221 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1,6 +1,4 @@
 /*
-  $Id: fore200e.c,v 1.5 2000/04/14 10:10:34 davem Exp $
-
   A FORE Systems 200E-series driver for ATM on Linux.
   Christophe Lizzi (lizzi@cnam.fr), October 1999-March 2003.
 
@@ -1502,9 +1500,9 @@ fore200e_open(struct atm_vcc *vcc)
     /* pseudo-CBR bandwidth requested? */
     if ((vcc->qos.txtp.traffic_class == ATM_CBR) && (vcc->qos.txtp.max_pcr > 0)) {
         
-        down(&fore200e->rate_sf);
+        mutex_lock(&fore200e->rate_mtx);
         if (fore200e->available_cell_rate < vcc->qos.txtp.max_pcr) {
-            up(&fore200e->rate_sf);
+            mutex_unlock(&fore200e->rate_mtx);
 
             kfree(fore200e_vcc);
             vc_map->vcc = NULL;
@@ -1513,7 +1511,7 @@ fore200e_open(struct atm_vcc *vcc)
 
         /* reserve bandwidth */
         fore200e->available_cell_rate -= vcc->qos.txtp.max_pcr;
-        up(&fore200e->rate_sf);
+        mutex_unlock(&fore200e->rate_mtx);
     }
     
     vcc->itf = vcc->dev->number;
@@ -1599,9 +1597,9 @@ fore200e_close(struct atm_vcc* vcc)
     /* release reserved bandwidth, if any */
     if ((vcc->qos.txtp.traffic_class == ATM_CBR) && (vcc->qos.txtp.max_pcr > 0)) {
 
-        down(&fore200e->rate_sf);
+        mutex_lock(&fore200e->rate_mtx);
         fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
-        up(&fore200e->rate_sf);
+        mutex_unlock(&fore200e->rate_mtx);
 
         clear_bit(ATM_VF_HASQOS, &vcc->flags);
     }
@@ -2064,16 +2062,16 @@ fore200e_change_qos(struct atm_vcc* vcc,struct atm_qos* qos, int flags)
 
     if ((qos->txtp.traffic_class == ATM_CBR) && (qos->txtp.max_pcr > 0)) {
 
-        down(&fore200e->rate_sf);
+        mutex_lock(&fore200e->rate_mtx);
         if (fore200e->available_cell_rate + vcc->qos.txtp.max_pcr < qos->txtp.max_pcr) {
-            up(&fore200e->rate_sf);
+            mutex_unlock(&fore200e->rate_mtx);
             return -EAGAIN;
         }
 
         fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
         fore200e->available_cell_rate -= qos->txtp.max_pcr;
 
-        up(&fore200e->rate_sf);
+        mutex_unlock(&fore200e->rate_mtx);
         
         memcpy(&vcc->qos, qos, sizeof(struct atm_qos));
         
@@ -2459,7 +2457,7 @@ fore200e_initialize(struct fore200e* fore200e)
 
     DPRINTK(2, "device %s being initialized\n", fore200e->name);
 
-    init_MUTEX(&fore200e->rate_sf);
+    mutex_init(&fore200e->rate_mtx);
     spin_lock_init(&fore200e->q_lock);
 
     cpq = fore200e->cp_queues = fore200e->virt_base + FORE200E_CP_QUEUES_OFFSET;
diff --git a/drivers/atm/fore200e.h b/drivers/atm/fore200e.h
index f9abfdac33e4..b85a54613dea 100644
--- a/drivers/atm/fore200e.h
+++ b/drivers/atm/fore200e.h
@@ -869,7 +869,7 @@ typedef struct fore200e {
 
     struct stats*              stats;                  /* last snapshot of the stats         */
     
-    struct semaphore           rate_sf;                /* protects rate reservation ops      */
+    struct mutex               rate_mtx;               /* protects rate reservation ops      */
     spinlock_t                 q_lock;                 /* protects queue ops                 */
 #ifdef FORE200E_USE_TASKLET
     struct tasklet_struct      tx_tasklet;             /* performs tx interrupt work         */
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 8510026b690a..d33aba6864c2 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1901,13 +1901,13 @@ he_service_rbrq(struct he_dev *he_dev, int group)
                         case ATM_AAL0:
                                 /* 2.10.1.5 raw cell receive */
                                 skb->len = ATM_AAL0_SDU;
-                                skb->tail = skb->data + skb->len;
+                                skb_set_tail_pointer(skb, skb->len);
                                 break;
                         case ATM_AAL5:
                                 /* 2.10.1.2 aal5 receive */
 
                                 skb->len = AAL5_LEN(skb->data, he_vcc->pdu_len);
-                                skb->tail = skb->data + skb->len;
+                                skb_set_tail_pointer(skb, skb->len);
 #ifdef USE_CHECKSUM_HW
                                 if (vcc->vpi == 0 && vcc->vci >= ATM_NOT_RSV_VCI) {
                                         skb->ip_summed = CHECKSUM_COMPLETE;
diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index b4b80140c398..057efbc55d38 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -1065,7 +1065,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
         vcc = vc->rx_vcc;
 
         pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(skb),
-                                    skb->end - skb->data, PCI_DMA_FROMDEVICE);
+                                    skb_end_pointer(skb) - skb->data,
+                                    PCI_DMA_FROMDEVICE);
 
         if ((vcc->qos.aal == ATM_AAL0) ||
             (vcc->qos.aal == ATM_AAL34)) {
@@ -1194,7 +1195,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
                 }
 
                 pci_unmap_single(card->pcidev, IDT77252_PRV_PADDR(skb),
-                                 skb->end - skb->data, PCI_DMA_FROMDEVICE);
+                                 skb_end_pointer(skb) - skb->data,
+                                 PCI_DMA_FROMDEVICE);
                 sb_pool_remove(card, skb);
 
                 skb_trim(skb, len);
@@ -1267,7 +1269,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
         tail = readl(SAR_REG_RAWCT);
 
         pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
-                                    queue->end - queue->head - 16,
+                                    skb_end_pointer(queue) - queue->head - 16,
                                     PCI_DMA_FROMDEVICE);
 
         while (head != tail) {
@@ -1363,7 +1365,8 @@ drop:
                                 queue = card->raw_cell_head;
                                 pci_dma_sync_single_for_cpu(card->pcidev,
                                                             IDT77252_PRV_PADDR(queue),
-                                                            queue->end - queue->data,
+                                                            (skb_end_pointer(queue) -
+                                                             queue->data),
                                                             PCI_DMA_FROMDEVICE);
                         } else {
                                 card->raw_cell_head = NULL;
@@ -1816,7 +1819,8 @@ push_rx_skb(struct idt77252_dev *card, struct sk_buff *skb, int queue)
         u32 handle;
         u32 addr;
 
-        skb->data = skb->tail = skb->head;
+        skb->data = skb->head;
+        skb_reset_tail_pointer(skb);
         skb->len = 0;
 
         skb_reserve(skb, 16);
@@ -1835,7 +1839,6 @@ push_rx_skb(struct idt77252_dev *card, struct sk_buff *skb, int queue)
                 skb_put(skb, SAR_FB_SIZE_3);
                 break;
         default:
-                dev_kfree_skb(skb);
                 return -1;
         }
 
@@ -1874,7 +1877,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
                 }
 
                 paddr = pci_map_single(card->pcidev, skb->data,
-                                       skb->end - skb->data,
+                                       skb_end_pointer(skb) - skb->data,
                                        PCI_DMA_FROMDEVICE);
                 IDT77252_PRV_PADDR(skb) = paddr;
 
@@ -1888,7 +1891,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
 
 outunmap:
         pci_unmap_single(card->pcidev, IDT77252_PRV_PADDR(skb),
-                         skb->end - skb->data, PCI_DMA_FROMDEVICE);
+                         skb_end_pointer(skb) - skb->data, PCI_DMA_FROMDEVICE);
 
         handle = IDT77252_PRV_POOL(skb);
         card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL;
@@ -1905,12 +1908,14 @@ recycle_rx_skb(struct idt77252_dev *card, struct sk_buff *skb)
         int err;
 
         pci_dma_sync_single_for_device(card->pcidev, IDT77252_PRV_PADDR(skb),
-                                       skb->end - skb->data, PCI_DMA_FROMDEVICE);
+                                       skb_end_pointer(skb) - skb->data,
+                                       PCI_DMA_FROMDEVICE);
 
         err = push_rx_skb(card, skb, POOL_QUEUE(handle));
         if (err) {
                 pci_unmap_single(card->pcidev, IDT77252_PRV_PADDR(skb),
-                                 skb->end - skb->data, PCI_DMA_FROMDEVICE);
+                                 skb_end_pointer(skb) - skb->data,
+                                 PCI_DMA_FROMDEVICE);
                 sb_pool_remove(card, skb);
                 dev_kfree_skb(skb);
         }
@@ -3122,7 +3127,8 @@ deinit_card(struct idt77252_dev *card)
                         if (skb) {
                                 pci_unmap_single(card->pcidev,
                                                  IDT77252_PRV_PADDR(skb),
-                                                 skb->end - skb->data,
+                                                 (skb_end_pointer(skb) -
+                                                  skb->data),
                                                  PCI_DMA_FROMDEVICE);
                                 card->sbpool[i].skb[j] = NULL;
                                 dev_kfree_skb(skb);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index aab9b3733d52..14ced85b3f54 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -2208,7 +2208,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          if (i == 1 && ns_rsqe_eopdu(rsqe))
             *((u32 *) sb->data) |= 0x00000002;
          skb_put(sb, NS_AAL0_HEADER);
-         memcpy(sb->tail, cell, ATM_CELL_PAYLOAD);
+         memcpy(skb_tail_pointer(sb), cell, ATM_CELL_PAYLOAD);
          skb_put(sb, ATM_CELL_PAYLOAD);
          ATM_SKB(sb)->vcc = vcc;
          __net_timestamp(sb);
@@ -2252,7 +2252,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
       vc->rx_iov = iovb;
       NS_SKB(iovb)->iovcnt = 0;
       iovb->len = 0;
-      iovb->tail = iovb->data = iovb->head;
+      iovb->data = iovb->head;
+      skb_reset_tail_pointer(iovb);
       NS_SKB(iovb)->vcc = vcc;
       /* IMPORTANT: a pointer to the sk_buff containing the small or large
                     buffer is stored as iovec base, NOT a pointer to the 
@@ -2265,7 +2266,8 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
       NS_SKB(iovb)->iovcnt = 0;
       iovb->len = 0;
-      iovb->tail = iovb->data = iovb->head;
+      iovb->data = iovb->head;
+      skb_reset_tail_pointer(iovb);
       NS_SKB(iovb)->vcc = vcc;
    }
    iov = &((struct iovec *) iovb->data)[NS_SKB(iovb)->iovcnt++];
@@ -2393,7 +2395,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
                skb->destructor = ns_lb_destructor;
 #endif /* NS_USE_DESTRUCTORS */
                skb_push(skb, NS_SMBUFSIZE);
-               memcpy(skb->data, sb->data, NS_SMBUFSIZE);
+               skb_copy_from_linear_data(sb, skb->data, NS_SMBUFSIZE);
                skb_put(skb, len - NS_SMBUFSIZE);
                ATM_SKB(skb)->vcc = vcc;
                __net_timestamp(skb);
@@ -2477,7 +2479,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
          {
             /* Copy the small buffer to the huge buffer */
             sb = (struct sk_buff *) iov->iov_base;
-            memcpy(hb->data, sb->data, iov->iov_len);
+            skb_copy_from_linear_data(sb, hb->data, iov->iov_len);
             skb_put(hb, iov->iov_len);
             remaining = len - iov->iov_len;
             iov++;
@@ -2489,7 +2491,7 @@ static void dequeue_rx(ns_dev *card, ns_rsqe *rsqe)
             {
                lb = (struct sk_buff *) iov->iov_base;
                tocopy = min_t(int, remaining, iov->iov_len);
-               memcpy(hb->tail, lb->data, tocopy);
+               skb_copy_from_linear_data(lb, skb_tail_pointer(hb), tocopy);
                skb_put(hb, tocopy);
                iov++;
                remaining -= tocopy;
diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
index 2308e83e5f33..1d8466817943 100644
--- a/drivers/block/aoe/aoe.h
+++ b/drivers/block/aoe/aoe.h
@@ -48,6 +48,15 @@ struct aoe_hdr {
         __be32 tag;
 };
 
+#ifdef __KERNEL__
+#include <linux/skbuff.h>
+
+static inline struct aoe_hdr *aoe_hdr(const struct sk_buff *skb)
+{
+        return (struct aoe_hdr *)skb_mac_header(skb);
+}
+#endif
+
 struct aoe_atahdr {
         unsigned char aflags;
         unsigned char errfeat;
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 8d17d8df3662..1a6aeac5a1c3 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -27,7 +27,8 @@ new_skb(ulong len)
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb) {
-                skb->nh.raw = skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
+                skb_reset_network_header(skb);
                 skb->protocol = __constant_htons(ETH_P_AOE);
                 skb->priority = 0;
                 skb->next = skb->prev = NULL;
@@ -118,7 +119,7 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
 
         /* initialize the headers & frame */
         skb = f->skb;
-        h = (struct aoe_hdr *) skb->mac.raw;
+        h = aoe_hdr(skb);
         ah = (struct aoe_atahdr *) (h+1);
         skb_put(skb, sizeof *h + sizeof *ah);
         memset(h, 0, skb->len);
@@ -207,7 +208,7 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff **tail)
                 skb->dev = ifp;
                 if (sl_tail == NULL)
                         sl_tail = skb;
-                h = (struct aoe_hdr *) skb->mac.raw;
+                h = aoe_hdr(skb);
                 memset(h, 0, sizeof *h + sizeof *ch);
 
                 memset(h->dst, 0xff, sizeof h->dst);
@@ -300,7 +301,7 @@ rexmit(struct aoedev *d, struct frame *f)
         aoechr_error(buf);
 
         skb = f->skb;
-        h = (struct aoe_hdr *) skb->mac.raw;
+        h = aoe_hdr(skb);
         ah = (struct aoe_atahdr *) (h+1);
         f->tag = n;
         h->tag = cpu_to_be32(n);
@@ -529,7 +530,7 @@ aoecmd_ata_rsp(struct sk_buff *skb)
         char ebuf[128];
         u16 aoemajor;
 
-        hin = (struct aoe_hdr *) skb->mac.raw;
+        hin = aoe_hdr(skb);
         aoemajor = be16_to_cpu(get_unaligned(&hin->major));
         d = aoedev_by_aoeaddr(aoemajor, hin->minor);
         if (d == NULL) {
@@ -561,7 +562,7 @@ aoecmd_ata_rsp(struct sk_buff *skb)
         calc_rttavg(d, tsince(f->tag));
 
         ahin = (struct aoe_atahdr *) (hin+1);
-        hout = (struct aoe_hdr *) f->skb->mac.raw;
+        hout = aoe_hdr(f->skb);
         ahout = (struct aoe_atahdr *) (hout+1);
         buf = f->buf;
 
@@ -695,7 +696,7 @@ aoecmd_ata_id(struct aoedev *d)
 
         /* initialize the headers & frame */
         skb = f->skb;
-        h = (struct aoe_hdr *) skb->mac.raw;
+        h = aoe_hdr(skb);
         ah = (struct aoe_atahdr *) (h+1);
         skb_put(skb, sizeof *h + sizeof *ah);
         memset(h, 0, skb->len);
@@ -726,7 +727,7 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
         enum { MAXFRAMES = 16 };
         u16 n;
 
-        h = (struct aoe_hdr *) skb->mac.raw;
+        h = aoe_hdr(skb);
         ch = (struct aoe_cfghdr *) (h+1);
 
         /*
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index aab6d91a2c22..f9ddfda4d9cb 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -123,7 +123,7 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
                 goto exit;
         skb_push(skb, ETH_HLEN);        /* (1) */
 
-        h = (struct aoe_hdr *) skb->mac.raw;
+        h = aoe_hdr(skb);
         n = be32_to_cpu(get_unaligned(&h->tag));
         if ((h->verfl & AOEFL_RSP) == 0 || (n & 1<<31))
                 goto exit;
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index c852eed91e4b..1eeb8f2cde71 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -140,7 +140,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_SLV, D_DLY};
 #include <linux/blkdev.h>
 #include <asm/uaccess.h>
 
-static spinlock_t pcd_lock;
+static DEFINE_SPINLOCK(pcd_lock);
 
 module_param(verbose, bool, 0644);
 module_param(major, int, 0);
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index 7cdaa1951260..5826508f6731 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -154,7 +154,7 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_SLV, D_LUN, D_DLY};
 #include <linux/blkpg.h>
 #include <asm/uaccess.h>
 
-static spinlock_t pf_spin_lock;
+static DEFINE_SPINLOCK(pf_spin_lock);
 
 module_param(verbose, bool, 0644);
 module_param(major, int, 0);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index a4fb70383188..f1b9dd7d47d6 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -777,7 +777,8 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command *
                 rq->cmd_flags |= REQ_QUIET;
 
         blk_execute_rq(rq->q, pd->bdev->bd_disk, rq, 0);
-        ret = rq->errors;
+        if (rq->errors)
+                ret = -EIO;
 out:
         blk_put_request(rq);
         return ret;
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 4c766f36d884..b990805806af 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -527,7 +527,7 @@ static int bfusb_send_frame(struct sk_buff *skb)
                 buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size;
 
                 memcpy(skb_put(nskb, 3), buf, 3);
-                memcpy(skb_put(nskb, size), skb->data + sent, size);
+                skb_copy_from_linear_data_offset(skb, sent, skb_put(nskb, size), size);
 
                 sent  += size;
                 count -= size;
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index acfb6a430dcc..851de4d5b7de 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -461,20 +461,20 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
                                 switch (info->rx_state) {
 
                                 case RECV_WAIT_EVENT_HEADER:
-                                        eh = (struct hci_event_hdr *)(info->rx_skb->data);
+                                        eh = hci_event_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = eh->plen;
                                         break;
 
                                 case RECV_WAIT_ACL_HEADER:
-                                        ah = (struct hci_acl_hdr *)(info->rx_skb->data);
+                                        ah = hci_acl_hdr(info->rx_skb);
                                         dlen = __le16_to_cpu(ah->dlen);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = dlen;
                                         break;
 
                                 case RECV_WAIT_SCO_HEADER:
-                                        sh = (struct hci_sco_hdr *)(info->rx_skb->data);
+                                        sh = hci_sco_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = sh->dlen;
                                         break;
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 9fca6513562d..e8ebd5d3de86 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -231,7 +231,7 @@ static void bpa10x_wakeup(struct bpa10x_data *data)
                 cr = (struct usb_ctrlrequest *) urb->setup_packet;
                 cr->wLength = __cpu_to_le16(skb->len);
 
-                memcpy(urb->transfer_buffer, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, urb->transfer_buffer, skb->len);
                 urb->transfer_buffer_length = skb->len;
 
                 err = usb_submit_urb(urb, GFP_ATOMIC);
@@ -250,7 +250,7 @@ static void bpa10x_wakeup(struct bpa10x_data *data)
                 skb = skb_dequeue(&data->tx_queue);
 
         if (skb) {
-                memcpy(urb->transfer_buffer, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, urb->transfer_buffer, skb->len);
                 urb->transfer_buffer_length = skb->len;
 
                 err = usb_submit_urb(urb, GFP_ATOMIC);
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index 18b0f3992c5b..39516074636b 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -303,20 +303,20 @@ static void bt3c_receive(bt3c_info_t *info)
                                 switch (info->rx_state) {
 
                                 case RECV_WAIT_EVENT_HEADER:
-                                        eh = (struct hci_event_hdr *)(info->rx_skb->data);
+                                        eh = hci_event_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = eh->plen;
                                         break;
 
                                 case RECV_WAIT_ACL_HEADER:
-                                        ah = (struct hci_acl_hdr *)(info->rx_skb->data);
+                                        ah = hci_acl_hdr(info->rx_skb);
                                         dlen = __le16_to_cpu(ah->dlen);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = dlen;
                                         break;
 
                                 case RECV_WAIT_SCO_HEADER:
-                                        sh = (struct hci_sco_hdr *)(info->rx_skb->data);
+                                        sh = hci_sco_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = sh->dlen;
                                         break;
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index c1bce75148fe..d7d2ea0d86a1 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -250,20 +250,20 @@ static void btuart_receive(btuart_info_t *info)
                                 switch (info->rx_state) {
 
                                 case RECV_WAIT_EVENT_HEADER:
-                                        eh = (struct hci_event_hdr *)(info->rx_skb->data);
+                                        eh = hci_event_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = eh->plen;
                                         break;
 
                                 case RECV_WAIT_ACL_HEADER:
-                                        ah = (struct hci_acl_hdr *)(info->rx_skb->data);
+                                        ah = hci_acl_hdr(info->rx_skb);
                                         dlen = __le16_to_cpu(ah->dlen);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = dlen;
                                         break;
 
                                 case RECV_WAIT_SCO_HEADER:
-                                        sh = (struct hci_sco_hdr *)(info->rx_skb->data);
+                                        sh = hci_sco_hdr(info->rx_skb);
                                         info->rx_state = RECV_WAIT_DATA;
                                         info->rx_count = sh->dlen;
                                         break;
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 459aa97937ab..7f9c54b9964a 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -425,7 +425,7 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
                 return -ENOMEM;
 
         skb_reserve(s, NSHL);
-        memcpy(skb_put(s, skb->len), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, skb_put(s, skb->len), skb->len);
         if (skb->len & 0x0001)
                 *skb_put(s, 1) = 0;     /* PAD */
 
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index 34f0afc42407..bfbae14cf93d 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -188,7 +188,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                                 continue;
 
                         case H4_W4_EVENT_HDR:
-                                eh = (struct hci_event_hdr *) h4->rx_skb->data;
+                                eh = hci_event_hdr(h4->rx_skb);
 
                                 BT_DBG("Event header: evt 0x%2.2x plen %d", eh->evt, eh->plen);
 
@@ -196,7 +196,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                                 continue;
 
                         case H4_W4_ACL_HDR:
-                                ah = (struct hci_acl_hdr *) h4->rx_skb->data;
+                                ah = hci_acl_hdr(h4->rx_skb);
                                 dlen = __le16_to_cpu(ah->dlen);
 
                                 BT_DBG("ACL header: dlen %d", dlen);
@@ -205,7 +205,7 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                                 continue;
 
                         case H4_W4_SCO_HDR:
-                                sh = (struct hci_sco_hdr *) h4->rx_skb->data;
+                                sh = hci_sco_hdr(h4->rx_skb);
 
                                 BT_DBG("SCO header: dlen %d", sh->dlen);
 
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index a61fb6da5d03..80a01150b86c 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1338,43 +1338,23 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file, unsigned int c
                  *   (use |'ed TIOCM_RNG/DSR/CD/CTS for masking)
                  * Caller should use TIOCGICOUNT to see which one it was
                  */
-        case TIOCMIWAIT: {
-                        DECLARE_WAITQUEUE(wait, current);
-                        int ret;
+        case TIOCMIWAIT:
+                spin_lock_irqsave(&info->slock, flags);
+                cnow = info->icount;    /* note the counters on entry */
+                spin_unlock_irqrestore(&info->slock, flags);
+
+                wait_event_interruptible(info->delta_msr_wait, ({
+                        cprev = cnow;
                         spin_lock_irqsave(&info->slock, flags);
-                        cprev = info->icount;   /* note the counters on entry */
+                        cnow = info->icount;    /* atomic copy */
                         spin_unlock_irqrestore(&info->slock, flags);
 
-                        add_wait_queue(&info->delta_msr_wait, &wait);
-                        while (1) {
-                                spin_lock_irqsave(&info->slock, flags);
-                                cnow = info->icount;    /* atomic copy */
-                                spin_unlock_irqrestore(&info->slock, flags);
-
-                                set_current_state(TASK_INTERRUPTIBLE);
-                                if (((arg & TIOCM_RNG) &&
-                                                (cnow.rng != cprev.rng)) ||
-                                                ((arg & TIOCM_DSR) &&
-                                                (cnow.dsr != cprev.dsr)) ||
-                                                ((arg & TIOCM_CD) &&
-                                                (cnow.dcd != cprev.dcd)) ||
-                                                ((arg & TIOCM_CTS) &&
-                                                (cnow.cts != cprev.cts))) {
-                                        ret = 0;
-                                        break;
-                                }
-                                /* see if a signal did it */
-                                if (signal_pending(current)) {
-                                        ret = -ERESTARTSYS;
-                                        break;
-                                }
-                                cprev = cnow;
-                        }
-                        current->state = TASK_RUNNING;
-                        remove_wait_queue(&info->delta_msr_wait, &wait);
-                        break;
-                }
-                /* NOTREACHED */
+                        ((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+                        ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+                        ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
+                        ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts));
+                }));
+                break;
                 /*
                  * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
                  * Return: write counters to the user passed counter struct
diff --git a/drivers/char/mxser_new.c b/drivers/char/mxser_new.c
index 9af07e4999d5..f7603b6aeb87 100644
--- a/drivers/char/mxser_new.c
+++ b/drivers/char/mxser_new.c
@@ -1758,43 +1758,23 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
                  *   (use |'ed TIOCM_RNG/DSR/CD/CTS for masking)
                  * Caller should use TIOCGICOUNT to see which one it was
                  */
-        case TIOCMIWAIT: {
-                DECLARE_WAITQUEUE(wait, current);
-                int ret;
+        case TIOCMIWAIT:
                 spin_lock_irqsave(&info->slock, flags);
-                cprev = info->icount;   /* note the counters on entry */
+                cnow = info->icount;    /* note the counters on entry */
                 spin_unlock_irqrestore(&info->slock, flags);
 
-                add_wait_queue(&info->delta_msr_wait, &wait);
-                while (1) {
+                wait_event_interruptible(info->delta_msr_wait, ({
+                        cprev = cnow;
                         spin_lock_irqsave(&info->slock, flags);
                         cnow = info->icount;    /* atomic copy */
                         spin_unlock_irqrestore(&info->slock, flags);
 
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        if (((arg & TIOCM_RNG) &&
-                                        (cnow.rng != cprev.rng)) ||
-                                        ((arg & TIOCM_DSR) &&
-                                        (cnow.dsr != cprev.dsr)) ||
-                                        ((arg & TIOCM_CD) &&
-                                        (cnow.dcd != cprev.dcd)) ||
-                                        ((arg & TIOCM_CTS) &&
-                                        (cnow.cts != cprev.cts))) {
-                                ret = 0;
-                                break;
-                        }
-                        /* see if a signal did it */
-                        if (signal_pending(current)) {
-                                ret = -ERESTARTSYS;
-                                break;
-                        }
-                        cprev = cnow;
-                }
-                current->state = TASK_RUNNING;
-                remove_wait_queue(&info->delta_msr_wait, &wait);
+                        ((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+                        ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+                        ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
+                        ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts));
+                }));
                 break;
-        }
-        /* NOTREACHED */
         /*
          * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
          * Return: write counters to the user passed counter struct
@@ -2230,7 +2210,14 @@ end_intr:
         port->mon_data.rxcnt += cnt;
         port->mon_data.up_rxcnt += cnt;
 
+        /*
+         * We are called from an interrupt context with &port->slock
+         * being held. Drop it temporarily in order to prevent
+         * recursive locking.
+         */
+        spin_unlock(&port->slock);
         tty_flip_buffer_push(tty);
+        spin_lock(&port->slock);
 }
 
 static void mxser_transmit_chars(struct mxser_port *port)
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index 8d025e9b5bce..157b1d09ab55 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -4169,7 +4169,7 @@ static int hdlcdev_xmit(struct sk_buff *skb, struct net_device *dev)
         netif_stop_queue(dev);
 
         /* copy data to device buffers */
-        memcpy(info->tx_buf, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, info->tx_buf, skb->len);
         info->tx_get = 0;
         info->tx_put = info->tx_count = skb->len;
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index b9dc7aa1dfb3..46c1b97748b6 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -881,15 +881,15 @@ EXPORT_SYMBOL(get_random_bytes);
  */
 static void init_std_data(struct entropy_store *r)
 {
-        struct timeval tv;
+        ktime_t now;
         unsigned long flags;
 
         spin_lock_irqsave(&r->lock, flags);
         r->entropy_count = 0;
         spin_unlock_irqrestore(&r->lock, flags);
 
-        do_gettimeofday(&tv);
-        add_entropy_words(r, (__u32 *)&tv, sizeof(tv)/4);
+        now = ktime_get_real();
+        add_entropy_words(r, (__u32 *)&now, sizeof(now)/4);
         add_entropy_words(r, (__u32 *)utsname(),
                           sizeof(*(utsname()))/4);
 }
@@ -911,14 +911,12 @@ void rand_initialize_irq(int irq)
                 return;
 
         /*
-         * If kmalloc returns null, we just won't use that entropy
+         * If kzalloc returns null, we just won't use that entropy
          * source.
          */
-        state = kmalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
-        if (state) {
-                memset(state, 0, sizeof(struct timer_rand_state));
+        state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
+        if (state)
                 irq_timer_state[irq] = state;
-        }
 }
 
 #ifdef CONFIG_BLOCK
@@ -927,14 +925,12 @@ void rand_initialize_disk(struct gendisk *disk)
         struct timer_rand_state *state;
 
         /*
-         * If kmalloc returns null, we just won't use that entropy
+         * If kzalloc returns null, we just won't use that entropy
          * source.
          */
-        state = kmalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
-        if (state) {
-                memset(state, 0, sizeof(struct timer_rand_state));
+        state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
+        if (state)
                 disk->random = state;
-        }
 }
 #endif
 
@@ -1469,7 +1465,6 @@ late_initcall(seqgen_init);
 __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
                                    __be16 sport, __be16 dport)
 {
-        struct timeval tv;
         __u32 seq;
         __u32 hash[12];
         struct keydata *keyptr = get_keyptr();
@@ -1485,8 +1480,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
         seq = twothirdsMD4Transform((const __u32 *)daddr, hash) & HASH_MASK;
         seq += keyptr->count;
 
-        do_gettimeofday(&tv);
-        seq += tv.tv_usec + tv.tv_sec * 1000000;
+        seq += ktime_get_real().tv64;
 
         return seq;
 }
@@ -1521,7 +1515,6 @@ __u32 secure_ip_id(__be32 daddr)
 __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
                                  __be16 sport, __be16 dport)
 {
-        struct timeval tv;
         __u32 seq;
         __u32 hash[4];
         struct keydata *keyptr = get_keyptr();
@@ -1543,12 +1536,11 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
          *      As close as possible to RFC 793, which
          *      suggests using a 250 kHz clock.
          *      Further reading shows this assumes 2 Mb/s networks.
-         *      For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
+         *      For 10 Gb/s Ethernet, a 1 GHz clock is appropriate.
          *      That's funny, Linux has one built in!  Use it!
          *      (Networks are faster now - should this be increased?)
          */
-        do_gettimeofday(&tv);
-        seq += tv.tv_usec + tv.tv_sec * 1000000;
+        seq += ktime_get_real().tv64;
 #if 0
         printk("init_seq(%lx, %lx, %d, %d) = %d\n",
                saddr, daddr, sport, dport, seq);
@@ -1556,8 +1548,6 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
         return seq;
 }
 
-EXPORT_SYMBOL(secure_tcp_sequence_number);
-
 /* Generate secure starting point for ephemeral IPV4 transport port search */
 u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
 {
@@ -1598,7 +1588,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16
 u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
                                 __be16 sport, __be16 dport)
 {
-        struct timeval tv;
         u64 seq;
         __u32 hash[4];
         struct keydata *keyptr = get_keyptr();
@@ -1611,8 +1600,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
         seq = half_md4_transform(hash, keyptr->secret);
         seq |= ((u64)keyptr->count) << (32 - HASH_BITS);
 
-        do_gettimeofday(&tv);
-        seq += tv.tv_usec + tv.tv_sec * 1000000;
+        seq += ktime_get_real().tv64;
         seq &= (1ull << 48) - 1;
 #if 0
         printk("dccp init_seq(%lx, %lx, %d, %d) = %d\n",
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index a905f7820331..a7b9e9bb3e8d 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -212,7 +212,7 @@ static void cn_rx_skb(struct sk_buff *__skb)
         skb = skb_get(__skb);
 
         if (skb->len >= NLMSG_SPACE(0)) {
-                nlh = (struct nlmsghdr *)skb->data;
+                nlh = nlmsg_hdr(skb);
 
                 if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
                     skb->len < nlh->nlmsg_len ||
@@ -448,7 +448,7 @@ static int __devinit cn_init(void)
 
         dev->nls = netlink_kernel_create(NETLINK_CONNECTOR,
                                          CN_NETLINK_USERS + 0xf,
-                                         dev->input, THIS_MODULE);
+                                         dev->input, NULL, THIS_MODULE);
         if (!dev->nls)
                 return -EIO;
 
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 01206ebb1cf2..30a76404f0af 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -121,9 +121,9 @@ superio_exit(void)
  * ISA constants
  */
 
-#define REGION_ALIGNMENT        ~7
-#define REGION_OFFSET           5
-#define REGION_LENGTH           2
+#define IOREGION_ALIGNMENT      ~7
+#define IOREGION_OFFSET         5
+#define IOREGION_LENGTH         2
 #define ADDR_REG_OFFSET         5
 #define DATA_REG_OFFSET         6
 
@@ -1194,7 +1194,7 @@ static int w83627ehf_detect(struct i2c_adapter *adapter)
         u8 fan4pin, fan5pin;
         int i, err = 0;
 
-        if (!request_region(address + REGION_OFFSET, REGION_LENGTH,
+        if (!request_region(address + IOREGION_OFFSET, IOREGION_LENGTH,
                             w83627ehf_driver.driver.name)) {
                 err = -EBUSY;
                 goto exit;
@@ -1322,7 +1322,7 @@ exit_remove:
 exit_free:
         kfree(data);
 exit_release:
-        release_region(address + REGION_OFFSET, REGION_LENGTH);
+        release_region(address + IOREGION_OFFSET, IOREGION_LENGTH);
 exit:
         return err;
 }
@@ -1337,7 +1337,7 @@ static int w83627ehf_detach_client(struct i2c_client *client)
 
         if ((err = i2c_detach_client(client)))
                 return err;
-        release_region(client->addr + REGION_OFFSET, REGION_LENGTH);
+        release_region(client->addr + IOREGION_OFFSET, IOREGION_LENGTH);
         kfree(data);
 
         return 0;
@@ -1380,7 +1380,7 @@ static int __init w83627ehf_find(int sioaddr, unsigned short *addr)
         superio_select(W83627EHF_LD_HWM);
         val = (superio_inb(SIO_REG_ADDR) << 8)
             | superio_inb(SIO_REG_ADDR + 1);
-        *addr = val & REGION_ALIGNMENT;
+        *addr = val & IOREGION_ALIGNMENT;
         if (*addr == 0) {
                 superio_exit();
                 return -ENODEV;
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index ca2e4f830c39..5bdf64b77913 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -57,6 +57,7 @@ if IDE
 config IDE_MAX_HWIFS
         int "Max IDE interfaces"
         depends on ALPHA || SUPERH || IA64 || EMBEDDED
+        range 1 10
         default 4
         help
           This is the maximum number of IDE hardware interfaces that will
diff --git a/drivers/ide/pci/delkin_cb.c b/drivers/ide/pci/delkin_cb.c
index d4b753e70119..dd7ec37fdeab 100644
--- a/drivers/ide/pci/delkin_cb.c
+++ b/drivers/ide/pci/delkin_cb.c
@@ -108,6 +108,7 @@ delkin_cb_remove (struct pci_dev *dev)
 
 static struct pci_device_id delkin_cb_pci_tbl[] __devinitdata = {
         { 0x1145, 0xf021, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { 0x1145, 0xf024, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, delkin_cb_pci_tbl);
diff --git a/drivers/ide/pci/hpt366.c b/drivers/ide/pci/hpt366.c
index 60ecdc258c7c..ab6fa271aeb3 100644
--- a/drivers/ide/pci/hpt366.c
+++ b/drivers/ide/pci/hpt366.c
@@ -1,10 +1,10 @@
 /*
- * linux/drivers/ide/pci/hpt366.c               Version 1.01    Dec 23, 2006
+ * linux/drivers/ide/pci/hpt366.c               Version 1.02    Apr 18, 2007
  *
  * Copyright (C) 1999-2003              Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001          Sun Microsystems, Inc.
  * Portions Copyright (C) 2003          Red Hat Inc
- * Portions Copyright (C) 2005-2006     MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2007     MontaVista Software, Inc.
  *
  * Thanks to HighPoint Technologies for their assistance, and hardware.
  * Special Thanks to Jon Burchmore in SanDiego for the deep pockets, his
@@ -494,6 +494,7 @@ static struct hpt_info hpt302n __devinitdata = {
         .chip_type      = HPT302N,
         .max_mode       = HPT302_ALLOW_ATA133_6 ? 4 : 3,
         .dpll_clk       = 77,
+        .settings       = hpt37x_settings
 };
 
 static struct hpt_info hpt371n __devinitdata = {
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index 03e44b337eb0..a364003ba47f 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -834,7 +834,7 @@ static inline u16 ether1394_type_trans(struct sk_buff *skb,
         struct eth1394hdr *eth;
         unsigned char *rawp;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull (skb, ETH1394_HLEN);
         eth = eth1394_hdr(skb);
 
@@ -1668,7 +1668,7 @@ static int ether1394_tx (struct sk_buff *skb, struct net_device *dev)
         if (memcmp(eth->h_dest, dev->broadcast, ETH1394_ALEN) == 0 ||
             proto == htons(ETH_P_ARP) ||
             (proto == htons(ETH_P_IP) &&
-             IN_MULTICAST(ntohl(skb->nh.iph->daddr)))) {
+             IN_MULTICAST(ntohl(ip_hdr(skb)->daddr)))) {
                 tx_type = ETH1394_GASP;
                 dest_node = LOCAL_BUS | ALL_NODES;
                 max_payload = priv->bc_maxpayload - ETHER1394_GASP_OVERHEAD;
diff --git a/drivers/ieee1394/eth1394.h b/drivers/ieee1394/eth1394.h
index c45cbff9138d..1e8356535149 100644
--- a/drivers/ieee1394/eth1394.h
+++ b/drivers/ieee1394/eth1394.h
@@ -90,7 +90,7 @@ struct eth1394hdr {
 
 static inline struct eth1394hdr *eth1394_hdr(const struct sk_buff *skb)
 {
-        return (struct eth1394hdr *)skb->mac.raw;
+        return (struct eth1394hdr *)skb_mac_header(skb);
 }
 #endif
 
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 59243d9aedd6..58bc272bd407 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -439,7 +439,8 @@ static void c2_rx_error(struct c2_port *c2_port, struct c2_element *elem)
         }
 
         /* Setup the skb for reuse since we're dropping this pkt */
-        elem->skb->tail = elem->skb->data = elem->skb->head;
+        elem->skb->data = elem->skb->head;
+        skb_reset_tail_pointer(elem->skb);
 
         /* Zero out the rxp hdr in the sk_buff */
         memset(elem->skb->data, 0, sizeof(*rxp_hdr));
@@ -521,9 +522,8 @@ static void c2_rx_interrupt(struct net_device *netdev)
                  * "sizeof(struct c2_rxp_hdr)".
                  */
                 skb->data += sizeof(*rxp_hdr);
-                skb->tail = skb->data + buflen;
+                skb_set_tail_pointer(skb, buflen);
                 skb->len = buflen;
-                skb->dev = netdev;
                 skb->protocol = eth_type_trans(skb, netdev);
 
                 netif_rx(skb);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 2d2de9b8b729..3b4b0acd707f 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -477,7 +477,7 @@ static void send_mpa_req(struct iwch_ep *ep, struct sk_buff *skb)
         BUG_ON(skb_cloned(skb));
 
         mpalen = sizeof(*mpa) + ep->plen;
-        if (skb->data + mpalen + sizeof(*req) > skb->end) {
+        if (skb->data + mpalen + sizeof(*req) > skb_end_pointer(skb)) {
                 kfree_skb(skb);
                 skb=alloc_skb(mpalen + sizeof(*req), GFP_KERNEL);
                 if (!skb) {
@@ -507,7 +507,7 @@ static void send_mpa_req(struct iwch_ep *ep, struct sk_buff *skb)
          */
         skb_get(skb);
         set_arp_failure_handler(skb, arp_failure_discard);
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
         len = skb->len;
         req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
         req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
@@ -559,7 +559,7 @@ static int send_mpa_reject(struct iwch_ep *ep, const void *pdata, u8 plen)
         skb_get(skb);
         skb->priority = CPL_PRIORITY_DATA;
         set_arp_failure_handler(skb, arp_failure_discard);
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
         req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
         req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
         req->wr_lo = htonl(V_WR_TID(ep->hwtid));
@@ -610,7 +610,7 @@ static int send_mpa_reply(struct iwch_ep *ep, const void *pdata, u8 plen)
          */
         skb_get(skb);
         set_arp_failure_handler(skb, arp_failure_discard);
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
         len = skb->len;
         req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
         req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
@@ -821,7 +821,8 @@ static void process_mpa_reply(struct iwch_ep *ep, struct sk_buff *skb)
         /*
          * copy the new data into our accumulation buffer.
          */
-        memcpy(&(ep->mpa_pkt[ep->mpa_pkt_len]), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
         ep->mpa_pkt_len += skb->len;
 
         /*
@@ -940,7 +941,8 @@ static void process_mpa_request(struct iwch_ep *ep, struct sk_buff *skb)
         /*
          * Copy the new data into our accumulation buffer.
          */
-        memcpy(&(ep->mpa_pkt[ep->mpa_pkt_len]), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, &(ep->mpa_pkt[ep->mpa_pkt_len]),
+                                  skb->len);
         ep->mpa_pkt_len += skb->len;
 
         /*
@@ -1619,7 +1621,8 @@ static int terminate(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
         PDBG("%s ep %p\n", __FUNCTION__, ep);
         skb_pull(skb, sizeof(struct cpl_rdma_terminate));
         PDBG("%s saving %d bytes of term msg\n", __FUNCTION__, skb->len);
-        memcpy(ep->com.qp->attr.terminate_buffer, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, ep->com.qp->attr.terminate_buffer,
+                                  skb->len);
         ep->com.qp->attr.terminate_msg_len = skb->len;
         ep->com.qp->attr.is_terminate_local = 0;
         return CPL_RET_BUF_DONE;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index da7e10230cf8..0c4e59b906cd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -406,7 +406,7 @@ void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
         skb_put_frags(skb, IPOIB_CM_HEAD_SIZE, wc->byte_len, newskb);
 
         skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, IPOIB_ENCAP_LEN);
 
         dev->last_rx = jiffies;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index c17e777cdc47..1bdb9101911a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -216,7 +216,7 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
         if (wc->slid != priv->local_lid ||
             wc->src_qp != priv->qp->qp_num) {
                 skb->protocol = ((struct ipoib_header *) skb->data)->proto;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb_pull(skb, IPOIB_ENCAP_LEN);
 
                 dev->last_rx = jiffies;
diff --git a/drivers/isdn/act2000/module.c b/drivers/isdn/act2000/module.c
index e3e5c1399076..ee2b0b9f8f46 100644
--- a/drivers/isdn/act2000/module.c
+++ b/drivers/isdn/act2000/module.c
@@ -442,7 +442,7 @@ act2000_sendbuf(act2000_card *card, int channel, int ack, struct sk_buff *skb)
                         return 0;
                 }
                 skb_reserve(xmit_skb, 19);
-                memcpy(skb_put(xmit_skb, len), skb->data, len);
+                skb_copy_from_linear_data(skb, skb_put(xmit_skb, len), len);
         } else {
                 xmit_skb = skb_clone(skb, GFP_ATOMIC);
                 if (!xmit_skb) {
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index 2baef349c12d..c8e1c357cec8 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -652,7 +652,7 @@ static int write_modem(struct cardstate *cs)
          * transmit data
          */
         count = min(bcs->tx_skb->len, (unsigned) ucs->bulk_out_size);
-        memcpy(ucs->bulk_out_buffer, bcs->tx_skb->data, count);
+        skb_copy_from_linear_data(bcs->tx_skb, ucs->bulk_out_buffer, count);
         skb_pull(bcs->tx_skb, count);
         atomic_set(&ucs->busy, 1);
         gig_dbg(DEBUG_OUTPUT, "write_modem: send %d bytes", count);
diff --git a/drivers/isdn/hardware/avm/b1dma.c b/drivers/isdn/hardware/avm/b1dma.c
index 1e2d38e3d68c..428872b653e9 100644
--- a/drivers/isdn/hardware/avm/b1dma.c
+++ b/drivers/isdn/hardware/avm/b1dma.c
@@ -404,7 +404,8 @@ static void b1dma_dispatch_tx(avmcard *card)
                 printk(KERN_DEBUG "tx: put 0x%x len=%d\n", 
                        skb->data[2], txlen);
 #endif
-                memcpy(dma->sendbuf.dmabuf, skb->data+2, skb->len-2);
+                skb_copy_from_linear_data_offset(skb, 2, dma->sendbuf.dmabuf,
+                                                 skb->len - 2);
         }
         txlen = (txlen + 3) & ~3;
 
diff --git a/drivers/isdn/hardware/avm/c4.c b/drivers/isdn/hardware/avm/c4.c
index 6f5efa8d78cb..d58f927e766a 100644
--- a/drivers/isdn/hardware/avm/c4.c
+++ b/drivers/isdn/hardware/avm/c4.c
@@ -457,7 +457,8 @@ static void c4_dispatch_tx(avmcard *card)
                 printk(KERN_DEBUG "%s: tx put 0x%x len=%d\n",
                                 card->name, skb->data[2], txlen);
 #endif
-                memcpy(dma->sendbuf.dmabuf, skb->data+2, skb->len-2);
+                skb_copy_from_linear_data_offset(skb, 2, dma->sendbuf.dmabuf,
+                                                 skb->len - 2);
         }
         txlen = (txlen + 3) & ~3;
 
diff --git a/drivers/isdn/hisax/elsa_ser.c b/drivers/isdn/hisax/elsa_ser.c
index ae377e812775..1642dca988a1 100644
--- a/drivers/isdn/hisax/elsa_ser.c
+++ b/drivers/isdn/hisax/elsa_ser.c
@@ -254,14 +254,16 @@ write_modem(struct BCState *bcs) {
         count = len;
         if (count > MAX_MODEM_BUF - fp) {
                 count = MAX_MODEM_BUF - fp;
-                memcpy(cs->hw.elsa.transbuf + fp, bcs->tx_skb->data, count);
+                skb_copy_from_linear_data(bcs->tx_skb,
+                                          cs->hw.elsa.transbuf + fp, count);
                 skb_pull(bcs->tx_skb, count);
                 cs->hw.elsa.transcnt += count;
                 ret = count;
                 count = len - count;
                 fp = 0;
         }
-        memcpy((cs->hw.elsa.transbuf + fp), bcs->tx_skb->data, count);
+        skb_copy_from_linear_data(bcs->tx_skb,
+                                  cs->hw.elsa.transbuf + fp, count);
         skb_pull(bcs->tx_skb, count);
         cs->hw.elsa.transcnt += count;
         ret += count;
diff --git a/drivers/isdn/hisax/isdnl2.c b/drivers/isdn/hisax/isdnl2.c
index cd3b5ad53491..3446f249d675 100644
--- a/drivers/isdn/hisax/isdnl2.c
+++ b/drivers/isdn/hisax/isdnl2.c
@@ -1293,7 +1293,8 @@ l2_pull_iqueue(struct FsmInst *fi, int event, void *arg)
                 oskb = skb;
                 skb = alloc_skb(oskb->len + i, GFP_ATOMIC);
                 memcpy(skb_put(skb, i), header, i);
-                memcpy(skb_put(skb, oskb->len), oskb->data, oskb->len);
+                skb_copy_from_linear_data(oskb,
+                                          skb_put(skb, oskb->len), oskb->len);
                 dev_kfree_skb(oskb);
         }
         st->l2.l2l1(st, PH_PULL | INDICATION, skb);
diff --git a/drivers/isdn/hysdn/hycapi.c b/drivers/isdn/hysdn/hycapi.c
index b2ae4ec1e49e..f85450146bdc 100644
--- a/drivers/isdn/hysdn/hycapi.c
+++ b/drivers/isdn/hysdn/hycapi.c
@@ -398,8 +398,9 @@ static u16 hycapi_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
                         _len = CAPIMSG_LEN(skb->data);
                         if (_len > 22) {
                                 _len2 = _len - 22;
-                                memcpy(msghead, skb->data, 22);
-                                memcpy(skb->data + _len2, msghead, 22);
+                                skb_copy_from_linear_data(skb, msghead, 22);
+                                skb_copy_to_linear_data_offset(skb, _len2,
+                                                               msghead, 22);
                                 skb_pull(skb, _len2);
                                 CAPIMSG_SETLEN(skb->data, 22);
                                 retval = capilib_data_b3_req(&cinfo->ncci_head,
diff --git a/drivers/isdn/hysdn/hysdn_net.c b/drivers/isdn/hysdn/hysdn_net.c
index 557d96c78a62..cfa8fa5e44ab 100644
--- a/drivers/isdn/hysdn/hysdn_net.c
+++ b/drivers/isdn/hysdn/hysdn_net.c
@@ -214,8 +214,6 @@ hysdn_rx_netpkt(hysdn_card * card, unsigned char *buf, unsigned short len)
                 lp->stats.rx_dropped++;
                 return;
         }
-        skb->dev = &lp->netdev;
-
         /* copy the data */
         memcpy(skb_put(skb, len), buf, len);
 
diff --git a/drivers/isdn/hysdn/hysdn_sched.c b/drivers/isdn/hysdn/hysdn_sched.c
index b7b5aa4748a0..81db4a190d41 100644
--- a/drivers/isdn/hysdn/hysdn_sched.c
+++ b/drivers/isdn/hysdn/hysdn_sched.c
@@ -113,7 +113,8 @@ hysdn_sched_tx(hysdn_card *card, unsigned char *buf,
             (skb = hysdn_tx_netget(card)) != NULL) 
         {
                 if (skb->len <= maxlen) {
-                        memcpy(buf, skb->data, skb->len);       /* copy the packet to the buffer */
+                        /* copy the packet to the buffer */
+                        skb_copy_from_linear_data(skb, buf, skb->len);
                         *len = skb->len;
                         *chan = CHAN_NDIS_DATA;
                         card->net_tx_busy = 1;  /* we are busy sending network data */
@@ -126,7 +127,7 @@ hysdn_sched_tx(hysdn_card *card, unsigned char *buf,
             ((skb = hycapi_tx_capiget(card)) != NULL) )
         {
                 if (skb->len <= maxlen) {
-                        memcpy(buf, skb->data, skb->len);
+                        skb_copy_from_linear_data(skb, buf, skb->len);
                         *len = skb->len;
                         *chan = CHAN_CAPI;
                         hycapi_tx_capiack(card);
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index 9c926e41b114..c97330b19877 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -829,7 +829,7 @@ isdn_readbchan(int di, int channel, u_char * buf, u_char * fp, int len, wait_que
                                 dflag = 0;
                         }
                         count_put = count_pull;
-                        memcpy(cp, skb->data, count_put);
+                        skb_copy_from_linear_data(skb, cp, count_put);
                         cp += count_put;
                         len -= count_put;
 #ifdef CONFIG_ISDN_AUDIO
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 838b3734e2b6..aa83277aba74 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -872,7 +872,8 @@ typedef struct {
 static void
 isdn_net_log_skb(struct sk_buff * skb, isdn_net_local * lp)
 {
-        u_char *p = skb->nh.raw; /* hopefully, this was set correctly */
+        /* hopefully, this was set correctly */
+        const u_char *p = skb_network_header(skb);
         unsigned short proto = ntohs(skb->protocol);
         int data_ofs;
         ip_ports *ipp;
@@ -880,7 +881,7 @@ isdn_net_log_skb(struct sk_buff * skb, isdn_net_local * lp)
 
         addinfo[0] = '\0';
         /* This check stolen from 2.1.72 dev_queue_xmit_nit() */
-        if (skb->nh.raw < skb->data || skb->nh.raw >= skb->tail) {
+        if (p < skb->data || skb->network_header >= skb->tail) {
                 /* fall back to old isdn_net_log_packet method() */
                 char * buf = skb->data;
 
@@ -1121,7 +1122,7 @@ isdn_net_adjust_hdr(struct sk_buff *skb, struct net_device *dev)
         if (!skb)
                 return;
         if (lp->p_encap == ISDN_NET_ENCAP_ETHER) {
-                int pullsize = (ulong)skb->nh.raw - (ulong)skb->data - ETH_HLEN;
+                const int pullsize = skb_network_offset(skb) - ETH_HLEN;
                 if (pullsize > 0) {
                         printk(KERN_DEBUG "isdn_net: Pull junk %d\n", pullsize);
                         skb_pull(skb, pullsize);
@@ -1366,7 +1367,7 @@ isdn_net_type_trans(struct sk_buff *skb, struct net_device *dev)
         struct ethhdr *eth;
         unsigned char *rawp;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
         eth = eth_hdr(skb);
 
@@ -1786,7 +1787,7 @@ isdn_net_receive(struct net_device *ndev, struct sk_buff *skb)
         }
         skb->dev = ndev;
         skb->pkt_type = PACKET_HOST;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
 #ifdef ISDN_DEBUG_NET_DUMP
         isdn_dumppkt("R:", skb->data, skb->len, 40);
 #endif
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 1b2df80c3bce..387392cb3d68 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -1100,7 +1100,8 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
                                         goto drop_packet;
                                 }
                                 skb_put(skb, skb_old->len + 128);
-                                memcpy(skb->data, skb_old->data, skb_old->len);
+                                skb_copy_from_linear_data(skb_old, skb->data,
+                                                          skb_old->len);
                                 if (net_dev->local->ppp_slot < 0) {
                                         printk(KERN_ERR "%s: net_dev->local->ppp_slot(%d) out of range\n",
                                                 __FUNCTION__, net_dev->local->ppp_slot);
@@ -1167,7 +1168,7 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
                 mlp->huptimer = 0;
 #endif /* CONFIG_IPPP_FILTER */
         skb->dev = dev;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         netif_rx(skb);
         /* net_dev->local->stats.rx_packets++; done in isdn_net.c */
         return;
@@ -1902,7 +1903,9 @@ void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
                 while( from != to ) {
                         unsigned int len = from->len - MP_HEADER_LEN;
 
-                        memcpy(skb_put(skb,len), from->data+MP_HEADER_LEN, len);
+                        skb_copy_from_linear_data_offset(from, MP_HEADER_LEN,
+                                                         skb_put(skb,len),
+                                                         len);
                         frag = from->next;
                         isdn_ppp_mp_free_skb(mp, from);
                         from = frag; 
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index e3add27dd0e1..e93ad59f60bf 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -415,7 +415,8 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
                 spin_lock_irqsave(&card->isdnloop_lock, flags);
                 nskb = dev_alloc_skb(skb->len);
                 if (nskb) {
-                        memcpy(skb_put(nskb, len), skb->data, len);
+                        skb_copy_from_linear_data(skb,
+                                                  skb_put(nskb, len), len);
                         skb_queue_tail(&card->bqueue[channel], nskb);
                         dev_kfree_skb(skb);
                 } else
diff --git a/drivers/isdn/pcbit/capi.c b/drivers/isdn/pcbit/capi.c
index 47c59e95898d..7b55e151f1b0 100644
--- a/drivers/isdn/pcbit/capi.c
+++ b/drivers/isdn/pcbit/capi.c
@@ -429,8 +429,9 @@ int capi_decode_conn_ind(struct pcbit_chan * chan,
                 if (!(info->data.setup.CallingPN = kmalloc(len - count + 1, GFP_ATOMIC)))
                         return -1;
        
-                memcpy(info->data.setup.CallingPN, skb->data + count + 1, 
-                       len - count);
+                skb_copy_from_linear_data_offset(skb, count + 1,
+                                                 info->data.setup.CallingPN,
+                                                 len - count);
                 info->data.setup.CallingPN[len - count] = 0;
 
         }
@@ -457,8 +458,9 @@ int capi_decode_conn_ind(struct pcbit_chan * chan,
                 if (!(info->data.setup.CalledPN = kmalloc(len - count + 1, GFP_ATOMIC)))
                         return -1;
         
-                memcpy(info->data.setup.CalledPN, skb->data + count + 1, 
-                       len - count); 
+                skb_copy_from_linear_data_offset(skb, count + 1,
+                                                 info->data.setup.CalledPN,
+                                                 len - count);
                 info->data.setup.CalledPN[len - count] = 0;
 
         }
@@ -539,7 +541,7 @@ int capi_decode_conn_actv_ind(struct pcbit_chan * chan, struct sk_buff *skb)
 
 #ifdef DEBUG
         if (len > 1 && len < 31) {
-                memcpy(str, skb->data + 2, len - 1);
+                skb_copy_from_linear_data_offset(skb, 2, str, len - 1);
                 str[len] = 0;
                 printk(KERN_DEBUG "Connected Party Number: %s\n", str);
         }
diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index e85b4c7c36f7..cab26f301eab 100644
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -1171,6 +1171,7 @@ void kvm_mmu_pre_write(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes)
                          * and zap two pdes instead of one.
                          */
                         if (level == PT32_ROOT_LEVEL) {
+                                page_offset &= ~7; /* kill rounding error */
                                 page_offset <<= 1;
                                 npte = 2;
                         }
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index 76e9c36597eb..6a5ab409c4e7 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -174,7 +174,7 @@ static unsigned short dvb_net_eth_type_trans(struct sk_buff *skb,
         struct ethhdr *eth;
         unsigned char *rawp;
 
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb,dev->hard_header_len);
         eth = eth_hdr(skb);
 
@@ -600,6 +600,7 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                         /* Check CRC32, we've got it in our skb already. */
                         unsigned short ulen = htons(priv->ule_sndu_len);
                         unsigned short utype = htons(priv->ule_sndu_type);
+                        const u8 *tail;
                         struct kvec iov[3] = {
                                 { &ulen, sizeof ulen },
                                 { &utype, sizeof utype },
@@ -613,10 +614,11 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                         }
 
                         ule_crc = iov_crc32(ule_crc, iov, 3);
-                        expected_crc = *((u8 *)priv->ule_skb->tail - 4) << 24 |
-                                       *((u8 *)priv->ule_skb->tail - 3) << 16 |
-                                       *((u8 *)priv->ule_skb->tail - 2) << 8 |
-                                       *((u8 *)priv->ule_skb->tail - 1);
+                        tail = skb_tail_pointer(priv->ule_skb);
+                        expected_crc = *(tail - 4) << 24 |
+                                       *(tail - 3) << 16 |
+                                       *(tail - 2) << 8 |
+                                       *(tail - 1);
                         if (ule_crc != expected_crc) {
                                 printk(KERN_WARNING "%lu: CRC32 check FAILED: %08x / %08x, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
                                        priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0);
@@ -695,7 +697,9 @@ static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
                                         }
                                         else
                                         {
-                                                memcpy(dest_addr,  priv->ule_skb->data, ETH_ALEN);
+                                                skb_copy_from_linear_data(priv->ule_skb,
+                                                              dest_addr,
+                                                              ETH_ALEN);
                                                 skb_pull(priv->ule_skb, ETH_ALEN);
                                         }
                                 }
diff --git a/drivers/message/fusion/mptlan.c b/drivers/message/fusion/mptlan.c
index b691292ff599..7dd34bd28efc 100644
--- a/drivers/message/fusion/mptlan.c
+++ b/drivers/message/fusion/mptlan.c
@@ -714,6 +714,7 @@ mpt_lan_sdu_send (struct sk_buff *skb, struct net_device *dev)
         LANSendRequest_t *pSendReq;
         SGETransaction32_t *pTrans;
         SGESimple64_t *pSimple;
+        const unsigned char *mac;
         dma_addr_t dma;
         unsigned long flags;
         int ctx;
@@ -753,7 +754,7 @@ mpt_lan_sdu_send (struct sk_buff *skb, struct net_device *dev)
         /* Set the mac.raw pointer, since this apparently isn't getting
          * done before we get the skb. Pull the data pointer past the mac data.
          */
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, 12);
 
         dma = pci_map_single(mpt_dev->pcidev, skb->data, skb->len,
@@ -784,6 +785,7 @@ mpt_lan_sdu_send (struct sk_buff *skb, struct net_device *dev)
 //                      IOC_AND_NETDEV_NAMES_s_s(dev),
 //                      ctx, skb, skb->data));
 
+        mac = skb_mac_header(skb);
 #ifdef QLOGIC_NAA_WORKAROUND
 {
         struct NAA_Hosed *nh;
@@ -793,12 +795,12 @@ mpt_lan_sdu_send (struct sk_buff *skb, struct net_device *dev)
            drops. */
         read_lock_irq(&bad_naa_lock);
         for (nh = mpt_bad_naa; nh != NULL; nh=nh->next) {
-                if ((nh->ieee[0] == skb->mac.raw[0]) &&
-                    (nh->ieee[1] == skb->mac.raw[1]) &&
-                    (nh->ieee[2] == skb->mac.raw[2]) &&
-                    (nh->ieee[3] == skb->mac.raw[3]) &&
-                    (nh->ieee[4] == skb->mac.raw[4]) &&
-                    (nh->ieee[5] == skb->mac.raw[5])) {
+                if ((nh->ieee[0] == mac[0]) &&
+                    (nh->ieee[1] == mac[1]) &&
+                    (nh->ieee[2] == mac[2]) &&
+                    (nh->ieee[3] == mac[3]) &&
+                    (nh->ieee[4] == mac[4]) &&
+                    (nh->ieee[5] == mac[5])) {
                         cur_naa = nh->NAA;
                         dlprintk ((KERN_INFO "mptlan/sdu_send: using NAA value "
                                   "= %04x.\n", cur_naa));
@@ -810,12 +812,12 @@ mpt_lan_sdu_send (struct sk_buff *skb, struct net_device *dev)
 #endif
 
         pTrans->TransactionDetails[0] = cpu_to_le32((cur_naa         << 16) |
-                                                    (skb->mac.raw[0] <<  8) |
-                                                    (skb->mac.raw[1] <<  0));
-        pTrans->TransactionDetails[1] = cpu_to_le32((skb->mac.raw[2] << 24) |
-                                                    (skb->mac.raw[3] << 16) |
-                                                    (skb->mac.raw[4] <<  8) |
-                                                    (skb->mac.raw[5] <<  0));
+                                                    (mac[0] <<  8) |
+                                                    (mac[1] <<  0));
+        pTrans->TransactionDetails[1] = cpu_to_le32((mac[2] << 24) |
+                                                    (mac[3] << 16) |
+                                                    (mac[4] <<  8) |
+                                                    (mac[5] <<  0));
 
         pSimple = (SGESimple64_t *) &pTrans->TransactionDetails[2];
 
@@ -930,7 +932,7 @@ mpt_lan_receive_post_turbo(struct net_device *dev, u32 tmsg)
                 pci_dma_sync_single_for_cpu(mpt_dev->pcidev, priv->RcvCtl[ctx].dma,
                                             priv->RcvCtl[ctx].len, PCI_DMA_FROMDEVICE);
 
-                memcpy(skb_put(skb, len), old_skb->data, len);
+                skb_copy_from_linear_data(old_skb, skb_put(skb, len), len);
 
                 pci_dma_sync_single_for_device(mpt_dev->pcidev, priv->RcvCtl[ctx].dma,
                                                priv->RcvCtl[ctx].len, PCI_DMA_FROMDEVICE);
@@ -1091,7 +1093,7 @@ mpt_lan_receive_post_reply(struct net_device *dev,
                                                     priv->RcvCtl[ctx].dma,
                                                     priv->RcvCtl[ctx].len,
                                                     PCI_DMA_FROMDEVICE);
-                        memcpy(skb_put(skb, l), old_skb->data, l);
+                        skb_copy_from_linear_data(old_skb, skb_put(skb, l), l);
 
                         pci_dma_sync_single_for_device(mpt_dev->pcidev,
                                                        priv->RcvCtl[ctx].dma,
@@ -1120,7 +1122,7 @@ mpt_lan_receive_post_reply(struct net_device *dev,
                                             priv->RcvCtl[ctx].len,
                                             PCI_DMA_FROMDEVICE);
 
-                memcpy(skb_put(skb, len), old_skb->data, len);
+                skb_copy_from_linear_data(old_skb, skb_put(skb, len), len);
 
                 pci_dma_sync_single_for_device(mpt_dev->pcidev,
                                                priv->RcvCtl[ctx].dma,
@@ -1549,7 +1551,7 @@ mpt_lan_type_trans(struct sk_buff *skb, struct net_device *dev)
         struct mpt_lan_ohdr *fch = (struct mpt_lan_ohdr *)skb->data;
         struct fcllc *fcllc;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, sizeof(struct mpt_lan_ohdr));
 
         if (fch->dtype == htons(0xffff)) {
diff --git a/drivers/mtd/maps/sun_uflash.c b/drivers/mtd/maps/sun_uflash.c
index 4db2055cee31..001af7f7ddda 100644
--- a/drivers/mtd/maps/sun_uflash.c
+++ b/drivers/mtd/maps/sun_uflash.c
@@ -39,7 +39,7 @@ MODULE_VERSION("2.0");
 
 static LIST_HEAD(device_list);
 struct uflash_dev {
-        char                    *name;  /* device name */
+        const char              *name;  /* device name */
         struct map_info         map;    /* mtd map info */
         struct mtd_info         *mtd;   /* mtd info */
 };
@@ -80,7 +80,7 @@ int uflash_devinit(struct linux_ebus_device *edev, struct device_node *dp)
 
         up->name = of_get_property(dp, "model", NULL);
         if (up->name && 0 < strlen(up->name))
-                up->map.name = up->name;
+                up->map.name = (char *)up->name;
 
         up->map.phys = res->start;
 
diff --git a/drivers/net/3c501.c b/drivers/net/3c501.c
index 06e33786078d..4bee99ba7dbb 100644
--- a/drivers/net/3c501.c
+++ b/drivers/net/3c501.c
@@ -735,7 +735,6 @@ static void el_receive(struct net_device *dev)
         else
         {
                 skb_reserve(skb,2);     /* Force 16 byte alignment */
-                skb->dev = dev;
                 /*
                  *      The read increments through the bytes. The interrupt
                  *      handler will fix the pointer when it returns to
diff --git a/drivers/net/3c505.c b/drivers/net/3c505.c
index 702bfb2a5e99..e985a85a5623 100644
--- a/drivers/net/3c505.c
+++ b/drivers/net/3c505.c
@@ -615,7 +615,6 @@ static void receive_packet(struct net_device *dev, int len)
         if (test_and_set_bit(0, (void *) &adapter->dmaing))
                 printk(KERN_ERR "%s: rx blocked, DMA in progress, dir %d\n", dev->name, adapter->current_dma.direction);
 
-        skb->dev = dev;
         adapter->current_dma.direction = 0;
         adapter->current_dma.length = rlen;
         adapter->current_dma.skb = skb;
@@ -1026,7 +1025,7 @@ static int send_packet(struct net_device *dev, struct sk_buff *skb)
         adapter->current_dma.start_time = jiffies;
 
         if ((unsigned long)(skb->data + nlen) >= MAX_DMA_ADDRESS || nlen != skb->len) {
-                memcpy(adapter->dma_buffer, skb->data, nlen);
+                skb_copy_from_linear_data(skb, adapter->dma_buffer, nlen);
                 memset(adapter->dma_buffer+skb->len, 0, nlen-skb->len);
                 target = isa_virt_to_bus(adapter->dma_buffer);
         }
diff --git a/drivers/net/3c507.c b/drivers/net/3c507.c
index 54e1d5aebed3..eed4299dc426 100644
--- a/drivers/net/3c507.c
+++ b/drivers/net/3c507.c
@@ -873,7 +873,6 @@ static void el16_rx(struct net_device *dev)
                         }
 
                         skb_reserve(skb,2);
-                        skb->dev = dev;
 
                         /* 'skb->data' points to the start of sk_buff data area. */
                         memcpy_fromio(skb_put(skb,pkt_len), data_frame + 10, pkt_len);
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index f791bf026e51..c7511c4d3b68 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1091,7 +1091,6 @@ el3_rx(struct net_device *dev)
                                 printk("Receiving packet size %d status %4.4x.\n",
                                            pkt_len, rx_status);
                         if (skb != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);     /* Align IP on 16 byte */
 
                                 /* 'skb->data' points to the start of sk_buff data area. */
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index c307ce66145c..290166d5e7d1 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -1292,7 +1292,6 @@ static int corkscrew_rx(struct net_device *dev)
                                 printk("Receiving packet size %d status %4.4x.\n",
                                      pkt_len, rx_status);
                         if (skb != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 insl(ioaddr + RX_FIFO,
@@ -1363,7 +1362,6 @@ static int boomerang_rx(struct net_device *dev)
                            copying to a properly sized skbuff. */
                         if (pkt_len < rx_copybreak
                             && (skb = dev_alloc_skb(pkt_len + 4)) != 0) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 memcpy(skb_put(skb, pkt_len),
diff --git a/drivers/net/3c523.c b/drivers/net/3c523.c
index 17d61eb0a7e5..da1a22c13865 100644
--- a/drivers/net/3c523.c
+++ b/drivers/net/3c523.c
@@ -988,7 +988,6 @@ static void elmc_rcv_int(struct net_device *dev)
                                 rbd->status = 0;
                                 skb = (struct sk_buff *) dev_alloc_skb(totlen + 2);
                                 if (skb != NULL) {
-                                        skb->dev = dev;
                                         skb_reserve(skb, 2);    /* 16 byte alignment */
                                         skb_put(skb,totlen);
                                         eth_copy_and_sum(skb, (char *) p->base+(unsigned long) rbd->buffer,totlen,0);
@@ -1146,7 +1145,7 @@ static int elmc_send_packet(struct sk_buff *skb, struct net_device *dev)
 
         if (len != skb->len)
                 memset((char *) p->xmit_cbuffs[p->xmit_count], 0, ETH_ZLEN);
-        memcpy((char *) p->xmit_cbuffs[p->xmit_count], (char *) (skb->data), skb->len);
+        skb_copy_from_linear_data(skb, (char *) p->xmit_cbuffs[p->xmit_count], skb->len);
 
 #if (NUM_XMIT_BUFFS == 1)
 #ifdef NO_NOPCOMMANDS
diff --git a/drivers/net/3c527.c b/drivers/net/3c527.c
index 6c7437e60bd2..c7b571be20e0 100644
--- a/drivers/net/3c527.c
+++ b/drivers/net/3c527.c
@@ -1189,7 +1189,6 @@ static void mc32_rx_ring(struct net_device *dev)
                         }
 
                         skb->protocol=eth_type_trans(skb,dev);
-                        skb->dev=dev;
                         dev->last_rx = jiffies;
                         lp->net_stats.rx_packets++;
                         lp->net_stats.rx_bytes += length;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index b406ecfa7268..80924f76dee8 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2414,7 +2414,6 @@ static int vortex_rx(struct net_device *dev)
                                 printk(KERN_DEBUG "Receiving packet size %d status %4.4x.\n",
                                            pkt_len, rx_status);
                         if (skb != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 if (vp->bus_master &&
@@ -2491,7 +2490,6 @@ boomerang_rx(struct net_device *dev)
                         /* Check if the packet is long enough to just accept without
                            copying to a properly sized skbuff. */
                         if (pkt_len < rx_copybreak && (skb = dev_alloc_skb(pkt_len + 2)) != 0) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                                 pci_dma_sync_single_for_cpu(VORTEX_PCI(vp), dma, PKT_BUF_SZ, PCI_DMA_FROMDEVICE);
                                 /* 'skb_put()' points to the start of sk_buff data area. */
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 1b3d11ed6cff..d396f996af57 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -331,7 +331,6 @@ static int lance_rx (struct net_device *dev)
                                 return 0;
                         }
 
-                        skb->dev = dev;
                         skb_reserve (skb, 2);           /* 16 byte align */
                         skb_put (skb, len);             /* make room */
                         eth_copy_and_sum(skb,
@@ -568,7 +567,7 @@ int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
 
         if (skb->len < ETH_ZLEN)
                 memset((char *)&ib->tx_buf[entry][0], 0, ETH_ZLEN);
-        memcpy ((char *)&ib->tx_buf [entry][0], skb->data, skblen);
+        skb_copy_from_linear_data(skb, &ib->tx_buf[entry][0], skblen);
 
         /* Now, give the packet to the lance */
         ib->btx_ring [entry].tmd1_bits = (LE_T1_POK|LE_T1_OWN);
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 12c8453f44bc..e8c9f27817b0 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -573,7 +573,6 @@ rx_status_loop:
                 }
 
                 skb_reserve(new_skb, RX_OFFSET);
-                new_skb->dev = dev;
 
                 pci_unmap_single(cp->pdev, mapping,
                                  buflen, PCI_DMA_FROMDEVICE);
@@ -807,7 +806,7 @@ static int cp_start_xmit (struct sk_buff *skb, struct net_device *dev)
                 if (mss)
                         flags |= LargeSend | ((mss & MSSMask) << MSSShift);
                 else if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        const struct iphdr *ip = skb->nh.iph;
+                        const struct iphdr *ip = ip_hdr(skb);
                         if (ip->protocol == IPPROTO_TCP)
                                 flags |= IPCS | TCPCS;
                         else if (ip->protocol == IPPROTO_UDP)
@@ -826,7 +825,7 @@ static int cp_start_xmit (struct sk_buff *skb, struct net_device *dev)
                 u32 first_len, first_eor;
                 dma_addr_t first_mapping;
                 int frag, first_entry = entry;
-                const struct iphdr *ip = skb->nh.iph;
+                const struct iphdr *ip = ip_hdr(skb);
 
                 /* We must give this initial chunk to the device last.
                  * Otherwise we could race with the device.
@@ -1082,7 +1081,6 @@ static int cp_refill_rx (struct cp_private *cp)
                 if (!skb)
                         goto err_out;
 
-                skb->dev = cp->dev;
                 skb_reserve(skb, RX_OFFSET);
 
                 mapping = pci_map_single(cp->pdev, skb->data, cp->rx_buf_sz,
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 99304b2aa86e..a844b1fe2dc4 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1904,10 +1904,10 @@ static __inline__ void wrap_copy(struct sk_buff *skb, const unsigned char *ring,
         u32 left = RX_BUF_LEN - offset;
 
         if (size > left) {
-                memcpy(skb->data, ring + offset, left);
-                memcpy(skb->data+left, ring, size - left);
+                skb_copy_to_linear_data(skb, ring + offset, left);
+                skb_copy_to_linear_data_offset(skb, left, ring, size - left);
         } else
-                memcpy(skb->data, ring + offset, size);
+                skb_copy_to_linear_data(skb, ring + offset, size);
 }
 #endif
 
@@ -2013,7 +2013,6 @@ no_early_rx:
 
                 skb = dev_alloc_skb (pkt_size + 2);
                 if (likely(skb)) {
-                        skb->dev = dev;
                         skb_reserve (skb, 2);   /* 16 byte align the IP fields. */
 #if RX_BUF_IDX == 3
                         wrap_copy(skb, rx_ring, ring_offset+4, pkt_size);
diff --git a/drivers/net/82596.c b/drivers/net/82596.c
index 640d7ca2ebcf..3ff1155459a3 100644
--- a/drivers/net/82596.c
+++ b/drivers/net/82596.c
@@ -830,7 +830,6 @@ memory_squeeze:
                                 lp->stats.rx_dropped++;
                         }
                         else {
-                                skb->dev = dev;
                                 if (!rx_in_place) {
                                         /* 16 byte align the data fields */
                                         skb_reserve(skb, 2);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index c3f9f599f134..a3d46ea37126 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2263,6 +2263,7 @@ config GIANFAR
         tristate "Gianfar Ethernet"
         depends on 85xx || 83xx || PPC_86xx
         select PHYLIB
+        select CRC32
         help
           This driver supports the Gigabit TSEC on the MPC83xx, MPC85xx,
           and MPC86xx family of chips, and the FEC on the 8540.
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 33af833667da..58527322a39d 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -206,7 +206,7 @@ obj-$(CONFIG_TR) += tokenring/
 obj-$(CONFIG_WAN) += wan/
 obj-$(CONFIG_ARCNET) += arcnet/
 obj-$(CONFIG_NET_PCMCIA) += pcmcia/
-obj-$(CONFIG_NET_RADIO) += wireless/
+obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
 obj-$(CONFIG_HAMRADIO) += hamradio/
 obj-$(CONFIG_IRDA) += irda/
diff --git a/drivers/net/a2065.c b/drivers/net/a2065.c
index d76548e75350..1226cbba0450 100644
--- a/drivers/net/a2065.c
+++ b/drivers/net/a2065.c
@@ -320,7 +320,6 @@ static int lance_rx (struct net_device *dev)
                                 return 0;
                         }
 
-                        skb->dev = dev;
                         skb_reserve (skb, 2);           /* 16 byte align */
                         skb_put (skb, len);             /* make room */
                         eth_copy_and_sum(skb,
@@ -599,7 +598,7 @@ static int lance_start_xmit (struct sk_buff *skb, struct net_device *dev)
         ib->btx_ring [entry].length = (-len) | 0xf000;
         ib->btx_ring [entry].misc = 0;
 
-        memcpy ((char *)&ib->tx_buf [entry][0], skb->data, skblen);
+        skb_copy_from_linear_data(skb, &ib->tx_buf [entry][0], skblen);
 
         /* Clear the slack of the packet, do I need this? */
         if (len != skblen)
diff --git a/drivers/net/acenic.c b/drivers/net/acenic.c
index 7138e0e025bc..7122b7ba8d61 100644
--- a/drivers/net/acenic.c
+++ b/drivers/net/acenic.c
@@ -2027,7 +2027,6 @@ static void ace_rx_int(struct net_device *dev, u32 rxretprd, u32 rxretcsm)
                  */
                 csum = retdesc->tcp_udp_csum;
 
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
 
                 /*
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 962c954c2d56..675fe918421b 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -798,9 +798,7 @@ static int amd8111e_rx_poll(struct net_device *dev, int * budget)
                         pci_unmap_single(lp->pci_dev,lp->rx_dma_addr[rx_index],
                                          lp->rx_buff_len-2, PCI_DMA_FROMDEVICE);
                         skb_put(skb, pkt_len);
-                        skb->dev = dev;
                         lp->rx_skbuff[rx_index] = new_skb;
-                        new_skb->dev = dev;
                         lp->rx_dma_addr[rx_index] = pci_map_single(lp->pci_dev,
                                                                    new_skb->data,
                                                                    lp->rx_buff_len-2,
@@ -926,9 +924,7 @@ static int amd8111e_rx(struct net_device *dev)
                 pci_unmap_single(lp->pci_dev,lp->rx_dma_addr[rx_index],
                         lp->rx_buff_len-2, PCI_DMA_FROMDEVICE);
                 skb_put(skb, pkt_len);
-                skb->dev = dev;
                 lp->rx_skbuff[rx_index] = new_skb;
-                new_skb->dev = dev;
                 lp->rx_dma_addr[rx_index] = pci_map_single(lp->pci_dev,
                         new_skb->data, lp->rx_buff_len-2,PCI_DMA_FROMDEVICE);
 
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index dba5e5165452..da6ffa8cd81e 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -853,9 +853,9 @@ static void cops_rx(struct net_device *dev)
                 return;
         }
 
-        skb->mac.raw    = skb->data;    /* Point to entire packet. */
+        skb_reset_mac_header(skb);    /* Point to entire packet. */
         skb_pull(skb,3);
-        skb->h.raw      = skb->data;    /* Point to data (Skip header). */
+        skb_reset_transport_header(skb);    /* Point to data (Skip header). */
 
         /* Update the counters. */
         lp->stats.rx_packets++;
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index 2ea44ce49810..6a6cbd331a16 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -770,13 +770,13 @@ static int sendup_buffer (struct net_device *dev)
         skb->data[0] = dnode;
         skb->data[1] = snode;
         skb->data[2] = llaptype;
-        skb->mac.raw = skb->data;       /* save pointer to llap header */
+        skb_reset_mac_header(skb);      /* save pointer to llap header */
         skb_pull(skb,3);
 
         /* copy ddp(s,e)hdr + contents */
-        memcpy(skb->data,(void*)ltdmabuf,len);
+        skb_copy_to_linear_data(skb, ltdmabuf, len);
 
-        skb->h.raw = skb->data;
+        skb_reset_transport_header(skb);
 
         stats->rx_packets++;
         stats->rx_bytes+=skb->len;
@@ -917,13 +917,14 @@ static int ltpc_xmit(struct sk_buff *skb, struct net_device *dev)
 
         int i;
         struct lt_sendlap cbuf;
+        unsigned char *hdr;
 
         cbuf.command = LT_SENDLAP;
         cbuf.dnode = skb->data[0];
         cbuf.laptype = skb->data[2];
         skb_pull(skb,3);        /* skip past LLAP header */
         cbuf.length = skb->len; /* this is host order */
-        skb->h.raw=skb->data;
+        skb_reset_transport_header(skb);
 
         if(debug & DEBUG_UPPER) {
                 printk("command ");
@@ -932,11 +933,13 @@ static int ltpc_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk("\n");
         }
 
-        do_write(dev,&cbuf,sizeof(cbuf),skb->h.raw,skb->len);
+        hdr = skb_transport_header(skb);
+        do_write(dev, &cbuf, sizeof(cbuf), hdr, skb->len);
 
         if(debug & DEBUG_UPPER) {
                 printk("sent %d ddp bytes\n",skb->len);
-                for(i=0;i<skb->len;i++) printk("%02x ",skb->h.raw[i]);
+                for (i = 0; i < skb->len; i++)
+                        printk("%02x ", hdr[i]);
                 printk("\n");
         }
 
diff --git a/drivers/net/arcnet/arc-rawmode.c b/drivers/net/arcnet/arc-rawmode.c
index 6318814a11a8..e0a18e7c73cb 100644
--- a/drivers/net/arcnet/arc-rawmode.c
+++ b/drivers/net/arcnet/arc-rawmode.c
@@ -110,7 +110,7 @@ static void rx(struct net_device *dev, int bufnum,
 
         pkt = (struct archdr *) skb->data;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, ARC_HDR_SIZE);
 
         /* up to sizeof(pkt->soft) has already been copied from the card */
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 83004fdab0a4..681e20b8466f 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -519,9 +519,12 @@ static int arcnet_header(struct sk_buff *skb, struct net_device *dev,
                  * real header when we do rebuild_header.
                  */
                 *(uint16_t *) skb_push(skb, 2) = type;
-                if (skb->nh.raw - skb->mac.raw != 2)
+                /*
+                 * XXX: Why not use skb->mac_len?
+                 */
+                if (skb->network_header - skb->mac_header != 2)
                         BUGMSG(D_NORMAL, "arcnet_header: Yikes!  diff (%d) is not 2!\n",
-                               (int)(skb->nh.raw - skb->mac.raw));
+                               (int)(skb->network_header - skb->mac_header));
                 return -2;      /* return error -- can't transmit yet! */
         }
         else {
@@ -554,11 +557,13 @@ static int arcnet_rebuild_header(struct sk_buff *skb)
         unsigned short type;
         uint8_t daddr=0;
         struct ArcProto *proto;
-
-        if (skb->nh.raw - skb->mac.raw != 2) {
+        /*
+         * XXX: Why not use skb->mac_len?
+         */
+        if (skb->network_header - skb->mac_header != 2) {
                 BUGMSG(D_NORMAL,
-                     "rebuild_header: shouldn't be here! (hdrsize=%d)\n",
-                     (int)(skb->nh.raw - skb->mac.raw));
+                       "rebuild_header: shouldn't be here! (hdrsize=%d)\n",
+                       (int)(skb->network_header - skb->mac_header));
                 return 0;
         }
         type = *(uint16_t *) skb_pull(skb, 2);
diff --git a/drivers/net/arcnet/capmode.c b/drivers/net/arcnet/capmode.c
index 66485585ab39..cc4610db6395 100644
--- a/drivers/net/arcnet/capmode.c
+++ b/drivers/net/arcnet/capmode.c
@@ -122,10 +122,8 @@ static void rx(struct net_device *dev, int bufnum,
         }
         skb_put(skb, length + ARC_HDR_SIZE + sizeof(int));
         skb->dev = dev;
-
-        pkt = (struct archdr *) skb->data;
-
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
+        pkt = (struct archdr *)skb_mac_header(skb);
         skb_pull(skb, ARC_HDR_SIZE);
 
         /* up to sizeof(pkt->soft) has already been copied from the card */
@@ -270,13 +268,13 @@ static int ack_tx(struct net_device *dev, int acked)
   skb_put(ackskb, length + ARC_HDR_SIZE );
   ackskb->dev = dev;
 
-  ackpkt = (struct archdr *) ackskb->data;
-
-  ackskb->mac.raw = ackskb->data;
+  skb_reset_mac_header(ackskb);
+  ackpkt = (struct archdr *)skb_mac_header(ackskb);
   /* skb_pull(ackskb, ARC_HDR_SIZE); */
 
 
-  memcpy(ackpkt, lp->outgoing.skb->data, ARC_HDR_SIZE+sizeof(struct arc_cap));
+  skb_copy_from_linear_data(lp->outgoing.skb, ackpkt,
+                ARC_HDR_SIZE + sizeof(struct arc_cap));
   ackpkt->soft.cap.proto=0; /* using protocol 0 for acknowledge */
   ackpkt->soft.cap.mes.ack=acked;
 
diff --git a/drivers/net/arcnet/rfc1051.c b/drivers/net/arcnet/rfc1051.c
index 6d6c69f036ef..2de8877ece29 100644
--- a/drivers/net/arcnet/rfc1051.c
+++ b/drivers/net/arcnet/rfc1051.c
@@ -94,7 +94,7 @@ static unsigned short type_trans(struct sk_buff *skb, struct net_device *dev)
         int hdr_size = ARC_HDR_SIZE + RFC1051_HDR_SIZE;
 
         /* Pull off the arcnet header. */
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, hdr_size);
 
         if (pkt->hard.dest == 0)
diff --git a/drivers/net/arcnet/rfc1201.c b/drivers/net/arcnet/rfc1201.c
index bee34226abfa..460a095000c2 100644
--- a/drivers/net/arcnet/rfc1201.c
+++ b/drivers/net/arcnet/rfc1201.c
@@ -96,7 +96,7 @@ static unsigned short type_trans(struct sk_buff *skb, struct net_device *dev)
         int hdr_size = ARC_HDR_SIZE + RFC1201_HDR_SIZE;
 
         /* Pull off the arcnet header. */
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, hdr_size);
 
         if (pkt->hard.dest == 0)
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index 9dfc09b181c1..a0e68e718531 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -743,7 +743,6 @@ static int ariadne_rx(struct net_device *dev)
             }
 
 
-            skb->dev = dev;
             skb_reserve(skb,2);         /* 16 byte align */
             skb_put(skb,pkt_len);       /* Make room */
             eth_copy_and_sum(skb, (char *)priv->rx_buff[entry], pkt_len,0);
diff --git a/drivers/net/arm/am79c961a.c b/drivers/net/arm/am79c961a.c
index ddd12d44ff22..8f0d7ce503c9 100644
--- a/drivers/net/arm/am79c961a.c
+++ b/drivers/net/arm/am79c961a.c
@@ -526,7 +526,6 @@ am79c961_rx(struct net_device *dev, struct dev_priv *priv)
                 skb = dev_alloc_skb(len + 2);
 
                 if (skb) {
-                        skb->dev = dev;
                         skb_reserve(skb, 2);
 
                         am_readbuffer(dev, pktaddr, skb_put(skb, len), len);
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 1621b8fe35cf..152fa7a042b8 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -858,7 +858,6 @@ static void at91ether_rx(struct net_device *dev)
                         skb_reserve(skb, 2);
                         memcpy(skb_put(skb, pktlen), p_recv, pktlen);
 
-                        skb->dev = dev;
                         skb->protocol = eth_type_trans(skb, dev);
                         dev->last_rx = jiffies;
                         lp->stats.rx_bytes += pktlen;
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index dd698b033a62..2438c5bff237 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -255,7 +255,6 @@ static int ep93xx_rx(struct net_device *dev, int *budget)
 
                 skb = dev_alloc_skb(length + 2);
                 if (likely(skb != NULL)) {
-                        skb->dev = dev;
                         skb_reserve(skb, 2);
                         dma_sync_single(NULL, ep->descs->rdesc[entry].buf_addr,
                                                 length, DMA_FROM_DEVICE);
diff --git a/drivers/net/arm/ether1.c b/drivers/net/arm/ether1.c
index a2921882eba8..f075cebe84ad 100644
--- a/drivers/net/arm/ether1.c
+++ b/drivers/net/arm/ether1.c
@@ -875,7 +875,6 @@ ether1_recv_done (struct net_device *dev)
                         skb = dev_alloc_skb (length + 2);
 
                         if (skb) {
-                                skb->dev = dev;
                                 skb_reserve (skb, 2);
 
                                 ether1_readbuffer (dev, skb_put (skb, length), rbd.rbd_bufl, length);
diff --git a/drivers/net/arm/ether3.c b/drivers/net/arm/ether3.c
index 841178343a07..32da2eb9bcee 100644
--- a/drivers/net/arm/ether3.c
+++ b/drivers/net/arm/ether3.c
@@ -661,7 +661,6 @@ if (next_ptr < RX_START || next_ptr >= RX_END) {
                         if (skb) {
                                 unsigned char *buf;
 
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);
                                 buf = skb_put(skb, length);
                                 ether3_readbuffer(dev, buf + 12, length - 12);
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index 56ae8babd919..bed8e0ebaf19 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -768,7 +768,6 @@ net_rx(struct net_device *dev)
                                 lp->stats.rx_dropped++;
                                 break;
                         }
-                        skb->dev = dev;
                         skb_reserve(skb,2);
 
                         insw(ioaddr + DATAPORT, skb_put(skb,pkt_len), (pkt_len + 1) >> 1);
diff --git a/drivers/net/atari_bionet.c b/drivers/net/atari_bionet.c
index 4e3bf6a1f22c..3d87bd2b4194 100644
--- a/drivers/net/atari_bionet.c
+++ b/drivers/net/atari_bionet.c
@@ -453,7 +453,8 @@ bionet_send_packet(struct sk_buff *skb, struct net_device *dev) {
                 stdma_lock(bionet_intr, NULL);
                 local_irq_restore(flags);
                 if( !STRAM_ADDR(buf+length-1) ) {
-                        memcpy(nic_packet->buffer, skb->data, length);
+                        skb_copy_from_linear_data(skb, nic_packet->buffer,
+                                                  length);
                         buf = (unsigned long)&((struct nic_pkt_s *)phys_nic_packet)->buffer;
                 }
 
@@ -544,13 +545,13 @@ bionet_poll_rx(struct net_device *dev) {
                                 break;
                         }
 
-                        skb->dev = dev;
                         skb_reserve( skb, 2 );          /* 16 Byte align  */
                         skb_put( skb, pkt_len );        /* make room */
 
                         /* 'skb->data' points to the start of sk_buff data area.
                          */
-                        memcpy(skb->data, nic_packet->buffer, pkt_len);
+                        skb_copy_to_linear_data(skb, nic_packet->buffer,
+                                                pkt_len);
                         skb->protocol = eth_type_trans( skb, dev );
                         netif_rx(skb);
                         dev->last_rx = jiffies;
diff --git a/drivers/net/atari_pamsnet.c b/drivers/net/atari_pamsnet.c
index 3b5436149286..54714409a09b 100644
--- a/drivers/net/atari_pamsnet.c
+++ b/drivers/net/atari_pamsnet.c
@@ -717,7 +717,8 @@ pamsnet_send_packet(struct sk_buff *skb, struct net_device *dev) {
 
                 local_irq_restore(flags);
                 if( !STRAM_ADDR(buf+length-1) ) {
-                        memcpy(nic_packet->buffer, skb->data, length);
+                        skb_copy_from_linear_data(skb, nic_packet->buffer,
+                                                  length);
                         buf = (unsigned long)phys_nic_packet;
                 }
 
@@ -792,7 +793,8 @@ pamsnet_poll_rx(struct net_device *dev) {
 
                         /* 'skb->data' points to the start of sk_buff data area.
                          */
-                        memcpy(skb->data, nic_packet->buffer, pkt_len);
+                        skb_copy_to_linear_data(skb, nic_packet->buffer,
+                                                pkt_len);
                         netif_rx(skb);
                         dev->last_rx = jiffies;
                         lp->stats.rx_packets++;
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index 7e37ac86a69a..dfa8b9ba4c80 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -1047,7 +1047,6 @@ static int lance_rx( struct net_device *dev )
                                                    pkt_len );
                                 }
 
-                                skb->dev = dev;
                                 skb_reserve( skb, 2 );  /* 16 byte align */
                                 skb_put( skb, pkt_len );        /* Make room */
                                 lp->memcpy_f( skb->data, PKTBUF_ADDR(head), pkt_len );
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 8606eac5bec8..4b1d4d153ecf 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -408,7 +408,6 @@ static void atl1_rx_checksum(struct atl1_adapter *adapter,
 static u16 atl1_alloc_rx_buffers(struct atl1_adapter *adapter)
 {
         struct atl1_rfd_ring *rfd_ring = &adapter->rfd_ring;
-        struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
         struct page *page;
         unsigned long offset;
@@ -444,7 +443,6 @@ static u16 atl1_alloc_rx_buffers(struct atl1_adapter *adapter)
                  * the 14 byte MAC header is removed
                  */
                 skb_reserve(skb, NET_IP_ALIGN);
-                skb->dev = netdev;
 
                 buffer_info->alloced = 1;
                 buffer_info->skb = skb;
@@ -1296,19 +1294,21 @@ static int atl1_tso(struct atl1_adapter *adapter, struct sk_buff *skb,
                 }
 
                 if (skb->protocol == ntohs(ETH_P_IP)) {
-                        skb->nh.iph->tot_len = 0;
-                        skb->nh.iph->check = 0;
-                        skb->h.th->check =
-                            ~csum_tcpudp_magic(skb->nh.iph->saddr,
-                                               skb->nh.iph->daddr, 0,
-                                               IPPROTO_TCP, 0);
-                        ipofst = skb->nh.raw - skb->data;
+                        struct iphdr *iph = ip_hdr(skb);
+
+                        iph->tot_len = 0;
+                        iph->check = 0;
+                        tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
+                                                                 iph->daddr, 0,
+                                                                 IPPROTO_TCP,
+                                                                 0);
+                        ipofst = skb_network_offset(skb);
                         if (ipofst != ENET_HEADER_SIZE) /* 802.3 frame */
                                 tso->tsopl |= 1 << TSO_PARAM_ETHTYPE_SHIFT;
 
-                        tso->tsopl |= (skb->nh.iph->ihl &
+                        tso->tsopl |= (iph->ihl &
                                 CSUM_PARAM_IPHL_MASK) << CSUM_PARAM_IPHL_SHIFT;
-                        tso->tsopl |= ((skb->h.th->doff << 2) &
+                        tso->tsopl |= (tcp_hdrlen(skb) &
                                 TSO_PARAM_TCPHDRLEN_MASK) << TSO_PARAM_TCPHDRLEN_SHIFT;
                         tso->tsopl |= (skb_shinfo(skb)->gso_size &
                                 TSO_PARAM_MSS_MASK) << TSO_PARAM_MSS_SHIFT;
@@ -1327,8 +1327,8 @@ static int atl1_tx_csum(struct atl1_adapter *adapter, struct sk_buff *skb,
         u8 css, cso;
 
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                cso = skb->h.raw - skb->data;
-                css = (skb->h.raw + skb->csum_offset) - skb->data;
+                cso = skb_transport_offset(skb);
+                css = cso + skb->csum_offset;
                 if (unlikely(cso & 0x1)) {
                         printk(KERN_DEBUG "%s: payload offset != even number\n",
                                 atl1_driver_name);
@@ -1370,8 +1370,7 @@ static void atl1_tx_map(struct atl1_adapter *adapter,
 
         if (tcp_seg) {
                 /* TSO/GSO */
-                proto_hdr_len =
-                    ((skb->h.raw - skb->data) + (skb->h.th->doff << 2));
+                proto_hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 buffer_info->length = proto_hdr_len;
                 page = virt_to_page(skb->data);
                 offset = (unsigned long)skb->data & ~PAGE_MASK;
@@ -1563,8 +1562,8 @@ static int atl1_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         mss = skb_shinfo(skb)->gso_size;
         if (mss) {
                 if (skb->protocol == htons(ETH_P_IP)) {
-                        proto_hdr_len = ((skb->h.raw - skb->data) +
-                                         (skb->h.th->doff << 2));
+                        proto_hdr_len = (skb_transport_offset(skb) +
+                                         tcp_hdrlen(skb));
                         if (unlikely(proto_hdr_len > len)) {
                                 dev_kfree_skb_any(skb);
                                 return NETDEV_TX_OK;
diff --git a/drivers/net/atp.c b/drivers/net/atp.c
index 2d306fcb7f36..18aba838c1ff 100644
--- a/drivers/net/atp.c
+++ b/drivers/net/atp.c
@@ -793,7 +793,6 @@ static void net_rx(struct net_device *dev)
                         lp->stats.rx_dropped++;
                         goto done;
                 }
-                skb->dev = dev;
 
                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                 read_block(ioaddr, pkt_len, skb_put(skb,pkt_len), dev->if_port);
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 69ae229b680e..d10fb80e9a63 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -1125,7 +1125,7 @@ static int au1000_tx(struct sk_buff *skb, struct net_device *dev)
         }
 
         pDB = aup->tx_db_inuse[aup->tx_head];
-        memcpy((void *)pDB->vaddr, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, pDB->vaddr, skb->len);
         if (skb->len < ETH_ZLEN) {
                 for (i=skb->len; i<ETH_ZLEN; i++) {
                         ((char *)pDB->vaddr)[i] = 0;
@@ -1205,7 +1205,6 @@ static int au1000_rx(struct net_device *dev)
                                 aup->stats.rx_dropped++;
                                 continue;
                         }
-                        skb->dev = dev;
                         skb_reserve(skb, 2);    /* 16 byte IP header align */
                         eth_copy_and_sum(skb,
                                 (unsigned char *)pDB->vaddr, frmlen, 0);
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index d742bfe24471..879a2fff474e 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -825,12 +825,11 @@ static int b44_rx(struct b44 *bp, int budget)
                         if (copy_skb == NULL)
                                 goto drop_it_no_recycle;
 
-                        copy_skb->dev = bp->dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         /* DMA sync done above, copy just the actual packet */
-                        memcpy(copy_skb->data, skb->data+bp->rx_offset, len);
-
+                        skb_copy_from_linear_data_offset(skb, bp->rx_offset,
+                                                         copy_skb->data, len);
                         skb = copy_skb;
                 }
                 skb->ip_summed = CHECKSUM_NONE;
@@ -1007,7 +1006,8 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto err_out;
                 }
 
-                memcpy(skb_put(bounce_skb, len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(bounce_skb, len),
+                                          skb->len);
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
         }
diff --git a/drivers/net/bmac.c b/drivers/net/bmac.c
index c143304dcff5..4612725965df 100644
--- a/drivers/net/bmac.c
+++ b/drivers/net/bmac.c
@@ -715,7 +715,6 @@ static irqreturn_t bmac_rxdma_intr(int irq, void *dev_id)
                 if (skb != NULL) {
                         nb -= ETHERCRC;
                         skb_put(skb, nb);
-                        skb->dev = dev;
                         skb->protocol = eth_type_trans(skb, dev);
                         netif_rx(skb);
                         dev->last_rx = jiffies;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 0b7aded8dcfd..f98a2205a090 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.7"
-#define DRV_MODULE_RELDATE      "March 29, 2007"
+#define DRV_MODULE_VERSION      "1.5.8"
+#define DRV_MODULE_RELDATE      "April 24, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -1884,10 +1884,8 @@ bnx2_rx_int(struct bnx2 *bp, int budget)
                                 goto reuse_rx;
 
                         /* aligned copy */
-                        memcpy(new_skb->data,
-                                skb->data + bp->rx_offset - 2,
-                                len + 2);
-
+                        skb_copy_from_linear_data_offset(skb, bp->rx_offset - 2,
+                                      new_skb->data, len + 2);
                         skb_reserve(new_skb, 2);
                         skb_put(new_skb, len);
 
@@ -3421,6 +3419,9 @@ bnx2_init_chip(struct bnx2 *bp)
         val = REG_RD(bp, BNX2_MQ_CONFIG);
         val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
         val |= BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE_256;
+        if (CHIP_ID(bp) == CHIP_ID_5709_A0 || CHIP_ID(bp) == CHIP_ID_5709_A1)
+                val |= BNX2_MQ_CONFIG_HALT_DIS;
+
         REG_WR(bp, BNX2_MQ_CONFIG, val);
 
         val = 0x10000 + (MAX_CID_CNT * MB_KERNEL_CTX_SIZE);
@@ -4510,6 +4511,7 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if ((mss = skb_shinfo(skb)->gso_size) &&
                 (skb->len > (bp->dev->mtu + ETH_HLEN))) {
                 u32 tcp_opt_len, ip_tcp_len;
+                struct iphdr *iph;
 
                 if (skb_header_cloned(skb) &&
                     pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
@@ -4517,25 +4519,23 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         return NETDEV_TX_OK;
                 }
 
-                tcp_opt_len = ((skb->h.th->doff - 5) * 4);
                 vlan_tag_flags |= TX_BD_FLAGS_SW_LSO;
 
                 tcp_opt_len = 0;
-                if (skb->h.th->doff > 5) {
-                        tcp_opt_len = (skb->h.th->doff - 5) << 2;
-                }
-                ip_tcp_len = (skb->nh.iph->ihl << 2) + sizeof(struct tcphdr);
-
-                skb->nh.iph->check = 0;
-                skb->nh.iph->tot_len = htons(mss + ip_tcp_len + tcp_opt_len);
-                skb->h.th->check =
-                        ~csum_tcpudp_magic(skb->nh.iph->saddr,
-                                            skb->nh.iph->daddr,
-                                            0, IPPROTO_TCP, 0);
-
-                if (tcp_opt_len || (skb->nh.iph->ihl > 5)) {
-                        vlan_tag_flags |= ((skb->nh.iph->ihl - 5) +
-                                (tcp_opt_len >> 2)) << 8;
+                if (tcp_hdr(skb)->doff > 5)
+                        tcp_opt_len = tcp_optlen(skb);
+
+                ip_tcp_len = ip_hdrlen(skb) + sizeof(struct tcphdr);
+
+                iph = ip_hdr(skb);
+                iph->check = 0;
+                iph->tot_len = htons(mss + ip_tcp_len + tcp_opt_len);
+                tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
+                                                         iph->daddr, 0,
+                                                         IPPROTO_TCP, 0);
+                if (tcp_opt_len || (iph->ihl > 5)) {
+                        vlan_tag_flags |= ((iph->ihl - 5) +
+                                           (tcp_opt_len >> 2)) << 8;
                 }
         }
         else
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index ccbdf81c6599..878eee58f12a 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6518,6 +6518,7 @@ struct bnx2 {
 #define CHIP_ID_5708_B0                 0x57081000
 #define CHIP_ID_5708_B1                 0x57081010
 #define CHIP_ID_5709_A0                 0x57090000
+#define CHIP_ID_5709_A1                 0x57090010
 
 #define CHIP_BOND_ID(bp)                (((bp)->chip_id) & 0xf)
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 3fb354d9c515..7e03f41ae2c2 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -884,8 +884,8 @@ static int ad_lacpdu_send(struct port *port)
         }
 
         skb->dev = slave->dev;
-        skb->mac.raw = skb->data;
-        skb->nh.raw = skb->data + ETH_HLEN;
+        skb_reset_mac_header(skb);
+        skb->network_header = skb->mac_header + ETH_HLEN;
         skb->protocol = PKT_TYPE_LACPDU;
         skb->priority = TC_PRIO_CONTROL;
 
@@ -928,8 +928,8 @@ static int ad_marker_send(struct port *port, struct marker *marker)
         skb_reserve(skb, 16);
 
         skb->dev = slave->dev;
-        skb->mac.raw = skb->data;
-        skb->nh.raw = skb->data + ETH_HLEN;
+        skb_reset_mac_header(skb);
+        skb->network_header = skb->mac_header + ETH_HLEN;
         skb->protocol = PKT_TYPE_LACPDU;
 
         marker_header = (struct marker_header *)skb_put(skb, length);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 217a2eedee0a..92c3b6f6a8e7 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -104,10 +104,15 @@ struct arp_pkt {
 };
 #pragma pack()
 
+static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb)
+{
+        return (struct arp_pkt *)skb_network_header(skb);
+}
+
 /* Forward declaration */
 static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[]);
 
-static inline u8 _simple_hash(u8 *hash_start, int hash_size)
+static inline u8 _simple_hash(const u8 *hash_start, int hash_size)
 {
         int i;
         u8 hash = 0;
@@ -613,7 +618,7 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, u32 src_ip)
 static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond)
 {
         struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond));
-        struct arp_pkt *arp = (struct arp_pkt *)skb->nh.raw;
+        struct arp_pkt *arp = arp_pkt(skb);
         struct slave *assigned_slave;
         struct rlb_client_info *client_info;
         u32 hash_index = 0;
@@ -701,7 +706,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
  */
 static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)
 {
-        struct arp_pkt *arp = (struct arp_pkt *)skb->nh.raw;
+        struct arp_pkt *arp = arp_pkt(skb);
         struct slave *tx_slave = NULL;
 
         if (arp->op_code == __constant_htons(ARPOP_REPLY)) {
@@ -890,8 +895,8 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
                 data = skb_put(skb, size);
                 memcpy(data, &pkt, size);
 
-                skb->mac.raw = data;
-                skb->nh.raw = data + ETH_HLEN;
+                skb_reset_mac_header(skb);
+                skb->network_header = skb->mac_header + ETH_HLEN;
                 skb->protocol = pkt.type;
                 skb->priority = TC_PRIO_CONTROL;
                 skb->dev = slave->dev;
@@ -1263,10 +1268,10 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
         int hash_size = 0;
         int do_tx_balance = 1;
         u32 hash_index = 0;
-        u8 *hash_start = NULL;
+        const u8 *hash_start = NULL;
         int res = 1;
 
-        skb->mac.raw = (unsigned char *)skb->data;
+        skb_reset_mac_header(skb);
         eth_data = eth_hdr(skb);
 
         /* make sure that the curr_active_slave and the slaves list do
@@ -1280,15 +1285,18 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
         }
 
         switch (ntohs(skb->protocol)) {
-        case ETH_P_IP:
+        case ETH_P_IP: {
+                const struct iphdr *iph = ip_hdr(skb);
+
                 if ((memcmp(eth_data->h_dest, mac_bcast, ETH_ALEN) == 0) ||
-                    (skb->nh.iph->daddr == ip_bcast) ||
-                    (skb->nh.iph->protocol == IPPROTO_IGMP)) {
+                    (iph->daddr == ip_bcast) ||
+                    (iph->protocol == IPPROTO_IGMP)) {
                         do_tx_balance = 0;
                         break;
                 }
-                hash_start = (char*)&(skb->nh.iph->daddr);
-                hash_size = sizeof(skb->nh.iph->daddr);
+                hash_start = (char *)&(iph->daddr);
+                hash_size = sizeof(iph->daddr);
+        }
                 break;
         case ETH_P_IPV6:
                 if (memcmp(eth_data->h_dest, mac_bcast, ETH_ALEN) == 0) {
@@ -1296,8 +1304,8 @@ int bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev)
                         break;
                 }
 
-                hash_start = (char*)&(skb->nh.ipv6h->daddr);
-                hash_size = sizeof(skb->nh.ipv6h->daddr);
+                hash_start = (char *)&(ipv6_hdr(skb)->daddr);
+                hash_size = sizeof(ipv6_hdr(skb)->daddr);
                 break;
         case ETH_P_IPX:
                 if (ipx_hdr(skb)->ipx_checksum !=
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e4724d874e7c..cea3783c92c5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2524,7 +2524,7 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
                                  (2 * sizeof(u32)))))
                 goto out_unlock;
 
-        arp = skb->nh.arph;
+        arp = arp_hdr(skb);
         if (arp->ar_hln != dev->addr_len ||
             skb->pkt_type == PACKET_OTHERHOST ||
             skb->pkt_type == PACKET_LOOPBACK ||
@@ -3476,7 +3476,7 @@ static int bond_xmit_hash_policy_l34(struct sk_buff *skb,
                                     struct net_device *bond_dev, int count)
 {
         struct ethhdr *data = (struct ethhdr *)skb->data;
-        struct iphdr *iph = skb->nh.iph;
+        struct iphdr *iph = ip_hdr(skb);
         u16 *layer4hdr = (u16 *)((u32 *)iph + iph->ihl);
         int layer4_xor = 0;
 
@@ -3640,9 +3640,8 @@ static struct net_device_stats *bond_get_stats(struct net_device *bond_dev)
         read_lock_bh(&bond->lock);
 
         bond_for_each_slave(bond, slave, i) {
-                if (slave->dev->get_stats) {
-                        sstats = slave->dev->get_stats(slave->dev);
-
+                sstats = slave->dev->get_stats(slave->dev);
+                if (sstats) {
                         stats->rx_packets += sstats->rx_packets;
                         stats->rx_bytes += sstats->rx_bytes;
                         stats->rx_errors += sstats->rx_errors;
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index c8126484c2be..4aec747d9e43 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -1995,7 +1995,6 @@ static int cas_rx_process_pkt(struct cas *cp, struct cas_rx_comp *rxc,
                 return -1;
 
         *skbref = skb;
-        skb->dev = cp->dev;
         skb_reserve(skb, swivel);
 
         p = skb->data;
@@ -2822,10 +2821,8 @@ static inline int cas_xmit_tx_ringN(struct cas *cp, int ring,
 
         ctrl = 0;
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                u64 csum_start_off, csum_stuff_off;
-
-                csum_start_off = (u64) (skb->h.raw - skb->data);
-                csum_stuff_off = csum_start_off + skb->csum_offset;
+                const u64 csum_start_off = skb_transport_offset(skb);
+                const u64 csum_stuff_off = csum_start_off + skb->csum_offset;
 
                 ctrl =  TX_DESC_CSUM_EN |
                         CAS_BASE(TX_DESC_CSUM_START, csum_start_off) |
@@ -2849,8 +2846,8 @@ static inline int cas_xmit_tx_ringN(struct cas *cp, int ring,
                               ctrl | TX_DESC_SOF, 0);
                 entry = TX_DESC_NEXT(ring, entry);
 
-                memcpy(tx_tiny_buf(cp, ring, entry), skb->data +
-                       len - tabort, tabort);
+                skb_copy_from_linear_data_offset(skb, len - tabort,
+                              tx_tiny_buf(cp, ring, entry), tabort);
                 mapping = tx_tiny_map(cp, ring, entry, tentry);
                 cas_write_txd(cp, ring, entry, mapping, tabort, ctrl,
                               (nr_frags == 0));
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 326d4a665123..e4f874a70fe5 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1062,7 +1062,7 @@ static inline struct sk_buff *get_packet(struct pci_dev *pdev,
                                             pci_unmap_addr(ce, dma_addr),
                                             pci_unmap_len(ce, dma_len),
                                             PCI_DMA_FROMDEVICE);
-                memcpy(skb->data, ce->skb->data, len);
+                skb_copy_from_linear_data(ce->skb, skb->data, len);
                 pci_dma_sync_single_for_device(pdev,
                                                pci_unmap_addr(ce, dma_addr),
                                                pci_unmap_len(ce, dma_len),
@@ -1379,12 +1379,11 @@ static void sge_rx(struct sge *sge, struct freelQ *fl, unsigned int len)
         }
         __skb_pull(skb, sizeof(*p));
 
-        skb->dev = adapter->port[p->iff].dev;
         skb->dev->last_rx = jiffies;
         st = per_cpu_ptr(sge->port_stats[p->iff], smp_processor_id());
         st->rx_packets++;
 
-        skb->protocol = eth_type_trans(skb, skb->dev);
+        skb->protocol = eth_type_trans(skb, adapter->port[p->iff].dev);
         if ((adapter->flags & RX_CSUM_ENABLED) && p->csum == 0xffff &&
             skb->protocol == htons(ETH_P_IP) &&
             (skb->data[9] == IPPROTO_TCP || skb->data[9] == IPPROTO_UDP)) {
@@ -1866,14 +1865,14 @@ int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 ++st->tx_tso;
 
-                eth_type = skb->nh.raw - skb->data == ETH_HLEN ?
+                eth_type = skb_network_offset(skb) == ETH_HLEN ?
                         CPL_ETH_II : CPL_ETH_II_VLAN;
 
                 hdr = (struct cpl_tx_pkt_lso *)skb_push(skb, sizeof(*hdr));
                 hdr->opcode = CPL_TX_PKT_LSO;
                 hdr->ip_csum_dis = hdr->l4_csum_dis = 0;
-                hdr->ip_hdr_words = skb->nh.iph->ihl;
-                hdr->tcp_hdr_words = skb->h.th->doff;
+                hdr->ip_hdr_words = ip_hdr(skb)->ihl;
+                hdr->tcp_hdr_words = tcp_hdr(skb)->doff;
                 hdr->eth_type_mss = htons(MK_ETH_TYPE_MSS(eth_type,
                                                           skb_shinfo(skb)->gso_size));
                 hdr->len = htonl(skb->len - sizeof(*hdr));
@@ -1913,7 +1912,7 @@ int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 if (!(adapter->flags & UDP_CSUM_CAPABLE) &&
                     skb->ip_summed == CHECKSUM_PARTIAL &&
-                    skb->nh.iph->protocol == IPPROTO_UDP) {
+                    ip_hdr(skb)->protocol == IPPROTO_UDP) {
                         if (unlikely(skb_checksum_help(skb))) {
                                 pr_debug("%s: unable to do udp checksum\n", dev->name);
                                 dev_kfree_skb_any(skb);
@@ -1926,7 +1925,7 @@ int t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  */
                 if ((unlikely(!adapter->sge->espibug_skb[dev->if_port]))) {
                         if (skb->protocol == htons(ETH_P_ARP) &&
-                            skb->nh.arph->ar_op == htons(ARPOP_REQUEST)) {
+                            arp_hdr(skb)->ar_op == htons(ARPOP_REQUEST)) {
                                 adapter->sge->espibug_skb[dev->if_port] = skb;
                                 /* We want to re-use this skb later. We
                                  * simply bump the reference count and it
@@ -2096,10 +2095,14 @@ static void espibug_workaround_t204(unsigned long data)
                                         0x0, 0x7, 0x43, 0x0, 0x0, 0x0
                                 };
 
-                                memcpy(skb->data + sizeof(struct cpl_tx_pkt),
-                                        ch_mac_addr, ETH_ALEN);
-                                memcpy(skb->data + skb->len - 10,
-                                        ch_mac_addr, ETH_ALEN);
+                                skb_copy_to_linear_data_offset(skb,
+                                                    sizeof(struct cpl_tx_pkt),
+                                                               ch_mac_addr,
+                                                               ETH_ALEN);
+                                skb_copy_to_linear_data_offset(skb,
+                                                               skb->len - 10,
+                                                               ch_mac_addr,
+                                                               ETH_ALEN);
                                 skb->cb[0] = 0xff;
                         }
 
@@ -2126,10 +2129,14 @@ static void espibug_workaround(unsigned long data)
                         if (!skb->cb[0]) {
                                 u8 ch_mac_addr[ETH_ALEN] =
                                     {0x0, 0x7, 0x43, 0x0, 0x0, 0x0};
-                                memcpy(skb->data + sizeof(struct cpl_tx_pkt),
-                                       ch_mac_addr, ETH_ALEN);
-                                memcpy(skb->data + skb->len - 10, ch_mac_addr,
-                                       ETH_ALEN);
+                                skb_copy_to_linear_data_offset(skb,
+                                                     sizeof(struct cpl_tx_pkt),
+                                                               ch_mac_addr,
+                                                               ETH_ALEN);
+                                skb_copy_to_linear_data_offset(skb,
+                                                               skb->len - 10,
+                                                               ch_mac_addr,
+                                                               ETH_ALEN);
                                 skb->cb[0] = 0xff;
                         }
 
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 8eb571276000..5bdf5ca85a65 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -1348,7 +1348,8 @@ e100_rx(struct net_device *dev)
 
 #ifdef ETHDEBUG
                 printk("head = 0x%x, data = 0x%x, tail = 0x%x, end = 0x%x\n",
-                  skb->head, skb->data, skb->tail, skb->end);
+                       skb->head, skb->data, skb_tail_pointer(skb),
+                       skb_end_pointer(skb));
                 printk("copying packet to 0x%x.\n", skb_data_ptr);
 #endif
 
@@ -1375,7 +1376,6 @@ e100_rx(struct net_device *dev)
                 myNextRxDesc->descr.buf = L1_CACHE_ALIGN(virt_to_phys(myNextRxDesc->skb->data));
         }
 
-        skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
 
         /* Send the packet to the upper layers */
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 4612f71a7106..9774bb1b3e80 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1004,7 +1004,6 @@ skip_this_frame:
                 return;
         }
         skb_reserve(skb, 2);    /* longword align L3 header */
-        skb->dev = dev;
 
         if (bp + length > lp->end_dma_buff) {
                 int semi_cnt = lp->end_dma_buff - bp;
@@ -1702,7 +1701,6 @@ net_rx(struct net_device *dev)
                 return;
         }
         skb_reserve(skb, 2);    /* longword align L3 header */
-        skb->dev = dev;
 
         readwords(ioaddr, RX_FRAME_PORT, skb_put(skb, length), length >> 1);
         if (length & 1)
diff --git a/drivers/net/cxgb3/cxgb3_defs.h b/drivers/net/cxgb3/cxgb3_defs.h
index e14862b43d17..483a594210a7 100644
--- a/drivers/net/cxgb3/cxgb3_defs.h
+++ b/drivers/net/cxgb3/cxgb3_defs.h
@@ -67,7 +67,10 @@ static inline union listen_entry *stid2entry(const struct tid_info *t,
 static inline struct t3c_tid_entry *lookup_tid(const struct tid_info *t,
                                                unsigned int tid)
 {
-        return tid < t->ntids ? &(t->tid_tab[tid]) : NULL;
+        struct t3c_tid_entry *t3c_tid = tid < t->ntids ?
+            &(t->tid_tab[tid]) : NULL;
+
+        return (t3c_tid && t3c_tid->client) ? t3c_tid : NULL;
 }
 
 /*
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index 48649244673e..ebcf35e4cf5b 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -508,6 +508,7 @@ void cxgb3_queue_tid_release(struct t3cdev *tdev, unsigned int tid)
 
         spin_lock_bh(&td->tid_release_lock);
         p->ctx = (void *)td->tid_release_list;
+        p->client = NULL;
         td->tid_release_list = p;
         if (!p->ctx)
                 schedule_work(&td->tid_release_task);
@@ -623,7 +624,8 @@ static int do_act_open_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_atid(&(T3C_DATA(dev))->tid_maps, atid);
-        if (t3c_tid->ctx && t3c_tid->client && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client &&
+            t3c_tid->client->handlers &&
             t3c_tid->client->handlers[CPL_ACT_OPEN_RPL]) {
                 return t3c_tid->client->handlers[CPL_ACT_OPEN_RPL] (dev, skb,
                                                                     t3c_tid->
@@ -642,7 +644,7 @@ static int do_stid_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_stid(&(T3C_DATA(dev))->tid_maps, stid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode] (dev, skb,
                                                              t3c_tid->ctx);
@@ -660,7 +662,7 @@ static int do_hwtid_rpl(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode]
                     (dev, skb, t3c_tid->ctx);
@@ -689,6 +691,28 @@ static int do_cr(struct t3cdev *dev, struct sk_buff *skb)
         }
 }
 
+/*
+ * Returns an sk_buff for a reply CPL message of size len.  If the input
+ * sk_buff has no other users it is trimmed and reused, otherwise a new buffer
+ * is allocated.  The input skb must be of size at least len.  Note that this
+ * operation does not destroy the original skb data even if it decides to reuse
+ * the buffer.
+ */
+static struct sk_buff *cxgb3_get_cpl_reply_skb(struct sk_buff *skb, size_t len,
+                                               int gfp)
+{
+        if (likely(!skb_cloned(skb))) {
+                BUG_ON(skb->len < len);
+                __skb_trim(skb, len);
+                skb_get(skb);
+        } else {
+                skb = alloc_skb(len, gfp);
+                if (skb)
+                        __skb_put(skb, len);
+        }
+        return skb;
+}
+
 static int do_abort_req_rss(struct t3cdev *dev, struct sk_buff *skb)
 {
         union opcode_tid *p = cplhdr(skb);
@@ -696,30 +720,39 @@ static int do_abort_req_rss(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[p->opcode]) {
                 return t3c_tid->client->handlers[p->opcode]
                     (dev, skb, t3c_tid->ctx);
         } else {
                 struct cpl_abort_req_rss *req = cplhdr(skb);
                 struct cpl_abort_rpl *rpl;
+                struct sk_buff *reply_skb;
+                unsigned int tid = GET_TID(req);
+                u8 cmd = req->status;
+
+                if (req->status == CPL_ERR_RTX_NEG_ADVICE ||
+                    req->status == CPL_ERR_PERSIST_NEG_ADVICE)
+                        goto out;
 
-                struct sk_buff *skb =
-                    alloc_skb(sizeof(struct cpl_abort_rpl), GFP_ATOMIC);
-                if (!skb) {
+                reply_skb = cxgb3_get_cpl_reply_skb(skb,
+                                                    sizeof(struct
+                                                           cpl_abort_rpl),
+                                                    GFP_ATOMIC);
+
+                if (!reply_skb) {
                         printk("do_abort_req_rss: couldn't get skb!\n");
                         goto out;
                 }
-                skb->priority = CPL_PRIORITY_DATA;
-                __skb_put(skb, sizeof(struct cpl_abort_rpl));
-                rpl = cplhdr(skb);
+                reply_skb->priority = CPL_PRIORITY_DATA;
+                __skb_put(reply_skb, sizeof(struct cpl_abort_rpl));
+                rpl = cplhdr(reply_skb);
                 rpl->wr.wr_hi =
                     htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_RPL));
-                rpl->wr.wr_lo = htonl(V_WR_TID(GET_TID(req)));
-                OPCODE_TID(rpl) =
-                    htonl(MK_OPCODE_TID(CPL_ABORT_RPL, GET_TID(req)));
-                rpl->cmd = req->status;
-                cxgb3_ofld_send(dev, skb);
+                rpl->wr.wr_lo = htonl(V_WR_TID(tid));
+                OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_ABORT_RPL, tid));
+                rpl->cmd = cmd;
+                cxgb3_ofld_send(dev, reply_skb);
 out:
                 return CPL_RET_BUF_DONE;
         }
@@ -732,7 +765,7 @@ static int do_act_establish(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_atid(&(T3C_DATA(dev))->tid_maps, atid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[CPL_ACT_ESTABLISH]) {
                 return t3c_tid->client->handlers[CPL_ACT_ESTABLISH]
                     (dev, skb, t3c_tid->ctx);
@@ -750,7 +783,7 @@ static int do_trace(struct t3cdev *dev, struct sk_buff *skb)
         skb->protocol = htons(0xffff);
         skb->dev = dev->lldev;
         skb_pull(skb, sizeof(*p));
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         netif_receive_skb(skb);
         return 0;
 }
@@ -762,7 +795,7 @@ static int do_term(struct t3cdev *dev, struct sk_buff *skb)
         struct t3c_tid_entry *t3c_tid;
 
         t3c_tid = lookup_tid(&(T3C_DATA(dev))->tid_maps, hwtid);
-        if (t3c_tid->ctx && t3c_tid->client->handlers &&
+        if (t3c_tid && t3c_tid->ctx && t3c_tid->client->handlers &&
             t3c_tid->client->handlers[opcode]) {
                 return t3c_tid->client->handlers[opcode] (dev, skb,
                                                           t3c_tid->ctx);
@@ -961,7 +994,7 @@ void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
         for (tid = 0; tid < ti->ntids; tid++) {
                 te = lookup_tid(ti, tid);
                 BUG_ON(!te);
-                if (te->ctx && te->client && te->client->redirect) {
+                if (te && te->ctx && te->client && te->client->redirect) {
                         update_tcb = te->client->redirect(te->ctx, old, new, e);
                         if (update_tcb) {
                                 l2t_hold(L2DATA(tdev), e);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 027ab2c3825c..3666586a4831 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -661,7 +661,7 @@ static inline struct sk_buff *get_imm_packet(const struct rsp_desc *resp)
 
         if (skb) {
                 __skb_put(skb, IMMED_PKT_SIZE);
-                memcpy(skb->data, resp->imm_data, IMMED_PKT_SIZE);
+                skb_copy_to_linear_data(skb, resp->imm_data, IMMED_PKT_SIZE);
         }
         return skb;
 }
@@ -897,11 +897,11 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
                 d->flit[2] = 0;
                 cntrl |= V_TXPKT_OPCODE(CPL_TX_PKT_LSO);
                 hdr->cntrl = htonl(cntrl);
-                eth_type = skb->nh.raw - skb->data == ETH_HLEN ?
+                eth_type = skb_network_offset(skb) == ETH_HLEN ?
                     CPL_ETH_II : CPL_ETH_II_VLAN;
                 tso_info |= V_LSO_ETH_TYPE(eth_type) |
-                    V_LSO_IPHDR_WORDS(skb->nh.iph->ihl) |
-                    V_LSO_TCPHDR_WORDS(skb->h.th->doff);
+                    V_LSO_IPHDR_WORDS(ip_hdr(skb)->ihl) |
+                    V_LSO_TCPHDR_WORDS(tcp_hdr(skb)->doff);
                 hdr->lso_info = htonl(tso_info);
                 flits = 3;
         } else {
@@ -913,7 +913,8 @@ static void write_tx_pkt_wr(struct adapter *adap, struct sk_buff *skb,
                 if (skb->len <= WR_LEN - sizeof(*cpl)) {
                         q->sdesc[pidx].skb = NULL;
                         if (!skb->data_len)
-                                memcpy(&d->flit[2], skb->data, skb->len);
+                                skb_copy_from_linear_data(skb, &d->flit[2],
+                                                          skb->len);
                         else
                                 skb_copy_bits(skb, 0, &d->flit[2], skb->len);
 
@@ -1319,16 +1320,19 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
         /* Only TX_DATA builds SGLs */
 
         from = (struct work_request_hdr *)skb->data;
-        memcpy(&d->flit[1], &from[1], skb->h.raw - skb->data - sizeof(*from));
+        memcpy(&d->flit[1], &from[1],
+               skb_transport_offset(skb) - sizeof(*from));
 
-        flits = (skb->h.raw - skb->data) / 8;
+        flits = skb_transport_offset(skb) / 8;
         sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
-        sgl_flits = make_sgl(skb, sgp, skb->h.raw, skb->tail - skb->h.raw,
+        sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
+                             skb->tail - skb->transport_header,
                              adap->pdev);
         if (need_skb_unmap()) {
                 setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
                 skb->destructor = deferred_unmap_destructor;
-                ((struct unmap_info *)skb->cb)->len = skb->tail - skb->h.raw;
+                ((struct unmap_info *)skb->cb)->len = (skb->tail -
+                                                       skb->transport_header);
         }
 
         write_wr_hdr_sgl(ndesc, skb, d, pidx, q, sgl, flits, sgl_flits,
@@ -1349,8 +1353,8 @@ static inline unsigned int calc_tx_descs_ofld(const struct sk_buff *skb)
         if (skb->len <= WR_LEN && cnt == 0)
                 return 1;       /* packet fits as immediate data */
 
-        flits = (skb->h.raw - skb->data) / 8;   /* headers */
-        if (skb->tail != skb->h.raw)
+        flits = skb_transport_offset(skb) / 8;  /* headers */
+        if (skb->tail != skb->transport_header)
                 cnt++;
         return flits_to_desc(flits + sgl_len(cnt));
 }
@@ -1620,7 +1624,9 @@ static inline int rx_offload(struct t3cdev *tdev, struct sge_rspq *rq,
                              unsigned int gather_idx)
 {
         rq->offload_pkts++;
-        skb->mac.raw = skb->nh.raw = skb->h.raw = skb->data;
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
 
         if (rq->polling) {
                 rx_gather[gather_idx++] = skb;
@@ -1684,9 +1690,8 @@ static void rx_eth(struct adapter *adap, struct sge_rspq *rq,
         struct port_info *pi;
 
         skb_pull(skb, sizeof(*p) + pad);
-        skb->dev = adap->port[p->iff];
         skb->dev->last_rx = jiffies;
-        skb->protocol = eth_type_trans(skb, skb->dev);
+        skb->protocol = eth_type_trans(skb, adap->port[p->iff]);
         pi = netdev_priv(skb->dev);
         if (pi->rx_csum_offload && p->csum_valid && p->csum == 0xffff &&
             !p->fragment) {
@@ -1717,11 +1722,11 @@ static void skb_data_init(struct sk_buff *skb, struct sge_fl_page *p,
 {
         skb->len = len;
         if (len <= SKB_DATA_SIZE) {
-                memcpy(skb->data, p->va, len);
+                skb_copy_to_linear_data(skb, p->va, len);
                 skb->tail += len;
                 put_page(p->frag.page);
         } else {
-                memcpy(skb->data, p->va, SKB_DATA_SIZE);
+                skb_copy_to_linear_data(skb, p->va, SKB_DATA_SIZE);
                 skb_shinfo(skb)->frags[0].page = p->frag.page;
                 skb_shinfo(skb)->frags[0].page_offset =
                     p->frag.page_offset + SKB_DATA_SIZE;
@@ -1767,7 +1772,7 @@ static struct sk_buff *get_packet(struct adapter *adap, struct sge_fl *fl,
                         __skb_put(skb, len);
                         pci_dma_sync_single_for_cpu(adap->pdev, mapping, len,
                                                     PCI_DMA_FROMDEVICE);
-                        memcpy(skb->data, sd->t.skb->data, len);
+                        skb_copy_from_linear_data(sd->t.skb, skb->data, len);
                         pci_dma_sync_single_for_device(adap->pdev, mapping, len,
                                                        PCI_DMA_FROMDEVICE);
                 } else if (!drop_thres)
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index d83f075ef2d7..fb485d0a43d8 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -1523,19 +1523,25 @@ static int mac_intr_handler(struct adapter *adap, unsigned int idx)
  */
 int t3_phy_intr_handler(struct adapter *adapter)
 {
-        static const int intr_gpio_bits[] = { 8, 0x20 };
-
+        u32 mask, gpi = adapter_info(adapter)->gpio_intr;
         u32 i, cause = t3_read_reg(adapter, A_T3DBG_INT_CAUSE);
 
         for_each_port(adapter, i) {
-                if (cause & intr_gpio_bits[i]) {
-                        struct cphy *phy = &adap2pinfo(adapter, i)->phy;
-                        int phy_cause = phy->ops->intr_handler(phy);
+                struct port_info *p = adap2pinfo(adapter, i);
+
+                mask = gpi - (gpi & (gpi - 1));
+                gpi -= mask;
+
+                if (!(p->port_type->caps & SUPPORTED_IRQ))
+                        continue;
+
+                if (cause & mask) {
+                        int phy_cause = p->phy.ops->intr_handler(&p->phy);
 
                         if (phy_cause & cphy_cause_link_change)
                                 t3_link_changed(adapter, i);
                         if (phy_cause & cphy_cause_fifo_error)
-                                phy->fifo_errors++;
+                                p->phy.fifo_errors++;
                 }
         }
 
diff --git a/drivers/net/de600.c b/drivers/net/de600.c
index e547ce14eefe..dae97b860daa 100644
--- a/drivers/net/de600.c
+++ b/drivers/net/de600.c
@@ -359,7 +359,6 @@ static void de600_rx_intr(struct net_device *dev)
         }
         /* else */
 
-        skb->dev = dev;
         skb_reserve(skb,2);     /* Align */
 
         /* 'skb->data' points to the start of sk_buff data area. */
diff --git a/drivers/net/de620.c b/drivers/net/de620.c
index b6ad0cb50552..dc4892426174 100644
--- a/drivers/net/de620.c
+++ b/drivers/net/de620.c
@@ -697,7 +697,6 @@ static int de620_rx_intr(struct net_device *dev)
                 }
                 else { /* Yep! Go get it! */
                         skb_reserve(skb,2);     /* Align */
-                        skb->dev = dev;
                         /* skb->data points to the start of sk_buff data area */
                         buffer = skb_put(skb,size);
                         /* copy the packet into the buffer */
diff --git a/drivers/net/declance.c b/drivers/net/declance.c
index 9f7e1db8ce62..95d854e2295c 100644
--- a/drivers/net/declance.c
+++ b/drivers/net/declance.c
@@ -616,7 +616,6 @@ static int lance_rx(struct net_device *dev)
                         }
                         lp->stats.rx_bytes += len;
 
-                        skb->dev = dev;
                         skb_reserve(skb, 2);    /* 16 byte align */
                         skb_put(skb, len);      /* make room */
 
diff --git a/drivers/net/defxx.c b/drivers/net/defxx.c
index 07d2731c1aa8..571d82f8008c 100644
--- a/drivers/net/defxx.c
+++ b/drivers/net/defxx.c
@@ -3091,13 +3091,13 @@ static void dfx_rcv_queue_process(
                                         {
                                                 /* Receive buffer allocated, pass receive packet up */
 
-                                                memcpy(skb->data, p_buff + RCV_BUFF_K_PADDING, pkt_len+3);
+                                                skb_copy_to_linear_data(skb,
+                                                               p_buff + RCV_BUFF_K_PADDING,
+                                                               pkt_len + 3);
                                         }
 
                                         skb_reserve(skb,3);             /* adjust data field so that it points to FC byte */
                                         skb_put(skb, pkt_len);          /* pass up packet length, NOT including CRC */
-                                        skb->dev = bp->dev;             /* pass up device pointer */
-
                                         skb->protocol = fddi_type_trans(skb, bp->dev);
                                         bp->rcv_total_bytes += skb->len;
                                         netif_rx(skb);
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 5113eef755b9..183497020bfc 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -1044,7 +1044,6 @@ static int depca_rx(struct net_device *dev)
                                         unsigned char *buf;
                                         skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                         buf = skb_put(skb, pkt_len);
-                                        skb->dev = dev;
                                         if (entry < lp->rx_old) {       /* Wrapped buffer */
                                                 len = (lp->rxRingMask - lp->rx_old + 1) * RX_BUFF_SZ;
                                                 memcpy_fromio(buf, lp->rx_buff[lp->rx_old], len);
@@ -1491,8 +1490,9 @@ static void __init depca_platform_probe (void)
                 depca_io_ports[i].device = pldev;
 
                 if (platform_device_add(pldev)) {
-                        platform_device_put(pldev);
                         depca_io_ports[i].device = NULL;
+                        pldev->dev.platform_data = NULL;
+                        platform_device_put(pldev);
                         continue;
                 }
 
diff --git a/drivers/net/dgrs.c b/drivers/net/dgrs.c
index a79520295fd0..df62c0232f36 100644
--- a/drivers/net/dgrs.c
+++ b/drivers/net/dgrs.c
@@ -503,7 +503,6 @@ dgrs_rcv_frame(
                 /* discarding the frame */
                 goto out;
         }
-        skb->dev = devN;
         skb_reserve(skb, 2);    /* Align IP header */
 
 again:
@@ -742,7 +741,7 @@ static int dgrs_start_xmit(struct sk_buff *skb, struct net_device *devN)
                 }
 
                 amt = min_t(unsigned int, len, rbdp->size - count);
-                memcpy( (char *) S2H(rbdp->buf) + count, skb->data + i, amt);
+                skb_copy_from_linear_data_offset(skb, i, S2H(rbdp->buf) + count, amt);
                 i += amt;
                 count += amt;
                 len -= amt;
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 9d446a0fe0bf..74ec64a1625d 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -504,7 +504,6 @@ rio_timer (unsigned long data)
                                         break;
                                 }
                                 np->rx_skbuff[entry] = skb;
-                                skb->dev = dev;
                                 /* 16 byte align the IP header */
                                 skb_reserve (skb, 2);
                                 np->rx_ring[entry].fraginfo =
@@ -575,7 +574,6 @@ alloc_list (struct net_device *dev)
                                 dev->name);
                         break;
                 }
-                skb->dev = dev; /* Mark as being used by this device. */
                 skb_reserve (skb, 2);   /* 16 byte align the IP header. */
                 /* Rubicon now supports 40 bits of addressing space. */
                 np->rx_ring[i].fraginfo =
@@ -866,7 +864,6 @@ receive_packet (struct net_device *dev)
                                                                 DMA_48BIT_MASK,
                                                             np->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
-                                skb->dev = dev;
                                 /* 16 byte align the IP header */
                                 skb_reserve (skb, 2);
                                 eth_copy_and_sum (skb,
@@ -910,7 +907,6 @@ receive_packet (struct net_device *dev)
                                 break;
                         }
                         np->rx_skbuff[entry] = skb;
-                        skb->dev = dev;
                         /* 16 byte align the IP header */
                         skb_reserve (skb, 2);
                         np->rx_ring[entry].fraginfo =
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 615d2b14efa7..8cc1174e7f64 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -954,7 +954,6 @@ dm9000_rx(struct net_device *dev)
                 /* Move data from DM9000 */
                 if (GoodPacket
                     && ((skb = dev_alloc_skb(RxLen + 4)) != NULL)) {
-                        skb->dev = dev;
                         skb_reserve(skb, 2);
                         rdptr = (u8 *) skb_put(skb, RxLen - 4);
 
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 0cefef5e3f06..4d0e0aea72bf 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1769,7 +1769,7 @@ static int e100_rx_alloc_skb(struct nic *nic, struct rx *rx)
 
         /* Align, init, and map the RFD. */
         skb_reserve(rx->skb, NET_IP_ALIGN);
-        memcpy(rx->skb->data, &nic->blank_rfd, sizeof(struct rfd));
+        skb_copy_to_linear_data(rx->skb, &nic->blank_rfd, sizeof(struct rfd));
         rx->dma_addr = pci_map_single(nic->pdev, rx->skb->data,
                 RFD_BUF_LEN, PCI_DMA_BIDIRECTIONAL);
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 1d08e937af82..48e2ade704d3 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2887,33 +2887,30 @@ e1000_tso(struct e1000_adapter *adapter, struct e1000_tx_ring *tx_ring,
                                 return err;
                 }
 
-                hdr_len = ((skb->h.raw - skb->data) + (skb->h.th->doff << 2));
+                hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 mss = skb_shinfo(skb)->gso_size;
                 if (skb->protocol == htons(ETH_P_IP)) {
-                        skb->nh.iph->tot_len = 0;
-                        skb->nh.iph->check = 0;
-                        skb->h.th->check =
-                                ~csum_tcpudp_magic(skb->nh.iph->saddr,
-                                                   skb->nh.iph->daddr,
-                                                   0,
-                                                   IPPROTO_TCP,
-                                                   0);
+                        struct iphdr *iph = ip_hdr(skb);
+                        iph->tot_len = 0;
+                        iph->check = 0;
+                        tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
+                                                                 iph->daddr, 0,
+                                                                 IPPROTO_TCP,
+                                                                 0);
                         cmd_length = E1000_TXD_CMD_IP;
-                        ipcse = skb->h.raw - skb->data - 1;
+                        ipcse = skb_transport_offset(skb) - 1;
                 } else if (skb->protocol == htons(ETH_P_IPV6)) {
-                        skb->nh.ipv6h->payload_len = 0;
-                        skb->h.th->check =
-                                ~csum_ipv6_magic(&skb->nh.ipv6h->saddr,
-                                                 &skb->nh.ipv6h->daddr,
-                                                 0,
-                                                 IPPROTO_TCP,
-                                                 0);
+                        ipv6_hdr(skb)->payload_len = 0;
+                        tcp_hdr(skb)->check =
+                                ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
+                                                 &ipv6_hdr(skb)->daddr,
+                                                 0, IPPROTO_TCP, 0);
                         ipcse = 0;
                 }
-                ipcss = skb->nh.raw - skb->data;
-                ipcso = (void *)&(skb->nh.iph->check) - (void *)skb->data;
-                tucss = skb->h.raw - skb->data;
-                tucso = (void *)&(skb->h.th->check) - (void *)skb->data;
+                ipcss = skb_network_offset(skb);
+                ipcso = (void *)&(ip_hdr(skb)->check) - (void *)skb->data;
+                tucss = skb_transport_offset(skb);
+                tucso = (void *)&(tcp_hdr(skb)->check) - (void *)skb->data;
                 tucse = 0;
 
                 cmd_length |= (E1000_TXD_CMD_DEXT | E1000_TXD_CMD_TSE |
@@ -2954,7 +2951,7 @@ e1000_tx_csum(struct e1000_adapter *adapter, struct e1000_tx_ring *tx_ring,
         uint8_t css;
 
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                css = skb->h.raw - skb->data;
+                css = skb_transport_offset(skb);
 
                 i = tx_ring->next_to_use;
                 buffer_info = &tx_ring->buffer_info[i];
@@ -2962,7 +2959,8 @@ e1000_tx_csum(struct e1000_adapter *adapter, struct e1000_tx_ring *tx_ring,
 
                 context_desc->lower_setup.ip_config = 0;
                 context_desc->upper_setup.tcp_fields.tucss = css;
-                context_desc->upper_setup.tcp_fields.tucso = css + skb->csum;
+                context_desc->upper_setup.tcp_fields.tucso =
+                        css + skb->csum_offset;
                 context_desc->upper_setup.tcp_fields.tucse = 0;
                 context_desc->tcp_seg_setup.data = 0;
                 context_desc->cmd_and_length = cpu_to_le32(E1000_TXD_CMD_DEXT);
@@ -3296,7 +3294,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 /* TSO Workaround for 82571/2/3 Controllers -- if skb->data
                 * points to just header, pull a few bytes of payload from
                 * frags into skb->data */
-                hdr_len = ((skb->h.raw - skb->data) + (skb->h.th->doff << 2));
+                hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 if (skb->data_len && (hdr_len == (skb->len - skb->data_len))) {
                         switch (adapter->hw.mac_type) {
                                 unsigned int pull_size;
@@ -3307,7 +3305,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                                  * NOTE: this is a TSO only workaround
                                  * if end byte alignment not correct move us
                                  * into the next dword */
-                                if ((unsigned long)(skb->tail - 1) & 4)
+                                if ((unsigned long)(skb_tail_pointer(skb) - 1) & 4)
                                         break;
                                 /* fall through */
                         case e1000_82571:
@@ -3796,7 +3794,7 @@ e1000_intr_msi(int irq, void *data)
 
         for (i = 0; i < E1000_MAX_INTR; i++)
                 if (unlikely(!adapter->clean_rx(adapter, adapter->rx_ring) &
-                   e1000_clean_tx_irq(adapter, adapter->tx_ring)))
+                   !e1000_clean_tx_irq(adapter, adapter->tx_ring)))
                         break;
 
         if (likely(adapter->itr_setting & 3))
@@ -3899,7 +3897,7 @@ e1000_intr(int irq, void *data)
 
         for (i = 0; i < E1000_MAX_INTR; i++)
                 if (unlikely(!adapter->clean_rx(adapter, adapter->rx_ring) &
-                   e1000_clean_tx_irq(adapter, adapter->tx_ring)))
+                   !e1000_clean_tx_irq(adapter, adapter->tx_ring)))
                         break;
 
         if (likely(adapter->itr_setting & 3))
@@ -3949,7 +3947,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
         poll_dev->quota -= work_done;
 
         /* If no Tx and not enough Rx work done, exit the polling mode */
-        if ((tx_cleaned && (work_done < work_to_do)) ||
+        if ((!tx_cleaned && (work_done == 0)) ||
            !netif_running(poll_dev)) {
 quit_polling:
                 if (likely(adapter->itr_setting & 3))
@@ -3979,7 +3977,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter,
 #ifdef CONFIG_E1000_NAPI
         unsigned int count = 0;
 #endif
-        boolean_t cleaned = TRUE;
+        boolean_t cleaned = FALSE;
         unsigned int total_tx_bytes=0, total_tx_packets=0;
 
         i = tx_ring->next_to_clean;
@@ -4013,10 +4011,7 @@ e1000_clean_tx_irq(struct e1000_adapter *adapter,
 #ifdef CONFIG_E1000_NAPI
 #define E1000_TX_WEIGHT 64
                 /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (count++ == E1000_TX_WEIGHT) {
-                        cleaned = FALSE;
-                        break;
-                }
+                if (count++ == E1000_TX_WEIGHT) break;
 #endif
         }
 
@@ -4230,9 +4225,12 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                             netdev_alloc_skb(netdev, length + NET_IP_ALIGN);
                         if (new_skb) {
                                 skb_reserve(new_skb, NET_IP_ALIGN);
-                                memcpy(new_skb->data - NET_IP_ALIGN,
-                                       skb->data - NET_IP_ALIGN,
-                                       length + NET_IP_ALIGN);
+                                skb_copy_to_linear_data_offset(new_skb,
+                                                               -NET_IP_ALIGN,
+                                                               (skb->data -
+                                                                NET_IP_ALIGN),
+                                                               (length +
+                                                                NET_IP_ALIGN));
                                 /* save the skb in buffer_info as good */
                                 buffer_info->skb = skb;
                                 skb = new_skb;
@@ -4394,7 +4392,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                                 PCI_DMA_FROMDEVICE);
                         vaddr = kmap_atomic(ps_page->ps_page[0],
                                             KM_SKB_DATA_SOFTIRQ);
-                        memcpy(skb->tail, vaddr, l1);
+                        memcpy(skb_tail_pointer(skb), vaddr, l1);
                         kunmap_atomic(vaddr, KM_SKB_DATA_SOFTIRQ);
                         pci_dma_sync_single_for_device(pdev,
                                 ps_page_dma->ps_page_dma[0],
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index b4463094c93a..39654e1e2bed 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1591,7 +1591,6 @@ eepro_rx(struct net_device *dev)
 
                                 break;
                         }
-                        skb->dev = dev;
                         skb_reserve(skb,2);
 
                         if (lp->version == LAN595)
diff --git a/drivers/net/eepro100.c b/drivers/net/eepro100.c
index e28bb1e38f8d..6c267c38df97 100644
--- a/drivers/net/eepro100.c
+++ b/drivers/net/eepro100.c
@@ -1793,7 +1793,6 @@ speedo_rx(struct net_device *dev)
                            copying to a properly sized skbuff. */
                         if (pkt_len < rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != 0) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                                 /* 'skb_put()' points to the start of sk_buff data area. */
                                 pci_dma_sync_single_for_cpu(sp->pdev, sp->rx_ring_dma[entry],
@@ -1805,8 +1804,9 @@ speedo_rx(struct net_device *dev)
                                 eth_copy_and_sum(skb, sp->rx_skbuff[entry]->data, pkt_len, 0);
                                 skb_put(skb, pkt_len);
 #else
-                                memcpy(skb_put(skb, pkt_len), sp->rx_skbuff[entry]->data,
-                                           pkt_len);
+                                skb_copy_from_linear_data(sp->rx_skbuff[entry],
+                                                          skb_put(skb, pkt_len),
+                                                          pkt_len);
 #endif
                                 pci_dma_sync_single_for_device(sp->pdev, sp->rx_ring_dma[entry],
                                                                                            sizeof(struct RxFD) + pkt_len,
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 3868b8031266..8aaf5ec0c360 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -976,7 +976,6 @@ static void eexp_hw_rx_pio(struct net_device *dev)
                                         lp->stats.rx_dropped++;
                                         break;
                                 }
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);
                                 outw(pbuf+10, ioaddr+READ_PTR);
                                 insw(ioaddr+DATAPORT, skb_put(skb,pkt_len),(pkt_len+1)>>1);
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 0e4042bc0a48..58364a0ff378 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -391,8 +391,8 @@ static int ehea_poll(struct net_device *dev, int *budget)
                                         if (!skb)
                                                 break;
                                 }
-                                memcpy(skb->data, ((char*)cqe) + 64,
-                                       cqe->num_bytes_transfered - 4);
+                                skb_copy_to_linear_data(skb, ((char*)cqe) + 64,
+                                               cqe->num_bytes_transfered - 4);
                                 ehea_fill_skb(dev, skb, cqe);
                         } else if (rq == 2) {  /* RQ2 */
                                 skb = get_skb_by_index(skb_arr_rq2,
@@ -1262,8 +1262,8 @@ static int ehea_clean_portres(struct ehea_port *port, struct ehea_port_res *pr)
 static inline void write_ip_start_end(struct ehea_swqe *swqe,
                                       const struct sk_buff *skb)
 {
-        swqe->ip_start = (u8)(((u64)skb->nh.iph) - ((u64)skb->data));
-        swqe->ip_end = (u8)(swqe->ip_start + skb->nh.iph->ihl * 4 - 1);
+        swqe->ip_start = skb_network_offset(skb);
+        swqe->ip_end = (u8)(swqe->ip_start + ip_hdrlen(skb) - 1);
 }
 
 static inline void write_tcp_offset_end(struct ehea_swqe *swqe,
@@ -1300,13 +1300,13 @@ static void write_swqe2_TSO(struct sk_buff *skb,
         /* copy only eth/ip/tcp headers to immediate data and
          * the rest of skb->data to sg1entry
          */
-        headersize = ETH_HLEN + (skb->nh.iph->ihl * 4) + (skb->h.th->doff * 4);
+        headersize = ETH_HLEN + ip_hdrlen(skb) + tcp_hdrlen(skb);
 
         skb_data_size = skb->len - skb->data_len;
 
         if (skb_data_size >= headersize) {
                 /* copy immediate data */
-                memcpy(imm_data, skb->data, headersize);
+                skb_copy_from_linear_data(skb, imm_data, headersize);
                 swqe->immediate_data_length = headersize;
 
                 if (skb_data_size > headersize) {
@@ -1337,7 +1337,7 @@ static void write_swqe2_nonTSO(struct sk_buff *skb,
          */
         if (skb_data_size >= SWQE2_MAX_IMM) {
                 /* copy immediate data */
-                memcpy(imm_data, skb->data, SWQE2_MAX_IMM);
+                skb_copy_from_linear_data(skb, imm_data, SWQE2_MAX_IMM);
 
                 swqe->immediate_data_length = SWQE2_MAX_IMM;
 
@@ -1350,7 +1350,7 @@ static void write_swqe2_nonTSO(struct sk_buff *skb,
                         swqe->descriptors++;
                 }
         } else {
-                memcpy(imm_data, skb->data, skb_data_size);
+                skb_copy_from_linear_data(skb, imm_data, skb_data_size);
                 swqe->immediate_data_length = skb_data_size;
         }
 }
@@ -1688,6 +1688,7 @@ static void ehea_xmit2(struct sk_buff *skb, struct net_device *dev,
                        struct ehea_swqe *swqe, u32 lkey)
 {
         if (skb->protocol == htons(ETH_P_IP)) {
+                const struct iphdr *iph = ip_hdr(skb);
                 /* IPv4 */
                 swqe->tx_control |= EHEA_SWQE_CRC
                                  | EHEA_SWQE_IP_CHECKSUM
@@ -1697,15 +1698,15 @@ static void ehea_xmit2(struct sk_buff *skb, struct net_device *dev,
 
                 write_ip_start_end(swqe, skb);
 
-                if (skb->nh.iph->protocol == IPPROTO_UDP) {
-                        if ((skb->nh.iph->frag_off & IP_MF) ||
-                            (skb->nh.iph->frag_off & IP_OFFSET))
+                if (iph->protocol == IPPROTO_UDP) {
+                        if ((iph->frag_off & IP_MF) ||
+                            (iph->frag_off & IP_OFFSET))
                                 /* IP fragment, so don't change cs */
                                 swqe->tx_control &= ~EHEA_SWQE_TCP_CHECKSUM;
                         else
                                 write_udp_offset_end(swqe, skb);
 
-                } else if (skb->nh.iph->protocol == IPPROTO_TCP) {
+                } else if (iph->protocol == IPPROTO_TCP) {
                         write_tcp_offset_end(swqe, skb);
                 }
 
@@ -1731,10 +1732,11 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
         int i;
 
         if (skb->protocol == htons(ETH_P_IP)) {
+                const struct iphdr *iph = ip_hdr(skb);
                 /* IPv4 */
                 write_ip_start_end(swqe, skb);
 
-                if (skb->nh.iph->protocol == IPPROTO_TCP) {
+                if (iph->protocol == IPPROTO_TCP) {
                         swqe->tx_control |= EHEA_SWQE_CRC
                                          | EHEA_SWQE_IP_CHECKSUM
                                          | EHEA_SWQE_TCP_CHECKSUM
@@ -1742,9 +1744,9 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
 
                         write_tcp_offset_end(swqe, skb);
 
-                } else if (skb->nh.iph->protocol == IPPROTO_UDP) {
-                        if ((skb->nh.iph->frag_off & IP_MF) ||
-                            (skb->nh.iph->frag_off & IP_OFFSET))
+                } else if (iph->protocol == IPPROTO_UDP) {
+                        if ((iph->frag_off & IP_MF) ||
+                            (iph->frag_off & IP_OFFSET))
                                 /* IP fragment, so don't change cs */
                                 swqe->tx_control |= EHEA_SWQE_CRC
                                                  | EHEA_SWQE_IMM_DATA_PRESENT;
@@ -1770,10 +1772,11 @@ static void ehea_xmit3(struct sk_buff *skb, struct net_device *dev,
         /* copy (immediate) data */
         if (nfrags == 0) {
                 /* data is in a single piece */
-                memcpy(imm_data, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, imm_data, skb->len);
         } else {
                 /* first copy data from the skb->data buffer ... */
-                memcpy(imm_data, skb->data, skb->len - skb->data_len);
+                skb_copy_from_linear_data(skb, imm_data,
+                                          skb->len - skb->data_len);
                 imm_data += skb->len - skb->data_len;
 
                 /* ... then copy data from the fragments */
diff --git a/drivers/net/epic100.c b/drivers/net/epic100.c
index 3a6a83d3ee1c..4e3f14c9c717 100644
--- a/drivers/net/epic100.c
+++ b/drivers/net/epic100.c
@@ -934,7 +934,6 @@ static void epic_init_ring(struct net_device *dev)
                 ep->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
-                skb->dev = dev;                 /* Mark as being used by this device. */
                 skb_reserve(skb, 2);    /* 16 byte align the IP header. */
                 ep->rx_ring[i].bufaddr = pci_map_single(ep->pci_dev,
                         skb->data, ep->rx_buf_sz, PCI_DMA_FROMDEVICE);
@@ -1199,7 +1198,6 @@ static int epic_rx(struct net_device *dev, int budget)
                            to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(ep->pci_dev,
                                                             ep->rx_ring[entry].bufaddr,
@@ -1236,7 +1234,6 @@ static int epic_rx(struct net_device *dev, int budget)
                         skb = ep->rx_skbuff[entry] = dev_alloc_skb(ep->rx_buf_sz);
                         if (skb == NULL)
                                 break;
-                        skb->dev = dev;                 /* Mark as being used by this device. */
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                         ep->rx_ring[entry].bufaddr = pci_map_single(ep->pci_dev,
                                 skb->data, ep->rx_buf_sz, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 93283e386f3a..04abf59e5007 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -1175,7 +1175,6 @@ static void eth16i_rx(struct net_device *dev)
                                 break;
                         }
 
-                        skb->dev = dev;
                         skb_reserve(skb,2);
 
                         /*
diff --git a/drivers/net/ewrk3.c b/drivers/net/ewrk3.c
index 714ea1176ec7..cb0792c187ba 100644
--- a/drivers/net/ewrk3.c
+++ b/drivers/net/ewrk3.c
@@ -993,7 +993,6 @@ static int ewrk3_rx(struct net_device *dev)
 
                                         if ((skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
                                                 unsigned char *p;
-                                                skb->dev = dev;
                                                 skb_reserve(skb, 2);    /* Align to 16 bytes */
                                                 p = skb_put(skb, pkt_len);
 
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 38a13f440530..abe9b089c610 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -1719,7 +1719,6 @@ static int netdev_rx(struct net_device *dev)
                            to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak &&
                             (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(np->pci_dev,
                                                             np->cur_rx->buffer,
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 6764281b4531..255b09124e11 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -647,7 +647,6 @@ while (!((status = bdp->cbd_sc) & BD_ENET_RX_EMPTY)) {
                 printk("%s: Memory squeeze, dropping packet.\n", dev->name);
                 fep->stats.rx_dropped++;
         } else {
-                skb->dev = dev;
                 skb_put(skb,pkt_len-4); /* Make room */
                 eth_copy_and_sum(skb, data, pkt_len-4, 0);
                 skb->protocol=eth_type_trans(skb,dev);
diff --git a/drivers/net/fec_8xx/fec_main.c b/drivers/net/fec_8xx/fec_main.c
index 77f747a5afa7..e824d5d231af 100644
--- a/drivers/net/fec_8xx/fec_main.c
+++ b/drivers/net/fec_8xx/fec_main.c
@@ -551,7 +551,9 @@ static int fec_enet_rx_common(struct net_device *dev, int *budget)
                                 skbn = dev_alloc_skb(pkt_len + 2);
                                 if (skbn != NULL) {
                                         skb_reserve(skbn, 2);   /* align IP header */
-                                        memcpy(skbn->data, skb->data, pkt_len);
+                                        skb_copy_from_linear_data(skb
+                                                                  skbn->data,
+                                                                  pkt_len);
                                         /* swap */
                                         skbt = skb;
                                         skb = skbn;
@@ -561,7 +563,6 @@ static int fec_enet_rx_common(struct net_device *dev, int *budget)
                                 skbn = dev_alloc_skb(ENET_RX_FRSIZE);
 
                         if (skbn != NULL) {
-                                skb->dev = dev;
                                 skb_put(skb, pkt_len);  /* Make room */
                                 skb->protocol = eth_type_trans(skb, dev);
                                 received++;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index d04214e4e581..7a018027fcc0 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -1385,11 +1385,12 @@ static int nv_alloc_rx(struct net_device *dev)
         while (np->put_rx.orig != less_rx) {
                 struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz + NV_RX_ALLOC_PAD);
                 if (skb) {
-                        skb->dev = dev;
                         np->put_rx_ctx->skb = skb;
-                        np->put_rx_ctx->dma = pci_map_single(np->pci_dev, skb->data,
-                                                             skb->end-skb->data, PCI_DMA_FROMDEVICE);
-                        np->put_rx_ctx->dma_len = skb->end-skb->data;
+                        np->put_rx_ctx->dma = pci_map_single(np->pci_dev,
+                                                             skb->data,
+                                                             skb_tailroom(skb),
+                                                             PCI_DMA_FROMDEVICE);
+                        np->put_rx_ctx->dma_len = skb_tailroom(skb);
                         np->put_rx.orig->buf = cpu_to_le32(np->put_rx_ctx->dma);
                         wmb();
                         np->put_rx.orig->flaglen = cpu_to_le32(np->rx_buf_sz | NV_RX_AVAIL);
@@ -1416,11 +1417,12 @@ static int nv_alloc_rx_optimized(struct net_device *dev)
         while (np->put_rx.ex != less_rx) {
                 struct sk_buff *skb = dev_alloc_skb(np->rx_buf_sz + NV_RX_ALLOC_PAD);
                 if (skb) {
-                        skb->dev = dev;
                         np->put_rx_ctx->skb = skb;
-                        np->put_rx_ctx->dma = pci_map_single(np->pci_dev, skb->data,
-                                                             skb->end-skb->data, PCI_DMA_FROMDEVICE);
-                        np->put_rx_ctx->dma_len = skb->end-skb->data;
+                        np->put_rx_ctx->dma = pci_map_single(np->pci_dev,
+                                                             skb->data,
+                                                             skb_tailroom(skb),
+                                                             PCI_DMA_FROMDEVICE);
+                        np->put_rx_ctx->dma_len = skb_tailroom(skb);
                         np->put_rx.ex->bufhigh = cpu_to_le64(np->put_rx_ctx->dma) >> 32;
                         np->put_rx.ex->buflow = cpu_to_le64(np->put_rx_ctx->dma) & 0x0FFFFFFFF;
                         wmb();
@@ -1604,8 +1606,9 @@ static void nv_drain_rx(struct net_device *dev)
                 wmb();
                 if (np->rx_skb[i].skb) {
                         pci_unmap_single(np->pci_dev, np->rx_skb[i].dma,
-                                                np->rx_skb[i].skb->end-np->rx_skb[i].skb->data,
-                                                PCI_DMA_FROMDEVICE);
+                                         (skb_end_pointer(np->rx_skb[i].skb) -
+                                          np->rx_skb[i].skb->data),
+                                         PCI_DMA_FROMDEVICE);
                         dev_kfree_skb(np->rx_skb[i].skb);
                         np->rx_skb[i].skb = NULL;
                 }
@@ -4376,11 +4379,12 @@ static int nv_loopback_test(struct net_device *dev)
                 ret = 0;
                 goto out;
         }
+        test_dma_addr = pci_map_single(np->pci_dev, tx_skb->data,
+                                       skb_tailroom(tx_skb),
+                                       PCI_DMA_FROMDEVICE);
         pkt_data = skb_put(tx_skb, pkt_len);
         for (i = 0; i < pkt_len; i++)
                 pkt_data[i] = (u8)(i & 0xff);
-        test_dma_addr = pci_map_single(np->pci_dev, tx_skb->data,
-                                       tx_skb->end-tx_skb->data, PCI_DMA_FROMDEVICE);
 
         if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
                 np->tx_ring.orig[0].buf = cpu_to_le32(test_dma_addr);
@@ -4437,7 +4441,7 @@ static int nv_loopback_test(struct net_device *dev)
         }
 
         pci_unmap_page(np->pci_dev, test_dma_addr,
-                       tx_skb->end-tx_skb->data,
+                       (skb_end_pointer(tx_skb) - tx_skb->data),
                        PCI_DMA_TODEVICE);
         dev_kfree_skb_any(tx_skb);
  out:
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index 4a05c14bf7ec..e2ddd617493a 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -160,7 +160,8 @@ static int fs_enet_rx_napi(struct net_device *dev, int *budget)
                                 skbn = dev_alloc_skb(pkt_len + 2);
                                 if (skbn != NULL) {
                                         skb_reserve(skbn, 2);   /* align IP header */
-                                        memcpy(skbn->data, skb->data, pkt_len);
+                                        skb_copy_from_linear_data(skb,
+                                                      skbn->data, pkt_len);
                                         /* swap */
                                         skbt = skb;
                                         skb = skbn;
@@ -170,7 +171,6 @@ static int fs_enet_rx_napi(struct net_device *dev, int *budget)
                                 skbn = dev_alloc_skb(ENET_RX_FRSIZE);
 
                         if (skbn != NULL) {
-                                skb->dev = dev;
                                 skb_put(skb, pkt_len);  /* Make room */
                                 skb->protocol = eth_type_trans(skb, dev);
                                 received++;
@@ -294,7 +294,8 @@ static int fs_enet_rx_non_napi(struct net_device *dev)
                                 skbn = dev_alloc_skb(pkt_len + 2);
                                 if (skbn != NULL) {
                                         skb_reserve(skbn, 2);   /* align IP header */
-                                        memcpy(skbn->data, skb->data, pkt_len);
+                                        skb_copy_from_linear_data(skb,
+                                                      skbn->data, pkt_len);
                                         /* swap */
                                         skbt = skb;
                                         skb = skbn;
@@ -304,7 +305,6 @@ static int fs_enet_rx_non_napi(struct net_device *dev)
                                 skbn = dev_alloc_skb(ENET_RX_FRSIZE);
 
                         if (skbn != NULL) {
-                                skb->dev = dev;
                                 skb_put(skb, pkt_len);  /* Make room */
                                 skb->protocol = eth_type_trans(skb, dev);
                                 received++;
@@ -516,7 +516,6 @@ void fs_init_bds(struct net_device *dev)
                         break;
                 }
                 fep->rx_skbuff[i] = skb;
-                skb->dev = dev;
                 CBDW_BUFADDR(bdp,
                         dma_map_single(fep->dev, skb->data,
                                 L1_CACHE_ALIGN(PKT_MAXBUF_SIZE),
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index d981d4c41dd3..b666a0cc0642 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -942,18 +942,18 @@ static inline void gfar_tx_checksum(struct sk_buff *skb, struct txfcb *fcb)
 
         /* Tell the controller what the protocol is */
         /* And provide the already calculated phcs */
-        if (skb->nh.iph->protocol == IPPROTO_UDP) {
+        if (ip_hdr(skb)->protocol == IPPROTO_UDP) {
                 flags |= TXFCB_UDP;
-                fcb->phcs = skb->h.uh->check;
+                fcb->phcs = udp_hdr(skb)->check;
         } else
-                fcb->phcs = skb->h.th->check;
+                fcb->phcs = udp_hdr(skb)->check;
 
         /* l3os is the distance between the start of the
          * frame (skb->data) and the start of the IP hdr.
          * l4os is the distance between the start of the
          * l3 hdr and the l4 hdr */
-        fcb->l3os = (u16)(skb->nh.raw - skb->data - GMAC_FCB_LEN);
-        fcb->l4os = (u16)(skb->h.raw - skb->nh.raw);
+        fcb->l3os = (u16)(skb_network_offset(skb) - GMAC_FCB_LEN);
+        fcb->l4os = skb_network_header_len(skb);
 
         fcb->flags = flags;
 }
@@ -1295,8 +1295,6 @@ struct sk_buff * gfar_new_skb(struct net_device *dev, struct rxbd8 *bdp)
          */
         skb_reserve(skb, alignamount);
 
-        skb->dev = dev;
-
         bdp->bufPtr = dma_map_single(NULL, skb->data,
                         priv->rx_buffer_size, DMA_FROM_DEVICE);
 
diff --git a/drivers/net/hamachi.c b/drivers/net/hamachi.c
index c3c0d67fc383..2521b111b3a5 100644
--- a/drivers/net/hamachi.c
+++ b/drivers/net/hamachi.c
@@ -1568,7 +1568,6 @@ static int hamachi_rx(struct net_device *dev)
                                 printk(KERN_ERR "%s: rx_copybreak non-zero "
                                   "not good with RX_CHECKSUM\n", dev->name);
 #endif
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(hmp->pci_dev,
                                                             hmp->rx_ring[entry].addr,
diff --git a/drivers/net/hamradio/baycom_ser_fdx.c b/drivers/net/hamradio/baycom_ser_fdx.c
index 59214e74b9cf..30baf6ecfc63 100644
--- a/drivers/net/hamradio/baycom_ser_fdx.c
+++ b/drivers/net/hamradio/baycom_ser_fdx.c
@@ -75,12 +75,14 @@
 #include <linux/ioport.h>
 #include <linux/string.h>
 #include <linux/init.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
 #include <linux/hdlcdrv.h>
 #include <linux/baycom.h>
 #include <linux/jiffies.h>
 
+#include <asm/uaccess.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+
 /* --------------------------------------------------------------------- */
 
 #define BAYCOM_DEBUG
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index d2542697e298..656f2789c9ba 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -282,7 +282,7 @@ static int bpq_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb->protocol = ax25_type_trans(skb, dev);
-        skb->nh.raw = skb->data;
+        skb_reset_network_header(skb);
         dev->hard_header(skb, dev, ETH_P_BPQ, bpq->dest_addr, NULL, 0);
         bpq->stats.tx_packets++;
         bpq->stats.tx_bytes+=skb->len;
diff --git a/drivers/net/hamradio/dmascc.c b/drivers/net/hamradio/dmascc.c
index 0fbb414b5a4d..3be8c5047599 100644
--- a/drivers/net/hamradio/dmascc.c
+++ b/drivers/net/hamradio/dmascc.c
@@ -930,7 +930,7 @@ static int scc_send_packet(struct sk_buff *skb, struct net_device *dev)
 
         /* Transfer data to DMA buffer */
         i = priv->tx_head;
-        memcpy(priv->tx_buf[i], skb->data + 1, skb->len - 1);
+        skb_copy_from_linear_data_offset(skb, 1, priv->tx_buf[i], skb->len - 1);
         priv->tx_len[i] = skb->len - 1;
 
         /* Clear interrupts while we touch our circular buffers */
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index f5a17ad9d3d6..b33adc6a340b 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -317,7 +317,9 @@ void hdlcdrv_transmitter(struct net_device *dev, struct hdlcdrv_state *s)
                                 dev_kfree_skb_irq(skb);
                                 break;
                         }
-                        memcpy(s->hdlctx.buffer, skb->data+1, pkt_len);
+                        skb_copy_from_linear_data_offset(skb, 1,
+                                                         s->hdlctx.buffer,
+                                                         pkt_len);
                         dev_kfree_skb_irq(skb);
                         s->hdlctx.bp = s->hdlctx.buffer;
                         append_crc_ccitt(s->hdlctx.buffer, pkt_len);
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index ee3ea4fa729f..467559debfd6 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -638,7 +638,9 @@ static void yam_tx_byte(struct net_device *dev, struct yam_port *yp)
                                 dev_kfree_skb_any(skb);
                                 break;
                         }
-                        memcpy(yp->tx_buf, skb->data + 1, yp->tx_len);
+                        skb_copy_from_linear_data_offset(skb, 1,
+                                                         yp->tx_buf,
+                                                         yp->tx_len);
                         dev_kfree_skb_any(skb);
                         yp->tx_count = 0;
                         yp->tx_crcl = 0x21;
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 7dc5185aa2c0..8118a6750b61 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1816,7 +1816,6 @@ static void hp100_rx(struct net_device *dev)
                         u_char *ptr;
 
                         skb_reserve(skb,2);
-                        skb->dev = dev;
 
                         /* ptr to start of the sk_buff data area */
                         skb_put(skb, pkt_len);
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index dd8ad8746825..3d82d46f4998 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1338,7 +1338,7 @@ static inline int emac_rx_sg_append(struct ocp_enet_private *dev, int slot)
                         dev_kfree_skb(dev->rx_sg_skb);
                         dev->rx_sg_skb = NULL;
                 } else {
-                        cacheable_memcpy(dev->rx_sg_skb->tail,
+                        cacheable_memcpy(skb_tail_pointer(dev->rx_sg_skb),
                                          dev->rx_skb[slot]->data, len);
                         skb_put(dev->rx_sg_skb, len);
                         emac_recycle_rx_skb(dev, slot, len);
@@ -1398,7 +1398,6 @@ static int emac_poll_rx(void *param, int budget)
 
                 skb_put(skb, len);
               push_packet:
-                skb->dev = dev->ndev;
                 skb->protocol = eth_type_trans(skb, dev->ndev);
                 emac_rx_csum(dev, skb, ctrl);
 
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 3f946c811511..fe85d6fcba33 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -601,7 +601,6 @@ static void irqrx_handler(struct net_device *dev)
 
                                 /* set up skb fields */
 
-                                skb->dev = dev;
                                 skb->protocol = eth_type_trans(skb, dev);
                                 skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 458db0538a9a..0573fcfcb2c4 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -798,7 +798,6 @@ static int ibmveth_poll(struct net_device *netdev, int *budget)
 
                                 skb_reserve(skb, offset);
                                 skb_put(skb, length);
-                                skb->dev = netdev;
                                 skb->protocol = eth_type_trans(skb, netdev);
 
                                 netif_receive_skb(skb); /* send it up */
diff --git a/drivers/net/ioc3-eth.c b/drivers/net/ioc3-eth.c
index 4ad780719a84..f749e07c6425 100644
--- a/drivers/net/ioc3-eth.c
+++ b/drivers/net/ioc3-eth.c
@@ -633,8 +633,6 @@ static inline void ioc3_rx(struct ioc3_private *ip)
 
                         ip->rx_skbs[rx_entry] = NULL;   /* Poison  */
 
-                        new_skb->dev = priv_netdev(ip);
-
                         /* Because we reserve afterwards. */
                         skb_put(new_skb, (1664 + RX_OFFSET));
                         rxb = (struct ioc3_erxbuf *) new_skb->data;
@@ -940,7 +938,6 @@ static void ioc3_alloc_rings(struct net_device *dev)
                         }
 
                         ip->rx_skbs[i] = skb;
-                        skb->dev = dev;
 
                         /* Because we reserve afterwards. */
                         skb_put(skb, (1664 + RX_OFFSET));
@@ -1396,9 +1393,9 @@ static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * manually.
          */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                int proto = ntohs(skb->nh.iph->protocol);
+                const struct iphdr *ih = ip_hdr(skb);
+                const int proto = ntohs(ih->protocol);
                 unsigned int csoff;
-                struct iphdr *ih = skb->nh.iph;
                 uint32_t csum, ehsum;
                 uint16_t *eh;
 
@@ -1425,11 +1422,11 @@ static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 csoff = ETH_HLEN + (ih->ihl << 2);
                 if (proto == IPPROTO_UDP) {
                         csoff += offsetof(struct udphdr, check);
-                        skb->h.uh->check = csum;
+                        udp_hdr(skb)->check = csum;
                 }
                 if (proto == IPPROTO_TCP) {
                         csoff += offsetof(struct tcphdr, check);
-                        skb->h.th->check = csum;
+                        tcp_hdr(skb)->check = csum;
                 }
 
                 w0 = ETXD_DOCHECKSUM | (csoff << ETXD_CHKOFF_SHIFT);
@@ -1446,7 +1443,7 @@ static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (len <= 104) {
                 /* Short packet, let's copy it directly into the ring.  */
-                memcpy(desc->data, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, desc->data, skb->len);
                 if (len < ETH_ZLEN) {
                         /* Very short packet, pad with zeros at the end. */
                         memset(desc->data + len, 0, ETH_ZLEN - len);
diff --git a/drivers/net/irda/ali-ircc.c b/drivers/net/irda/ali-ircc.c
index cebf8c374bc5..f9c889c0dd07 100644
--- a/drivers/net/irda/ali-ircc.c
+++ b/drivers/net/irda/ali-ircc.c
@@ -1472,9 +1472,8 @@ static int ali_ircc_fir_hard_xmit(struct sk_buff *skb, struct net_device *dev)
 
         self->stats.tx_bytes += skb->len;
 
-        memcpy(self->tx_fifo.queue[self->tx_fifo.free].start, skb->data, 
-               skb->len);
-        
+        skb_copy_from_linear_data(skb, self->tx_fifo.queue[self->tx_fifo.free].start,
+                      skb->len);
         self->tx_fifo.len++;
         self->tx_fifo.free++;
 
@@ -1924,7 +1923,7 @@ static int  ali_ircc_dma_receive_complete(struct ali_ircc_cb *self)
                         
                         /* Copy frame without CRC, CRC is removed by hardware*/
                         skb_put(skb, len);
-                        memcpy(skb->data, self->rx_buff.data, len);
+                        skb_copy_to_linear_data(skb, self->rx_buff.data, len);
 
                         /* Move to next frame */
                         self->rx_buff.data += len;
@@ -1932,7 +1931,7 @@ static int  ali_ircc_dma_receive_complete(struct ali_ircc_cb *self)
                         self->stats.rx_packets++;
 
                         skb->dev = self->netdev;
-                        skb->mac.raw  = skb->data;
+                        skb_reset_mac_header(skb);
                         skb->protocol = htons(ETH_P_IRDA);
                         netif_rx(skb);
                         self->netdev->last_rx = jiffies;
diff --git a/drivers/net/irda/au1k_ir.c b/drivers/net/irda/au1k_ir.c
index 37914dc5b90e..4dbdfaaf37bf 100644
--- a/drivers/net/irda/au1k_ir.c
+++ b/drivers/net/irda/au1k_ir.c
@@ -526,7 +526,7 @@ static int au1k_irda_hard_xmit(struct sk_buff *skb, struct net_device *dev)
         
         if (aup->speed == 4000000) {
                 /* FIR */
-                memcpy((void *)pDB->vaddr, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, pDB->vaddr, skb->len);
                 ptxd->count_0 = skb->len & 0xff;
                 ptxd->count_1 = (skb->len >> 8) & 0xff;
 
@@ -604,9 +604,9 @@ static int au1k_irda_rx(struct net_device *dev)
                                 skb_put(skb, count);
                         else
                                 skb_put(skb, count-2);
-                        memcpy(skb->data, (void *)pDB->vaddr, count-2);
+                        skb_copy_to_linear_data(skb, pDB->vaddr, count - 2);
                         skb->dev = dev;
-                        skb->mac.raw = skb->data;
+                        skb_reset_mac_header(skb);
                         skb->protocol = htons(ETH_P_IRDA);
                         netif_rx(skb);
                         prxd->count_0 = 0;
diff --git a/drivers/net/irda/donauboe.c b/drivers/net/irda/donauboe.c
index 11af0ae7510e..3ca47bf6dfec 100644
--- a/drivers/net/irda/donauboe.c
+++ b/drivers/net/irda/donauboe.c
@@ -1119,7 +1119,7 @@ dumpbufs(skb->data,skb->len,'>');
   else
     {
       len = skb->len;
-      memcpy (self->tx_bufs[self->txs], skb->data, len);
+      skb_copy_from_linear_data(skb, self->tx_bufs[self->txs], len);
     }
   self->ring->tx[self->txs].len = len & 0x0fff;
 
@@ -1282,11 +1282,11 @@ dumpbufs(self->rx_bufs[self->rxs],len,'<');
                       skb_reserve (skb, 1);
 
                       skb_put (skb, len);
-                      memcpy (skb->data, self->rx_bufs[self->rxs], len);
-
+                      skb_copy_to_linear_data(skb, self->rx_bufs[self->rxs],
+                                              len);
                       self->stats.rx_packets++;
                       skb->dev = self->netdev;
-                      skb->mac.raw = skb->data;
+                      skb_reset_mac_header(skb);
                       skb->protocol = htons (ETH_P_IRDA);
                     }
                   else
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 1d510bdc9b84..0ac240ca905b 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -441,7 +441,7 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
                 goto drop;
         }
 
-        memcpy(self->tx_buff + self->header_length, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, self->tx_buff + self->header_length, skb->len);
 
         /* Change setting for next frame */
         if (self->capability & IUC_STIR421X) {
@@ -902,7 +902,7 @@ static void irda_usb_receive(struct urb *urb)
 
         if(docopy) {
                 /* Copy packet, so we can recycle the original */
-                memcpy(newskb->data, skb->data, urb->actual_length);
+                skb_copy_from_linear_data(skb, newskb->data, urb->actual_length);
                 /* Deliver this new skb */
                 dataskb = newskb;
                 /* And hook the old skb to the URB
@@ -921,7 +921,7 @@ static void irda_usb_receive(struct urb *urb)
 
         /* Ask the networking layer to queue the packet for the IrDA stack */
         dataskb->dev = self->netdev;
-        dataskb->mac.raw  = dataskb->data;
+        skb_reset_mac_header(dataskb);
         dataskb->protocol = htons(ETH_P_IRDA);
         len = dataskb->len;
         netif_rx(dataskb);
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index f0c61f3b2a82..0de867288a47 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -200,14 +200,14 @@ static inline int mcs_setup_transceiver_vishay(struct mcs_cb *mcs)
 /* Setup a communication between mcs7780 and agilent chip. */
 static inline int mcs_setup_transceiver_agilent(struct mcs_cb *mcs)
 {
-        IRDA_WARNING("This transceiver type is not supported yet.");
+        IRDA_WARNING("This transceiver type is not supported yet.\n");
         return 1;
 }
 
 /* Setup a communication between mcs7780 and sharp chip. */
 static inline int mcs_setup_transceiver_sharp(struct mcs_cb *mcs)
 {
-        IRDA_WARNING("This transceiver type is not supported yet.");
+        IRDA_WARNING("This transceiver type is not supported yet.\n");
         return 1;
 }
 
@@ -279,7 +279,7 @@ static inline int mcs_setup_transceiver(struct mcs_cb *mcs)
                 break;
 
         default:
-                IRDA_WARNING("Unknown transceiver type: %d",
+                IRDA_WARNING("Unknown transceiver type: %d\n",
                              mcs->transceiver_type);
                 ret = 1;
         }
@@ -318,7 +318,7 @@ static inline int mcs_setup_transceiver(struct mcs_cb *mcs)
                 return ret;
 
 error:
-        IRDA_ERROR("%s", msg);
+        IRDA_ERROR("%s\n", msg);
         return ret;
 }
 
@@ -353,7 +353,7 @@ static unsigned mcs_wrap_fir_skb(const struct sk_buff *skb, __u8 *buf)
         buf[0] = len & 0xff;
         buf[1] = (len >> 8) & 0xff;
         /* copy the data into the tx buffer. */
-        memcpy(buf+2, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, buf + 2, skb->len);
         /* put the fcs in the last four bytes in little endian order. */
         buf[len - 4] = fcs & 0xff;
         buf[len - 3] = (fcs >> 8) & 0xff;
@@ -377,7 +377,7 @@ static unsigned mcs_wrap_mir_skb(const struct sk_buff *skb, __u8 *buf)
         buf[0] = len & 0xff;
         buf[1] = (len >> 8) & 0xff;
         /* copy the data */
-        memcpy(buf+2, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, buf + 2, skb->len);
         /* put the fcs in last two bytes in little endian order. */
         buf[len - 2] = fcs & 0xff;
         buf[len - 1] = (fcs >> 8) & 0xff;
@@ -426,9 +426,9 @@ static void mcs_unwrap_mir(struct mcs_cb *mcs, __u8 *buf, int len)
         }
 
         skb_reserve(skb, 1);
-        memcpy(skb->data, buf, new_len);
+        skb_copy_to_linear_data(skb, buf, new_len);
         skb_put(skb, new_len);
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IRDA);
         skb->dev = mcs->netdev;
 
@@ -479,9 +479,9 @@ static void mcs_unwrap_fir(struct mcs_cb *mcs, __u8 *buf, int len)
         }
 
         skb_reserve(skb, 1);
-        memcpy(skb->data, buf, new_len);
+        skb_copy_to_linear_data(skb, buf, new_len);
         skb_put(skb, new_len);
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IRDA);
         skb->dev = mcs->netdev;
 
@@ -587,7 +587,7 @@ static int mcs_speed_change(struct mcs_cb *mcs)
         } while(cnt++ < 100 && (rval & MCS_IRINTX));
 
         if(cnt >= 100) {
-                IRDA_ERROR("unable to change speed");
+                IRDA_ERROR("unable to change speed\n");
                 ret = -EIO;
                 goto error;
         }
@@ -638,7 +638,7 @@ static int mcs_speed_change(struct mcs_cb *mcs)
 
                 default:
                         ret = 1;
-                        IRDA_WARNING("Unknown transceiver type: %d",
+                        IRDA_WARNING("Unknown transceiver type: %d\n",
                                      mcs->transceiver_type);
                 }
         if (unlikely(ret))
@@ -733,7 +733,7 @@ static int mcs_net_open(struct net_device *netdev)
         sprintf(hwname, "usb#%d", mcs->usbdev->devnum);
         mcs->irlap = irlap_open(netdev, &mcs->qos, hwname);
         if (!mcs->irlap) {
-                IRDA_ERROR("mcs7780: irlap_open failed");
+                IRDA_ERROR("mcs7780: irlap_open failed\n");
                 goto error2;
         }
 
@@ -862,7 +862,7 @@ static int mcs_hard_xmit(struct sk_buff *skb, struct net_device *ndev)
                           mcs->out_buf, wraplen, mcs_send_irq, mcs);
 
         if ((ret = usb_submit_urb(mcs->tx_urb, GFP_ATOMIC))) {
-                IRDA_ERROR("failed tx_urb: %d", ret);
+                IRDA_ERROR("failed tx_urb: %d\n", ret);
                 switch (ret) {
                 case -ENODEV:
                 case -EPIPE:
@@ -897,7 +897,7 @@ static int mcs_probe(struct usb_interface *intf,
         if (!ndev)
                 goto error1;
 
-        IRDA_DEBUG(1, "MCS7780 USB-IrDA bridge found at %d.", udev->devnum);
+        IRDA_DEBUG(1, "MCS7780 USB-IrDA bridge found at %d.\n", udev->devnum);
 
         /* what is it realy for? */
         SET_MODULE_OWNER(ndev);
@@ -905,7 +905,7 @@ static int mcs_probe(struct usb_interface *intf,
 
         ret = usb_reset_configuration(udev);
         if (ret != 0) {
-                IRDA_ERROR("mcs7780: usb reset configuration failed");
+                IRDA_ERROR("mcs7780: usb reset configuration failed\n");
                 goto error2;
         }
 
@@ -950,7 +950,7 @@ static int mcs_probe(struct usb_interface *intf,
         if (ret != 0)
                 goto error2;
 
-        IRDA_DEBUG(1, "IrDA: Registered MosChip MCS7780 device as %s",
+        IRDA_DEBUG(1, "IrDA: Registered MosChip MCS7780 device as %s\n",
                    ndev->name);
 
         mcs->transceiver_type = transceiver_type;
@@ -981,7 +981,7 @@ static void mcs_disconnect(struct usb_interface *intf)
         free_netdev(mcs->netdev);
 
         usb_set_intfdata(intf, NULL);
-        IRDA_DEBUG(0, "MCS7780 now disconnected.");
+        IRDA_DEBUG(0, "MCS7780 now disconnected.\n");
 }
 
 /* Module insertion */
@@ -992,7 +992,7 @@ static int __init mcs_init(void)
         /* register this driver with the USB subsystem */
         result = usb_register(&mcs_driver);
         if (result)
-                IRDA_ERROR("usb_register failed. Error number %d", result);
+                IRDA_ERROR("usb_register failed. Error number %d\n", result);
 
         return result;
 }
diff --git a/drivers/net/irda/nsc-ircc.c b/drivers/net/irda/nsc-ircc.c
index 29b5ccd29d0b..d96c89751a71 100644
--- a/drivers/net/irda/nsc-ircc.c
+++ b/drivers/net/irda/nsc-ircc.c
@@ -1466,9 +1466,8 @@ static int nsc_ircc_hard_xmit_fir(struct sk_buff *skb, struct net_device *dev)
 
         self->stats.tx_bytes += skb->len;
 
-        memcpy(self->tx_fifo.queue[self->tx_fifo.free].start, skb->data, 
-               skb->len);
-        
+        skb_copy_from_linear_data(skb, self->tx_fifo.queue[self->tx_fifo.free].start,
+                      skb->len);
         self->tx_fifo.len++;
         self->tx_fifo.free++;
 
@@ -1869,10 +1868,14 @@ static int nsc_ircc_dma_receive_complete(struct nsc_ircc_cb *self, int iobase)
                         /* Copy frame without CRC */
                         if (self->io.speed < 4000000) {
                                 skb_put(skb, len-2);
-                                memcpy(skb->data, self->rx_buff.data, len-2);
+                                skb_copy_to_linear_data(skb,
+                                                        self->rx_buff.data,
+                                                        len - 2);
                         } else {
                                 skb_put(skb, len-4);
-                                memcpy(skb->data, self->rx_buff.data, len-4);
+                                skb_copy_to_linear_data(skb,
+                                                        self->rx_buff.data,
+                                                        len - 4);
                         }
 
                         /* Move to next frame */
@@ -1881,7 +1884,7 @@ static int nsc_ircc_dma_receive_complete(struct nsc_ircc_cb *self, int iobase)
                         self->stats.rx_packets++;
 
                         skb->dev = self->netdev;
-                        skb->mac.raw  = skb->data;
+                        skb_reset_mac_header(skb);
                         skb->protocol = htons(ETH_P_IRDA);
                         netif_rx(skb);
                         self->netdev->last_rx = jiffies;
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 2272156af31e..fb196fd91855 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -386,12 +386,12 @@ static void pxa_irda_fir_irq_eif(struct pxa_irda *si, struct net_device *dev, in
 
                 /* Align IP header to 20 bytes  */
                 skb_reserve(skb, 1);
-                memcpy(skb->data, si->dma_rx_buff, len);
+                skb_copy_to_linear_data(skb, si->dma_rx_buff, len);
                 skb_put(skb, len);
 
                 /* Feed it to IrLAP  */
                 skb->dev = dev;
-                skb->mac.raw  = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = htons(ETH_P_IRDA);
                 netif_rx(skb);
 
@@ -484,7 +484,7 @@ static int pxa_irda_hard_xmit(struct sk_buff *skb, struct net_device *dev)
                 unsigned long mtt = irda_get_mtt(skb);
 
                 si->dma_tx_buff_len = skb->len;
-                memcpy(si->dma_tx_buff, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, si->dma_tx_buff, skb->len);
 
                 if (mtt)
                         while ((unsigned)(OSCR - si->last_oscr)/4 < mtt)
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index 937372d00398..056639f72bec 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -504,7 +504,7 @@ static void sa1100_irda_fir_error(struct sa1100_irda *si, struct net_device *dev
 
                 skb_put(skb, len);
                 skb->dev = dev;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = htons(ETH_P_IRDA);
                 si->stats.rx_packets++;
                 si->stats.rx_bytes += len;
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 31c623381ea8..198bf3bfa70f 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -315,6 +315,7 @@ static struct smsc_chip __initdata lpc_chips_flat[] =
 {
         /* Base address 0x2E or 0x4E */
         { "47N227",     KEY55_1|FIR|SERx4,      0x5a, 0x00 },
+        { "47N227",     KEY55_1|FIR|SERx4,      0x7a, 0x00 },
         { "47N267",     KEY55_1|FIR|SERx4,      0x5e, 0x00 },
         { NULL }
 };
@@ -1161,7 +1162,7 @@ static int smsc_ircc_hard_xmit_fir(struct sk_buff *skb, struct net_device *dev)
                 self->new_speed = speed;
         }
 
-        memcpy(self->tx_buff.head, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, self->tx_buff.head, skb->len);
 
         self->tx_buff.len = skb->len;
         self->tx_buff.data = self->tx_buff.head;
@@ -1412,7 +1413,7 @@ static void smsc_ircc_dma_receive_complete(struct smsc_ircc_cb *self)
         self->stats.rx_bytes += len;
 
         skb->dev = self->netdev;
-        skb->mac.raw  = skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IRDA);
         netif_rx(skb);
 }
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index 20d306fea4cb..755aa444a4dd 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -52,7 +52,6 @@
 #include <linux/kthread.h>
 #include <linux/freezer.h>
 #include <net/irda/irda.h>
-#include <net/irda/irlap.h>
 #include <net/irda/irda_device.h>
 #include <net/irda/wrapper.h>
 #include <net/irda/crc.h>
@@ -349,7 +348,7 @@ static void fir_eof(struct stir_cb *stir)
                 }
                 skb_reserve(nskb, 1);
                 skb = nskb;
-                memcpy(nskb->data, rx_buff->data, len);
+                skb_copy_to_linear_data(nskb, rx_buff->data, len);
         } else {
                 nskb = dev_alloc_skb(rx_buff->truesize);
                 if (unlikely(!nskb)) {
@@ -364,7 +363,7 @@ static void fir_eof(struct stir_cb *stir)
 
         skb_put(skb, len);
 
-        skb->mac.raw  = skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IRDA);
         skb->dev = stir->netdev;
 
diff --git a/drivers/net/irda/via-ircc.c b/drivers/net/irda/via-ircc.c
index c3ed9b3067e5..ff5358574d0a 100644
--- a/drivers/net/irda/via-ircc.c
+++ b/drivers/net/irda/via-ircc.c
@@ -925,8 +925,8 @@ static int via_ircc_hard_xmit_fir(struct sk_buff *skb,
 
         self->tx_fifo.tail += skb->len;
         self->stats.tx_bytes += skb->len;
-        memcpy(self->tx_fifo.queue[self->tx_fifo.free].start, skb->data,
-               skb->len);
+        skb_copy_from_linear_data(skb,
+                      self->tx_fifo.queue[self->tx_fifo.free].start, skb->len);
         self->tx_fifo.len++;
         self->tx_fifo.free++;
 //F01   if (self->tx_fifo.len == 1) {
@@ -1125,7 +1125,7 @@ static int via_ircc_dma_receive_complete(struct via_ircc_cb *self,
                 self->stats.rx_bytes += len;
                 self->stats.rx_packets++;
                 skb->dev = self->netdev;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = htons(ETH_P_IRDA);
                 netif_rx(skb);
                 return TRUE;
@@ -1189,7 +1189,7 @@ F01_E */
                 skb_reserve(skb, 1);
                 skb_put(skb, len - 4);
 
-                memcpy(skb->data, self->rx_buff.data, len - 4);
+                skb_copy_to_linear_data(skb, self->rx_buff.data, len - 4);
                 IRDA_DEBUG(2, "%s(): len=%x.rx_buff=%p\n", __FUNCTION__,
                            len - 4, self->rx_buff.data);
 
@@ -1198,7 +1198,7 @@ F01_E */
                 self->stats.rx_bytes += len;
                 self->stats.rx_packets++;
                 skb->dev = self->netdev;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = htons(ETH_P_IRDA);
                 netif_rx(skb);
 
@@ -1234,7 +1234,7 @@ static int upload_rxdata(struct via_ircc_cb *self, int iobase)
         }
         skb_reserve(skb, 1);
         skb_put(skb, len - 4 + 1);
-        memcpy(skb->data, self->rx_buff.data, len - 4 + 1);
+        skb_copy_to_linear_data(skb, self->rx_buff.data, len - 4 + 1);
         st_fifo->tail++;
         st_fifo->len++;
         if (st_fifo->tail > MAX_RX_WINDOW)
@@ -1244,7 +1244,7 @@ static int upload_rxdata(struct via_ircc_cb *self, int iobase)
         self->stats.rx_bytes += len;
         self->stats.rx_packets++;
         skb->dev = self->netdev;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol = htons(ETH_P_IRDA);
         netif_rx(skb);
         if (st_fifo->len < (MAX_RX_WINDOW + 2)) {
@@ -1303,7 +1303,7 @@ static int RxTimerHandler(struct via_ircc_cb *self, int iobase)
                         }
                         skb_reserve(skb, 1);
                         skb_put(skb, len - 4);
-                        memcpy(skb->data, self->rx_buff.data, len - 4);
+                        skb_copy_to_linear_data(skb, self->rx_buff.data, len - 4);
 
                         IRDA_DEBUG(2, "%s(): len=%x.head=%x\n", __FUNCTION__,
                                    len - 4, st_fifo->head);
@@ -1313,7 +1313,7 @@ static int RxTimerHandler(struct via_ircc_cb *self, int iobase)
                         self->stats.rx_bytes += len;
                         self->stats.rx_packets++;
                         skb->dev = self->netdev;
-                        skb->mac.raw = skb->data;
+                        skb_reset_mac_header(skb);
                         skb->protocol = htons(ETH_P_IRDA);
                         netif_rx(skb);
                 }               //while
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index 3457e9d8b667..c4be973867a6 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -595,7 +595,7 @@ static int vlsi_process_rx(struct vlsi_ring *r, struct ring_descr *rd)
         rd->skb = NULL;
         skb->dev = ndev;
         memcpy(skb_put(skb,len), rd->buf, len);
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         if (in_interrupt())
                 netif_rx(skb);
         else
@@ -993,7 +993,7 @@ static int vlsi_hard_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         goto drop;
                 }
                 else
-                        memcpy(rd->buf, skb->data, len);
+                        skb_copy_from_linear_data(skb, rd->buf, len);
         }
 
         rd->skb = skb;                  /* remember skb for tx-complete stats */
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index 4212657fa4f9..5182e800cc18 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -529,7 +529,7 @@ int w83977af_hard_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Decide if we should use PIO or DMA transfer */
         if (self->io.speed > PIO_MAX_SPEED) {
                 self->tx_buff.data = self->tx_buff.head;
-                memcpy(self->tx_buff.data, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, self->tx_buff.data, skb->len);
                 self->tx_buff.len = skb->len;
                 
                 mtt = irda_get_mtt(skb);
@@ -908,10 +908,14 @@ int w83977af_dma_receive_complete(struct w83977af_ir *self)
                         /* Copy frame without CRC */
                         if (self->io.speed < 4000000) {
                                 skb_put(skb, len-2);
-                                memcpy(skb->data, self->rx_buff.data, len-2);
+                                skb_copy_to_linear_data(skb,
+                                                        self->rx_buff.data,
+                                                        len - 2);
                         } else {
                                 skb_put(skb, len-4);
-                                memcpy(skb->data, self->rx_buff.data, len-4);
+                                skb_copy_to_linear_data(skb,
+                                                        self->rx_buff.data,
+                                                        len - 4);
                         }
 
                         /* Move to next frame */
@@ -919,7 +923,7 @@ int w83977af_dma_receive_complete(struct w83977af_ir *self)
                         self->stats.rx_packets++;
                         
                         skb->dev = self->netdev;
-                        skb->mac.raw  = skb->data;
+                        skb_reset_mac_header(skb);
                         skb->protocol = htons(ETH_P_IRDA);
                         netif_rx(skb);
                         self->netdev->last_rx = jiffies;
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index 0e9ba3c3faf7..347d50cd77d4 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -1540,7 +1540,6 @@ static void veth_receive(struct veth_lpar_connection *cnx,
                 }
 
                 skb_put(skb, length);
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
                 skb->ip_summed = CHECKSUM_NONE;
                 netif_rx(skb);  /* send it up */
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index afc2ec72529e..dfde80e54aef 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1182,24 +1182,27 @@ ixgb_tso(struct ixgb_adapter *adapter, struct sk_buff *skb)
 
         if (likely(skb_is_gso(skb))) {
                 struct ixgb_buffer *buffer_info;
+                struct iphdr *iph;
+
                 if (skb_header_cloned(skb)) {
                         err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
                         if (err)
                                 return err;
                 }
 
-                hdr_len = ((skb->h.raw - skb->data) + (skb->h.th->doff << 2));
+                hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
                 mss = skb_shinfo(skb)->gso_size;
-                skb->nh.iph->tot_len = 0;
-                skb->nh.iph->check = 0;
-                skb->h.th->check = ~csum_tcpudp_magic(skb->nh.iph->saddr,
-                                                      skb->nh.iph->daddr,
-                                                      0, IPPROTO_TCP, 0);
-                ipcss = skb->nh.raw - skb->data;
-                ipcso = (void *)&(skb->nh.iph->check) - (void *)skb->data;
-                ipcse = skb->h.raw - skb->data - 1;
-                tucss = skb->h.raw - skb->data;
-                tucso = (void *)&(skb->h.th->check) - (void *)skb->data;
+                iph = ip_hdr(skb);
+                iph->tot_len = 0;
+                iph->check = 0;
+                tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
+                                                         iph->daddr, 0,
+                                                         IPPROTO_TCP, 0);
+                ipcss = skb_network_offset(skb);
+                ipcso = (void *)&(iph->check) - (void *)skb->data;
+                ipcse = skb_transport_offset(skb) - 1;
+                tucss = skb_transport_offset(skb);
+                tucso = (void *)&(tcp_hdr(skb)->check) - (void *)skb->data;
                 tucse = 0;
 
                 i = adapter->tx_ring.next_to_use;
@@ -1243,7 +1246,7 @@ ixgb_tx_csum(struct ixgb_adapter *adapter, struct sk_buff *skb)
 
         if(likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
                 struct ixgb_buffer *buffer_info;
-                css = skb->h.raw - skb->data;
+                css = skb_transport_offset(skb);
                 cso = css + skb->csum_offset;
 
                 i = adapter->tx_ring.next_to_use;
@@ -2014,9 +2017,12 @@ ixgb_clean_rx_irq(struct ixgb_adapter *adapter)
                             netdev_alloc_skb(netdev, length + NET_IP_ALIGN);
                         if (new_skb) {
                                 skb_reserve(new_skb, NET_IP_ALIGN);
-                                memcpy(new_skb->data - NET_IP_ALIGN,
-                                       skb->data - NET_IP_ALIGN,
-                                       length + NET_IP_ALIGN);
+                                skb_copy_to_linear_data_offset(new_skb,
+                                                               -NET_IP_ALIGN,
+                                                               (skb->data -
+                                                                NET_IP_ALIGN),
+                                                               (length +
+                                                                NET_IP_ALIGN));
                                 /* save the skb in buffer_info as good */
                                 buffer_info->skb = skb;
                                 skb = new_skb;
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index a4eccb11d677..6683afc02aaa 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -110,11 +110,10 @@ static int ixpdev_rx(struct net_device *dev, int *budget)
 
                 skb = dev_alloc_skb(desc->pkt_length + 2);
                 if (likely(skb != NULL)) {
-                        skb->dev = nds[desc->channel];
                         skb_reserve(skb, 2);
                         eth_copy_and_sum(skb, buf, desc->pkt_length, 0);
                         skb_put(skb, desc->pkt_length);
-                        skb->protocol = eth_type_trans(skb, skb->dev);
+                        skb->protocol = eth_type_trans(skb, nds[desc->channel]);
 
                         skb->dev->last_rx = jiffies;
 
diff --git a/drivers/net/lance.c b/drivers/net/lance.c
index a3843320dbe1..0fe96c85828b 100644
--- a/drivers/net/lance.c
+++ b/drivers/net/lance.c
@@ -988,7 +988,7 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (lance_debug > 5)
                         printk("%s: bouncing a high-memory packet (%#x).\n",
                                    dev->name, (u32)isa_virt_to_bus(skb->data));
-                memcpy(&lp->tx_bounce_buffs[entry], skb->data, skb->len);
+                skb_copy_from_linear_data(skb, &lp->tx_bounce_buffs[entry], skb->len);
                 lp->tx_ring[entry].base =
                         ((u32)isa_virt_to_bus((lp->tx_bounce_buffs + entry)) & 0xffffff) | 0x83000000;
                 dev_kfree_skb(skb);
@@ -1184,7 +1184,6 @@ lance_rx(struct net_device *dev)
                                         }
                                         break;
                                 }
-                                skb->dev = dev;
                                 skb_reserve(skb,2);     /* 16 byte align */
                                 skb_put(skb,pkt_len);   /* Make room */
                                 eth_copy_and_sum(skb,
diff --git a/drivers/net/lasi_82596.c b/drivers/net/lasi_82596.c
index 452863d5d498..0edcd125fd61 100644
--- a/drivers/net/lasi_82596.c
+++ b/drivers/net/lasi_82596.c
@@ -801,7 +801,6 @@ memory_squeeze:
                                 lp->stats.rx_dropped++;
                         }
                         else {
-                                skb->dev = dev;
                                 if (!rx_in_place) {
                                         /* 16 byte align the data fields */
                                         dma_sync_single_for_cpu(lp->dev, (dma_addr_t)WSWAPchar(rbd->b_data), PKT_BUF_SZ, DMA_FROM_DEVICE);
diff --git a/drivers/net/lib8390.c b/drivers/net/lib8390.c
index e726c06b8dc6..5c86e737f954 100644
--- a/drivers/net/lib8390.c
+++ b/drivers/net/lib8390.c
@@ -722,7 +722,6 @@ static void ei_receive(struct net_device *dev)
                         else
                         {
                                 skb_reserve(skb,2);     /* IP headers on 16 byte boundaries */
-                                skb->dev = dev;
                                 skb_put(skb, pkt_len);  /* Make room */
                                 ei_block_input(dev, pkt_len, skb, current_offset + sizeof(rx_frame));
                                 skb->protocol=eth_type_trans(skb,dev);
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 2b739fd584f1..6ba6ed2b480a 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -75,8 +75,9 @@ static DEFINE_PER_CPU(struct pcpu_lstats, pcpu_lstats);
 #ifdef LOOPBACK_TSO
 static void emulate_large_send_offload(struct sk_buff *skb)
 {
-        struct iphdr *iph = skb->nh.iph;
-        struct tcphdr *th = (struct tcphdr*)(skb->nh.raw + (iph->ihl * 4));
+        struct iphdr *iph = ip_hdr(skb);
+        struct tcphdr *th = (struct tcphdr *)(skb_network_header(skb) +
+                                              (iph->ihl * 4));
         unsigned int doffset = (iph->ihl + th->doff) * 4;
         unsigned int mtu = skb_shinfo(skb)->gso_size + doffset;
         unsigned int offset = 0;
@@ -90,10 +91,11 @@ static void emulate_large_send_offload(struct sk_buff *skb)
                 if (!nskb)
                         break;
                 skb_reserve(nskb, 32);
-                nskb->mac.raw = nskb->data - 14;
-                nskb->nh.raw = nskb->data;
-                iph = nskb->nh.iph;
-                memcpy(nskb->data, skb->nh.raw, doffset);
+                skb_set_mac_header(nskb, -ETH_HLEN);
+                skb_reset_network_header(nskb);
+                iph = ip_hdr(nskb);
+                skb_copy_to_linear_data(nskb, skb_network_header(skb),
+                                        doffset);
                 if (skb_copy_bits(skb,
                                   doffset + offset,
                                   nskb->data + doffset,
@@ -108,7 +110,7 @@ static void emulate_large_send_offload(struct sk_buff *skb)
                 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
                 nskb->pkt_type = skb->pkt_type;
 
-                th = (struct tcphdr*)(nskb->nh.raw + iph->ihl*4);
+                th = (struct tcphdr *)(skb_network_header(nskb) + iph->ihl * 4);
                 iph->tot_len = htons(frag_size + doffset);
                 iph->id = htons(id);
                 iph->check = 0;
@@ -137,7 +139,6 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_orphan(skb);
 
         skb->protocol = eth_type_trans(skb,dev);
-        skb->dev = dev;
 #ifndef LOOPBACK_MUST_CHECKSUM
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 #endif
@@ -145,7 +146,7 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
 #ifdef LOOPBACK_TSO
         if (skb_is_gso(skb)) {
                 BUG_ON(skb->protocol != htons(ETH_P_IP));
-                BUG_ON(skb->nh.iph->protocol != IPPROTO_TCP);
+                BUG_ON(ip_hdr(skb)->protocol != IPPROTO_TCP);
 
                 emulate_large_send_offload(skb);
                 return 0;
@@ -163,11 +164,9 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static struct net_device_stats loopback_stats;
-
 static struct net_device_stats *get_stats(struct net_device *dev)
 {
-        struct net_device_stats *stats = &loopback_stats;
+        struct net_device_stats *stats = &dev->stats;
         unsigned long bytes = 0;
         unsigned long packets = 0;
         int i;
@@ -207,7 +206,6 @@ static const struct ethtool_ops loopback_ethtool_ops = {
 struct net_device loopback_dev = {
         .name                   = "lo",
         .get_stats              = &get_stats,
-        .priv                   = &loopback_stats,
         .mtu                    = (16 * 1024) + 20 + 20 + 12,
         .hard_start_xmit        = loopback_xmit,
         .hard_header            = eth_header,
diff --git a/drivers/net/lp486e.c b/drivers/net/lp486e.c
index 177c502f7385..5fc18da1873d 100644
--- a/drivers/net/lp486e.c
+++ b/drivers/net/lp486e.c
@@ -676,7 +676,6 @@ i596_rx_one(struct net_device *dev, struct i596_private *lp,
                         return 1;
                 }
 
-                skb->dev = dev;
                 memcpy(skb_put(skb,pkt_len), rfd->data, pkt_len);
 
                 skb->protocol = eth_type_trans(skb,dev);
diff --git a/drivers/net/mac89x0.c b/drivers/net/mac89x0.c
index e960138011c0..90e695d53266 100644
--- a/drivers/net/mac89x0.c
+++ b/drivers/net/mac89x0.c
@@ -530,7 +530,6 @@ net_rx(struct net_device *dev)
                 return;
         }
         skb_put(skb, length);
-        skb->dev = dev;
 
         memcpy_fromio(skb->data, dev->mem_start + PP_RxFrame, length);
 
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 2e9571bf0736..0e04f7ac3f2e 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -357,7 +357,6 @@ static int macb_rx_frame(struct macb *bp, unsigned int first_frag,
         }
 
         skb_reserve(skb, RX_OFFSET);
-        skb->dev = bp->dev;
         skb->ip_summed = CHECKSUM_NONE;
         skb_put(skb, len);
 
@@ -368,9 +367,10 @@ static int macb_rx_frame(struct macb *bp, unsigned int first_frag,
                         BUG_ON(frag != last_frag);
                         frag_len = len - offset;
                 }
-                memcpy(skb->data + offset,
-                       bp->rx_buffers + (RX_BUFFER_SIZE * frag),
-                       frag_len);
+                skb_copy_to_linear_data_offset(skb, offset,
+                                               (bp->rx_buffers +
+                                                (RX_BUFFER_SIZE * frag)),
+                                               frag_len);
                 offset += RX_BUFFER_SIZE;
                 bp->rx_ring[frag].addr &= ~MACB_BIT(RX_USED);
                 wmb();
@@ -576,7 +576,8 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
         int i;
         dev_dbg(&bp->pdev->dev,
                 "start_xmit: len %u head %p data %p tail %p end %p\n",
-                skb->len, skb->head, skb->data, skb->tail, skb->end);
+                skb->len, skb->head, skb->data,
+                skb_tail_pointer(skb), skb_end_pointer(skb));
         dev_dbg(&bp->pdev->dev,
                 "data:");
         for (i = 0; i < 16; i++)
diff --git a/drivers/net/mace.c b/drivers/net/mace.c
index 9ec24f0d5d68..b3bd62394958 100644
--- a/drivers/net/mace.c
+++ b/drivers/net/mace.c
@@ -939,7 +939,6 @@ static irqreturn_t mace_rxdma_intr(int irq, void *dev_id)
                 else    /* Ethernet header; mace includes FCS */
                     nb -= 8;
                 skb_put(skb, nb);
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
                 mp->stats.rx_bytes += skb->len;
                 netif_rx(skb);
diff --git a/drivers/net/macmace.c b/drivers/net/macmace.c
index 5d541e873041..27911c07558d 100644
--- a/drivers/net/macmace.c
+++ b/drivers/net/macmace.c
@@ -420,8 +420,7 @@ static int mace_xmit_start(struct sk_buff *skb, struct net_device *dev)
         mp->stats.tx_bytes += skb->len;
 
         /* We need to copy into our xmit buffer to take care of alignment and caching issues */
-
-        memcpy((void *) mp->tx_ring, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, mp->tx_ring, skb->len);
 
         /* load the Tx DMA and fire it off */
 
@@ -621,7 +620,6 @@ static void mace_dma_rx_frame(struct net_device *dev, struct mace_frame *mf)
         skb_reserve(skb,2);
         memcpy(skb_put(skb, mf->len), mf->data, mf->len);
 
-        skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
         netif_rx(skb);
         dev->last_rx = jiffies;
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index 7e69ca6edd91..0343ea12b299 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -421,7 +421,6 @@ static void meth_rx(struct net_device* dev, unsigned long int_status)
                                         /* Write metadata, and then pass to the receive level */
                                         skb_put(skb_c, len);
                                         priv->rx_skbs[priv->rx_write] = skb;
-                                        skb_c->dev = dev;
                                         skb_c->protocol = eth_type_trans(skb_c, dev);
                                         dev->last_rx = jiffies;
                                         priv->stats.rx_packets++;
@@ -609,7 +608,7 @@ static void meth_tx_short_prepare(struct meth_private *priv,
 
         desc->header.raw = METH_TX_CMD_INT_EN | (len-1) | ((128-len) << 16);
         /* maybe I should set whole thing to 0 first... */
-        memcpy(desc->data.dt + (120 - len), skb->data, skb->len);
+        skb_copy_from_linear_data(skb, desc->data.dt + (120 - len), skb->len);
         if (skb->len < len)
                 memset(desc->data.dt + 120 - len + skb->len, 0, len-skb->len);
 }
@@ -627,8 +626,8 @@ static void meth_tx_1page_prepare(struct meth_private *priv,
 
         /* unaligned part */
         if (unaligned_len) {
-                memcpy(desc->data.dt + (120 - unaligned_len),
-                       skb->data, unaligned_len);
+                skb_copy_from_linear_data(skb, desc->data.dt + (120 - unaligned_len),
+                              unaligned_len);
                 desc->header.raw |= (128 - unaligned_len) << 16;
         }
 
@@ -653,8 +652,8 @@ static void meth_tx_2page_prepare(struct meth_private *priv,
         desc->header.raw = METH_TX_CMD_INT_EN | TX_CATBUF1 | TX_CATBUF2| (skb->len - 1);
         /* unaligned part */
         if (unaligned_len){
-                memcpy(desc->data.dt + (120 - unaligned_len),
-                       skb->data, unaligned_len);
+                skb_copy_from_linear_data(skb, desc->data.dt + (120 - unaligned_len),
+                              unaligned_len);
                 desc->header.raw |= (128 - unaligned_len) << 16;
         }
 
diff --git a/drivers/net/mipsnet.c b/drivers/net/mipsnet.c
index f42b9e201937..403f63afd201 100644
--- a/drivers/net/mipsnet.c
+++ b/drivers/net/mipsnet.c
@@ -101,7 +101,6 @@ static inline ssize_t mipsnet_get_fromdev(struct net_device *dev, size_t count)
         if (ioiocpy_frommipsnet(dev, skb_put(skb, len), len))
                 return -EFAULT;
 
-        skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 8015a7c5b0c9..ab15ecd4b3d6 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -434,7 +434,6 @@ static int mv643xx_eth_receive_queue(struct net_device *dev, int budget)
                          * received packet
                          */
                         skb_put(skb, pkt_info.byte_cnt - 4);
-                        skb->dev = dev;
 
                         if (pkt_info.cmd_sts & ETH_LAYER_4_CHECKSUM_OK) {
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1162,15 +1161,15 @@ static void eth_tx_submit_descs_for_skb(struct mv643xx_private *mp,
 
                 cmd_sts |= ETH_GEN_TCP_UDP_CHECKSUM |
                            ETH_GEN_IP_V_4_CHECKSUM  |
-                           skb->nh.iph->ihl << ETH_TX_IHL_SHIFT;
+                           ip_hdr(skb)->ihl << ETH_TX_IHL_SHIFT;
 
-                switch (skb->nh.iph->protocol) {
+                switch (ip_hdr(skb)->protocol) {
                 case IPPROTO_UDP:
                         cmd_sts |= ETH_UDP_FRAME;
-                        desc->l4i_chk = skb->h.uh->check;
+                        desc->l4i_chk = udp_hdr(skb)->check;
                         break;
                 case IPPROTO_TCP:
-                        desc->l4i_chk = skb->h.th->check;
+                        desc->l4i_chk = tcp_hdr(skb)->check;
                         break;
                 default:
                         BUG();
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index f8efe0e70a6b..16e3c4315e82 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -879,7 +879,7 @@ myri10ge_rx_skb_build(struct sk_buff *skb, u8 * va,
          * skb_pull() (for ether_pad and eth_type_trans()) requires
          * the beginning of the packet in skb_headlen(), move it
          * manually */
-        memcpy(skb->data, va, hlen);
+        skb_copy_to_linear_data(skb, va, hlen);
         skb_shinfo(skb)->frags[0].page_offset += hlen;
         skb_shinfo(skb)->frags[0].size -= hlen;
         skb->data_len -= hlen;
@@ -1020,7 +1020,6 @@ myri10ge_rx_done(struct myri10ge_priv *mgp, struct myri10ge_rx_buf *rx,
                 skb_shinfo(skb)->nr_frags = 0;
         }
         skb->protocol = eth_type_trans(skb, dev);
-        skb->dev = dev;
 
         if (mgp->csum_flag) {
                 if ((skb->protocol == htons(ETH_P_IP)) ||
@@ -2030,7 +2029,7 @@ again:
         odd_flag = 0;
         flags = (MXGEFW_FLAGS_NO_TSO | MXGEFW_FLAGS_FIRST);
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                cksum_offset = (skb->h.raw - skb->data);
+                cksum_offset = skb_transport_offset(skb);
                 pseudo_hdr_offset = cksum_offset + skb->csum_offset;
                 /* If the headers are excessively large, then we must
                  * fall back to a software checksum */
@@ -2055,7 +2054,7 @@ again:
                  * send loop that we are still in the
                  * header portion of the TSO packet.
                  * TSO header must be at most 134 bytes long */
-                cum_len = -((skb->h.raw - skb->data) + (skb->h.th->doff << 2));
+                cum_len = -(skb_transport_offset(skb) + tcp_hdrlen(skb));
 
                 /* for TSO, pseudo_hdr_offset holds mss.
                  * The firmware figures out where to put
diff --git a/drivers/net/myri_sbus.c b/drivers/net/myri_sbus.c
index ee26ef52289f..13444da93273 100644
--- a/drivers/net/myri_sbus.c
+++ b/drivers/net/myri_sbus.c
@@ -368,7 +368,7 @@ static __be16 myri_type_trans(struct sk_buff *skb, struct net_device *dev)
         struct ethhdr *eth;
         unsigned char *rawp;
 
-        skb->mac.raw = (((unsigned char *)skb->data) + MYRI_PAD_LEN);
+        skb_set_mac_header(skb, MYRI_PAD_LEN);
         skb_pull(skb, dev->hard_header_len);
         eth = eth_hdr(skb);
 
@@ -502,7 +502,7 @@ static void myri_rx(struct myri_eth *mp, struct net_device *dev)
                         copy_skb->dev = dev;
                         DRX(("resv_and_put "));
                         skb_put(copy_skb, len);
-                        memcpy(copy_skb->data, skb->data, len);
+                        skb_copy_from_linear_data(skb, copy_skb->data, len);
 
                         /* Reuse original ring buffer. */
                         DRX(("reuse "));
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 349b96a3ec4c..a8d7ff2c96ac 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -2289,7 +2289,6 @@ static void netdev_rx(struct net_device *dev, int *work_done, int work_to_do)
                          * without copying to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak
                             && (skb = dev_alloc_skb(pkt_len + RX_OFFSET)) != NULL) {
-                                skb->dev = dev;
                                 /* 16 byte align the IP header */
                                 skb_reserve(skb, RX_OFFSET);
                                 pci_dma_sync_single_for_cpu(np->pci_dev,
diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
index a53644f6a29b..2b8da0a54998 100644
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -168,7 +168,6 @@ static void netx_eth_receive(struct net_device *ndev)
                 FIFO_PTR_SEGMENT(seg) | FIFO_PTR_FRAMENO(frameno));
 
         ndev->last_rx = jiffies;
-        skb->dev = ndev;
         skb->protocol = eth_type_trans(skb, ndev);
         netif_rx(skb);
         priv->stats.rx_packets++;
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 6537574a9cda..0fba8f190762 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -35,6 +35,8 @@
 #include "netxen_nic_hw.h"
 #include "netxen_nic_phan_reg.h"
 
+#include <net/ip.h>
+
 /*  PCI Windowing for DDR regions.  */
 
 #define ADDR_IN_RANGE(addr, low, high)  \
@@ -371,22 +373,21 @@ void netxen_tso_check(struct netxen_adapter *adapter,
                       struct cmd_desc_type0 *desc, struct sk_buff *skb)
 {
         if (desc->mss) {
-                desc->total_hdr_length = sizeof(struct ethhdr) +
-                    ((skb->nh.iph)->ihl * sizeof(u32)) +
-                    ((skb->h.th)->doff * sizeof(u32));
+                desc->total_hdr_length = (sizeof(struct ethhdr) +
+                                          ip_hdrlen(skb) + tcp_hdrlen(skb));
                 netxen_set_cmd_desc_opcode(desc, TX_TCP_LSO);
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                if (skb->nh.iph->protocol == IPPROTO_TCP) {
+                if (ip_hdr(skb)->protocol == IPPROTO_TCP) {
                         netxen_set_cmd_desc_opcode(desc, TX_TCP_PKT);
-                } else if (skb->nh.iph->protocol == IPPROTO_UDP) {
+                } else if (ip_hdr(skb)->protocol == IPPROTO_UDP) {
                         netxen_set_cmd_desc_opcode(desc, TX_UDP_PKT);
                 } else {
                         return;
                 }
         }
         adapter->stats.xmitcsummed++;
-        desc->tcp_hdr_offset = skb->h.raw - skb->data;
-        desc->ip_hdr_offset = skb->nh.raw - skb->data;
+        desc->tcp_hdr_offset = skb_transport_offset(skb);
+        desc->ip_hdr_offset = skb_network_offset(skb);
 }
 
 int netxen_is_flash_supported(struct netxen_adapter *adapter)
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index eff965dc5fff..5cd40562da7c 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -1129,7 +1129,6 @@ netxen_process_rcv(struct netxen_adapter *adapter, int ctxid,
                 port->stats.csummed++;
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
-        skb->dev = netdev;
         if (desc_ctx == RCV_DESC_LRO_CTXID) {
                 /* True length was only available on the last pkt */
                 skb_put(skb, buffer->lro_length);
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 7d2525e76abb..ab25c225a07e 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -41,6 +41,7 @@
 
 #include <linux/dma-mapping.h>
 #include <linux/vmalloc.h>
+#include <net/ip.h>
 
 MODULE_DESCRIPTION("NetXen Multi port (1/10) Gigabit Network Driver");
 MODULE_LICENSE("GPL");
@@ -778,9 +779,8 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 if (skb_shinfo(skb)->gso_size > 0) {
 
                         no_of_desc++;
-                        if (((skb->nh.iph)->ihl * sizeof(u32)) +
-                            ((skb->h.th)->doff * sizeof(u32)) +
-                            sizeof(struct ethhdr) >
+                        if ((ip_hdrlen(skb) + tcp_hdrlen(skb) +
+                             sizeof(struct ethhdr)) >
                             (sizeof(struct cmd_desc_type0) - 2)) {
                                 no_of_desc++;
                         }
@@ -920,8 +920,10 @@ static int netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                         /* copy the next 64 bytes - should be enough except
                          * for pathological case
                          */
-                        memcpy((void *)hwdesc, (void *)(skb->data) +
-                               first_hdr_len, hdr_len - first_hdr_len);
+                        skb_copy_from_linear_data_offset(skb, first_hdr_len,
+                                                         hwdesc,
+                                                         (hdr_len -
+                                                          first_hdr_len));
                         producer = get_next_index(producer, max_tx_desc_count);
                 }
         }
diff --git a/drivers/net/ni5010.c b/drivers/net/ni5010.c
index 8be0d030d6f4..3d5b4232f65f 100644
--- a/drivers/net/ni5010.c
+++ b/drivers/net/ni5010.c
@@ -562,7 +562,6 @@ static void ni5010_rx(struct net_device *dev)
                 return;
         }
 
-        skb->dev = dev;
         skb_reserve(skb, 2);
 
         /* Read packet into buffer */
diff --git a/drivers/net/ni52.c b/drivers/net/ni52.c
index a6f4b24b0176..8dbd6d1900b5 100644
--- a/drivers/net/ni52.c
+++ b/drivers/net/ni52.c
@@ -934,7 +934,6 @@ static void ni52_rcv_int(struct net_device *dev)
                                         skb = (struct sk_buff *) dev_alloc_skb(totlen+2);
                                         if(skb != NULL)
                                         {
-                                                skb->dev = dev;
                                                 skb_reserve(skb,2);
                                                 skb_put(skb,totlen);
                                                 eth_copy_and_sum(skb,(char *) p->base+(unsigned long) rbd->buffer,totlen,0);
@@ -1183,7 +1182,7 @@ static int ni52_send_packet(struct sk_buff *skb, struct net_device *dev)
         else
 #endif
         {
-                memcpy((char *)p->xmit_cbuffs[p->xmit_count],(char *)(skb->data),skb->len);
+                skb_copy_from_linear_data(skb, (char *) p->xmit_cbuffs[p->xmit_count], skb->len);
                 len = skb->len;
                 if (len < ETH_ZLEN) {
                         len = ETH_ZLEN;
diff --git a/drivers/net/ni65.c b/drivers/net/ni65.c
index 1578f4d98498..3818edf0ac18 100644
--- a/drivers/net/ni65.c
+++ b/drivers/net/ni65.c
@@ -610,7 +610,6 @@ static void *ni65_alloc_mem(struct net_device *dev,char *what,int size,int type)
                         printk(KERN_WARNING "%s: unable to allocate %s memory.\n",dev->name,what);
                         return NULL;
                 }
-                skb->dev = dev;
                 skb_reserve(skb,2+16);
                 skb_put(skb,R_BUF_SIZE);         /* grab the whole space .. (not necessary) */
                 ptr = skb->data;
@@ -1094,7 +1093,6 @@ static void ni65_recv_intr(struct net_device *dev,int csr0)
                         if(skb)
                         {
                                 skb_reserve(skb,2);
-        skb->dev = dev;
 #ifdef RCV_VIA_SKB
                                 if( (unsigned long) (skb->data + R_BUF_SIZE) > 0x1000000) {
                                         skb_put(skb,len);
@@ -1178,8 +1176,9 @@ static int ni65_send_packet(struct sk_buff *skb, struct net_device *dev)
                 if( (unsigned long) (skb->data + skb->len) > 0x1000000) {
 #endif
 
-                        memcpy((char *) p->tmdbounce[p->tmdbouncenum] ,(char *)skb->data,
-                                                         (skb->len > T_BUF_SIZE) ? T_BUF_SIZE : skb->len);
+                        skb_copy_from_linear_data(skb, p->tmdbounce[p->tmdbouncenum],
+                                      skb->len > T_BUF_SIZE ? T_BUF_SIZE :
+                                                              skb->len);
                         if (len > skb->len)
                                 memset((char *)p->tmdbounce[p->tmdbouncenum]+skb->len, 0, len-skb->len);
                         dev_kfree_skb (skb);
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 9ec6e9e54f47..6a32338623f1 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -607,7 +607,6 @@ static inline int rx_refill(struct net_device *ndev, gfp_t gfp)
                 res &= 0xf;
                 skb_reserve(skb, res);
 
-                skb->dev = ndev;
                 if (gfp != GFP_ATOMIC)
                         spin_lock_irqsave(&dev->rx_info.lock, flags);
                 res = ns83820_add_rx_skb(dev, skb);
@@ -1157,9 +1156,9 @@ again:
         extsts = 0;
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 extsts |= EXTSTS_IPPKT;
-                if (IPPROTO_TCP == skb->nh.iph->protocol)
+                if (IPPROTO_TCP == ip_hdr(skb)->protocol)
                         extsts |= EXTSTS_TCPPKT;
-                else if (IPPROTO_UDP == skb->nh.iph->protocol)
+                else if (IPPROTO_UDP == ip_hdr(skb)->protocol)
                         extsts |= EXTSTS_UDPPKT;
         }
 
diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c
index d670ac74824f..76fe9dd8e841 100644
--- a/drivers/net/pasemi_mac.c
+++ b/drivers/net/pasemi_mac.c
@@ -334,8 +334,6 @@ static void pasemi_mac_replenish_rx_ring(struct net_device *dev)
                         break;
                 }
 
-                skb->dev = dev;
-
                 dma = pci_map_single(mac->dma_pdev, skb->data, skb->len,
                                      PCI_DMA_FROMDEVICE);
 
@@ -731,16 +729,18 @@ static int pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev)
         dflags = XCT_MACTX_O | XCT_MACTX_ST | XCT_MACTX_SS | XCT_MACTX_CRC_PAD;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                switch (skb->nh.iph->protocol) {
+                const unsigned char *nh = skb_network_header(skb);
+
+                switch (ip_hdr(skb)->protocol) {
                 case IPPROTO_TCP:
                         dflags |= XCT_MACTX_CSUM_TCP;
-                        dflags |= XCT_MACTX_IPH((skb->h.raw - skb->nh.raw) >> 2);
-                        dflags |= XCT_MACTX_IPO(skb->nh.raw - skb->data);
+                        dflags |= XCT_MACTX_IPH(skb_network_header_len(skb) >> 2);
+                        dflags |= XCT_MACTX_IPO(nh - skb->data);
                         break;
                 case IPPROTO_UDP:
                         dflags |= XCT_MACTX_CSUM_UDP;
-                        dflags |= XCT_MACTX_IPH((skb->h.raw - skb->nh.raw) >> 2);
-                        dflags |= XCT_MACTX_IPO(skb->nh.raw - skb->data);
+                        dflags |= XCT_MACTX_IPH(skb_network_header_len(skb) >> 2);
+                        dflags |= XCT_MACTX_IPO(nh - skb->data);
                         break;
                 }
         }
diff --git a/drivers/net/pci-skeleton.c b/drivers/net/pci-skeleton.c
index 6ca4e4fa6b88..df8998b4f37e 100644
--- a/drivers/net/pci-skeleton.c
+++ b/drivers/net/pci-skeleton.c
@@ -1344,7 +1344,7 @@ static int netdrv_start_xmit (struct sk_buff *skb, struct net_device *dev)
 
         tp->tx_info[entry].skb = skb;
         /* tp->tx_info[entry].mapping = 0; */
-        memcpy (tp->tx_buf[entry], skb->data, skb->len);
+        skb_copy_from_linear_data(skb, tp->tx_buf[entry], skb->len);
 
         /* Note: the chip doesn't have auto-pad! */
         NETDRV_W32 (TxStatus0 + (entry * sizeof(u32)),
@@ -1565,7 +1565,6 @@ static void netdrv_rx_interrupt (struct net_device *dev,
 
                 skb = dev_alloc_skb (pkt_size + 2);
                 if (skb) {
-                        skb->dev = dev;
                         skb_reserve (skb, 2);   /* 16 byte align the IP fields. */
 
                         eth_copy_and_sum (skb, &rx_ring[ring_offset + 4], pkt_size, 0);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index c7bd9c1c7f31..2b395ee21f75 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -1056,7 +1056,6 @@ static int el3_rx(struct net_device *dev, int worklimit)
                         DEBUG(3, "  Receiving packet size %d status %4.4x.\n",
                                   pkt_len, rx_status);
                         if (skb != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);
                                 insl(ioaddr+RX_FIFO, skb_put(skb, pkt_len),
                                                 ((pkt_len+3)>>2));
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 461e8274ef69..143ae2ff309e 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -883,7 +883,6 @@ static int el3_rx(struct net_device *dev)
             DEBUG(3, "    Receiving packet size %d status %4.4x.\n",
                   pkt_len, rx_status);
             if (skb != NULL) {
-                skb->dev = dev;
                 skb_reserve(skb, 2);
                 insl(ioaddr+RX_FIFO, skb_put(skb, pkt_len),
                         (pkt_len+3)>>2);
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 6139048f8117..808fae1577e0 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -1136,7 +1136,7 @@ static int ei_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 ei_block_output(dev, length, skb->data, output_page);
         else {
                 memset(packet, 0, ETH_ZLEN);
-                memcpy(packet, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, packet, skb->len);
                 ei_block_output(dev, length, packet, output_page);
         }
         
@@ -1496,7 +1496,6 @@ static void ei_receive(struct net_device *dev)
                         else
                         {
                                 skb_reserve(skb,2);     /* IP headers on 16 byte boundaries */
-                                skb->dev = dev;
                                 skb_put(skb, pkt_len);  /* Make room */
                                 ei_block_input(dev, pkt_len, skb, current_offset + sizeof(rx_frame));
                                 skb->protocol=eth_type_trans(skb,dev);
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 0d7de617e535..3f93d4933235 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -999,7 +999,6 @@ static void fjn_rx(struct net_device *dev)
                 lp->stats.rx_dropped++;
                 break;
             }
-            skb->dev = dev;
 
             skb_reserve(skb, 2);
             insw(ioaddr + DATAPORT, skb_put(skb, pkt_len),
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 3b707747a811..73da611fd536 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -1182,12 +1182,10 @@ static int mace_rx(struct net_device *dev, unsigned char RxCnt)
       skb = dev_alloc_skb(pkt_len+2);
 
       if (skb != NULL) {
-        skb->dev = dev;
-
         skb_reserve(skb, 2);
         insw(ioaddr + AM2150_RCV, skb_put(skb, pkt_len), pkt_len>>1);
         if (pkt_len & 1)
-            *(skb->tail-1) = inb(ioaddr + AM2150_RCV);
+            *(skb_tail_pointer(skb) - 1) = inb(ioaddr + AM2150_RCV);
         skb->protocol = eth_type_trans(skb, dev);
         
         netif_rx(skb); /* Send the packet to the upper (protocol) layers. */
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 2561f76033ea..7912dbd14251 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1669,7 +1669,6 @@ static void smc_rx(struct net_device *dev)
              (packet_length+1)>>1);
         skb->protocol = eth_type_trans(skb, dev);
         
-        skb->dev = dev;
         netif_rx(skb);
         dev->last_rx = jiffies;
         smc->stats.rx_packets++;
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index 5879e7c36988..809ec440b8eb 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -1226,7 +1226,6 @@ xirc2ps_interrupt(int irq, void *dev_id)
                             (pktlen+1)>>1);
                 }
                 skb->protocol = eth_type_trans(skb, dev);
-                skb->dev = dev;
                 netif_rx(skb);
                 dev->last_rx = jiffies;
                 lp->stats.rx_packets++;
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index 4d94ba7899bf..0791360a6a66 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1206,7 +1206,6 @@ static void pcnet32_rx_entry(struct net_device *dev,
                                          PCI_DMA_FROMDEVICE);
                         skb_put(skb, pkt_len);
                         lp->rx_skbuff[entry] = newskb;
-                        newskb->dev = dev;
                         lp->rx_dma_addr[entry] =
                                             pci_map_single(lp->pci_dev,
                                                            newskb->data,
diff --git a/drivers/net/plip.c b/drivers/net/plip.c
index 6bb085f54437..8754cf3356b0 100644
--- a/drivers/net/plip.c
+++ b/drivers/net/plip.c
@@ -546,7 +546,7 @@ static __be16 plip_type_trans(struct sk_buff *skb, struct net_device *dev)
         struct ethhdr *eth;
         unsigned char *rawp;
 
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb,dev->hard_header_len);
         eth = eth_hdr(skb);
 
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 933e2f3c77aa..caabbc408c34 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -802,9 +802,9 @@ process_input_packet(struct asyncppp *ap)
 
         /* check for address/control and protocol compression */
         p = skb->data;
-        if (p[0] == PPP_ALLSTATIONS && p[1] == PPP_UI) {
+        if (p[0] == PPP_ALLSTATIONS) {
                 /* chop off address/control */
-                if (skb->len < 3)
+                if (p[1] != PPP_UI || skb->len < 3)
                         goto err;
                 p = skb_pull(skb, 2);
         }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index ef58e4128782..6d596ca50cfd 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -88,8 +88,6 @@ struct ppp_file {
 #define PF_TO_PPP(pf)           PF_TO_X(pf, struct ppp)
 #define PF_TO_CHANNEL(pf)       PF_TO_X(pf, struct channel)
 
-#define ROUNDUP(n, x)           (((n) + (x) - 1) / (x))
-
 /*
  * Data structure describing one ppp unit.
  * A ppp unit corresponds to a ppp network interface device
@@ -1297,7 +1295,7 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
          */
         fragsize = len;
         if (nfree > 1)
-                fragsize = ROUNDUP(fragsize, nfree);
+                fragsize = DIV_ROUND_UP(fragsize, nfree);
         /* nbigger channels get fragsize bytes, the rest get fragsize-1,
            except if nbigger==0, then they all get fragsize. */
         nbigger = len % nfree;
@@ -1685,7 +1683,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                         skb_pull_rcsum(skb, 2);
                         skb->dev = ppp->dev;
                         skb->protocol = htons(npindex_to_ethertype[npi]);
-                        skb->mac.raw = skb->data;
+                        skb_reset_mac_header(skb);
                         netif_rx(skb);
                         ppp->dev->last_rx = jiffies;
                 }
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index b6f0e9a25e26..5918fab38349 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -594,7 +594,8 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
                                 return NULL;
                         }
                         skb_reserve(npkt,2);
-                        memcpy(skb_put(npkt,skb->len), skb->data, skb->len);
+                        skb_copy_from_linear_data(skb,
+                                      skb_put(npkt, skb->len), skb->len);
                         kfree_skb(skb);
                         skb = npkt;
                 }
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index ebfa2967cd68..6f98834e6ace 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -207,7 +207,7 @@ static inline struct pppox_sock *get_item(unsigned long sid,
 
 static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp)
 {
-        struct net_device *dev = NULL;
+        struct net_device *dev;
         int ifindex;
 
         dev = dev_get_by_name(sp->sa_addr.pppoe.dev);
@@ -218,20 +218,6 @@ static inline struct pppox_sock *get_item_by_addr(struct sockaddr_pppox *sp)
         return get_item(sp->sa_addr.pppoe.sid, sp->sa_addr.pppoe.remote, ifindex);
 }
 
-static inline int set_item(struct pppox_sock *po)
-{
-        int i;
-
-        if (!po)
-                return -EINVAL;
-
-        write_lock_bh(&pppoe_hash_lock);
-        i = __set_item(po);
-        write_unlock_bh(&pppoe_hash_lock);
-
-        return i;
-}
-
 static inline struct pppox_sock *delete_item(unsigned long sid, char *addr, int ifindex)
 {
         struct pppox_sock *ret;
@@ -255,54 +241,53 @@ static inline struct pppox_sock *delete_item(unsigned long sid, char *addr, int
 static void pppoe_flush_dev(struct net_device *dev)
 {
         int hash;
-
         BUG_ON(dev == NULL);
 
-        read_lock_bh(&pppoe_hash_lock);
+        write_lock_bh(&pppoe_hash_lock);
         for (hash = 0; hash < PPPOE_HASH_SIZE; hash++) {
                 struct pppox_sock *po = item_hash_table[hash];
 
                 while (po != NULL) {
-                        if (po->pppoe_dev == dev) {
-                                struct sock *sk = sk_pppox(po);
-
-                                sock_hold(sk);
-                                po->pppoe_dev = NULL;
+                        struct sock *sk = sk_pppox(po);
+                        if (po->pppoe_dev != dev) {
+                                po = po->next;
+                                continue;
+                        }
+                        po->pppoe_dev = NULL;
+                        dev_put(dev);
 
-                                /* We hold a reference to SK, now drop the
-                                 * hash table lock so that we may attempt
-                                 * to lock the socket (which can sleep).
-                                 */
-                                read_unlock_bh(&pppoe_hash_lock);
 
-                                lock_sock(sk);
+                        /* We always grab the socket lock, followed by the
+                         * pppoe_hash_lock, in that order.  Since we should
+                         * hold the sock lock while doing any unbinding,
+                         * we need to release the lock we're holding.
+                         * Hold a reference to the sock so it doesn't disappear
+                         * as we're jumping between locks.
+                         */
 
-                                if (sk->sk_state &
-                                    (PPPOX_CONNECTED | PPPOX_BOUND)) {
-                                        pppox_unbind_sock(sk);
-                                        dev_put(dev);
-                                        sk->sk_state = PPPOX_ZOMBIE;
-                                        sk->sk_state_change(sk);
-                                }
+                        sock_hold(sk);
 
-                                release_sock(sk);
+                        write_unlock_bh(&pppoe_hash_lock);
+                        lock_sock(sk);
 
-                                sock_put(sk);
+                        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+                                pppox_unbind_sock(sk);
+                                sk->sk_state = PPPOX_ZOMBIE;
+                                sk->sk_state_change(sk);
+                        }
 
-                                read_lock_bh(&pppoe_hash_lock);
+                        release_sock(sk);
+                        sock_put(sk);
 
-                                /* Now restart from the beginning of this
-                                 * hash chain.  We always NULL out pppoe_dev
-                                 * so we are guaranteed to make forward
-                                 * progress.
-                                 */
-                                po = item_hash_table[hash];
-                                continue;
-                        }
-                        po = po->next;
+                        /* Restart scan at the beginning of this hash chain.
+                         * While the lock was dropped the chain contents may
+                         * have changed.
+                         */
+                        write_lock_bh(&pppoe_hash_lock);
+                        po = item_hash_table[hash];
                 }
         }
-        read_unlock_bh(&pppoe_hash_lock);
+        write_unlock_bh(&pppoe_hash_lock);
 }
 
 static int pppoe_device_event(struct notifier_block *this,
@@ -344,10 +329,10 @@ static struct notifier_block pppoe_notifier = {
 static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 {
         struct pppox_sock *po = pppox_sk(sk);
-        struct pppox_sock *relay_po = NULL;
+        struct pppox_sock *relay_po;
 
         if (sk->sk_state & PPPOX_BOUND) {
-                struct pppoe_hdr *ph = (struct pppoe_hdr *) skb->nh.raw;
+                struct pppoe_hdr *ph = pppoe_hdr(skb);
                 int len = ntohs(ph->length);
                 skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
                 if (pskb_trim_rcsum(skb, len))
@@ -401,7 +386,7 @@ static int pppoe_rcv(struct sk_buff *skb,
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
 
-        ph = (struct pppoe_hdr *) skb->nh.raw;
+        ph = pppoe_hdr(skb);
 
         po = get_item((unsigned long) ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
         if (po != NULL)
@@ -433,7 +418,7 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
         if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
                 goto out;
 
-        ph = (struct pppoe_hdr *) skb->nh.raw;
+        ph = pppoe_hdr(skb);
         if (ph->code != PADT_CODE)
                 goto abort;
 
@@ -514,36 +499,49 @@ static int pppoe_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct pppox_sock *po;
-        int error = 0;
 
         if (!sk)
                 return 0;
 
-        if (sock_flag(sk, SOCK_DEAD))
+        lock_sock(sk);
+        if (sock_flag(sk, SOCK_DEAD)){
+                release_sock(sk);
                 return -EBADF;
+        }
 
         pppox_unbind_sock(sk);
 
         /* Signal the death of the socket. */
         sk->sk_state = PPPOX_DEAD;
 
+
+        /* Write lock on hash lock protects the entire "po" struct from
+         * concurrent updates via pppoe_flush_dev. The "po" struct should
+         * be considered part of the hash table contents, thus protected
+         * by the hash table lock */
+        write_lock_bh(&pppoe_hash_lock);
+
         po = pppox_sk(sk);
         if (po->pppoe_pa.sid) {
-                delete_item(po->pppoe_pa.sid, po->pppoe_pa.remote, po->pppoe_ifindex);
+                __delete_item(po->pppoe_pa.sid,
+                              po->pppoe_pa.remote, po->pppoe_ifindex);
         }
 
-        if (po->pppoe_dev)
+        if (po->pppoe_dev) {
                 dev_put(po->pppoe_dev);
+                po->pppoe_dev = NULL;
+        }
 
-        po->pppoe_dev = NULL;
+        write_unlock_bh(&pppoe_hash_lock);
 
         sock_orphan(sk);
         sock->sk = NULL;
 
         skb_queue_purge(&sk->sk_receive_queue);
+        release_sock(sk);
         sock_put(sk);
 
-        return error;
+        return 0;
 }
 
 
@@ -599,14 +597,18 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
                 po->pppoe_dev = dev;
                 po->pppoe_ifindex = dev->ifindex;
 
-                if (!(dev->flags & IFF_UP))
+                write_lock_bh(&pppoe_hash_lock);
+                if (!(dev->flags & IFF_UP)){
+                        write_unlock_bh(&pppoe_hash_lock);
                         goto err_put;
+                }
 
                 memcpy(&po->pppoe_pa,
                        &sp->sa_addr.pppoe,
                        sizeof(struct pppoe_addr));
 
-                error = set_item(po);
+                error = __set_item(po);
+                write_unlock_bh(&pppoe_hash_lock);
                 if (error < 0)
                         goto err_put;
 
@@ -762,10 +764,10 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
 static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
                   struct msghdr *m, size_t total_len)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         struct sock *sk = sock->sk;
         struct pppox_sock *po = pppox_sk(sk);
-        int error = 0;
+        int error;
         struct pppoe_hdr hdr;
         struct pppoe_hdr *ph;
         struct net_device *dev;
@@ -799,7 +801,7 @@ static int pppoe_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* Reserve space for headers. */
         skb_reserve(skb, dev->hard_header_len);
-        skb->nh.raw = skb->data;
+        skb_reset_network_header(skb);
 
         skb->dev = dev;
 
@@ -869,7 +871,8 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
                         goto abort;
 
                 skb_reserve(skb2, dev->hard_header_len + sizeof(struct pppoe_hdr));
-                memcpy(skb_put(skb2, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(skb2, skb->len),
+                                          skb->len);
         } else {
                 /* Make a clone so as to not disturb the original skb,
                  * give dev_queue_xmit something it can free.
@@ -884,7 +887,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
         memcpy(ph, &hdr, sizeof(struct pppoe_hdr));
         skb2->protocol = __constant_htons(ETH_P_PPP_SES);
 
-        skb2->nh.raw = skb2->data;
+        skb_reset_network_header(skb2);
 
         skb2->dev = dev;
 
@@ -929,10 +932,8 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
                   struct msghdr *m, size_t total_len, int flags)
 {
         struct sock *sk = sock->sk;
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         int error = 0;
-        int len;
-        struct pppoe_hdr *ph = NULL;
 
         if (sk->sk_state & PPPOX_BOUND) {
                 error = -EIO;
@@ -942,26 +943,21 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &error);
 
-        if (error < 0) {
+        if (error < 0)
                 goto end;
-        }
 
         m->msg_namelen = 0;
 
         if (skb) {
-                error = 0;
-                ph = (struct pppoe_hdr *) skb->nh.raw;
-                len = ntohs(ph->length);
+                struct pppoe_hdr *ph = pppoe_hdr(skb);
+                const int len = ntohs(ph->length);
 
                 error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
-                if (error < 0)
-                        goto do_skb_free;
-                error = len;
+                if (error == 0)
+                        error = len;
         }
 
-do_skb_free:
-        if (skb)
-                kfree_skb(skb);
+        kfree_skb(skb);
 end:
         return error;
 }
@@ -991,7 +987,7 @@ out:
 
 static __inline__ struct pppox_sock *pppoe_get_idx(loff_t pos)
 {
-        struct pppox_sock *po = NULL;
+        struct pppox_sock *po;
         int i = 0;
 
         for (; i < PPPOE_HASH_SIZE; i++) {
diff --git a/drivers/net/pppox.c b/drivers/net/pppox.c
index 9315046b3f55..3f8115db4d54 100644
--- a/drivers/net/pppox.c
+++ b/drivers/net/pppox.c
@@ -58,7 +58,7 @@ void pppox_unbind_sock(struct sock *sk)
 {
         /* Clear connection to ppp device, if attached. */
 
-        if (sk->sk_state & (PPPOX_BOUND | PPPOX_ZOMBIE)) {
+        if (sk->sk_state & (PPPOX_BOUND | PPPOX_CONNECTED | PPPOX_ZOMBIE)) {
                 ppp_unregister_channel(&pppox_sk(sk)->chan);
                 sk->sk_state = PPPOX_DEAD;
         }
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index a8246eb2f8d9..7b80fb7a9d9b 100755
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -1873,7 +1873,6 @@ static void ql_process_mac_rx_intr(struct ql3_adapter *qdev,
                          pci_unmap_len(lrg_buf_cb2, maplen),
                          PCI_DMA_FROMDEVICE);
         prefetch(skb->data);
-        skb->dev = qdev->ndev;
         skb->ip_summed = CHECKSUM_NONE;
         skb->protocol = eth_type_trans(skb, qdev->ndev);
 
@@ -1928,7 +1927,8 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
                  * Copy the ethhdr from first buffer to second. This
                  * is necessary for 3022 IP completions.
                  */
-                memcpy(skb_push(skb2, size), skb1->data + VLAN_ID_LEN, size);
+                skb_copy_from_linear_data_offset(skb1, VLAN_ID_LEN,
+                                                 skb_push(skb2, size), size);
         } else {
                 u16 checksum = le16_to_cpu(ib_ip_rsp_ptr->checksum);
                 if (checksum & 
@@ -1946,7 +1946,6 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
                         skb2->ip_summed = CHECKSUM_UNNECESSARY;
                 }
         }
-        skb2->dev = qdev->ndev;
         skb2->protocol = eth_type_trans(skb2, qdev->ndev);
 
         netif_receive_skb(skb2);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 6a77b8a92245..45876a854f00 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2284,7 +2284,7 @@ static inline u32 rtl8169_tso_csum(struct sk_buff *skb, struct net_device *dev)
                         return LargeSend | ((mss & MSSMask) << MSSShift);
         }
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                const struct iphdr *ip = skb->nh.iph;
+                const struct iphdr *ip = ip_hdr(skb);
 
                 if (ip->protocol == IPPROTO_TCP)
                         return IPCS | TCPCS;
@@ -2586,7 +2586,6 @@ rtl8169_rx_interrupt(struct net_device *dev, struct rtl8169_private *tp,
                         pci_action(tp->pci_dev, le64_to_cpu(desc->addr),
                                    tp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 
-                        skb->dev = dev;
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index b7ff484af3e1..df6b73872fdb 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -115,7 +115,6 @@ static int rionet_rx_clean(struct net_device *ndev)
 
                 rnet->rx_skb[i]->data = data;
                 skb_put(rnet->rx_skb[i], RIO_MAX_MSG_SIZE);
-                rnet->rx_skb[i]->dev = ndev;
                 rnet->rx_skb[i]->protocol =
                     eth_type_trans(rnet->rx_skb[i], ndev);
                 error = netif_rx(rnet->rx_skb[i]);
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index d81536f90df6..25c73d47daad 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1029,7 +1029,6 @@ static void rx_int(struct net_device *dev, u32 rxlimit, u32 index)
                                         goto defer;
                                 }
                         }
-                        skb->dev = dev;
                         skb->protocol = hippi_type_trans(skb, dev);
 
                         netif_rx(skb);          /* send it up */
@@ -1452,7 +1451,7 @@ static int rr_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
                 skb_reserve(new_skb, 8);
                 skb_put(new_skb, len);
-                memcpy(new_skb->data, skb->data, len);
+                skb_copy_from_linear_data(skb, new_skb->data, len);
                 dev_kfree_skb(skb);
                 skb = new_skb;
         }
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 46ebf141ee5a..600d3ff347fc 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -2195,7 +2195,7 @@ static int fill_rxd_3buf(struct s2io_nic *nic, struct RxD_t *rxdp, struct \
         frag_list->next = NULL;
         tmp = (void *)ALIGN((long)frag_list->data, ALIGN_SIZE + 1);
         frag_list->data = tmp;
-        frag_list->tail = tmp;
+        skb_reset_tail_pointer(frag_list);
 
         /* Buffer-2 receives L4 data payload */
         ((struct RxD3*)rxdp)->Buffer2_ptr = pci_map_single(nic->pdev,
@@ -2349,7 +2349,7 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                         tmp += ALIGN_SIZE;
                         tmp &= ~ALIGN_SIZE;
                         skb->data = (void *) (unsigned long)tmp;
-                        skb->tail = (void *) (unsigned long)tmp;
+                        skb_reset_tail_pointer(skb);
 
                         if (!(((struct RxD3*)rxdp)->Buffer0_ptr))
                                 ((struct RxD3*)rxdp)->Buffer0_ptr =
diff --git a/drivers/net/saa9730.c b/drivers/net/saa9730.c
index 143958f1ef0a..ad94358ece89 100644
--- a/drivers/net/saa9730.c
+++ b/drivers/net/saa9730.c
@@ -688,7 +688,6 @@ static int lan_saa9730_rx(struct net_device *dev)
                         } else {
                                 lp->stats.rx_bytes += len;
                                 lp->stats.rx_packets++;
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align */
                                 skb_put(skb, len);      /* make room */
                                 eth_copy_and_sum(skb,
diff --git a/drivers/net/sb1000.c b/drivers/net/sb1000.c
index b9fa4fbb1398..1de3eec1a792 100644
--- a/drivers/net/sb1000.c
+++ b/drivers/net/sb1000.c
@@ -834,7 +834,7 @@ printk("cm0: IP identification: %02x%02x  fragment offset: %02x%02x\n", buffer[3
                         goto dropped_frame;
                 }
                 skb->dev = dev;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = (unsigned short) buffer[NewDatagramHeaderSkip + 16];
                 insw(ioaddr, skb_put(skb, NewDatagramDataSize),
                         NewDatagramDataSize / 2);
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 103c3174ab54..0a3a379b634c 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -933,9 +933,6 @@ static int sbdma_add_rcvbuffer(sbmacdma_t *d,struct sk_buff *sb)
                 }
 
                 sbdma_align_skb(sb_new, SMP_CACHE_BYTES, ETHER_ALIGN);
-
-                /* mark skbuff owned by our device */
-                sb_new->dev = d->sbdma_eth->sbm_dev;
         }
         else {
                 sb_new = sb;
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index c32c21af3fdd..5b7284c955dc 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -814,7 +814,6 @@ static void _sc92031_rx_tasklet(struct net_device *dev)
                         memcpy(skb_put(skb, pkt_size), rx_ring + rx_ring_offset, pkt_size);
                 }
 
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
                 dev->last_rx = jiffies;
                 netif_rx(skb);
diff --git a/drivers/net/seeq8005.c b/drivers/net/seeq8005.c
index 0d6c95c7aedf..4bce7c4f373c 100644
--- a/drivers/net/seeq8005.c
+++ b/drivers/net/seeq8005.c
@@ -550,7 +550,6 @@ static void seeq8005_rx(struct net_device *dev)
                                 lp->stats.rx_dropped++;
                                 break;
                         }
-                        skb->dev = dev;
                         skb_reserve(skb, 2);    /* align data on 16 byte */
                         buf = skb_put(skb,pkt_len);
 
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index 52ed522a234c..d8c9c5d66d4f 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -318,7 +318,6 @@ static inline void sgiseeq_rx(struct net_device *dev, struct sgiseeq_private *sp
                         skb = dev_alloc_skb(len + 2);
 
                         if (skb) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);
                                 skb_put(skb, len);
 
@@ -535,7 +534,7 @@ static int sgiseeq_start_xmit(struct sk_buff *skb, struct net_device *dev)
          *    entry and the HPC got to the end of the chain before we
          *    added this new entry and restarted it.
          */
-        memcpy((char *)(long)td->buf_vaddr, skb->data, skblen);
+        skb_copy_from_linear_data(skb, (char *)(long)td->buf_vaddr, skblen);
         if (len != skblen)
                 memset((char *)(long)td->buf_vaddr + skb->len, 0, len-skblen);
         td->tdma.cntinfo = (len & HPCDMA_BCNT) |
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index 34463ce6f132..bc8de48da313 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -632,7 +632,6 @@ static int sis190_rx_interrupt(struct net_device *dev,
                         pci_action(tp->pci_dev, le32_to_cpu(desc->addr),
                                    tp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 
-                        skb->dev = dev;
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index b3750f284279..dea0126723da 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1160,7 +1160,6 @@ sis900_init_rx_ring(struct net_device *net_dev)
                            buffer */
                         break;
                 }
-                skb->dev = net_dev;
                 sis_priv->rx_skbuff[i] = skb;
                 sis_priv->rx_ring[i].cmdsts = RX_BUF_SIZE;
                 sis_priv->rx_ring[i].bufptr = pci_map_single(sis_priv->pci_dev,
@@ -1755,6 +1754,24 @@ static int sis900_rx(struct net_device *net_dev)
                 } else {
                         struct sk_buff * skb;
 
+                        pci_unmap_single(sis_priv->pci_dev,
+                                sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
+                                PCI_DMA_FROMDEVICE);
+
+                        /* refill the Rx buffer, what if there is not enought
+                         * memory for new socket buffer ?? */
+                        if ((skb = dev_alloc_skb(RX_BUF_SIZE)) == NULL) {
+                                /*
+                                 * Not enough memory to refill the buffer
+                                 * so we need to recycle the old one so
+                                 * as to avoid creating a memory hole
+                                 * in the rx ring
+                                 */
+                                skb = sis_priv->rx_skbuff[entry];
+                                sis_priv->stats.rx_dropped++;
+                                goto refill_rx_ring;
+                        }       
+
                         /* This situation should never happen, but due to
                            some unknow bugs, it is possible that
                            we are working on NULL sk_buff :-( */
@@ -1768,9 +1785,6 @@ static int sis900_rx(struct net_device *net_dev)
                                 break;
                         }
 
-                        pci_unmap_single(sis_priv->pci_dev,
-                                sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
-                                PCI_DMA_FROMDEVICE);
                         /* give the socket buffer to upper layers */
                         skb = sis_priv->rx_skbuff[entry];
                         skb_put(skb, rx_size);
@@ -1783,33 +1797,13 @@ static int sis900_rx(struct net_device *net_dev)
                         net_dev->last_rx = jiffies;
                         sis_priv->stats.rx_bytes += rx_size;
                         sis_priv->stats.rx_packets++;
-
-                        /* refill the Rx buffer, what if there is not enought
-                         * memory for new socket buffer ?? */
-                        if ((skb = dev_alloc_skb(RX_BUF_SIZE)) == NULL) {
-                                /* not enough memory for skbuff, this makes a
-                                 * "hole" on the buffer ring, it is not clear
-                                 * how the hardware will react to this kind
-                                 * of degenerated buffer */
-                                if (netif_msg_rx_status(sis_priv))
-                                        printk(KERN_INFO "%s: Memory squeeze,"
-                                                "deferring packet.\n",
-                                                net_dev->name);
-                                sis_priv->rx_skbuff[entry] = NULL;
-                                /* reset buffer descriptor state */
-                                sis_priv->rx_ring[entry].cmdsts = 0;
-                                sis_priv->rx_ring[entry].bufptr = 0;
-                                sis_priv->stats.rx_dropped++;
-                                sis_priv->cur_rx++;
-                                break;
-                        }
-                        skb->dev = net_dev;
+                        sis_priv->dirty_rx++;
+refill_rx_ring:
                         sis_priv->rx_skbuff[entry] = skb;
                         sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
                         sis_priv->rx_ring[entry].bufptr =
                                 pci_map_single(sis_priv->pci_dev, skb->data,
                                         RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
-                        sis_priv->dirty_rx++;
                 }
                 sis_priv->cur_rx++;
                 entry = sis_priv->cur_rx % NUM_RX_DESC;
@@ -1836,7 +1830,6 @@ static int sis900_rx(struct net_device *net_dev)
                                 sis_priv->stats.rx_dropped++;
                                 break;
                         }
-                        skb->dev = net_dev;
                         sis_priv->rx_skbuff[entry] = skb;
                         sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE;
                         sis_priv->rx_ring[entry].bufptr =
diff --git a/drivers/net/sk98lin/skge.c b/drivers/net/sk98lin/skge.c
index e94ab256b540..e0a93005e6dc 100644
--- a/drivers/net/sk98lin/skge.c
+++ b/drivers/net/sk98lin/skge.c
@@ -1562,10 +1562,10 @@ struct sk_buff	*pMessage)	/* pointer to send-message              */
         pTxd->pMBuf     = pMessage;
 
         if (pMessage->ip_summed == CHECKSUM_PARTIAL) {
-                u16 hdrlen = pMessage->h.raw - pMessage->data;
+                u16 hdrlen = skb_transport_offset(pMessage);
                 u16 offset = hdrlen + pMessage->csum_offset;
 
-                if ((pMessage->h.ipiph->protocol == IPPROTO_UDP ) &&
+                if ((ipip_hdr(pMessage)->protocol == IPPROTO_UDP) &&
                         (pAC->GIni.GIChipRev == 0) &&
                         (pAC->GIni.GIChipId == CHIP_ID_YUKON)) {
                         pTxd->TBControl = BMU_TCP_CHECK;
@@ -1681,7 +1681,7 @@ struct sk_buff	*pMessage)	/* pointer to send-message              */
         ** Does the HW need to evaluate checksum for TCP or UDP packets? 
         */
         if (pMessage->ip_summed == CHECKSUM_PARTIAL) {
-                u16 hdrlen = pMessage->h.raw - pMessage->data;
+                u16 hdrlen = skb_transport_offset(pMessage);
                 u16 offset = hdrlen + pMessage->csum_offset;
 
                 Control = BMU_STFWD;
@@ -1691,7 +1691,7 @@ struct sk_buff	*pMessage)	/* pointer to send-message              */
                 ** opcode for udp is not working in the hardware yet 
                 ** (Revision 2.0)
                 */
-                if ((pMessage->h.ipiph->protocol == IPPROTO_UDP ) &&
+                if ((ipip_hdr(pMessage)->protocol == IPPROTO_UDP) &&
                         (pAC->GIni.GIChipRev == 0) &&
                         (pAC->GIni.GIChipId == CHIP_ID_YUKON)) {
                         Control |= BMU_TCP_CHECK;
@@ -2127,7 +2127,7 @@ rx_start:
                                                     (dma_addr_t) PhysAddr,
                                                     FrameLength,
                                                     PCI_DMA_FROMDEVICE);
-                        memcpy(pNewMsg->data, pMsg, FrameLength);
+                        skb_copy_to_linear_data(pNewMsg, pMsg, FrameLength);
 
                         pci_dma_sync_single_for_device(pAC->PciDev,
                                                        (dma_addr_t) PhysAddr,
@@ -2193,7 +2193,6 @@ rx_start:
                                 SK_PNMI_CNT_RX_OCTETS_DELIVERED(pAC,
                                         FrameLength, pRxPort->PortIndex);
 
-                                pMsg->dev = pAC->dev[pRxPort->PortIndex];
                                 pMsg->protocol = eth_type_trans(pMsg,
                                         pAC->dev[pRxPort->PortIndex]);
                                 netif_rx(pMsg);
@@ -2246,7 +2245,6 @@ rx_start:
                                 (IFF_PROMISC | IFF_ALLMULTI)) != 0 ||
                                 (ForRlmt & SK_RLMT_RX_PROTOCOL) ==
                                 SK_RLMT_RX_PROTOCOL) {
-                                pMsg->dev = pAC->dev[pRxPort->PortIndex];
                                 pMsg->protocol = eth_type_trans(pMsg,
                                         pAC->dev[pRxPort->PortIndex]);
                                 netif_rx(pMsg);
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 9733a11c6146..a7ef6c8b7721 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -1680,7 +1680,6 @@ void mac_drv_rx_complete(struct s_smc *smc, volatile struct s_smt_fp_rxd *rxd,
         rxd->rxd_os.skb = NULL;
         skb_trim(skb, len);
         skb->protocol = fddi_type_trans(skb, bp->dev);
-        skb->dev = bp->dev;     /* pass up device pointer */
 
         netif_rx(skb);
         bp->dev->last_rx = jiffies;
@@ -1938,7 +1937,7 @@ int mac_drv_rx_init(struct s_smc *smc, int len, int fc,
         }
         skb_reserve(skb, 3);
         skb_put(skb, len);
-        memcpy(skb->data, look_ahead, len);
+        skb_copy_to_linear_data(skb, look_ahead, len);
 
         // deliver frame to system
         skb->protocol = fddi_type_trans(skb, smc->os.dev);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index d476a3cc2e94..f1a0e6c0fbdd 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -2654,12 +2654,12 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         td->dma_hi = map >> 32;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                int offset = skb->h.raw - skb->data;
+                const int offset = skb_transport_offset(skb);
 
                 /* This seems backwards, but it is what the sk98lin
                  * does.  Looks like hardware is wrong?
                  */
-                if (skb->h.ipiph->protocol == IPPROTO_UDP
+                if (ipip_hdr(skb)->protocol == IPPROTO_UDP
                     && hw->chip_rev == 0 && hw->chip_id == CHIP_ID_YUKON)
                         control = BMU_TCP_CHECK;
                 else
@@ -2950,7 +2950,7 @@ static struct sk_buff *skge_rx_get(struct net_device *dev,
                 pci_dma_sync_single_for_cpu(skge->hw->pdev,
                                             pci_unmap_addr(e, mapaddr),
                                             len, PCI_DMA_FROMDEVICE);
-                memcpy(skb->data, e->skb->data, len);
+                skb_copy_from_linear_data(e->skb, skb->data, len);
                 pci_dma_sync_single_for_device(skge->hw->pdev,
                                                pci_unmap_addr(e, mapaddr),
                                                len, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 4a009b7b1777..238c2ca34da6 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -32,6 +32,7 @@
 #include <linux/ethtool.h>
 #include <linux/pci.h>
 #include <linux/ip.h>
+#include <net/ip.h>
 #include <linux/tcp.h>
 #include <linux/in.h>
 #include <linux/delay.h>
@@ -49,7 +50,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.13"
+#define DRV_VERSION             "1.14"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -123,7 +124,10 @@ static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4361) }, /* 88E8050 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4362) }, /* 88E8053 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4363) }, /* 88E8055 */
+#ifdef broken
+        /* This device causes data corruption problems that are not resolved */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4364) }, /* 88E8056 */
+#endif
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4366) }, /* 88EC036 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4367) }, /* 88EC032 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4368) }, /* 88EC034 */
@@ -740,12 +744,17 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
         if (hw->chip_id == CHIP_ID_YUKON_EC_U || hw->chip_id == CHIP_ID_YUKON_EX) {
                 sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
                 sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
-                if (hw->dev[port]->mtu > ETH_DATA_LEN) {
-                        /* set Tx GMAC FIFO Almost Empty Threshold */
-                        sky2_write32(hw, SK_REG(port, TX_GMF_AE_THR), 0x180);
-                        /* Disable Store & Forward mode for TX */
-                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T), TX_STFW_DIS);
-                }
+
+                /* set Tx GMAC FIFO Almost Empty Threshold */
+                sky2_write32(hw, SK_REG(port, TX_GMF_AE_THR),
+                             (ECU_JUMBO_WM << 16) | ECU_AE_THR);
+
+                if (hw->dev[port]->mtu > ETH_DATA_LEN)
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_ENA | TX_STFW_DIS);
+                else
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_DIS | TX_STFW_ENA);
         }
 
 }
@@ -1278,7 +1287,7 @@ static int sky2_up(struct net_device *dev)
         /* Set almost empty threshold */
         if (hw->chip_id == CHIP_ID_YUKON_EC_U
             && hw->chip_rev == CHIP_REV_YU_EC_U_A0)
-                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
+                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), ECU_TXFF_LEV);
 
         sky2_prefetch_init(hw, txqaddr[port], sky2->tx_le_map,
                            TX_RING_SIZE - 1);
@@ -1383,8 +1392,8 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         /* Check for TCP Segmentation Offload */
         mss = skb_shinfo(skb)->gso_size;
         if (mss != 0) {
-                mss += ((skb->h.th->doff - 5) * 4);     /* TCP options */
-                mss += (skb->nh.iph->ihl * 4) + sizeof(struct tcphdr);
+                mss += tcp_optlen(skb); /* TCP options */
+                mss += ip_hdrlen(skb) + sizeof(struct tcphdr);
                 mss += ETH_HLEN;
 
                 if (mss != sky2->tx_last_mss) {
@@ -1412,14 +1421,14 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
 
         /* Handle TCP checksum offload */
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                unsigned offset = skb->h.raw - skb->data;
+                const unsigned offset = skb_transport_offset(skb);
                 u32 tcpsum;
 
                 tcpsum = offset << 16;          /* sum start */
                 tcpsum |= offset + skb->csum_offset;    /* sum write */
 
                 ctrl = CALSUM | WR_SUM | INIT_SUM | LOCK_SUM;
-                if (skb->nh.iph->protocol == IPPROTO_UDP)
+                if (ip_hdr(skb)->protocol == IPPROTO_UDP)
                         ctrl |= UDPTCP;
 
                 if (tcpsum != sky2->tx_tcpsum) {
@@ -1584,13 +1593,6 @@ static int sky2_down(struct net_device *dev)
         sky2_write32(hw, RB_ADDR(txqaddr[port], RB_CTRL),
                      RB_RST_SET | RB_DIS_OP_MD);
 
-        /* WA for dev. #4.209 */
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U
-            && (hw->chip_rev == CHIP_REV_YU_EC_U_A1 || hw->chip_rev == CHIP_REV_YU_EC_U_B0))
-                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
-                             sky2->speed != SPEED_1000 ?
-                             TX_STFW_ENA : TX_STFW_DIS);
-
         ctrl = gma_read16(hw, port, GM_GP_CTRL);
         ctrl &= ~(GM_GPCR_TX_ENA | GM_GPCR_RX_ENA);
         gma_write16(hw, port, GM_GP_CTRL, ctrl);
@@ -1890,6 +1892,7 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
         struct sky2_hw *hw = sky2->hw;
+        unsigned port = sky2->port;
         int err;
         u16 ctl, mode;
         u32 imask;
@@ -1897,9 +1900,8 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (new_mtu < ETH_ZLEN || new_mtu > ETH_JUMBO_MTU)
                 return -EINVAL;
 
-        /* TSO on Yukon Ultra and MTU > 1500 not supported */
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U && new_mtu > ETH_DATA_LEN)
-                dev->features &= ~NETIF_F_TSO;
+        if (new_mtu > ETH_DATA_LEN && hw->chip_id == CHIP_ID_YUKON_FE)
+                return -EINVAL;
 
         if (!netif_running(dev)) {
                 dev->mtu = new_mtu;
@@ -1915,8 +1917,18 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
 
         synchronize_irq(hw->pdev->irq);
 
-        ctl = gma_read16(hw, sky2->port, GM_GP_CTRL);
-        gma_write16(hw, sky2->port, GM_GP_CTRL, ctl & ~GM_GPCR_RX_ENA);
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U || hw->chip_id == CHIP_ID_YUKON_EX) {
+                if (new_mtu > ETH_DATA_LEN) {
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_ENA | TX_STFW_DIS);
+                        dev->features &= NETIF_F_TSO | NETIF_F_SG | NETIF_F_IP_CSUM;
+                } else
+                        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                                     TX_JUMBO_DIS | TX_STFW_ENA);
+        }
+
+        ctl = gma_read16(hw, port, GM_GP_CTRL);
+        gma_write16(hw, port, GM_GP_CTRL, ctl & ~GM_GPCR_RX_ENA);
         sky2_rx_stop(sky2);
         sky2_rx_clean(sky2);
 
@@ -1928,9 +1940,9 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (dev->mtu > ETH_DATA_LEN)
                 mode |= GM_SMOD_JUMBO_ENA;
 
-        gma_write16(hw, sky2->port, GM_SERIAL_MODE, mode);
+        gma_write16(hw, port, GM_SERIAL_MODE, mode);
 
-        sky2_write8(hw, RB_ADDR(rxqaddr[sky2->port], RB_CTRL), RB_ENA_OP_MD);
+        sky2_write8(hw, RB_ADDR(rxqaddr[port], RB_CTRL), RB_ENA_OP_MD);
 
         err = sky2_rx_start(sky2);
         sky2_write32(hw, B0_IMSK, imask);
@@ -1938,7 +1950,7 @@ static int sky2_change_mtu(struct net_device *dev, int new_mtu)
         if (err)
                 dev_close(dev);
         else {
-                gma_write16(hw, sky2->port, GM_GP_CTRL, ctl);
+                gma_write16(hw, port, GM_GP_CTRL, ctl);
 
                 netif_poll_enable(hw->dev[0]);
                 netif_wake_queue(dev);
@@ -1959,7 +1971,7 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
                 skb_reserve(skb, 2);
                 pci_dma_sync_single_for_cpu(sky2->hw->pdev, re->data_addr,
                                             length, PCI_DMA_FROMDEVICE);
-                memcpy(skb->data, re->skb->data, length);
+                skb_copy_from_linear_data(re->skb, skb->data, length);
                 skb->ip_summed = re->skb->ip_summed;
                 skb->csum = re->skb->csum;
                 pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
@@ -2340,26 +2352,22 @@ static void sky2_mac_intr(struct sky2_hw *hw, unsigned port)
         }
 }
 
-/* This should never happen it is a fatal situation */
-static void sky2_descriptor_error(struct sky2_hw *hw, unsigned port,
-                                  const char *rxtx, u32 mask)
+/* This should never happen it is a bug. */
+static void sky2_le_error(struct sky2_hw *hw, unsigned port,
+                          u16 q, unsigned ring_size)
 {
         struct net_device *dev = hw->dev[port];
         struct sky2_port *sky2 = netdev_priv(dev);
-        u32 imask;
-
-        printk(KERN_ERR PFX "%s: %s descriptor error (hardware problem)\n",
-               dev ? dev->name : "<not registered>", rxtx);
+        unsigned idx;
+        const u64 *le = (q == Q_R1 || q == Q_R2)
+                ? (u64 *) sky2->rx_le : (u64 *) sky2->tx_le;
 
-        imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~mask;
-        sky2_write32(hw, B0_IMSK, imask);
+        idx = sky2_read16(hw, Y2_QADDR(q, PREF_UNIT_GET_IDX));
+        printk(KERN_ERR PFX "%s: descriptor error q=%#x get=%u [%llx] put=%u\n",
+               dev->name, (unsigned) q, idx, (unsigned long long) le[idx],
+               (unsigned) sky2_read16(hw, Y2_QADDR(q, PREF_UNIT_PUT_IDX)));
 
-        if (dev) {
-                spin_lock(&sky2->phy_lock);
-                sky2_link_down(sky2);
-                spin_unlock(&sky2->phy_lock);
-        }
+        sky2_write32(hw, Q_ADDR(q, Q_CSR), BMU_CLR_IRQ_CHK);
 }
 
 /* If idle then force a fake soft NAPI poll once a second
@@ -2383,23 +2391,15 @@ static void sky2_idle(unsigned long arg)
         mod_timer(&hw->idle_timer, jiffies + msecs_to_jiffies(idle_timeout));
 }
 
-
-static int sky2_poll(struct net_device *dev0, int *budget)
+/* Hardware/software error handling */
+static void sky2_err_intr(struct sky2_hw *hw, u32 status)
 {
-        struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
-        int work_limit = min(dev0->quota, *budget);
-        int work_done = 0;
-        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
+        if (net_ratelimit())
+                dev_warn(&hw->pdev->dev, "error interrupt status=%#x\n", status);
 
         if (status & Y2_IS_HW_ERR)
                 sky2_hw_intr(hw);
 
-        if (status & Y2_IS_IRQ_PHY1)
-                sky2_phy_intr(hw, 0);
-
-        if (status & Y2_IS_IRQ_PHY2)
-                sky2_phy_intr(hw, 1);
-
         if (status & Y2_IS_IRQ_MAC1)
                 sky2_mac_intr(hw, 0);
 
@@ -2407,16 +2407,33 @@ static int sky2_poll(struct net_device *dev0, int *budget)
                 sky2_mac_intr(hw, 1);
 
         if (status & Y2_IS_CHK_RX1)
-                sky2_descriptor_error(hw, 0, "receive", Y2_IS_CHK_RX1);
+                sky2_le_error(hw, 0, Q_R1, RX_LE_SIZE);
 
         if (status & Y2_IS_CHK_RX2)
-                sky2_descriptor_error(hw, 1, "receive", Y2_IS_CHK_RX2);
+                sky2_le_error(hw, 1, Q_R2, RX_LE_SIZE);
 
         if (status & Y2_IS_CHK_TXA1)
-                sky2_descriptor_error(hw, 0, "transmit", Y2_IS_CHK_TXA1);
+                sky2_le_error(hw, 0, Q_XA1, TX_RING_SIZE);
 
         if (status & Y2_IS_CHK_TXA2)
-                sky2_descriptor_error(hw, 1, "transmit", Y2_IS_CHK_TXA2);
+                sky2_le_error(hw, 1, Q_XA2, TX_RING_SIZE);
+}
+
+static int sky2_poll(struct net_device *dev0, int *budget)
+{
+        struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
+        int work_limit = min(dev0->quota, *budget);
+        int work_done = 0;
+        u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
+
+        if (unlikely(status & Y2_IS_ERROR))
+                sky2_err_intr(hw, status);
+
+        if (status & Y2_IS_IRQ_PHY1)
+                sky2_phy_intr(hw, 0);
+
+        if (status & Y2_IS_IRQ_PHY2)
+                sky2_phy_intr(hw, 1);
 
         work_done = sky2_status_intr(hw, work_limit);
         if (work_done < work_limit) {
@@ -2534,16 +2551,14 @@ static void sky2_reset(struct sky2_hw *hw)
         int i;
 
         /* disable ASF */
-        if (hw->chip_id <= CHIP_ID_YUKON_EC) {
-                if (hw->chip_id == CHIP_ID_YUKON_EX) {
-                        status = sky2_read16(hw, HCU_CCSR);
-                        status &= ~(HCU_CCSR_AHB_RST | HCU_CCSR_CPU_RST_MODE |
-                                    HCU_CCSR_UC_STATE_MSK);
-                        sky2_write16(hw, HCU_CCSR, status);
-                } else
-                        sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
-                sky2_write16(hw, B0_CTST, Y2_ASF_DISABLE);
-        }
+        if (hw->chip_id == CHIP_ID_YUKON_EX) {
+                status = sky2_read16(hw, HCU_CCSR);
+                status &= ~(HCU_CCSR_AHB_RST | HCU_CCSR_CPU_RST_MODE |
+                            HCU_CCSR_UC_STATE_MSK);
+                sky2_write16(hw, HCU_CCSR, status);
+        } else
+                sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
+        sky2_write16(hw, B0_CTST, Y2_ASF_DISABLE);
 
         /* do a SW reset */
         sky2_write8(hw, B0_CTST, CS_RST_SET);
@@ -3328,6 +3343,36 @@ static void sky2_get_regs(struct net_device *dev, struct ethtool_regs *regs,
                       regs->len - B3_RI_WTO_R1);
 }
 
+/* In order to do Jumbo packets on these chips, need to turn off the
+ * transmit store/forward. Therefore checksum offload won't work.
+ */
+static int no_tx_offload(struct net_device *dev)
+{
+        const struct sky2_port *sky2 = netdev_priv(dev);
+        const struct sky2_hw *hw = sky2->hw;
+
+        return dev->mtu > ETH_DATA_LEN &&
+                (hw->chip_id == CHIP_ID_YUKON_EX
+                 || hw->chip_id == CHIP_ID_YUKON_EC_U);
+}
+
+static int sky2_set_tx_csum(struct net_device *dev, u32 data)
+{
+        if (data && no_tx_offload(dev))
+                return -EINVAL;
+
+        return ethtool_op_set_tx_csum(dev, data);
+}
+
+
+static int sky2_set_tso(struct net_device *dev, u32 data)
+{
+        if (data && no_tx_offload(dev))
+                return -EINVAL;
+
+        return ethtool_op_set_tso(dev, data);
+}
+
 static const struct ethtool_ops sky2_ethtool_ops = {
         .get_settings = sky2_get_settings,
         .set_settings = sky2_set_settings,
@@ -3343,9 +3388,9 @@ static const struct ethtool_ops sky2_ethtool_ops = {
         .get_sg = ethtool_op_get_sg,
         .set_sg = ethtool_op_set_sg,
         .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = sky2_set_tx_csum,
         .get_tso = ethtool_op_get_tso,
-        .set_tso = ethtool_op_set_tso,
+        .set_tso = sky2_set_tso,
         .get_rx_csum = sky2_get_rx_csum,
         .set_rx_csum = sky2_set_rx_csum,
         .get_strings = sky2_get_strings,
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index ac24bdc42976..5efb5afc45ba 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -288,6 +288,9 @@ enum {
                           | Y2_IS_CHK_TXA1 | Y2_IS_CHK_RX1,
         Y2_IS_PORT_2    = Y2_IS_IRQ_PHY2 | Y2_IS_IRQ_MAC2
                           | Y2_IS_CHK_TXA2 | Y2_IS_CHK_RX2,
+        Y2_IS_ERROR     = Y2_IS_HW_ERR |
+                          Y2_IS_IRQ_MAC1 | Y2_IS_CHK_TXA1 | Y2_IS_CHK_RX1 |
+                          Y2_IS_IRQ_MAC2 | Y2_IS_CHK_TXA2 | Y2_IS_CHK_RX2,
 };
 
 /*      B2_IRQM_HWE_MSK 32 bit  IRQ Moderation HW Error Mask */
@@ -738,6 +741,11 @@ enum {
         TX_GMF_RP       = 0x0d70,/* 32 bit      Tx GMAC FIFO Read Pointer */
         TX_GMF_RSTP     = 0x0d74,/* 32 bit      Tx GMAC FIFO Restart Pointer */
         TX_GMF_RLEV     = 0x0d78,/* 32 bit      Tx GMAC FIFO Read Level */
+
+        /* Threshold values for Yukon-EC Ultra and Extreme */
+        ECU_AE_THR      = 0x0070, /* Almost Empty Threshold */
+        ECU_TXFF_LEV    = 0x01a0, /* Tx BMU FIFO Level */
+        ECU_JUMBO_WM    = 0x0080, /* Jumbo Mode Watermark */
 };
 
 /* Descriptor Poll Timer Registers */
@@ -1631,6 +1639,9 @@ enum {
         TX_VLAN_TAG_ON  = 1<<25,/* enable  VLAN tagging */
         TX_VLAN_TAG_OFF = 1<<24,/* disable VLAN tagging */
 
+        TX_JUMBO_ENA    = 1<<23,/* PCI Jumbo Mode enable (Yukon-EC Ultra) */
+        TX_JUMBO_DIS    = 1<<22,/* PCI Jumbo Mode enable (Yukon-EC Ultra) */
+
         GMF_WSP_TST_ON  = 1<<18,/* Write Shadow Pointer Test On */
         GMF_WSP_TST_OFF = 1<<17,/* Write Shadow Pointer Test Off */
         GMF_WSP_STEP    = 1<<16,/* Write Shadow Pointer Step/Increment */
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 2f4b1de7a2b4..65bd20fac820 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -363,7 +363,7 @@ sl_bump(struct slip *sl)
         }
         skb->dev = sl->dev;
         memcpy(skb_put(skb,count), sl->rbuff, count);
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
         skb->protocol=htons(ETH_P_IP);
         netif_rx(skb);
         sl->dev->last_rx = jiffies;
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index c95614131980..8a2109a913b6 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -502,7 +502,6 @@ static inline void	 smc911x_rcv(struct net_device *dev)
                 DBG(SMC_DEBUG_PKTS, "%s: Received packet\n", dev->name,);
                 PRINT_PKT(data, ((pkt_len - 4) <= 64) ? pkt_len - 4 : 64);
                 dev->last_rx = jiffies;
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
                 netif_rx(skb);
                 lp->stats.rx_packets++;
@@ -1307,7 +1306,6 @@ smc911x_rx_dma_irq(int dma, void *data)
         lp->current_rx_skb = NULL;
         PRINT_PKT(skb->data, skb->len);
         dev->last_rx = jiffies;
-        skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
         netif_rx(skb);
         lp->stats.rx_packets++;
diff --git a/drivers/net/smc9194.c b/drivers/net/smc9194.c
index bd6e84506c29..36c1ebadbf20 100644
--- a/drivers/net/smc9194.c
+++ b/drivers/net/smc9194.c
@@ -1262,7 +1262,6 @@ static void smc_rcv(struct net_device *dev)
 
                 skb_reserve( skb, 2 );   /* 16 bit alignment */
 
-                skb->dev = dev;
                 data = skb_put( skb, packet_length);
 
 #ifdef USE_32_BIT
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 49f4b7712ebf..01cc3c742c38 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -568,7 +568,6 @@ static inline void  smc_rcv(struct net_device *dev)
                 PRINT_PKT(data, packet_len - 4);
 
                 dev->last_rx = jiffies;
-                skb->dev = dev;
                 skb->protocol = eth_type_trans(skb, dev);
                 netif_rx(skb);
                 lp->stats.rx_packets++;
diff --git a/drivers/net/sonic.c b/drivers/net/sonic.c
index ed7aa0a5acca..c6320c719931 100644
--- a/drivers/net/sonic.c
+++ b/drivers/net/sonic.c
@@ -85,7 +85,6 @@ static int sonic_open(struct net_device *dev)
                                dev->name);
                         return -ENOMEM;
                 }
-                skb->dev = dev;
                 /* align IP header unless DMA requires otherwise */
                 if (SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
                         skb_reserve(skb, 2);
@@ -451,7 +450,6 @@ static void sonic_rx(struct net_device *dev)
                                 lp->stats.rx_dropped++;
                                 break;
                         }
-                        new_skb->dev = dev;
                         /* provide 16 byte IP header alignment unless DMA requires otherwise */
                         if(SONIC_BUS_SCALE(lp->dma_bitmode) == 2)
                                 skb_reserve(new_skb, 2);
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 3b91af89e4c7..230da14b1b68 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -719,8 +719,8 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
                         SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
         spin_unlock_irqrestore(&chain->lock, flags);
 
-        if (skb->protocol == htons(ETH_P_IP))
-                switch (skb->nh.iph->protocol) {
+        if (skb->protocol == htons(ETH_P_IP) && skb->ip_summed == CHECKSUM_PARTIAL)
+                switch (ip_hdr(skb)->protocol) {
                 case IPPROTO_TCP:
                         hwdescr->dmac_cmd_status |= SPIDER_NET_DMAC_TCP;
                         break;
@@ -990,7 +990,6 @@ spider_net_pass_skb_up(struct spider_net_descr *descr,
         netdev = card->netdev;
 
         skb = descr->skb;
-        skb->dev = netdev;
         skb_put(skb, hwdescr->valid_size);
 
         /* the card seems to add 2 bytes of junk in front
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 8bba2e3da7e1..9d6e454a8f98 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1452,7 +1452,6 @@ static int __netdev_rx(struct net_device *dev, int *quota)
                    to a minimally-sized skbuff. */
                 if (pkt_len < rx_copybreak
                     && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                        skb->dev = dev;
                         skb_reserve(skb, 2);    /* 16 byte align the IP header */
                         pci_dma_sync_single_for_cpu(np->pci_dev,
                                                     np->rx_info[entry].mapping,
diff --git a/drivers/net/sun3_82586.c b/drivers/net/sun3_82586.c
index 4757aa647c7a..396c3d961f88 100644
--- a/drivers/net/sun3_82586.c
+++ b/drivers/net/sun3_82586.c
@@ -775,7 +775,6 @@ static void sun3_82586_rcv_int(struct net_device *dev)
                                         skb = (struct sk_buff *) dev_alloc_skb(totlen+2);
                                         if(skb != NULL)
                                         {
-                                                skb->dev = dev;
                                                 skb_reserve(skb,2);
                                                 skb_put(skb,totlen);
                                                 eth_copy_and_sum(skb,(char *) p->base+swab32((unsigned long) rbd->buffer),totlen,0);
@@ -1027,7 +1026,7 @@ static int sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
                         memset((char *)p->xmit_cbuffs[p->xmit_count], 0, ETH_ZLEN);
                         len = ETH_ZLEN;
                 }
-                memcpy((char *)p->xmit_cbuffs[p->xmit_count],(char *)(skb->data),skb->len);
+                skb_copy_from_linear_data(skb, p->xmit_cbuffs[p->xmit_count], skb->len);
 
 #if (NUM_XMIT_BUFFS == 1)
 #       ifdef NO_NOPCOMMANDS
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 7bee45b42a2c..791e081fdc15 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -629,7 +629,7 @@ static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
         head->length = (-len) | 0xf000;
         head->misc = 0;
 
-        memcpy( PKTBUF_ADDR(head), (void *)skb->data, skb->len );
+        skb_copy_from_linear_data(skb, PKTBUF_ADDR(head), skb->len);
         if (len != skb->len)
                 memset(PKTBUF_ADDR(head) + skb->len, 0, len-skb->len);
 
@@ -851,10 +851,9 @@ static int lance_rx( struct net_device *dev )
                                 }
 
 
-                                skb->dev = dev;
                                 skb_reserve( skb, 2 );  /* 16 byte align */
                                 skb_put( skb, pkt_len );        /* Make room */
-//                              memcpy( skb->data, PKTBUF_ADDR(head), pkt_len );
+//                              skb_copy_to_linear_data(skb, PKTBUF_ADDR(head), pkt_len);
                                 eth_copy_and_sum(skb,
                                                  PKTBUF_ADDR(head),
                                                  pkt_len, 0);
diff --git a/drivers/net/sunbmac.c b/drivers/net/sunbmac.c
index 18f88853e1e5..2ad8d58dee3b 100644
--- a/drivers/net/sunbmac.c
+++ b/drivers/net/sunbmac.c
@@ -855,7 +855,6 @@ static void bigmac_rx(struct bigmac *bp)
                                 drops++;
                                 goto drop_it;
                         }
-                        copy_skb->dev = bp->dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         sbus_dma_sync_single_for_cpu(bp->bigmac_sdev,
diff --git a/drivers/net/sundance.c b/drivers/net/sundance.c
index c06ecc8002b9..f51ba31970aa 100644
--- a/drivers/net/sundance.c
+++ b/drivers/net/sundance.c
@@ -1308,7 +1308,6 @@ static void rx_poll(unsigned long data)
                            to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(np->pci_dev,
                                                             desc->frag[0].addr,
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 08ea61db46fe..5da73212ac91 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -64,11 +64,9 @@
 #include <asm/uaccess.h>
 #include <asm/irq.h>
 
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
 #include <asm/idprom.h>
-#include <asm/openprom.h>
-#include <asm/oplib.h>
-#include <asm/pbm.h>
+#include <asm/prom.h>
 #endif
 
 #ifdef CONFIG_PPC_PMAC
@@ -845,11 +843,10 @@ static int gem_rx(struct gem *gp, int work_to_do)
                                 goto drop_it;
                         }
 
-                        copy_skb->dev = gp->dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(gp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
-                        memcpy(copy_skb->data, skb->data, len);
+                        skb_copy_from_linear_data(skb, copy_skb->data, len);
                         pci_dma_sync_single_for_device(gp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
 
                         /* We'll reuse the original ring buffer. */
@@ -1029,10 +1026,8 @@ static int gem_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         ctrl = 0;
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                u64 csum_start_off, csum_stuff_off;
-
-                csum_start_off = (u64) (skb->h.raw - skb->data);
-                csum_stuff_off = csum_start_off + skb->csum_offset;
+                const u64 csum_start_off = skb_transport_offset(skb);
+                const u64 csum_stuff_off = csum_start_off + skb->csum_offset;
 
                 ctrl = (TXDCTRL_CENAB |
                         (csum_start_off << 15) |
@@ -2849,7 +2844,7 @@ static int gem_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         return rc;
 }
 
-#if (!defined(__sparc__) && !defined(CONFIG_PPC_PMAC))
+#if (!defined(CONFIG_SPARC) && !defined(CONFIG_PPC_PMAC))
 /* Fetch MAC address from vital product data of PCI ROM. */
 static int find_eth_addr_in_vpd(void __iomem *rom_base, int len, unsigned char *dev_addr)
 {
@@ -2904,36 +2899,19 @@ static void get_gem_mac_nonobp(struct pci_dev *pdev, unsigned char *dev_addr)
 
 static int __devinit gem_get_device_address(struct gem *gp)
 {
-#if defined(__sparc__) || defined(CONFIG_PPC_PMAC)
+#if defined(CONFIG_SPARC) || defined(CONFIG_PPC_PMAC)
         struct net_device *dev = gp->dev;
-#endif
-
-#if defined(__sparc__)
-        struct pci_dev *pdev = gp->pdev;
-        struct pcidev_cookie *pcp = pdev->sysdata;
-        int use_idprom = 1;
-
-        if (pcp != NULL) {
-                unsigned char *addr;
-                int len;
-
-                addr = of_get_property(pcp->prom_node, "local-mac-address",
-                                       &len);
-                if (addr && len == 6) {
-                        use_idprom = 0;
-                        memcpy(dev->dev_addr, addr, 6);
-                }
-        }
-        if (use_idprom)
-                memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
-#elif defined(CONFIG_PPC_PMAC)
         const unsigned char *addr;
 
         addr = get_property(gp->of_node, "local-mac-address", NULL);
         if (addr == NULL) {
+#ifdef CONFIG_SPARC
+                addr = idprom->id_ethaddr;
+#else
                 printk("\n");
                 printk(KERN_ERR "%s: can't get mac-address\n", dev->name);
                 return -1;
+#endif
         }
         memcpy(dev->dev_addr, addr, 6);
 #else
@@ -3091,7 +3069,7 @@ static int __devinit gem_init_one(struct pci_dev *pdev,
         /* On Apple, we want a reference to the Open Firmware device-tree
          * node. We use it for clock control.
          */
-#ifdef CONFIG_PPC_PMAC
+#if defined(CONFIG_PPC_PMAC) || defined(CONFIG_SPARC)
         gp->of_node = pci_device_to_OF_node(pdev);
 #endif
 
diff --git a/drivers/net/sungem.h b/drivers/net/sungem.h
index a70067c85cc9..58cf87c5751e 100644
--- a/drivers/net/sungem.h
+++ b/drivers/net/sungem.h
@@ -1025,7 +1025,7 @@ struct gem {
 
         struct pci_dev          *pdev;
         struct net_device       *dev;
-#ifdef CONFIG_PPC_PMAC
+#if defined(CONFIG_PPC_PMAC) || defined(CONFIG_SPARC)
         struct device_node      *of_node;
 #endif
 };
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index ef671739cfea..51c3fe2108a3 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -55,9 +55,6 @@
 
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
-#ifdef CONFIG_SPARC
-#include <asm/pbm.h>
-#endif
 #endif
 
 #include "sunhme.h"
@@ -2058,11 +2055,10 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                                 goto drop_it;
                         }
 
-                        copy_skb->dev = dev;
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         hme_dma_sync_for_cpu(hp, dma_addr, len, DMA_FROMDEVICE);
-                        memcpy(copy_skb->data, skb->data, len);
+                        skb_copy_from_linear_data(skb, copy_skb->data, len);
                         hme_dma_sync_for_device(hp, dma_addr, len, DMA_FROMDEVICE);
 
                         /* Reuse original ring buffer. */
@@ -2270,10 +2266,8 @@ static int happy_meal_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tx_flags = TXFLAG_OWN;
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                u32 csum_start_off, csum_stuff_off;
-
-                csum_start_off = (u32) (skb->h.raw - skb->data);
-                csum_stuff_off = csum_start_off + skb->csum_offset;
+                const u32 csum_start_off = skb_transport_offset(skb);
+                const u32 csum_stuff_off = csum_start_off + skb->csum_offset;
 
                 tx_flags = (TXFLAG_OWN | TXFLAG_CSENABLE |
                             ((csum_start_off << 14) & TXFLAG_CSBUFBEGIN) |
@@ -2704,7 +2698,7 @@ static int __devinit happy_meal_sbus_probe_one(struct sbus_dev *sdev, int is_qfe
                         dev->dev_addr[i] = macaddr[i];
                 macaddr[5]++;
         } else {
-                unsigned char *addr;
+                const unsigned char *addr;
                 int len;
 
                 addr = of_get_property(dp, "local-mac-address", &len);
@@ -2986,7 +2980,7 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
 {
         struct quattro *qp = NULL;
 #ifdef CONFIG_SPARC
-        struct pcidev_cookie *pcp;
+        struct device_node *dp;
 #endif
         struct happy_meal *hp;
         struct net_device *dev;
@@ -2998,13 +2992,8 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
 
         /* Now make sure pci_dev cookie is there. */
 #ifdef CONFIG_SPARC
-        pcp = pdev->sysdata;
-        if (pcp == NULL) {
-                printk(KERN_ERR "happymeal(PCI): Some PCI device info missing\n");
-                return -ENODEV;
-        }
-
-        strcpy(prom_name, pcp->prom_node->name);
+        dp = pci_device_to_OF_node(pdev);
+        strcpy(prom_name, dp->name);
 #else
         if (is_quattro_p(pdev))
                 strcpy(prom_name, "SUNW,qfe");
@@ -3081,11 +3070,11 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
                 macaddr[5]++;
         } else {
 #ifdef CONFIG_SPARC
-                unsigned char *addr;
+                const unsigned char *addr;
                 int len;
 
                 if (qfe_slot != -1 &&
-                    (addr = of_get_property(pcp->prom_node,
+                    (addr = of_get_property(dp,
                                             "local-mac-address", &len)) != NULL
                     && len == 6) {
                         memcpy(dev->dev_addr, addr, 6);
@@ -3105,7 +3094,7 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
         hp->tcvregs    = (hpreg_base + 0x7000UL);
 
 #ifdef CONFIG_SPARC
-        hp->hm_revision = of_getintprop_default(pcp->prom_node, "hm-rev", 0xff);
+        hp->hm_revision = of_getintprop_default(dp, "hm-rev", 0xff);
         if (hp->hm_revision == 0xff) {
                 unsigned char prev;
 
@@ -3300,7 +3289,7 @@ static int __devinit hme_sbus_probe(struct of_device *dev, const struct of_devic
 {
         struct sbus_dev *sdev = to_sbus_device(&dev->dev);
         struct device_node *dp = dev->node;
-        char *model = of_get_property(dp, "model", NULL);
+        const char *model = of_get_property(dp, "model", NULL);
         int is_qfe = (match->data != NULL);
 
         if (!is_qfe && model && !strcmp(model, "SUNW,sbus-qfe"))
@@ -3314,7 +3303,7 @@ static int __devexit hme_sbus_remove(struct of_device *dev)
         struct happy_meal *hp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = hp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         /* XXX qfe parent interrupt... */
 
diff --git a/drivers/net/sunlance.c b/drivers/net/sunlance.c
index 5b00d79b5573..42722530ab24 100644
--- a/drivers/net/sunlance.c
+++ b/drivers/net/sunlance.c
@@ -547,7 +547,6 @@ static void lance_rx_dvma(struct net_device *dev)
 
                         lp->stats.rx_bytes += len;
 
-                        skb->dev = dev;
                         skb_reserve(skb, 2);            /* 16 byte align */
                         skb_put(skb, len);              /* make room */
                         eth_copy_and_sum(skb,
@@ -721,7 +720,6 @@ static void lance_rx_pio(struct net_device *dev)
 
                         lp->stats.rx_bytes += len;
 
-                        skb->dev = dev;
                         skb_reserve (skb, 2);           /* 16 byte align */
                         skb_put(skb, len);              /* make room */
                         lance_piocopy_to_skb(skb, &(ib->rx_buf[entry][0]), len);
@@ -1145,7 +1143,7 @@ static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct lance_init_block *ib = lp->init_block_mem;
                 ib->btx_ring [entry].length = (-len) | 0xf000;
                 ib->btx_ring [entry].misc = 0;
-                memcpy((char *)&ib->tx_buf [entry][0], skb->data, skblen);
+                skb_copy_from_linear_data(skb, &ib->tx_buf [entry][0], skblen);
                 if (len != skblen)
                         memset((char *) &ib->tx_buf [entry][skblen], 0, len - skblen);
                 ib->btx_ring [entry].tmd1_bits = (LE_T1_POK | LE_T1_OWN);
@@ -1550,7 +1548,7 @@ static int __exit sunlance_sun4_remove(void)
         struct lance_private *lp = dev_get_drvdata(&sun4_sdev.ofdev.dev);
         struct net_device *net_dev = lp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         lance_free_hwresources(lp);
 
@@ -1590,7 +1588,7 @@ static int __devexit sunlance_sbus_remove(struct of_device *dev)
         struct lance_private *lp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = lp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         lance_free_hwresources(lp);
 
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 7874eb1ef043..fa70e0b78af7 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -437,7 +437,6 @@ static void qe_rx(struct sunqe *qep)
                                 drops++;
                                 qep->net_stats.rx_dropped++;
                         } else {
-                                skb->dev = qep->dev;
                                 skb_reserve(skb, 2);
                                 skb_put(skb, len);
                                 eth_copy_and_sum(skb, (unsigned char *) this_qbuf,
@@ -593,7 +592,7 @@ static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Avoid a race... */
         qep->qe_block->qe_txd[entry].tx_flags = TXD_UPDATE;
 
-        memcpy(txbuf, skb->data, len);
+        skb_copy_from_linear_data(skb, txbuf, len);
 
         qep->qe_block->qe_txd[entry].tx_addr = txbuf_dvma;
         qep->qe_block->qe_txd[entry].tx_flags =
@@ -845,6 +844,8 @@ static int __init qec_ether_init(struct sbus_dev *sdev)
         if (!dev)
                 return -ENOMEM;
 
+        memcpy(dev->dev_addr, idprom->id_ethaddr, 6);
+
         qe = netdev_priv(dev);
 
         i = of_getintprop_default(sdev->ofdev.node, "channel#", -1);
@@ -960,7 +961,7 @@ static int __devexit qec_sbus_remove(struct of_device *dev)
         struct sunqe *qp = dev_get_drvdata(&dev->dev);
         struct net_device *net_dev = qp->dev;
 
-        unregister_netdevice(net_dev);
+        unregister_netdev(net_dev);
 
         sbus_iounmap(qp->qcregs, CREG_REG_SIZE);
         sbus_iounmap(qp->mregs, MREGS_REG_SIZE);
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index e3a7e3ceab77..d7741e23f8de 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1145,7 +1145,6 @@ tc35815_rx(struct net_device *dev)
                                 break;
                         }
                         skb_reserve(skb, 2);   /* 16 bit alignment */
-                        skb->dev = dev;
 
                         data = skb_put(skb, pkt_len);
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 256969e1300c..9488f49ea569 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -40,16 +40,16 @@
 #include <linux/dma-mapping.h>
 
 #include <net/checksum.h>
+#include <net/ip.h>
 
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/byteorder.h>
 #include <asm/uaccess.h>
 
-#ifdef CONFIG_SPARC64
+#ifdef CONFIG_SPARC
 #include <asm/idprom.h>
-#include <asm/oplib.h>
-#include <asm/pbm.h>
+#include <asm/prom.h>
 #endif
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
@@ -3349,7 +3349,7 @@ static int tg3_rx(struct tg3 *tp, int budget)
                         skb_reserve(copy_skb, 2);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
-                        memcpy(copy_skb->data, skb->data, len);
+                        skb_copy_from_linear_data(skb, copy_skb->data, len);
                         pci_dma_sync_single_for_device(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
 
                         /* We'll reuse the original ring buffer. */
@@ -3908,20 +3908,20 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                         mss |= (skb_headlen(skb) - ETH_HLEN) << 9;
                 else {
-                        tcp_opt_len = ((skb->h.th->doff - 5) * 4);
-                        ip_tcp_len = (skb->nh.iph->ihl * 4) +
-                                     sizeof(struct tcphdr);
+                        struct iphdr *iph = ip_hdr(skb);
+
+                        tcp_opt_len = tcp_optlen(skb);
+                        ip_tcp_len = ip_hdrlen(skb) + sizeof(struct tcphdr);
 
-                        skb->nh.iph->check = 0;
-                        skb->nh.iph->tot_len = htons(mss + ip_tcp_len +
-                                                     tcp_opt_len);
+                        iph->check = 0;
+                        iph->tot_len = htons(mss + ip_tcp_len + tcp_opt_len);
                         mss |= (ip_tcp_len + tcp_opt_len) << 9;
                 }
 
                 base_flags |= (TXD_FLAG_CPU_PRE_DMA |
                                TXD_FLAG_CPU_POST_DMA);
 
-                skb->h.th->check = 0;
+                tcp_hdr(skb)->check = 0;
 
         }
         else if (skb->ip_summed == CHECKSUM_PARTIAL)
@@ -4055,6 +4055,7 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
         mss = 0;
         if (skb->len > (tp->dev->mtu + ETH_HLEN) &&
             (mss = skb_shinfo(skb)->gso_size) != 0) {
+                struct iphdr *iph;
                 int tcp_opt_len, ip_tcp_len, hdr_len;
 
                 if (skb_header_cloned(skb) &&
@@ -4063,8 +4064,8 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
                         goto out_unlock;
                 }
 
-                tcp_opt_len = ((skb->h.th->doff - 5) * 4);
-                ip_tcp_len = (skb->nh.iph->ihl * 4) + sizeof(struct tcphdr);
+                tcp_opt_len = tcp_optlen(skb);
+                ip_tcp_len = ip_hdrlen(skb) + sizeof(struct tcphdr);
 
                 hdr_len = ip_tcp_len + tcp_opt_len;
                 if (unlikely((ETH_HLEN + hdr_len) > 80) &&
@@ -4074,34 +4075,31 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
                 base_flags |= (TXD_FLAG_CPU_PRE_DMA |
                                TXD_FLAG_CPU_POST_DMA);
 
-                skb->nh.iph->check = 0;
-                skb->nh.iph->tot_len = htons(mss + hdr_len);
+                iph = ip_hdr(skb);
+                iph->check = 0;
+                iph->tot_len = htons(mss + hdr_len);
                 if (tp->tg3_flags2 & TG3_FLG2_HW_TSO) {
-                        skb->h.th->check = 0;
+                        tcp_hdr(skb)->check = 0;
                         base_flags &= ~TXD_FLAG_TCPUDP_CSUM;
-                }
-                else {
-                        skb->h.th->check =
-                                ~csum_tcpudp_magic(skb->nh.iph->saddr,
-                                                   skb->nh.iph->daddr,
-                                                   0, IPPROTO_TCP, 0);
-                }
+                } else
+                        tcp_hdr(skb)->check = ~csum_tcpudp_magic(iph->saddr,
+                                                                 iph->daddr, 0,
+                                                                 IPPROTO_TCP,
+                                                                 0);
 
                 if ((tp->tg3_flags2 & TG3_FLG2_HW_TSO) ||
                     (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705)) {
-                        if (tcp_opt_len || skb->nh.iph->ihl > 5) {
+                        if (tcp_opt_len || iph->ihl > 5) {
                                 int tsflags;
 
-                                tsflags = ((skb->nh.iph->ihl - 5) +
-                                           (tcp_opt_len >> 2));
+                                tsflags = (iph->ihl - 5) + (tcp_opt_len >> 2);
                                 mss |= (tsflags << 11);
                         }
                 } else {
-                        if (tcp_opt_len || skb->nh.iph->ihl > 5) {
+                        if (tcp_opt_len || iph->ihl > 5) {
                                 int tsflags;
 
-                                tsflags = ((skb->nh.iph->ihl - 5) +
-                                           (tcp_opt_len >> 2));
+                                tsflags = (iph->ihl - 5) + (tcp_opt_len >> 2);
                                 base_flags |= tsflags << 12;
                         }
                 }
@@ -10988,24 +10986,20 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         return err;
 }
 
-#ifdef CONFIG_SPARC64
+#ifdef CONFIG_SPARC
 static int __devinit tg3_get_macaddr_sparc(struct tg3 *tp)
 {
         struct net_device *dev = tp->dev;
         struct pci_dev *pdev = tp->pdev;
-        struct pcidev_cookie *pcp = pdev->sysdata;
-
-        if (pcp != NULL) {
-                unsigned char *addr;
-                int len;
-
-                addr = of_get_property(pcp->prom_node, "local-mac-address",
-                                        &len);
-                if (addr && len == 6) {
-                        memcpy(dev->dev_addr, addr, 6);
-                        memcpy(dev->perm_addr, dev->dev_addr, 6);
-                        return 0;
-                }
+        struct device_node *dp = pci_device_to_OF_node(pdev);
+        const unsigned char *addr;
+        int len;
+
+        addr = of_get_property(dp, "local-mac-address", &len);
+        if (addr && len == 6) {
+                memcpy(dev->dev_addr, addr, 6);
+                memcpy(dev->perm_addr, dev->dev_addr, 6);
+                return 0;
         }
         return -ENODEV;
 }
@@ -11026,7 +11020,7 @@ static int __devinit tg3_get_device_address(struct tg3 *tp)
         u32 hi, lo, mac_offset;
         int addr_ok = 0;
 
-#ifdef CONFIG_SPARC64
+#ifdef CONFIG_SPARC
         if (!tg3_get_macaddr_sparc(tp))
                 return 0;
 #endif
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index f85f00251123..106dc1ef0acb 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -1112,7 +1112,7 @@ static int TLan_StartTx( struct sk_buff *skb, struct net_device *dev )
 
         if ( bbuf ) {
                 tail_buffer = priv->txBuffer + ( priv->txTail * TLAN_MAX_FRAME_SIZE );
-                memcpy( tail_buffer, skb->data, skb->len );
+                skb_copy_from_linear_data(skb, tail_buffer, skb->len);
         } else {
                 tail_list->buffer[0].address = pci_map_single(priv->pciDev, skb->data, skb->len, PCI_DMA_TODEVICE);
                 TLan_StoreSKB(tail_list, skb);
@@ -1577,7 +1577,6 @@ u32 TLan_HandleRxEOF( struct net_device *dev, u16 host_int )
                                 printk(KERN_INFO "TLAN: Couldn't allocate memory for received data.\n");
                         else {
                                 head_buffer = priv->rxBuffer + (priv->rxHead * TLAN_MAX_FRAME_SIZE);
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);
                                 t = (void *) skb_put(skb, frameSize);
 
@@ -1608,7 +1607,6 @@ u32 TLan_HandleRxEOF( struct net_device *dev, u16 host_int )
                                 skb->protocol = eth_type_trans( skb, dev );
                                 netif_rx( skb );
 
-                                new_skb->dev = dev;
                                 skb_reserve( new_skb, 2 );
                                 t = (void *) skb_put( new_skb, TLAN_MAX_FRAME_SIZE );
                                 head_list->buffer[0].address = pci_map_single(priv->pciDev, new_skb->data, TLAN_MAX_FRAME_SIZE, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/tokenring/3c359.c b/drivers/net/tokenring/3c359.c
index 7580bdeacadc..e22a3f5333ef 100644
--- a/drivers/net/tokenring/3c359.c
+++ b/drivers/net/tokenring/3c359.c
@@ -933,20 +933,21 @@ static void xl_rx(struct net_device *dev)
                                 return ;                                
                         }
         
-                        skb->dev = dev ; 
-
                         while (xl_priv->rx_ring_tail != temp_ring_loc) { 
                                 copy_len = xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfraglen & 0x7FFF ; 
                                 frame_length -= copy_len ;  
                                 pci_dma_sync_single_for_cpu(xl_priv->pdev,xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr,xl_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
-                                memcpy(skb_put(skb,copy_len), xl_priv->rx_ring_skb[xl_priv->rx_ring_tail]->data, copy_len) ; 
+                                skb_copy_from_linear_data(xl_priv->rx_ring_skb[xl_priv->rx_ring_tail],
+                                                          skb_put(skb, copy_len),
+                                                          copy_len);
                                 pci_dma_sync_single_for_device(xl_priv->pdev,xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr,xl_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
                                 adv_rx_ring(dev) ; 
                         } 
 
                         /* Now we have found the last fragment */
                         pci_dma_sync_single_for_cpu(xl_priv->pdev,xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr,xl_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
-                        memcpy(skb_put(skb,copy_len), xl_priv->rx_ring_skb[xl_priv->rx_ring_tail]->data, frame_length) ; 
+                        skb_copy_from_linear_data(xl_priv->rx_ring_skb[xl_priv->rx_ring_tail],
+                                      skb_put(skb,copy_len), frame_length);
 /*                      memcpy(skb_put(skb,frame_length), bus_to_virt(xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr), frame_length) ; */
                         pci_dma_sync_single_for_device(xl_priv->pdev,xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr,xl_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
                         adv_rx_ring(dev) ; 
@@ -967,8 +968,6 @@ static void xl_rx(struct net_device *dev)
                                 return ; 
                         }
 
-                        skb->dev = dev ; 
-
                         skb2 = xl_priv->rx_ring_skb[xl_priv->rx_ring_tail] ; 
                         pci_unmap_single(xl_priv->pdev, xl_priv->xl_rx_ring[xl_priv->rx_ring_tail].upfragaddr, xl_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ; 
                         skb_put(skb2, frame_length) ; 
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 01d55315ee8c..1e8958ee2d0a 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1771,7 +1771,6 @@ static void tr_rx(struct net_device *dev)
         /*BMS again, if she comes in with few but leaves with many */
         skb_reserve(skb, sizeof(struct trh_hdr) - lan_hdr_len);
         skb_put(skb, length);
-        skb->dev = dev;
         data = skb->data;
         rbuffer_len = ntohs(readw(rbuf + offsetof(struct rec_buf, buf_len)));
         rbufdata = rbuf + offsetof(struct rec_buf, data);
diff --git a/drivers/net/tokenring/lanstreamer.c b/drivers/net/tokenring/lanstreamer.c
index e999feb8c0bb..5d849c089a3b 100644
--- a/drivers/net/tokenring/lanstreamer.c
+++ b/drivers/net/tokenring/lanstreamer.c
@@ -944,8 +944,6 @@ static void streamer_rx(struct net_device *dev)
                                 printk(KERN_WARNING "%s: Not enough memory to copy packet to upper layers. \n", dev->name);
                                 streamer_priv->streamer_stats.rx_dropped++;
                         } else {        /* we allocated an skb OK */
-                                skb->dev = dev;
-
                                 if (buffer_cnt == 1) {
                                         /* release the DMA mapping */
                                         pci_unmap_single(streamer_priv->pci_dev, 
@@ -1607,10 +1605,11 @@ static void streamer_arb_cmd(struct net_device *dev)
                                       frame_data, buffer_len);
                 } while (next_ptr && (buff_off = next_ptr));
 
+                mac_frame->protocol = tr_type_trans(mac_frame, dev);
 #if STREAMER_NETWORK_MONITOR
                 printk(KERN_WARNING "%s: Received MAC Frame, details: \n",
                        dev->name);
-                mac_hdr = (struct trh_hdr *) mac_frame->data;
+                mac_hdr = tr_hdr(mac_frame);
                 printk(KERN_WARNING
                        "%s: MAC Frame Dest. Addr: %02x:%02x:%02x:%02x:%02x:%02x \n",
                        dev->name, mac_hdr->daddr[0], mac_hdr->daddr[1],
@@ -1622,8 +1621,6 @@ static void streamer_arb_cmd(struct net_device *dev)
                        mac_hdr->saddr[2], mac_hdr->saddr[3],
                        mac_hdr->saddr[4], mac_hdr->saddr[5]);
 #endif
-                mac_frame->dev = dev;
-                mac_frame->protocol = tr_type_trans(mac_frame, dev);
                 netif_rx(mac_frame);
 
                 /* Now tell the card we have dealt with the received frame */
diff --git a/drivers/net/tokenring/olympic.c b/drivers/net/tokenring/olympic.c
index 8f4ecc1109cb..09b3cfb8e809 100644
--- a/drivers/net/tokenring/olympic.c
+++ b/drivers/net/tokenring/olympic.c
@@ -814,8 +814,6 @@ static void olympic_rx(struct net_device *dev)
                                         olympic_priv->rx_ring_last_received += i ; 
                                         olympic_priv->rx_ring_last_received &= (OLYMPIC_RX_RING_SIZE -1) ;  
                                 } else  {
-                                        skb->dev = dev ; 
-
                                         /* Optimise based upon number of buffers used. 
                                            If only one buffer is used we can simply swap the buffers around.
                                            If more than one then we must use the new buffer and copy the information
@@ -847,7 +845,9 @@ static void olympic_rx(struct net_device *dev)
                                                         pci_dma_sync_single_for_cpu(olympic_priv->pdev,
                                                                 le32_to_cpu(olympic_priv->olympic_rx_ring[rx_ring_last_received].buffer),
                                                                 olympic_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ; 
-                                                        memcpy(skb_put(skb,length-4),olympic_priv->rx_ring_skb[rx_ring_last_received]->data,length-4) ; 
+                                                        skb_copy_from_linear_data(olympic_priv->rx_ring_skb[rx_ring_last_received],
+                                                                      skb_put(skb,length - 4),
+                                                                      length - 4);
                                                         pci_dma_sync_single_for_device(olympic_priv->pdev,
                                                                 le32_to_cpu(olympic_priv->olympic_rx_ring[rx_ring_last_received].buffer),
                                                                 olympic_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
@@ -864,7 +864,9 @@ static void olympic_rx(struct net_device *dev)
                                                                 olympic_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ; 
                                                         rx_desc = &(olympic_priv->olympic_rx_ring[rx_ring_last_received]);
                                                         cpy_length = (i == 1 ? frag_len : le32_to_cpu(rx_desc->res_length)); 
-                                                        memcpy(skb_put(skb, cpy_length), olympic_priv->rx_ring_skb[rx_ring_last_received]->data, cpy_length) ;
+                                                        skb_copy_from_linear_data(olympic_priv->rx_ring_skb[rx_ring_last_received],
+                                                                      skb_put(skb, cpy_length),
+                                                                      cpy_length);
                                                         pci_dma_sync_single_for_device(olympic_priv->pdev,
                                                                 le32_to_cpu(olympic_priv->olympic_rx_ring[rx_ring_last_received].buffer),
                                                                 olympic_priv->pkt_buf_sz,PCI_DMA_FROMDEVICE) ;
@@ -1440,16 +1442,16 @@ static void olympic_arb_cmd(struct net_device *dev)
                         next_ptr=readw(buf_ptr+offsetof(struct mac_receive_buffer,next)); 
                 } while (next_ptr && (buf_ptr=olympic_priv->olympic_lap + ntohs(next_ptr)));
 
+                mac_frame->protocol = tr_type_trans(mac_frame, dev);
+
                 if (olympic_priv->olympic_network_monitor) { 
                         struct trh_hdr *mac_hdr ; 
                         printk(KERN_WARNING "%s: Received MAC Frame, details: \n",dev->name) ;
-                        mac_hdr = (struct trh_hdr *)mac_frame->data ; 
+                        mac_hdr = tr_hdr(mac_frame);
                         printk(KERN_WARNING "%s: MAC Frame Dest. Addr: %02x:%02x:%02x:%02x:%02x:%02x \n", dev->name , mac_hdr->daddr[0], mac_hdr->daddr[1], mac_hdr->daddr[2], mac_hdr->daddr[3], mac_hdr->daddr[4], mac_hdr->daddr[5]) ; 
                         printk(KERN_WARNING "%s: MAC Frame Srce. Addr: %02x:%02x:%02x:%02x:%02x:%02x \n", dev->name , mac_hdr->saddr[0], mac_hdr->saddr[1], mac_hdr->saddr[2], mac_hdr->saddr[3], mac_hdr->saddr[4], mac_hdr->saddr[5]) ; 
                 }
-                mac_frame->dev = dev ; 
-                mac_frame->protocol = tr_type_trans(mac_frame,dev);
-                netif_rx(mac_frame) ;   
+                netif_rx(mac_frame);
                 dev->last_rx = jiffies;
 
 drop_frame:
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index cec282a6f62d..9bbea5c8acf4 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -3889,14 +3889,13 @@ static int smctr_process_rx_packet(MAC_HEADER *rmf, __u16 size,
 
                 /* Slide data into a sleek skb. */
                 skb_put(skb, skb->len);
-                memcpy(skb->data, rmf, skb->len);
+                skb_copy_to_linear_data(skb, rmf, skb->len);
 
                 /* Update Counters */
                 tp->MacStat.rx_packets++;
                 tp->MacStat.rx_bytes += skb->len;
 
                 /* Kick the packet on up. */
-                skb->dev = dev;
                 skb->protocol = tr_type_trans(skb, dev);
                 netif_rx(skb);
                 dev->last_rx = jiffies;
@@ -4476,14 +4475,13 @@ static int smctr_rx_frame(struct net_device *dev)
                                 if (skb) {
                                         skb_put(skb, rx_size);
 
-                                        memcpy(skb->data, pbuff, rx_size);
+                                        skb_copy_to_linear_data(skb, pbuff, rx_size);
 
                                         /* Update Counters */
                                         tp->MacStat.rx_packets++;
                                         tp->MacStat.rx_bytes += skb->len;
 
                                         /* Kick the packet on up. */
-                                        skb->dev = dev;
                                         skb->protocol = tr_type_trans(skb, dev);
                                         netif_rx(skb);
                                         dev->last_rx = jiffies;
diff --git a/drivers/net/tokenring/tms380tr.c b/drivers/net/tokenring/tms380tr.c
index ea797ca2b988..12bd294045a7 100644
--- a/drivers/net/tokenring/tms380tr.c
+++ b/drivers/net/tokenring/tms380tr.c
@@ -644,7 +644,7 @@ static int tms380tr_hardware_send_packet(struct sk_buff *skb, struct net_device
                 dmabuf  = 0;
                 i       = tp->TplFree->TPLIndex;
                 buf     = tp->LocalTxBuffers[i];
-                memcpy(buf, skb->data, length);
+                skb_copy_from_linear_data(skb, buf, length);
                 newbuf  = ((char *)buf - (char *)tp) + tp->dmabuffer;
         }
         else {
@@ -2168,7 +2168,6 @@ static void tms380tr_rcv_status_irq(struct net_device *dev)
                                 }
                                 else
                                 {
-                                        skb->dev        = dev;
                                         skb_put(skb, tp->MaxPacketSize);
                                         rpl->SkbStat    = SKB_DATA_COPY;
                                         ReceiveDataPtr  = rpl->MData;
@@ -2179,7 +2178,8 @@ static void tms380tr_rcv_status_irq(struct net_device *dev)
                                 || rpl->SkbStat == SKB_DMA_DIRECT))
                         {
                                 if(rpl->SkbStat == SKB_DATA_COPY)
-                                        memcpy(skb->data, ReceiveDataPtr, Length);
+                                        skb_copy_to_linear_data(skb, ReceiveDataPtr,
+                                                       Length);
 
                                 /* Deliver frame to system */
                                 rpl->Skb = NULL;
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index d92c5c597e16..0bfc2c9c1c08 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -788,7 +788,6 @@ static int tsi108_complete_rx(struct net_device *dev, int budget)
                         printk(".\n");
                 }
 
-                skb->dev = dev;
                 skb_put(skb, data->rxring[rx].len);
                 skb->protocol = eth_type_trans(skb, dev);
                 netif_receive_skb(skb);
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index c82befa209a2..861729806dc1 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -63,7 +63,7 @@ MODULE_PARM_DESC (debug, "de2104x bitmapped message enable number");
 
 /* Set the copy breakpoint for the copy-only-tiny-buffer Rx structure. */
 #if defined(__alpha__) || defined(__arm__) || defined(__hppa__) \
-        || defined(__sparc__) || defined(__ia64__) \
+        || defined(CONFIG_SPARC) || defined(__ia64__) \
         || defined(__sh__) || defined(__mips__)
 static int rx_copybreak = 1518;
 #else
@@ -435,7 +435,6 @@ static void de_rx (struct de_private *de)
                         rx_work = 100;
                         goto rx_next;
                 }
-                copy_skb->dev = de->dev;
 
                 if (!copying_skb) {
                         pci_unmap_single(de->pdev, mapping,
@@ -450,8 +449,8 @@ static void de_rx (struct de_private *de)
                 } else {
                         pci_dma_sync_single_for_cpu(de->pdev, mapping, len, PCI_DMA_FROMDEVICE);
                         skb_reserve(copy_skb, RX_OFFSET);
-                        memcpy(skb_put(copy_skb, len), skb->data, len);
-
+                        skb_copy_from_linear_data(skb, skb_put(copy_skb, len),
+                                                  len);
                         pci_dma_sync_single_for_device(de->pdev, mapping, len, PCI_DMA_FROMDEVICE);
 
                         /* We'll reuse the original ring buffer. */
diff --git a/drivers/net/tulip/de4x5.c b/drivers/net/tulip/de4x5.c
index 4b3cd3d8b62a..62143f92c231 100644
--- a/drivers/net/tulip/de4x5.c
+++ b/drivers/net/tulip/de4x5.c
@@ -1160,7 +1160,7 @@ de4x5_hw_init(struct net_device *dev, u_long iobase, struct device *gendev)
         sprintf(lp->adapter_name,"%s (%s)", name, gendev->bus_id);
 
         lp->dma_size = (NUM_RX_DESC + NUM_TX_DESC) * sizeof(struct de4x5_desc);
-#if defined(__alpha__) || defined(__powerpc__) || defined(__sparc_v9__) || defined(DE4X5_DO_MEMCPY)
+#if defined(__alpha__) || defined(__powerpc__) || defined(CONFIG_SPARC) || defined(DE4X5_DO_MEMCPY)
         lp->dma_size += RX_BUFF_SZ * NUM_RX_DESC + DE4X5_ALIGN;
 #endif
         lp->rx_ring = dma_alloc_coherent(gendev, lp->dma_size,
@@ -1175,7 +1175,7 @@ de4x5_hw_init(struct net_device *dev, u_long iobase, struct device *gendev)
         ** Set up the RX descriptor ring (Intels)
         ** Allocate contiguous receive buffers, long word aligned (Alphas)
         */
-#if !defined(__alpha__) && !defined(__powerpc__) && !defined(__sparc_v9__) && !defined(DE4X5_DO_MEMCPY)
+#if !defined(__alpha__) && !defined(__powerpc__) && !defined(CONFIG_SPARC) && !defined(DE4X5_DO_MEMCPY)
         for (i=0; i<NUM_RX_DESC; i++) {
             lp->rx_ring[i].status = 0;
             lp->rx_ring[i].des1 = cpu_to_le32(RX_BUFF_SZ);
@@ -1252,11 +1252,7 @@ de4x5_hw_init(struct net_device *dev, u_long iobase, struct device *gendev)
             mii_get_phy(dev);
         }
 
-#ifndef __sparc_v9__
         printk("      and requires IRQ%d (provided by %s).\n", dev->irq,
-#else
-        printk("      and requires IRQ%x (provided by %s).\n", dev->irq,
-#endif
                ((lp->bus == PCI) ? "PCI BIOS" : "EISA CNFG"));
     }
 
@@ -3627,14 +3623,13 @@ de4x5_alloc_rx_buff(struct net_device *dev, int index, int len)
     struct de4x5_private *lp = netdev_priv(dev);
     struct sk_buff *p;
 
-#if !defined(__alpha__) && !defined(__powerpc__) && !defined(__sparc_v9__) && !defined(DE4X5_DO_MEMCPY)
+#if !defined(__alpha__) && !defined(__powerpc__) && !defined(CONFIG_SPARC) && !defined(DE4X5_DO_MEMCPY)
     struct sk_buff *ret;
     u_long i=0, tmp;
 
     p = dev_alloc_skb(IEEE802_3_SZ + DE4X5_ALIGN + 2);
     if (!p) return NULL;
 
-    p->dev = dev;
     tmp = virt_to_bus(p->data);
     i = ((tmp + DE4X5_ALIGN) & ~DE4X5_ALIGN) - tmp;
     skb_reserve(p, i);
@@ -3655,7 +3650,6 @@ de4x5_alloc_rx_buff(struct net_device *dev, int index, int len)
     p = dev_alloc_skb(len + 2);
     if (!p) return NULL;
 
-    p->dev = dev;
     skb_reserve(p, 2);                                 /* Align */
     if (index < lp->rx_old) {                          /* Wrapped buffer */
         short tlen = (lp->rxRingSize - lp->rx_old) * RX_BUFF_SZ;
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 9aeac76184f3..b3a64ca98634 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -682,7 +682,7 @@ static int dmfe_start_xmit(struct sk_buff *skb, struct DEVICE *dev)
 
         /* transmit this packet */
         txptr = db->tx_insert_ptr;
-        memcpy(txptr->tx_buf_ptr, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, txptr->tx_buf_ptr, skb->len);
         txptr->tdes1 = cpu_to_le32(0xe1000000 | skb->len);
 
         /* Point to next transmit free descriptor */
@@ -988,14 +988,14 @@ static void dmfe_rx_packet(struct DEVICE *dev, struct dmfe_board_info * db)
 
                                                 skb = newskb;
                                                 /* size less than COPY_SIZE, allocate a rxlen SKB */
-                                                skb->dev = dev;
                                                 skb_reserve(skb, 2); /* 16byte align */
-                                                memcpy(skb_put(skb, rxlen), rxptr->rx_skb_ptr->data, rxlen);
+                                                skb_copy_from_linear_data(rxptr->rx_skb_ptr,
+                                                          skb_put(skb, rxlen),
+                                                                          rxlen);
                                                 dmfe_reuse_skb(db, rxptr->rx_skb_ptr);
-                                        } else {
-                                                skb->dev = dev;
+                                        } else
                                                 skb_put(skb, rxlen);
-                                        }
+
                                         skb->protocol = eth_type_trans(skb, dev);
                                         netif_rx(skb);
                                         dev->last_rx = jiffies;
diff --git a/drivers/net/tulip/interrupt.c b/drivers/net/tulip/interrupt.c
index e3488d7b8ede..e86df07769a1 100644
--- a/drivers/net/tulip/interrupt.c
+++ b/drivers/net/tulip/interrupt.c
@@ -192,7 +192,6 @@ int tulip_poll(struct net_device *dev, int *budget)
                                   to a minimally-sized skbuff. */
                                if (pkt_len < tulip_rx_copybreak
                                    && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                       skb->dev = dev;
                                        skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                        pci_dma_sync_single_for_cpu(tp->pdev,
                                                                    tp->rx_buffers[entry].mapping,
@@ -416,7 +415,6 @@ static int tulip_rx(struct net_device *dev)
                            to a minimally-sized skbuff. */
                         if (pkt_len < tulip_rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(tp->pdev,
                                                             tp->rx_buffers[entry].mapping,
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index e3774a522372..e9bf526ec534 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -36,8 +36,8 @@
 #include <asm/unaligned.h>
 #include <asm/uaccess.h>
 
-#ifdef __sparc__
-#include <asm/pbm.h>
+#ifdef CONFIG_SPARC
+#include <asm/prom.h>
 #endif
 
 static char version[] __devinitdata =
@@ -67,7 +67,7 @@ const char * const medianame[32] = {
 
 /* Set the copy breakpoint for the copy-only-tiny-buffer Rx structure. */
 #if defined(__alpha__) || defined(__arm__) || defined(__hppa__) \
-        || defined(__sparc__) || defined(__ia64__) \
+        || defined(CONFIG_SPARC) || defined(__ia64__) \
         || defined(__sh__) || defined(__mips__)
 static int rx_copybreak = 1518;
 #else
@@ -91,7 +91,7 @@ static int rx_copybreak = 100;
 static int csr0 = 0x01A00000 | 0xE000;
 #elif defined(__i386__) || defined(__powerpc__) || defined(__x86_64__)
 static int csr0 = 0x01A00000 | 0x8000;
-#elif defined(__sparc__) || defined(__hppa__)
+#elif defined(CONFIG_SPARC) || defined(__hppa__)
 /* The UltraSparc PCI controllers will disconnect at every 64-byte
  * crossing anyways so it makes no sense to tell Tulip to burst
  * any more than that.
@@ -1315,7 +1315,7 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
         /* DM9102A has troubles with MRM & clear reserved bits 24:22, 20, 16, 7:1 */
         if (tulip_uli_dm_quirk(pdev)) {
                 csr0 &= ~0x01f100ff;
-#if defined(__sparc__)
+#if defined(CONFIG_SPARC)
                 csr0 = (csr0 & ~0xff00) | 0xe000;
 #endif
         }
@@ -1535,23 +1535,19 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
            Many PCI BIOSes also incorrectly report the IRQ line, so we correct
            that here as well. */
         if (sum == 0  || sum == 6*0xff) {
-#if defined(__sparc__)
-                struct pcidev_cookie *pcp = pdev->sysdata;
+#if defined(CONFIG_SPARC)
+                struct device_node *dp = pci_device_to_OF_node(pdev);
+                const unsigned char *addr;
+                int len;
 #endif
                 eeprom_missing = 1;
                 for (i = 0; i < 5; i++)
                         dev->dev_addr[i] = last_phys_addr[i];
                 dev->dev_addr[i] = last_phys_addr[i] + 1;
-#if defined(__sparc__)
-                if (pcp) {
-                        unsigned char *addr;
-                        int len;
-
-                        addr = of_get_property(pcp->prom_node,
-                                               "local-mac-address", &len);
-                        if (addr && len == 6)
-                                memcpy(dev->dev_addr, addr, 6);
-                }
+#if defined(CONFIG_SPARC)
+                addr = of_get_property(dp, "local-mac-address", &len);
+                if (addr && len == 6)
+                        memcpy(dev->dev_addr, addr, 6);
 #endif
 #if defined(__i386__) || defined(__x86_64__)    /* Patch up x86 BIOS bug. */
                 if (last_irq)
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 229158e8e4be..ca2548eb7d63 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -583,7 +583,7 @@ static int uli526x_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* transmit this packet */
         txptr = db->tx_insert_ptr;
-        memcpy(txptr->tx_buf_ptr, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, txptr->tx_buf_ptr, skb->len);
         txptr->tdes1 = cpu_to_le32(0xe1000000 | skb->len);
 
         /* Point to next transmit free descriptor */
@@ -828,14 +828,14 @@ static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info
                                         ( (skb = dev_alloc_skb(rxlen + 2) )
                                         != NULL) ) {
                                         /* size less than COPY_SIZE, allocate a rxlen SKB */
-                                        skb->dev = dev;
                                         skb_reserve(skb, 2); /* 16byte align */
-                                        memcpy(skb_put(skb, rxlen), rxptr->rx_skb_ptr->tail, rxlen);
+                                        memcpy(skb_put(skb, rxlen),
+                                               skb_tail_pointer(rxptr->rx_skb_ptr),
+                                               rxlen);
                                         uli526x_reuse_skb(db, rxptr->rx_skb_ptr);
-                                } else {
-                                        skb->dev = dev;
+                                } else
                                         skb_put(skb, rxlen);
-                                }
+
                                 skb->protocol = eth_type_trans(skb, dev);
                                 netif_rx(skb);
                                 dev->last_rx = jiffies;
@@ -1177,7 +1177,10 @@ static void uli526x_reuse_skb(struct uli526x_board_info *db, struct sk_buff * sk
 
         if (!(rxptr->rdes0 & cpu_to_le32(0x80000000))) {
                 rxptr->rx_skb_ptr = skb;
-                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                rxptr->rdes2 = cpu_to_le32(pci_map_single(db->pdev,
+                                                          skb_tail_pointer(skb),
+                                                          RX_ALLOC_SIZE,
+                                                          PCI_DMA_FROMDEVICE));
                 wmb();
                 rxptr->rdes0 = cpu_to_le32(0x80000000);
                 db->rx_avail_cnt++;
@@ -1341,7 +1344,10 @@ static void allocate_rx_buffer(struct uli526x_board_info *db)
                 if ( ( skb = dev_alloc_skb(RX_ALLOC_SIZE) ) == NULL )
                         break;
                 rxptr->rx_skb_ptr = skb; /* FIXME (?) */
-                rxptr->rdes2 = cpu_to_le32( pci_map_single(db->pdev, skb->tail, RX_ALLOC_SIZE, PCI_DMA_FROMDEVICE) );
+                rxptr->rdes2 = cpu_to_le32(pci_map_single(db->pdev,
+                                                          skb_tail_pointer(skb),
+                                                          RX_ALLOC_SIZE,
+                                                          PCI_DMA_FROMDEVICE));
                 wmb();
                 rxptr->rdes0 = cpu_to_le32(0x80000000);
                 rxptr = rxptr->next_rx_desc;
diff --git a/drivers/net/tulip/winbond-840.c b/drivers/net/tulip/winbond-840.c
index 002a05e0722f..5b71ac78bca2 100644
--- a/drivers/net/tulip/winbond-840.c
+++ b/drivers/net/tulip/winbond-840.c
@@ -813,7 +813,6 @@ static void init_rxtx_rings(struct net_device *dev)
                 np->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
-                skb->dev = dev;                 /* Mark as being used by this device. */
                 np->rx_addr[i] = pci_map_single(np->pci_dev,skb->data,
                                         np->rx_buf_sz,PCI_DMA_FROMDEVICE);
 
@@ -903,7 +902,7 @@ static void init_registers(struct net_device *dev)
         }
 #elif defined(__powerpc__) || defined(__i386__) || defined(__alpha__) || defined(__ia64__) || defined(__x86_64__)
         i |= 0xE000;
-#elif defined(__sparc__) || defined (CONFIG_PARISC)
+#elif defined(CONFIG_SPARC) || defined (CONFIG_PARISC)
         i |= 0x4800;
 #else
 #warning Processor architecture undefined
@@ -1229,7 +1228,6 @@ static int netdev_rx(struct net_device *dev)
                            to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(np->pci_dev,np->rx_addr[entry],
                                                             np->rx_skbuff[entry]->len,
@@ -1278,7 +1276,6 @@ static int netdev_rx(struct net_device *dev)
                         np->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;                  /* Better luck next round. */
-                        skb->dev = dev;                 /* Mark as being used by this device. */
                         np->rx_addr[entry] = pci_map_single(np->pci_dev,
                                                         skb->data,
                                                         np->rx_buf_sz, PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/tulip/xircom_cb.c b/drivers/net/tulip/xircom_cb.c
index 61d313049dd0..985a1810ca59 100644
--- a/drivers/net/tulip/xircom_cb.c
+++ b/drivers/net/tulip/xircom_cb.c
@@ -411,9 +411,9 @@ static int xircom_start_xmit(struct sk_buff *skb, struct net_device *dev)
                            sometimes sends more than you ask it to. */
 
                         memset(&card->tx_buffer[bufferoffsets[desc]/4],0,1536);
-                        memcpy(&(card->tx_buffer[bufferoffsets[desc]/4]),skb->data,skb->len);
-
-
+                        skb_copy_from_linear_data(skb,
+                                  &(card->tx_buffer[bufferoffsets[desc] / 4]),
+                                                  skb->len);
                         /* FIXME: The specification tells us that the length we send HAS to be a multiple of
                            4 bytes. */
 
@@ -1207,7 +1207,6 @@ static void investigate_read_descriptor(struct net_device *dev,struct xircom_pri
                                 card->stats.rx_dropped++;
                                 goto out;
                         }
-                        skb->dev = dev;
                         skb_reserve(skb, 2);
                         eth_copy_and_sum(skb, (unsigned char*)&card->rx_buffer[bufferoffset / 4], pkt_len, 0);
                         skb_put(skb, pkt_len);
diff --git a/drivers/net/tulip/xircom_tulip_cb.c b/drivers/net/tulip/xircom_tulip_cb.c
index a998c5d0ae9c..f64172927377 100644
--- a/drivers/net/tulip/xircom_tulip_cb.c
+++ b/drivers/net/tulip/xircom_tulip_cb.c
@@ -65,7 +65,7 @@ static int rx_copybreak = 100;
 static int csr0 = 0x01A00000 | 0xE000;
 #elif defined(__powerpc__)
 static int csr0 = 0x01B00000 | 0x8000;
-#elif defined(__sparc__)
+#elif defined(CONFIG_SPARC)
 static int csr0 = 0x01B00080 | 0x8000;
 #elif defined(__i386__)
 static int csr0 = 0x01A00000 | 0x8000;
@@ -915,7 +915,9 @@ xircom_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         tp->tx_skbuff[entry] = skb;
         if (tp->chip_id == X3201_3) {
-                memcpy(tp->tx_aligned_skbuff[entry]->data,skb->data,skb->len);
+                skb_copy_from_linear_data(skb,
+                                          tp->tx_aligned_skbuff[entry]->data,
+                                          skb->len);
                 tp->tx_ring[entry].buffer1 = virt_to_bus(tp->tx_aligned_skbuff[entry]->data);
         } else
                 tp->tx_ring[entry].buffer1 = virt_to_bus(skb->data);
@@ -1238,7 +1240,6 @@ xircom_rx(struct net_device *dev)
                            to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak
                                 && (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
 #if ! defined(__alpha__)
                                 eth_copy_and_sum(skb, bus_to_virt(tp->rx_ring[entry].buffer1),
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 5643d1e84ed6..a2c6caaaae93 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -18,6 +18,10 @@
 /*
  *  Changes:
  *
+ *  Brian Braunstein <linuxkernel@bristyle.com> 2007/03/23
+ *    Fixed hw address handling.  Now net_device.dev_addr is kept consistent
+ *    with tun.dev_addr when the address is set by this module.
+ *
  *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
  *    Add TUNSETLINK ioctl to set the link encapsulation
  *
@@ -196,7 +200,10 @@ static void tun_net_init(struct net_device *dev)
                 dev->set_multicast_list = tun_net_mclist;
 
                 ether_setup(dev);
-                random_ether_addr(dev->dev_addr);
+
+                /* random address already created for us by tun_set_iff, use it */
+                memcpy(dev->dev_addr, tun->dev_addr, min(sizeof(tun->dev_addr), sizeof(dev->dev_addr)) );
+
                 dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
                 break;
         }
@@ -254,11 +261,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
                 return -EFAULT;
         }
 
-        skb->dev = tun->dev;
         switch (tun->flags & TUN_TYPE_MASK) {
         case TUN_TUN_DEV:
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
                 skb->protocol = pi.proto;
+                skb->dev = tun->dev;
                 break;
         case TUN_TAP_DEV:
                 skb->protocol = eth_type_trans(skb, tun->dev);
@@ -386,8 +393,8 @@ static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
                  *   - we are multicast promiscous.
                  *   - we belong to the multicast group.
                  */
-                memcpy(addr, skb->data,
-                       min_t(size_t, sizeof addr, skb->len));
+                skb_copy_from_linear_data(skb, addr, min_t(size_t, sizeof addr,
+                                                                   skb->len));
                 bit_nr = ether_crc(sizeof addr, addr) >> 26;
                 if ((tun->if_flags & IFF_PROMISC) ||
                                 memcmp(addr, tun->dev_addr, sizeof addr) == 0 ||
@@ -636,6 +643,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 return 0;
 
         case SIOCGIFHWADDR:
+                /* Note: the actual net device's address may be different */
                 memcpy(ifr.ifr_hwaddr.sa_data, tun->dev_addr,
                                 min(sizeof ifr.ifr_hwaddr.sa_data, sizeof tun->dev_addr));
                 if (copy_to_user( argp, &ifr, sizeof ifr))
@@ -643,16 +651,24 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                 return 0;
 
         case SIOCSIFHWADDR:
-                /** Set the character device's hardware address. This is used when
-                 * filtering packets being sent from the network device to the character
-                 * device. */
-                memcpy(tun->dev_addr, ifr.ifr_hwaddr.sa_data,
-                                min(sizeof ifr.ifr_hwaddr.sa_data, sizeof tun->dev_addr));
-                DBG(KERN_DEBUG "%s: set hardware address: %x:%x:%x:%x:%x:%x\n",
-                                tun->dev->name,
-                                tun->dev_addr[0], tun->dev_addr[1], tun->dev_addr[2],
-                                tun->dev_addr[3], tun->dev_addr[4], tun->dev_addr[5]);
-                return 0;
+        {
+                /* try to set the actual net device's hw address */
+                int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+
+                if (ret == 0) {
+                        /** Set the character device's hardware address. This is used when
+                         * filtering packets being sent from the network device to the character
+                         * device. */
+                        memcpy(tun->dev_addr, ifr.ifr_hwaddr.sa_data,
+                                        min(sizeof ifr.ifr_hwaddr.sa_data, sizeof tun->dev_addr));
+                        DBG(KERN_DEBUG "%s: set hardware address: %x:%x:%x:%x:%x:%x\n",
+                                        tun->dev->name,
+                                        tun->dev_addr[0], tun->dev_addr[1], tun->dev_addr[2],
+                                        tun->dev_addr[3], tun->dev_addr[4], tun->dev_addr[5]);
+                }
+
+                return  ret;
+        }
 
         case SIOCADDMULTI:
                 /** Add the specified group to the character device's multicast filter
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 0d91d094edd9..f2dd7763cd0b 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -1708,7 +1708,6 @@ typhoon_rx(struct typhoon *tp, struct basic_ring *rxRing, volatile u32 * ready,
 
                 if(pkt_len < rx_copybreak &&
                    (new_skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                        new_skb->dev = tp->dev;
                         skb_reserve(new_skb, 2);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr,
                                                     PKT_BUF_SZ,
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index f3a972e74e9a..adea290a9d5e 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1486,7 +1486,6 @@ static int rhine_rx(struct net_device *dev, int limit)
                            copying to a minimally-sized skbuff. */
                         if (pkt_len < rx_copybreak &&
                                 (skb = dev_alloc_skb(pkt_len + 2)) != NULL) {
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 pci_dma_sync_single_for_cpu(rp->pdev,
                                                             rp->rx_skbuff_dma[entry],
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 8e5d82051bd4..25b75b615188 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1339,7 +1339,8 @@ static inline int velocity_rx_copy(struct sk_buff **rx_skb, int pkt_size,
                         if (vptr->flags & VELOCITY_FLAGS_IP_ALIGN)
                                 skb_reserve(new_skb, 2);
 
-                        memcpy(new_skb->data, rx_skb[0]->data, pkt_size);
+                        skb_copy_from_linear_data(rx_skb[0], new_skb->data,
+                                                  pkt_size);
                         *rx_skb = new_skb;
                         ret = 0;
                 }
@@ -1398,7 +1399,6 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
                 vptr->stats.multicast++;
 
         skb = rd_info->skb;
-        skb->dev = vptr->dev;
 
         pci_dma_sync_single_for_cpu(vptr->pdev, rd_info->skb_dma,
                                     vptr->rx_buf_sz, PCI_DMA_FROMDEVICE);
@@ -1428,7 +1428,7 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
                    PCI_DMA_FROMDEVICE);
 
         skb_put(skb, pkt_len - 4);
-        skb->protocol = eth_type_trans(skb, skb->dev);
+        skb->protocol = eth_type_trans(skb, vptr->dev);
 
         stats->rx_bytes += pkt_len;
         netif_rx(skb);
@@ -1928,7 +1928,7 @@ static int velocity_xmit(struct sk_buff *skb, struct net_device *dev)
         if (pktlen < ETH_ZLEN) {
                 /* Cannot occur until ZC support */
                 pktlen = ETH_ZLEN;
-                memcpy(tdinfo->buf, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, tdinfo->buf, skb->len);
                 memset(tdinfo->buf + skb->len, 0, ETH_ZLEN - skb->len);
                 tdinfo->skb = skb;
                 tdinfo->skb_dma[0] = tdinfo->buf_dma;
@@ -1944,7 +1944,7 @@ static int velocity_xmit(struct sk_buff *skb, struct net_device *dev)
                 int nfrags = skb_shinfo(skb)->nr_frags;
                 tdinfo->skb = skb;
                 if (nfrags > 6) {
-                        memcpy(tdinfo->buf, skb->data, skb->len);
+                        skb_copy_from_linear_data(skb, tdinfo->buf, skb->len);
                         tdinfo->skb_dma[0] = tdinfo->buf_dma;
                         td_ptr->tdesc0.pktsize =
                         td_ptr->td_buf[0].pa_low = cpu_to_le32(tdinfo->skb_dma[0]);
@@ -2007,7 +2007,7 @@ static int velocity_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         if ((vptr->flags & VELOCITY_FLAGS_TX_CSUM)
                                  && (skb->ip_summed == CHECKSUM_PARTIAL)) {
-                struct iphdr *ip = skb->nh.iph;
+                const struct iphdr *ip = ip_hdr(skb);
                 if (ip->protocol == IPPROTO_TCP)
                         td_ptr->tdesc1.TCR |= TCR0_TCPCK;
                 else if (ip->protocol == IPPROTO_UDP)
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 5b82e4fd0d73..23464735fa88 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -773,7 +773,7 @@ static int sppp_rx_done(struct channel_data *chan)
         }
         chan->rx_skb->protocol = htons(ETH_P_WAN_PPP);
         chan->rx_skb->dev = chan->pppdev.dev;
-        chan->rx_skb->mac.raw = chan->rx_skb->data;
+        skb_reset_mac_header(chan->rx_skb);
         chan->stats.rx_packets++;
         chan->stats.rx_bytes += chan->cosa->rxsize;
         netif_rx(chan->rx_skb);
diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
index a631d1c2fa14..016b3ff3ea5e 100644
--- a/drivers/net/wan/cycx_x25.c
+++ b/drivers/net/wan/cycx_x25.c
@@ -834,7 +834,7 @@ static void cycx_x25_irq_rx(struct cycx_device *card, struct cycx_x25_cmd *cmd)
         ++chan->ifstats.rx_packets;
         chan->ifstats.rx_bytes += pktlen;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         netif_rx(skb);
         dev->last_rx = jiffies;         /* timestamp */
 }
diff --git a/drivers/net/wan/dlci.c b/drivers/net/wan/dlci.c
index 736987559432..66be20c292b6 100644
--- a/drivers/net/wan/dlci.c
+++ b/drivers/net/wan/dlci.c
@@ -176,7 +176,7 @@ static void dlci_receive(struct sk_buff *skb, struct net_device *dev)
         if (process)
         {
                 /* we've set up the protocol, so discard the header */
-                skb->mac.raw = skb->data; 
+                skb_reset_mac_header(skb);
                 skb_pull(skb, header);
                 dlp->stats.rx_bytes += skb->len;
                 netif_rx(skb);
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index 25021a7992a9..dca024471455 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1904,7 +1904,8 @@ static struct sk_buff *dscc4_init_dummy_skb(struct dscc4_dev_priv *dpriv)
                 struct TxFD *tx_fd = dpriv->tx_fd + last;
 
                 skb->len = DUMMY_SKB_SIZE;
-                memcpy(skb->data, version, strlen(version)%DUMMY_SKB_SIZE);
+                skb_copy_to_linear_data(skb, version,
+                                        strlen(version) % DUMMY_SKB_SIZE);
                 tx_fd->state = FrameEnd | TO_STATE_TX(DUMMY_SKB_SIZE);
                 tx_fd->data = pci_map_single(dpriv->pci_priv->pdev, skb->data,
                                              DUMMY_SKB_SIZE, PCI_DMA_TODEVICE);
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index c45d6a83339d..58a53b6d9b42 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -864,7 +864,7 @@ fst_tx_dma_complete(struct fst_card_info *card, struct fst_port_info *port,
 static __be16 farsync_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         skb->dev = dev;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->pkt_type = PACKET_HOST;
         return htons(ETH_P_CUST);
 }
diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
index c9664fd8a917..00e0aaadabcc 100644
--- a/drivers/net/wan/hdlc_cisco.c
+++ b/drivers/net/wan/hdlc_cisco.c
@@ -124,7 +124,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type,
         skb_put(skb, sizeof(struct cisco_packet));
         skb->priority = TC_PRIO_CONTROL;
         skb->dev = dev;
-        skb->nh.raw = skb->data;
+        skb_reset_network_header(skb);
 
         dev_queue_xmit(skb);
 }
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index c6c3c757d6f1..aeb2789adf26 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -533,7 +533,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
                 skb->protocol = __constant_htons(NLPID_CCITT_ANSI_LMI);
                 fr_hard_header(&skb, LMI_CCITT_ANSI_DLCI);
         }
-        data = skb->tail;
+        data = skb_tail_pointer(skb);
         data[i++] = LMI_CALLREF;
         data[i++] = dce ? LMI_STATUS : LMI_STATUS_ENQUIRY;
         if (lmi == LMI_ANSI)
@@ -590,7 +590,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
         skb_put(skb, i);
         skb->priority = TC_PRIO_CONTROL;
         skb->dev = dev;
-        skb->nh.raw = skb->data;
+        skb_reset_network_header(skb);
 
         dev_queue_xmit(skb);
 }
@@ -1011,7 +1011,6 @@ static int fr_rx(struct sk_buff *skb)
                 stats->rx_bytes += skb->len;
                 if (pvc->state.becn)
                         stats->rx_compressed++;
-                skb->dev = dev;
                 netif_rx(skb);
                 return NET_RX_SUCCESS;
         } else {
diff --git a/drivers/net/wan/hostess_sv11.c b/drivers/net/wan/hostess_sv11.c
index a02c5fb40567..9ba3e4ee6ec7 100644
--- a/drivers/net/wan/hostess_sv11.c
+++ b/drivers/net/wan/hostess_sv11.c
@@ -59,7 +59,7 @@ static void hostess_input(struct z8530_channel *c, struct sk_buff *skb)
         /* Drop the CRC - it's not a good idea to try and negotiate it ;) */
         skb_trim(skb, skb->len-2);
         skb->protocol=__constant_htons(ETH_P_WAN_PPP);
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
         skb->dev=c->netdevice;
         /*
          *      Send it to the PPP layer. We don't have time to process
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index 2b54f1bc3a0d..ae132c1c5459 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -1636,7 +1636,7 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             if (nsb) {
                 sc->lmc_rxq[i] = nsb;
                 nsb->dev = dev;
-                sc->lmc_rxring[i].buffer1 = virt_to_bus (nsb->tail);
+                sc->lmc_rxring[i].buffer1 = virt_to_bus(skb_tail_pointer(nsb));
             }
             sc->failed_recv_alloc = 1;
             goto skip_packet;
@@ -1667,8 +1667,8 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             skb_put (skb, len);
             skb->protocol = lmc_proto_type(sc, skb);
             skb->protocol = htons(ETH_P_WAN_PPP);
-            skb->mac.raw = skb->data;
-//            skb->nh.raw = skb->data;
+            skb_reset_mac_header(skb);
+            /* skb_reset_network_header(skb); */
             skb->dev = dev;
             lmc_proto_netif(sc, skb);
 
@@ -1679,7 +1679,7 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             if (nsb) {
                 sc->lmc_rxq[i] = nsb;
                 nsb->dev = dev;
-                sc->lmc_rxring[i].buffer1 = virt_to_bus (nsb->tail);
+                sc->lmc_rxring[i].buffer1 = virt_to_bus(skb_tail_pointer(nsb));
                 /* Transferred to 21140 below */
             }
             else {
@@ -1702,11 +1702,11 @@ static int lmc_rx (struct net_device *dev) /*fold00*/
             if(!nsb) {
                 goto give_it_anyways;
             }
-            memcpy(skb_put(nsb, len), skb->data, len);
+            skb_copy_from_linear_data(skb, skb_put(nsb, len), len);
             
             nsb->protocol = lmc_proto_type(sc, skb);
-            nsb->mac.raw = nsb->data;
-//            nsb->nh.raw = nsb->data;
+            skb_reset_mac_header(nsb);
+            /* skb_reset_network_header(nsb); */
             nsb->dev = dev;
             lmc_proto_netif(sc, nsb);
         }
@@ -1932,7 +1932,7 @@ static void lmc_softreset (lmc_softc_t * const sc) /*fold00*/
         sc->lmc_rxring[i].status = 0x80000000;
 
         /* used to be PKT_BUF_SZ now uses skb since we lose some to head room */
-        sc->lmc_rxring[i].length = skb->end - skb->data;
+        sc->lmc_rxring[i].length = skb_tailroom(skb);
 
         /* use to be tail which is dumb since you're thinking why write
          * to the end of the packj,et but since there's nothing there tail == data
diff --git a/drivers/net/wan/pc300_drv.c b/drivers/net/wan/pc300_drv.c
index 62184dee377c..999bf71937ca 100644
--- a/drivers/net/wan/pc300_drv.c
+++ b/drivers/net/wan/pc300_drv.c
@@ -1755,17 +1755,17 @@ cpc_trace(struct net_device *dev, struct sk_buff *skb_main, char rx_tx)
 
         skb->dev = dev;
         skb->protocol = htons(ETH_P_CUST);
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->pkt_type = PACKET_HOST;
         skb->len = 10 + skb_main->len;
 
-        memcpy(skb->data, dev->name, 5);
+        skb_copy_to_linear_data(skb, dev->name, 5);
         skb->data[5] = '[';
         skb->data[6] = rx_tx;
         skb->data[7] = ']';
         skb->data[8] = ':';
         skb->data[9] = ' ';
-        memcpy(&skb->data[10], skb_main->data, skb_main->len);
+        skb_copy_from_linear_data(skb_main, &skb->data[10], skb_main->len);
 
         netif_rx(skb);
 }
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 5873c346e7e9..07dbdfbfc15d 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -1003,17 +1003,17 @@ static void cpc_tty_trace(pc300dev_t *dev, char* buf, int len, char rxtx)
         skb_put (skb, 10 + len); 
         skb->dev = dev->dev; 
         skb->protocol = htons(ETH_P_CUST); 
-        skb->mac.raw = skb->data; 
+        skb_reset_mac_header(skb);
         skb->pkt_type = PACKET_HOST; 
         skb->len = 10 + len; 
 
-        memcpy(skb->data,dev->dev->name,5);
+        skb_copy_to_linear_data(skb, dev->dev->name, 5);
         skb->data[5] = '['; 
         skb->data[6] = rxtx; 
         skb->data[7] = ']'; 
         skb->data[8] = ':'; 
         skb->data[9] = ' '; 
-        memcpy(&skb->data[10], buf, len); 
+        skb_copy_to_linear_data_offset(skb, 10, buf, len);
         netif_rx(skb); 
 }       
 
diff --git a/drivers/net/wan/sbni.c b/drivers/net/wan/sbni.c
index fc5c0c611ffd..35eded7ffb2d 100644
--- a/drivers/net/wan/sbni.c
+++ b/drivers/net/wan/sbni.c
@@ -999,11 +999,6 @@ get_rx_buf( struct net_device  *dev )
         if( !skb )
                 return  NULL;
 
-#ifdef CONFIG_SBNI_MULTILINE
-        skb->dev = ((struct net_local *) dev->priv)->master;
-#else
-        skb->dev = dev;
-#endif
         skb_reserve( skb, 2 );          /* Align IP on longword boundaries */
         return  skb;
 }
diff --git a/drivers/net/wan/sealevel.c b/drivers/net/wan/sealevel.c
index 70fb1b98b1dd..131358108c5a 100644
--- a/drivers/net/wan/sealevel.c
+++ b/drivers/net/wan/sealevel.c
@@ -61,7 +61,7 @@ static void sealevel_input(struct z8530_channel *c, struct sk_buff *skb)
         /* Drop the CRC - it's not a good idea to try and negotiate it ;) */
         skb_trim(skb, skb->len-2);
         skb->protocol=htons(ETH_P_WAN_PPP);
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
         skb->dev=c->netdevice;
         /*
          *      Send it to the PPP layer. We don't have time to process
diff --git a/drivers/net/wan/syncppp.c b/drivers/net/wan/syncppp.c
index 218f7b574ab3..67fc67cfd452 100644
--- a/drivers/net/wan/syncppp.c
+++ b/drivers/net/wan/syncppp.c
@@ -227,7 +227,7 @@ static void sppp_input (struct net_device *dev, struct sk_buff *skb)
         unsigned long flags;
 
         skb->dev=dev;
-        skb->mac.raw=skb->data;
+        skb_reset_mac_header(skb);
 
         if (dev->flags & IFF_RUNNING)
         {
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index 8b4540bfc1b0..98ef400908b8 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -1656,7 +1656,7 @@ static void z8530_rx_done(struct z8530_channel *c)
                 else
                 {
                         skb_put(skb, ct);
-                        memcpy(skb->data, rxb, ct);
+                        skb_copy_to_linear_data(skb, rxb, ct);
                         c->stats.rx_packets++;
                         c->stats.rx_bytes+=ct;
                 }
@@ -1782,7 +1782,7 @@ int z8530_queue_xmit(struct z8530_channel *c, struct sk_buff *skb)
                  */
                 c->tx_next_ptr=c->tx_dma_buf[c->tx_dma_used];
                 c->tx_dma_used^=1;      /* Flip temp buffer */
-                memcpy(c->tx_next_ptr, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, c->tx_next_ptr, skb->len);
         }
         else
                 c->tx_next_ptr=skb->data;       
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index ece3d9c2dc61..4426841b2be6 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -2,47 +2,21 @@
 # Wireless LAN device configuration
 #
 
-menu "Wireless LAN (non-hamradio)"
-        depends on NETDEVICES
-
-config NET_RADIO
-        bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
-        select WIRELESS_EXT
-        ---help---
-          Support for wireless LANs and everything having to do with radio,
-          but not with amateur radio or FM broadcasting.
-
-          Saying Y here also enables the Wireless Extensions (creates
-          /proc/net/wireless and enables iwconfig access). The Wireless
-          Extension is a generic API allowing a driver to expose to the user
-          space configuration and statistics specific to common Wireless LANs.
-          The beauty of it is that a single set of tool can support all the
-          variations of Wireless LANs, regardless of their type (as long as
-          the driver supports Wireless Extension). Another advantage is that
-          these parameters may be changed on the fly without restarting the
-          driver (or Linux). If you wish to use Wireless Extensions with
-          wireless PCMCIA (PC-) cards, you need to say Y here; you can fetch
-          the tools from
-          <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>.
+menu "Wireless LAN"
 
-config NET_WIRELESS_RTNETLINK
-        bool "Wireless Extension API over RtNetlink"
-        depends on NET_RADIO
+config WLAN_PRE80211
+        bool "Wireless LAN (pre-802.11)"
+        depends on NETDEVICES
         ---help---
-          Support the Wireless Extension API over the RtNetlink socket
-          in addition to the traditional ioctl interface (selected above).
+          Say Y if you have any pre-802.11 wireless LAN hardware.
 
-          For now, few tools use this facility, but it might grow in the
-          future. The only downside is that it adds 4.5 kB to your kernel.
-
-# Note : the cards are obsolete (can't buy them anymore), but the drivers
-# are not, as people are still using them...
-comment "Obsolete Wireless cards support (pre-802.11)"
-        depends on NET_RADIO && (INET || ISA || PCMCIA)
+          This option does not affect the kernel build, it only
+          lets you choose drivers.
 
 config STRIP
         tristate "STRIP (Metricom starmode radio IP)"
-        depends on NET_RADIO && INET
+        depends on INET && WLAN_PRE80211
+        select WIRELESS_EXT
         ---help---
           Say Y if you have a Metricom radio and intend to use Starmode Radio
           IP. STRIP is a radio protocol developed for the MosquitoNet project
@@ -65,7 +39,8 @@ config STRIP
 
 config ARLAN
         tristate "Aironet Arlan 655 & IC2200 DS support"
-        depends on NET_RADIO && ISA && !64BIT
+        depends on ISA && !64BIT && WLAN_PRE80211
+        select WIRELESS_EXT
         ---help---
           Aironet makes Arlan, a class of wireless LAN adapters. These use the
           www.Telxon.com chip, which is also used on several similar cards.
@@ -80,7 +55,8 @@ config ARLAN
 
 config WAVELAN
         tristate "AT&T/Lucent old WaveLAN & DEC RoamAbout DS ISA support"
-        depends on NET_RADIO && ISA
+        depends on ISA && WLAN_PRE80211
+        select WIRELESS_EXT
         ---help---
           The Lucent WaveLAN (formerly NCR and AT&T; or DEC RoamAbout DS) is
           a Radio LAN (wireless Ethernet-like Local Area Network) using the
@@ -107,7 +83,8 @@ config WAVELAN
 
 config PCMCIA_WAVELAN
         tristate "AT&T/Lucent old WaveLAN Pcmcia wireless support"
-        depends on NET_RADIO && PCMCIA
+        depends on PCMCIA && WLAN_PRE80211
+        select WIRELESS_EXT
         help
           Say Y here if you intend to attach an AT&T/Lucent Wavelan PCMCIA
           (PC-card) wireless Ethernet networking card to your computer.  This
@@ -118,7 +95,8 @@ config PCMCIA_WAVELAN
 
 config PCMCIA_NETWAVE
         tristate "Xircom Netwave AirSurfer Pcmcia wireless support"
-        depends on NET_RADIO && PCMCIA
+        depends on PCMCIA && WLAN_PRE80211
+        select WIRELESS_EXT
         help
           Say Y here if you intend to attach this type of PCMCIA (PC-card)
           wireless Ethernet networking card to your computer.
@@ -126,12 +104,20 @@ config PCMCIA_NETWAVE
           To compile this driver as a module, choose M here: the module will be
           called netwave_cs.  If unsure, say N.
 
-comment "Wireless 802.11 Frequency Hopping cards support"
-        depends on NET_RADIO && PCMCIA
+
+config WLAN_80211
+        bool "Wireless LAN (IEEE 802.11)"
+        depends on NETDEVICES
+        ---help---
+          Say Y if you have any 802.11 wireless LAN hardware.
+
+          This option does not affect the kernel build, it only
+          lets you choose drivers.
 
 config PCMCIA_RAYCS
         tristate "Aviator/Raytheon 2.4MHz wireless support"
-        depends on NET_RADIO && PCMCIA
+        depends on PCMCIA && WLAN_80211
+        select WIRELESS_EXT
         ---help---
           Say Y here if you intend to attach an Aviator/Raytheon PCMCIA
           (PC-card) wireless Ethernet networking card to your computer.
@@ -141,12 +127,10 @@ config PCMCIA_RAYCS
           To compile this driver as a module, choose M here: the module will be
           called ray_cs.  If unsure, say N.
 
-comment "Wireless 802.11b ISA/PCI cards support"
-        depends on NET_RADIO && (ISA || PCI || PPC_PMAC || PCMCIA)
-
 config IPW2100
         tristate "Intel PRO/Wireless 2100 Network Connection"
-        depends on NET_RADIO && PCI
+        depends on PCI && WLAN_80211
+        select WIRELESS_EXT
         select FW_LOADER
         select IEEE80211
         ---help---
@@ -200,7 +184,8 @@ config IPW2100_DEBUG
 
 config IPW2200
         tristate "Intel PRO/Wireless 2200BG and 2915ABG Network Connection"
-        depends on NET_RADIO && PCI
+        depends on PCI && WLAN_80211
+        select WIRELESS_EXT
         select FW_LOADER
         select IEEE80211
         ---help---
@@ -282,7 +267,8 @@ config IPW2200_DEBUG
 
 config AIRO
         tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
-        depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
+        depends on ISA_DMA_API && WLAN_80211 && (PCI || BROKEN)
+        select WIRELESS_EXT
         select CRYPTO
         ---help---
           This is the standard Linux driver to support Cisco/Aironet ISA and
@@ -299,7 +285,8 @@ config AIRO
 
 config HERMES
         tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
-        depends on NET_RADIO && (PPC_PMAC || PCI || PCMCIA)
+        depends on (PPC_PMAC || PCI || PCMCIA) && WLAN_80211
+        select WIRELESS_EXT
         ---help---
           A driver for 802.11b wireless cards based on the "Hermes" or
           Intersil HFA384x (Prism 2) MAC controller.  This includes the vast
@@ -373,7 +360,8 @@ config PCI_HERMES
 
 config ATMEL
       tristate "Atmel at76c50x chipset  802.11b support"
-      depends on NET_RADIO && (PCI || PCMCIA)
+      depends on (PCI || PCMCIA) && WLAN_80211
+      select WIRELESS_EXT
       select FW_LOADER
       select CRC32
        ---help---
@@ -394,13 +382,9 @@ config PCI_ATMEL
         Enable support for PCI and mini-PCI cards containing the
         Atmel at76c506 chip.
 
-# If Pcmcia is compiled in, offer Pcmcia cards...
-comment "Wireless 802.11b Pcmcia/Cardbus cards support"
-        depends on NET_RADIO && PCMCIA
-
 config PCMCIA_HERMES
         tristate "Hermes PCMCIA card support"
-        depends on NET_RADIO && PCMCIA && HERMES
+        depends on PCMCIA && HERMES
         ---help---
           A driver for "Hermes" chipset based PCMCIA wireless adaptors, such
           as the Lucent WavelanIEEE/Orinoco cards and their OEM (Cabletron/
@@ -420,7 +404,7 @@ config PCMCIA_HERMES
 
 config PCMCIA_SPECTRUM
         tristate "Symbol Spectrum24 Trilogy PCMCIA card support"
-        depends on NET_RADIO && PCMCIA && HERMES
+        depends on PCMCIA && HERMES
         select FW_LOADER
         ---help---
 
@@ -434,7 +418,8 @@ config PCMCIA_SPECTRUM
 
 config AIRO_CS
         tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
-        depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
+        depends on PCMCIA && (BROKEN || !M32R) && WLAN_80211
+        select WIRELESS_EXT
         select CRYPTO
         select CRYPTO_AES
         ---help---
@@ -458,7 +443,8 @@ config AIRO_CS
 
 config PCMCIA_ATMEL
         tristate "Atmel at76c502/at76c504 PCMCIA cards"
-        depends on NET_RADIO && ATMEL && PCMCIA
+        depends on ATMEL && PCMCIA
+        select WIRELESS_EXT
         select FW_LOADER
         select CRC32
         ---help---
@@ -467,17 +453,17 @@ config PCMCIA_ATMEL
 
 config PCMCIA_WL3501
       tristate "Planet WL3501 PCMCIA cards"
-      depends on NET_RADIO && EXPERIMENTAL && PCMCIA
+      depends on EXPERIMENTAL && PCMCIA && WLAN_80211
+      select WIRELESS_EXT
        ---help---
          A driver for WL3501 PCMCIA 802.11 wireless cards made by Planet.
          It has basic support for Linux wireless extensions and initial
          micro support for ethtool.
 
-comment "Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support"
-        depends on NET_RADIO && PCI
 config PRISM54
         tristate 'Intersil Prism GT/Duette/Indigo PCI/Cardbus' 
-        depends on PCI && NET_RADIO && EXPERIMENTAL
+        depends on PCI && EXPERIMENTAL && WLAN_80211
+        select WIRELESS_EXT
         select FW_LOADER
         ---help---
           Enable PCI and Cardbus support for the following chipset based cards:
@@ -523,7 +509,8 @@ config PRISM54
 
 config USB_ZD1201
         tristate "USB ZD1201 based Wireless device support"
-        depends on USB && NET_RADIO
+        depends on USB && WLAN_80211
+        select WIRELESS_EXT
         select FW_LOADER
         ---help---
           Say Y if you want to use wireless LAN adapters based on the ZyDAS
@@ -542,11 +529,4 @@ source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/bcm43xx/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 
-# yes, this works even when no drivers are selected
-config NET_WIRELESS
-        bool
-        depends on NET_RADIO && (ISA || PCI || PPC_PMAC || PCMCIA)
-        default y
-
 endmenu
-
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 2ada76a93cb6..7fe0a61091a6 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2444,7 +2444,7 @@ static int add_airo_dev( struct net_device *dev );
 
 static int wll_header_parse(struct sk_buff *skb, unsigned char *haddr)
 {
-        memcpy(haddr, skb->mac.raw + 10, ETH_ALEN);
+        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN);
         return ETH_ALEN;
 }
 
@@ -3411,14 +3411,12 @@ badrx:
                         OUT4500( apriv, EVACK, EV_RX);
 
                         if (test_bit(FLAG_802_11, &apriv->flags)) {
-                                skb->mac.raw = skb->data;
+                                skb_reset_mac_header(skb);
                                 skb->pkt_type = PACKET_OTHERHOST;
                                 skb->dev = apriv->wifidev;
                                 skb->protocol = htons(ETH_P_802_2);
-                        } else {
-                                skb->dev = dev;
+                        } else
                                 skb->protocol = eth_type_trans(skb,dev);
-                        }
                         skb->dev->last_rx = jiffies;
                         skb->ip_summed = CHECKSUM_NONE;
 
@@ -3641,7 +3639,6 @@ badmic:
                 }
 #endif /* WIRELESS_SPY */
 
-                skb->dev = ai->dev;
                 skb->ip_summed = CHECKSUM_NONE;
                 skb->protocol = eth_type_trans(skb, ai->dev);
                 skb->dev->last_rx = jiffies;
@@ -3749,7 +3746,7 @@ void mpi_receive_802_11 (struct airo_info *ai)
                 wireless_spy_update(ai->dev, sa, &wstats);
         }
 #endif /* IW_WIRELESS_SPY */
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb->pkt_type = PACKET_OTHERHOST;
         skb->dev = ai->wifidev;
         skb->protocol = htons(ETH_P_802_2);
diff --git a/drivers/net/wireless/arlan-main.c b/drivers/net/wireless/arlan-main.c
index 4688e56b69c7..498e8486d125 100644
--- a/drivers/net/wireless/arlan-main.c
+++ b/drivers/net/wireless/arlan-main.c
@@ -1500,7 +1500,6 @@ static void arlan_rx_interrupt(struct net_device *dev, u_char rxStatus, u_short
                                 break;
                         }
                         skb_reserve(skb, 2);
-                        skb->dev = dev;
                         skbtmp = skb_put(skb, pkt_len);
 
                         memcpy_fromio(skbtmp + ARLAN_FAKE_HDR_LEN, ((char __iomem *) arlan) + rxOffset, pkt_len - ARLAN_FAKE_HDR_LEN);
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 23eba698aec5..51a7db53afa5 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -827,14 +827,14 @@ static int start_tx(struct sk_buff *skb, struct net_device *dev)
         if (priv->wep_is_on)
                 frame_ctl |= IEEE80211_FCTL_PROTECTED;
         if (priv->operating_mode == IW_MODE_ADHOC) {
-                memcpy(&header.addr1, skb->data, 6);
+                skb_copy_from_linear_data(skb, &header.addr1, 6);
                 memcpy(&header.addr2, dev->dev_addr, 6);
                 memcpy(&header.addr3, priv->BSSID, 6);
         } else {
                 frame_ctl |= IEEE80211_FCTL_TODS;
                 memcpy(&header.addr1, priv->CurrentBSSID, 6);
                 memcpy(&header.addr2, dev->dev_addr, 6);
-                memcpy(&header.addr3, skb->data, 6);
+                skb_copy_from_linear_data(skb, &header.addr3, 6);
         }
 
         if (priv->use_wpa)
@@ -920,7 +920,6 @@ static void fast_rx_path(struct atmel_private *priv,
                 memcpy(&skbp[6], header->addr2, 6); /* source address */
 
         priv->dev->last_rx = jiffies;
-        skb->dev = priv->dev;
         skb->protocol = eth_type_trans(skb, priv->dev);
         skb->ip_summed = CHECKSUM_NONE;
         netif_rx(skb);
@@ -1028,7 +1027,6 @@ static void frag_rx_path(struct atmel_private *priv,
                                        priv->rx_buf,
                                        priv->frag_len + 12);
                                 priv->dev->last_rx = jiffies;
-                                skb->dev = priv->dev;
                                 skb->protocol = eth_type_trans(skb, priv->dev);
                                 skb->ip_summed = CHECKSUM_NONE;
                                 netif_rx(skb);
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 533993f538fc..ce397e4284f4 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -1,6 +1,7 @@
 config BCM43XX
         tristate "Broadcom BCM43xx wireless support"
-        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && NET_RADIO && EXPERIMENTAL
+        depends on PCI && IEEE80211 && IEEE80211_SOFTMAC && WLAN_80211 && EXPERIMENTAL
+        select WIRELESS_EXT
         select FW_LOADER
         select HW_RANDOM
         ---help---
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index 6e0dc76400e5..e3d2e61a31ee 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -998,7 +998,8 @@ static void dma_tx_fragment(struct bcm43xx_dmaring *ring,
                         assert(0);
                         return;
                 }
-                memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb, skb_put(bounce_skb, skb->len),
+                                          skb->len);
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
         }
diff --git a/drivers/net/wireless/hostap/Kconfig b/drivers/net/wireless/hostap/Kconfig
index 308f773ad566..1fef33169fdd 100644
--- a/drivers/net/wireless/hostap/Kconfig
+++ b/drivers/net/wireless/hostap/Kconfig
@@ -1,6 +1,7 @@
 config HOSTAP
         tristate "IEEE 802.11 for Host AP (Prism2/2.5/3 and WEP/TKIP/CCMP)"
-        depends on NET_RADIO
+        depends on WLAN_80211
+        select WIRELESS_EXT
         select IEEE80211
         select IEEE80211_CRYPT_WEP
         ---help---
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index 7e04dc94b3bc..cbedc9ee740a 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -167,7 +167,7 @@ hdr->f.status = s; hdr->f.len = l; hdr->f.data = d
 
         ret = skb->len - phdrlen;
         skb->dev = dev;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, hdrlen);
         if (prism_header)
                 skb_pull(skb, phdrlen);
@@ -933,12 +933,14 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
                 if (frag == 0) {
                         /* copy first fragment (including full headers) into
                          * beginning of the fragment cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data, flen);
+                        skb_copy_from_linear_data(skb, skb_put(frag_skb, flen),
+                                                  flen);
                 } else {
                         /* append frame payload to the end of the fragment
                          * cache skb */
-                        memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
-                               flen);
+                        skb_copy_from_linear_data_offset(skb, hdrlen,
+                                                         skb_put(frag_skb,
+                                                                 flen), flen);
                 }
                 dev_kfree_skb(skb);
                 skb = NULL;
@@ -1044,8 +1046,9 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
             skb->len >= ETH_HLEN + ETH_ALEN) {
                 /* Non-standard frame: get addr4 from its bogus location after
                  * the payload */
-                memcpy(skb->data + ETH_ALEN,
-                       skb->data + skb->len - ETH_ALEN, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, skb->len - ETH_ALEN,
+                                                 skb->data + ETH_ALEN,
+                                                 ETH_ALEN);
                 skb_trim(skb, skb->len - ETH_ALEN);
         }
 
@@ -1073,17 +1076,17 @@ void hostap_80211_rx(struct net_device *dev, struct sk_buff *skb,
 
         if (skb2 != NULL) {
                 /* send to wireless media */
-                skb2->protocol = __constant_htons(ETH_P_802_3);
-                skb2->mac.raw = skb2->nh.raw = skb2->data;
-                /* skb2->nh.raw = skb2->data + ETH_HLEN; */
                 skb2->dev = dev;
+                skb2->protocol = __constant_htons(ETH_P_802_3);
+                skb_reset_mac_header(skb2);
+                skb_reset_network_header(skb2);
+                /* skb2->network_header += ETH_HLEN; */
                 dev_queue_xmit(skb2);
         }
 
         if (skb) {
                 skb->protocol = eth_type_trans(skb, dev);
                 memset(skb->cb, 0, sizeof(skb->cb));
-                skb->dev = dev;
                 netif_rx(skb);
         }
 
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 4a5be70c0419..246fac0e8001 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -146,7 +146,8 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         fc |= IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS;
                         /* From&To DS: Addr1 = RA, Addr2 = TA, Addr3 = DA,
                          * Addr4 = SA */
-                        memcpy(&hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        skb_copy_from_linear_data_offset(skb, ETH_ALEN,
+                                                         &hdr.addr4, ETH_ALEN);
                         hdr_len += ETH_ALEN;
                 } else {
                         /* bogus 4-addr format to workaround Prism2 station
@@ -159,7 +160,8 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         /* SA from skb->data + ETH_ALEN will be added after
                          * frame payload; use hdr.addr4 as a temporary buffer
                          */
-                        memcpy(&hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
+                        skb_copy_from_linear_data_offset(skb, ETH_ALEN,
+                                                         &hdr.addr4, ETH_ALEN);
                         need_tailroom += ETH_ALEN;
                 }
 
@@ -174,24 +176,27 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 else
                         memcpy(&hdr.addr1, local->bssid, ETH_ALEN);
                 memcpy(&hdr.addr2, dev->dev_addr, ETH_ALEN);
-                memcpy(&hdr.addr3, skb->data, ETH_ALEN);
+                skb_copy_from_linear_data(skb, &hdr.addr3, ETH_ALEN);
         } else if (local->iw_mode == IW_MODE_MASTER && !to_assoc_ap) {
                 fc |= IEEE80211_FCTL_FROMDS;
                 /* From DS: Addr1 = DA, Addr2 = BSSID, Addr3 = SA */
-                memcpy(&hdr.addr1, skb->data, ETH_ALEN);
+                skb_copy_from_linear_data(skb, &hdr.addr1, ETH_ALEN);
                 memcpy(&hdr.addr2, dev->dev_addr, ETH_ALEN);
-                memcpy(&hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, ETH_ALEN, &hdr.addr3,
+                                                 ETH_ALEN);
         } else if (local->iw_mode == IW_MODE_INFRA || to_assoc_ap) {
                 fc |= IEEE80211_FCTL_TODS;
                 /* To DS: Addr1 = BSSID, Addr2 = SA, Addr3 = DA */
                 memcpy(&hdr.addr1, to_assoc_ap ?
                        local->assoc_ap_addr : local->bssid, ETH_ALEN);
-                memcpy(&hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
-                memcpy(&hdr.addr3, skb->data, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, ETH_ALEN, &hdr.addr2,
+                                                 ETH_ALEN);
+                skb_copy_from_linear_data(skb, &hdr.addr3, ETH_ALEN);
         } else if (local->iw_mode == IW_MODE_ADHOC) {
                 /* not From/To DS: Addr1 = DA, Addr2 = SA, Addr3 = BSSID */
-                memcpy(&hdr.addr1, skb->data, ETH_ALEN);
-                memcpy(&hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
+                skb_copy_from_linear_data(skb, &hdr.addr1, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, ETH_ALEN, &hdr.addr2,
+                                                 ETH_ALEN);
                 memcpy(&hdr.addr3, local->bssid, ETH_ALEN);
         }
 
@@ -237,7 +242,7 @@ int hostap_data_start_xmit(struct sk_buff *skb, struct net_device *dev)
         iface->stats.tx_packets++;
         iface->stats.tx_bytes += skb->len;
 
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         meta = (struct hostap_skb_tx_data *) skb->cb;
         memset(meta, 0, sizeof(*meta));
         meta->magic = HOSTAP_SKB_TX_DATA_MAGIC;
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index efb8cf3bd8ad..4ca8a27b8c55 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -982,7 +982,8 @@ static void prism2_send_mgmt(struct net_device *dev,
         meta->tx_cb_idx = tx_cb_idx;
 
         skb->dev = dev;
-        skb->mac.raw = skb->nh.raw = skb->data;
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
         dev_queue_xmit(skb);
 }
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
@@ -1276,8 +1277,8 @@ static char * ap_auth_make_challenge(struct ap_data *ap)
                 return NULL;
         }
 
-        memcpy(tmpbuf, skb->data + ap->crypt->extra_mpdu_prefix_len,
-               WLAN_AUTH_CHALLENGE_LEN);
+        skb_copy_from_linear_data_offset(skb, ap->crypt->extra_mpdu_prefix_len,
+                                         tmpbuf, WLAN_AUTH_CHALLENGE_LEN);
         dev_kfree_skb(skb);
 
         return tmpbuf;
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index 3079378fb8cd..fb01fb95a9f0 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -1838,13 +1838,14 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
 
         /* skb->data starts with txdesc->frame_control */
         hdr_len = 24;
-        memcpy(&txdesc.frame_control, skb->data, hdr_len);
+        skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);
         fc = le16_to_cpu(txdesc.frame_control);
         if (WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA &&
             (fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS) &&
             skb->len >= 30) {
                 /* Addr4 */
-                memcpy(txdesc.addr4, skb->data + hdr_len, ETH_ALEN);
+                skb_copy_from_linear_data_offset(skb, hdr_len, txdesc.addr4,
+                                                 ETH_ALEN);
                 hdr_len += ETH_ALEN;
         }
 
@@ -2217,7 +2218,7 @@ static void hostap_tx_callback(local_info_t *local,
                 memcpy(skb_put(skb, len), payload, len);
 
         skb->dev = local->dev;
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
 
         cb->func(skb, ok, cb->data);
 }
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 9077e6edde34..1f9edd91565d 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -590,20 +590,20 @@ void hostap_dump_tx_header(const char *name, const struct hfa384x_tx_frame *tx)
 
 int hostap_80211_header_parse(struct sk_buff *skb, unsigned char *haddr)
 {
-        memcpy(haddr, skb->mac.raw + 10, ETH_ALEN); /* addr2 */
+        memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
         return ETH_ALEN;
 }
 
 
 int hostap_80211_prism_header_parse(struct sk_buff *skb, unsigned char *haddr)
 {
-        if (*(u32 *)skb->mac.raw == LWNG_CAP_DID_BASE) {
-                memcpy(haddr, skb->mac.raw +
-                       sizeof(struct linux_wlan_ng_prism_hdr) + 10,
+        const unsigned char *mac = skb_mac_header(skb);
+
+        if (*(u32 *)mac == LWNG_CAP_DID_BASE) {
+                memcpy(haddr, mac + sizeof(struct linux_wlan_ng_prism_hdr) + 10,
                        ETH_ALEN); /* addr2 */
-        } else { /* (*(u32 *)skb->mac.raw == htonl(LWNG_CAPHDR_VERSION)) */
-                memcpy(haddr, skb->mac.raw +
-                       sizeof(struct linux_wlan_ng_cap_hdr) + 10,
+        } else { /* (*(u32 *)mac == htonl(LWNG_CAPHDR_VERSION)) */
+                memcpy(haddr, mac + sizeof(struct linux_wlan_ng_cap_hdr) + 10,
                        ETH_ALEN); /* addr2 */
         }
         return ETH_ALEN;
@@ -1063,7 +1063,8 @@ int prism2_sta_send_mgmt(local_info_t *local, u8 *dst, u16 stype,
         meta->iface = netdev_priv(dev);
 
         skb->dev = dev;
-        skb->mac.raw = skb->nh.raw = skb->data;
+        skb_reset_mac_header(skb);
+        skb_reset_network_header(skb);
         dev_queue_xmit(skb);
 
         return 0;
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index ad6e4a428355..9137a4dd02eb 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -2416,8 +2416,9 @@ static void isr_rx(struct ipw2100_priv *priv, int i,
 #ifdef IPW2100_RX_DEBUG
         /* Make a copy of the frame so we can dump it to the logs if
          * ieee80211_rx fails */
-        memcpy(packet_data, packet->skb->data,
-               min_t(u32, status->frame_size, IPW_RX_NIC_BUFFER_LENGTH));
+        skb_copy_from_linear_data(packet->skb, packet_data,
+                                  min_t(u32, status->frame_size,
+                                             IPW_RX_NIC_BUFFER_LENGTH));
 #endif
 
         if (!ieee80211_rx(priv->ieee, packet->skb, stats)) {
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index c878a2f3239c..4839a45098cb 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -8133,7 +8133,7 @@ static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
                 skb->dev = priv->ieee->dev;
 
                 /* Point raw at the ieee80211_stats */
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
 
                 skb->pkt_type = PACKET_OTHERHOST;
                 skb->protocol = __constant_htons(ETH_P_80211_STATS);
@@ -10355,7 +10355,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv,
 
                 rt_hdr->it_len = dst->len;
 
-                memcpy(skb_put(dst, len), src->data, len);
+                skb_copy_from_linear_data(src, skb_put(dst, len), len);
 
                 if (!ieee80211_rx(priv->prom_priv->ieee, dst, &dummystats))
                         dev_kfree_skb_any(dst);
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
index a009ab517710..45b00e13ab2b 100644
--- a/drivers/net/wireless/netwave_cs.c
+++ b/drivers/net/wireless/netwave_cs.c
@@ -1283,7 +1283,6 @@ static int netwave_rx(struct net_device *dev)
 
         skb_reserve( skb, 2);  /* Align IP on 16 byte */
         skb_put( skb, rcvLen);
-        skb->dev = dev;
 
         /* Copy packet fragments to the skb data area */
         ptr = (u_char*) skb->data;
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 4e7f6cf51436..062286dc8e15 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -689,7 +689,7 @@ static void orinoco_stat_gather(struct net_device *dev,
         /* Note : gcc will optimise the whole section away if
          * WIRELESS_SPY is not defined... - Jean II */
         if (SPY_NUMBER(priv)) {
-                orinoco_spy_gather(dev, skb->mac.raw + ETH_ALEN,
+                orinoco_spy_gather(dev, skb_mac_header(skb) + ETH_ALEN,
                                    desc->signal, desc->silence);
         }
 }
@@ -770,7 +770,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
 
         /* Copy the 802.11 header to the skb */
         memcpy(skb_put(skb, hdrlen), &(desc->frame_ctl), hdrlen);
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
 
         /* If any, copy the data from the card to the skb */
         if (datalen > 0) {
@@ -915,7 +915,6 @@ static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
                 memcpy(hdr->h_source, desc.addr2, ETH_ALEN);
 
         dev->last_rx = jiffies;
-        skb->dev = dev;
         skb->protocol = eth_type_trans(skb, dev);
         skb->ip_summed = CHECKSUM_NONE;
         if (fc & IEEE80211_FCTL_TODS)
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index b1122912ee2d..dd070cccf324 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -136,7 +136,7 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
                                 printk("islpci_eth_transmit:wds_mac\n");
 #endif
                                 memmove(skb->data + 6, src, skb->len);
-                                memcpy(skb->data, wds_mac, 6);
+                                skb_copy_to_linear_data(skb, wds_mac, 6);
                         } else {
                                 memmove(skb->data, src, skb->len);
                         }
@@ -162,13 +162,16 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
 
                         skb_put(newskb, init_wds ? skb->len + 6 : skb->len);
                         if (init_wds) {
-                                memcpy(newskb->data + 6, skb->data, skb->len);
-                                memcpy(newskb->data, wds_mac, 6);
+                                skb_copy_from_linear_data(skb,
+                                                          newskb->data + 6,
+                                                          skb->len);
+                                skb_copy_to_linear_data(newskb, wds_mac, 6);
 #ifdef ISLPCI_ETH_DEBUG
                                 printk("islpci_eth_transmit:wds_mac\n");
 #endif
                         } else
-                                memcpy(newskb->data, skb->data, skb->len);
+                                skb_copy_from_linear_data(skb, newskb->data,
+                                                          skb->len);
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
                         DEBUG(SHOW_TRACING, "memcpy %p %p %i wds %i\n",
@@ -303,7 +306,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb)
                 skb_pull(*skb, sizeof (struct rfmon_header));
 
         (*skb)->protocol = htons(ETH_P_802_2);
-        (*skb)->mac.raw = (*skb)->data;
+        skb_reset_mac_header(*skb);
         (*skb)->pkt_type = PACKET_OTHERHOST;
 
         return 0;
@@ -374,10 +377,6 @@ islpci_eth_receive(islpci_private *priv)
         DEBUG(SHOW_BUFFER_CONTENTS, "\nrx %p ", skb->data);
         display_buffer((char *) skb->data, skb->len);
 #endif
-
-        /* do some additional sk_buff and network layer parameters */
-        skb->dev = ndev;
-
         /* take care of monitor mode and spy monitoring. */
         if (unlikely(priv->iw_mode == IW_MODE_MONITOR))
                 discard = islpci_monitor_rx(priv, &skb);
@@ -398,8 +397,10 @@ islpci_eth_receive(islpci_private *priv)
                         /* Update spy records */
                         wireless_spy_update(ndev, annex->addr2, &wstats);
 
-                        memcpy(skb->data + sizeof (struct rfmon_header),
-                               skb->data, 2 * ETH_ALEN);
+                        skb_copy_from_linear_data(skb,
+                                                  (skb->data +
+                                                   sizeof(struct rfmon_header)),
+                                                  2 * ETH_ALEN);
                         skb_pull(skb, sizeof (struct rfmon_header));
                 }
                 skb->protocol = eth_type_trans(skb, ndev);
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 47b2ccb6a633..3be624295a1f 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -2232,7 +2232,6 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs, unsigned i
         return;
     }
     skb_reserve( skb, 2);   /* Align IP on 16 byte (TBD check this)*/
-    skb->dev = dev;
 
     DEBUG(4,"ray_cs rx_data total_len = %x, rx_len = %x\n",total_len,rx_len);
 
@@ -2243,7 +2242,8 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs, unsigned i
     rx_ptr += copy_from_rx_buff(local, rx_ptr, pkt_addr & RX_BUFF_END, rx_len);
     /* Get source address */
 #ifdef WIRELESS_SPY
-    memcpy(linksrcaddr, ((struct mac_header *)skb->data)->addr_2, ETH_ALEN);
+    skb_copy_from_linear_data_offset(skb, offsetof(struct mac_header, addr_2),
+                                     linksrcaddr, ETH_ALEN);
 #endif
     /* Now, deal with encapsulation/translation/sniffer */
     if (!sniffer) {
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index f5ce1c6063d8..2a299a0676a6 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -2009,7 +2009,7 @@ static void deliver_packet(struct strip *strip_info, STRIP_Header * header,
                        packetlen);
                 skb->dev = get_strip_dev(strip_info);
                 skb->protocol = header->protocol;
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
 
                 /* Having put a fake header on the front of the sk_buff for the */
                 /* benefit of tools like tcpdump, skb_pull now 'consumes' that  */
diff --git a/drivers/net/wireless/wavelan.c b/drivers/net/wireless/wavelan.c
index 2aa3c761dd83..1cf090d60edc 100644
--- a/drivers/net/wireless/wavelan.c
+++ b/drivers/net/wireless/wavelan.c
@@ -2512,14 +2512,13 @@ wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
                 return;
         }
 
-        skb->dev = dev;
-
         /* Copy the packet to the buffer. */
         obram_read(ioaddr, buf_off, skb_put(skb, sksize), sksize);
         skb->protocol = eth_type_trans(skb, dev);
 
 #ifdef DEBUG_RX_INFO
-        wv_packet_info(skb->mac.raw, sksize, dev->name, "wv_packet_read");
+        wv_packet_info(skb_mac_header(skb), sksize, dev->name,
+                       "wv_packet_read");
 #endif                          /* DEBUG_RX_INFO */
 
         /* Statistics-gathering and associated stuff.
@@ -2555,7 +2554,7 @@ wv_packet_read(struct net_device * dev, u16 buf_off, int sksize)
 
                 /* Spying stuff */
 #ifdef IW_WIRELESS_SPY
-                wl_spy_gather(dev, skb->mac.raw + WAVELAN_ADDR_SIZE,
+                wl_spy_gather(dev, skb_mac_header(skb) + WAVELAN_ADDR_SIZE,
                               stats);
 #endif /* IW_WIRELESS_SPY */
 #ifdef HISTOGRAM
@@ -2939,7 +2938,7 @@ static int wavelan_packet_xmit(struct sk_buff *skb, struct net_device * dev)
          * need to pad. Jean II */
         if (skb->len < ETH_ZLEN) {
                 memset(data, 0, ETH_ZLEN);
-                memcpy(data, skb->data, skb->len);
+                skb_copy_from_linear_data(skb, data, skb->len);
                 /* Write packet on the card */
                 if(wv_packet_write(dev, data, ETH_ZLEN))
                         return 1;       /* We failed */
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
index b04239792f63..67b867f837ca 100644
--- a/drivers/net/wireless/wavelan_cs.c
+++ b/drivers/net/wireless/wavelan_cs.c
@@ -2884,14 +2884,12 @@ wv_packet_read(struct net_device *		dev,
       return;
     }
 
-  skb->dev = dev;
-
   skb_reserve(skb, 2);
   fd_p = read_ringbuf(dev, fd_p, (char *) skb_put(skb, sksize), sksize);
   skb->protocol = eth_type_trans(skb, dev);
 
 #ifdef DEBUG_RX_INFO
-  wv_packet_info(skb->mac.raw, sksize, dev->name, "wv_packet_read");
+  wv_packet_info(skb_mac_header(skb), sksize, dev->name, "wv_packet_read");
 #endif  /* DEBUG_RX_INFO */
      
   /* Statistics gathering & stuff associated.
@@ -2925,7 +2923,7 @@ wv_packet_read(struct net_device *		dev,
 #endif  /* WAVELAN_ROAMING */
           
 #ifdef WIRELESS_SPY
-      wl_spy_gather(dev, skb->mac.raw + WAVELAN_ADDR_SIZE, stats);
+      wl_spy_gather(dev, skb_mac_header(skb) + WAVELAN_ADDR_SIZE, stats);
 #endif  /* WIRELESS_SPY */
 #ifdef HISTOGRAM
       wl_his_gather(dev, stats);
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 6cb66a356c96..935b144d9b56 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -327,7 +327,6 @@ static void zd1201_usbrx(struct urb *urb)
                         memcpy(skb_put(skb, 6), &data[datalen-8], 6);
                         memcpy(skb_put(skb, 2), &data[datalen-24], 2);
                         memcpy(skb_put(skb, len), data, len);
-                        skb->dev = zd->dev;
                         skb->dev->last_rx = jiffies;
                         skb->protocol = eth_type_trans(skb, zd->dev);
                         zd->stats.rx_packets++;
@@ -385,7 +384,6 @@ static void zd1201_usbrx(struct urb *urb)
                         memcpy(skb_put(skb, 2), &data[6], 2);
                         memcpy(skb_put(skb, len), data+8, len);
                 }
-                skb->dev = zd->dev;
                 skb->dev->last_rx = jiffies;
                 skb->protocol = eth_type_trans(skb, zd->dev);
                 zd->stats.rx_packets++;
@@ -809,10 +807,10 @@ static int zd1201_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         txbuf[4] = 0x00;
         txbuf[5] = 0x00;
 
-        memcpy(txbuf+6, skb->data+12, skb->len-12);
+        skb_copy_from_linear_data_offset(skb, 12, txbuf + 6, skb->len - 12);
         if (pad)
                 txbuf[skb->len-12+6]=0;
-        memcpy(txbuf+skb->len-12+6+pad, skb->data, 12);
+        skb_copy_from_linear_data(skb, txbuf + skb->len - 12 + 6 + pad, 12);
         *(__be16*)&txbuf[skb->len+6+pad] = htons(skb->len-12+6);
         txbuf[txbuflen-1] = 0;
 
diff --git a/drivers/net/wireless/zd1211rw/Kconfig b/drivers/net/wireless/zd1211rw/Kconfig
index 66ed55bc5460..d1ab24a95630 100644
--- a/drivers/net/wireless/zd1211rw/Kconfig
+++ b/drivers/net/wireless/zd1211rw/Kconfig
@@ -1,6 +1,7 @@
 config ZD1211RW
         tristate "ZyDAS ZD1211/ZD1211B USB-wireless support"
-        depends on USB && IEEE80211 && IEEE80211_SOFTMAC && NET_RADIO && EXPERIMENTAL
+        depends on USB && IEEE80211_SOFTMAC && WLAN_80211 && EXPERIMENTAL
+        select WIRELESS_EXT
         select FW_LOADER
         ---help---
           This is an experimental driver for the ZyDAS ZD1211/ZD1211B wireless
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index aac8a1c5ba08..edaaad2f648b 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -62,6 +62,7 @@ static struct usb_device_id usb_ids[] = {
         { USB_DEVICE(0x0471, 0x1236), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x13b1, 0x0024), .driver_info = DEVICE_ZD1211B },
         { USB_DEVICE(0x0586, 0x340f), .driver_info = DEVICE_ZD1211B },
+        { USB_DEVICE(0x0baf, 0x0121), .driver_info = DEVICE_ZD1211B },
         /* "Driverless" devices that need ejecting */
         { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER },
         {}
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index 2412ce4917f2..3f4a7cf9efea 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -1137,7 +1137,6 @@ static int yellowfin_rx(struct net_device *dev)
                                 skb = dev_alloc_skb(pkt_len + 2);
                                 if (skb == NULL)
                                         break;
-                                skb->dev = dev;
                                 skb_reserve(skb, 2);    /* 16 byte align the IP header */
                                 eth_copy_and_sum(skb, rx_skb->data, pkt_len, 0);
                                 skb_put(skb, pkt_len);
diff --git a/drivers/net/znet.c b/drivers/net/znet.c
index b24b0727108c..4032e9f6f9b0 100644
--- a/drivers/net/znet.c
+++ b/drivers/net/znet.c
@@ -774,7 +774,6 @@ static void znet_rx(struct net_device *dev)
                                 znet->stats.rx_dropped++;
                                 break;
                         }
-                        skb->dev = dev;
 
                         if (&znet->rx_cur[(pkt_len+1)>>1] > znet->rx_end) {
                                 int semi_cnt = (znet->rx_end - znet->rx_cur)<<1;
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index d190c05d87ed..453e6829756c 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -372,9 +372,9 @@ static __inline__ int led_get_net_activity(void)
                 continue;
             if (LOOPBACK(in_dev->ifa_list->ifa_local))
                 continue;
-            if (!dev->get_stats) 
-                continue;
             stats = dev->get_stats(dev);
+            if (!stats)
+                continue;
             rx_total += stats->rx_packets;
             tx_total += stats->tx_packets;
         }
diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c
index 9793533276ec..400bb90084cf 100644
--- a/drivers/parport/parport_sunbpp.c
+++ b/drivers/parport/parport_sunbpp.c
@@ -126,7 +126,7 @@ static unsigned char status_sunbpp_to_pc(struct parport *p)
         if (!(value_tcr & P_TCR_BUSY))
                 bits |= PARPORT_STATUS_BUSY;
 
-        dprintk((KERN_DEBUG "tcr 0x%x ir 0x%x\n", regs->p_tcr, regs->p_ir));
+        dprintk((KERN_DEBUG "tcr 0x%x ir 0x%x\n", value_tcr, value_ir));
         dprintk((KERN_DEBUG "read status 0x%x\n", bits));
         return bits;
 }
@@ -147,7 +147,7 @@ static unsigned char control_sunbpp_to_pc(struct parport *p)
         if (value_or & P_OR_SLCT_IN)
                 bits |= PARPORT_CONTROL_SELECT;
 
-        dprintk((KERN_DEBUG "tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "tcr 0x%x or 0x%x\n", value_tcr, value_or));
         dprintk((KERN_DEBUG "read control 0x%x\n", bits));
         return bits;
 }
@@ -165,7 +165,8 @@ static unsigned char parport_sunbpp_frob_control(struct parport *p,
         unsigned char value_tcr = sbus_readb(&regs->p_tcr);
         unsigned char value_or = sbus_readb(&regs->p_or);
 
-        dprintk((KERN_DEBUG "frob1: tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "frob1: tcr 0x%x or 0x%x\n",
+                 value_tcr, value_or));
         if (mask & PARPORT_CONTROL_STROBE) {
                 if (val & PARPORT_CONTROL_STROBE) {
                         value_tcr &= ~P_TCR_DS;
@@ -197,7 +198,8 @@ static unsigned char parport_sunbpp_frob_control(struct parport *p,
 
         sbus_writeb(value_or, &regs->p_or);
         sbus_writeb(value_tcr, &regs->p_tcr);
-        dprintk((KERN_DEBUG "frob2: tcr 0x%x or 0x%x\n", regs->p_tcr, regs->p_or));
+        dprintk((KERN_DEBUG "frob2: tcr 0x%x or 0x%x\n",
+                 value_tcr, value_or));
         return parport_sunbpp_read_control(p);
 }
 
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index a4a96826d9e0..2fe1d690eb13 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -682,34 +682,7 @@ static void pci_read_irq(struct pci_dev *dev)
         dev->irq = irq;
 }
 
-static void change_legacy_io_resource(struct pci_dev * dev, unsigned index,
-                                      unsigned start, unsigned end)
-{
-        unsigned base = start & PCI_BASE_ADDRESS_IO_MASK;
-        unsigned len = (end | ~PCI_BASE_ADDRESS_IO_MASK) - base + 1;
-
-        /*
-         * Some X versions get confused when the BARs reported through
-         * /sys or /proc differ from those seen in config space, thus
-         * try to update the config space values, too.
-         */
-        if (!(pci_resource_flags(dev, index) & IORESOURCE_IO))
-                printk(KERN_WARNING "%s: cannot adjust BAR%u (not I/O)\n",
-                       pci_name(dev), index);
-        else if (pci_resource_len(dev, index) != len)
-                printk(KERN_WARNING "%s: cannot adjust BAR%u (size %04X)\n",
-                       pci_name(dev), index, (unsigned)pci_resource_len(dev, index));
-        else {
-                printk(KERN_INFO "%s: trying to change BAR%u from %04X to %04X\n",
-                       pci_name(dev), index,
-                       (unsigned)pci_resource_start(dev, index), base);
-                pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + index * 4, base);
-        }
-        pci_resource_start(dev, index) = start;
-        pci_resource_end(dev, index)   = end;
-        pci_resource_flags(dev, index) =
-                IORESOURCE_IO | IORESOURCE_PCI_FIXED | PCI_BASE_ADDRESS_SPACE_IO;
-}
+#define LEGACY_IO_RESOURCE      (IORESOURCE_IO | IORESOURCE_PCI_FIXED)
 
 /**
  * pci_setup_device - fill in class and map information of a device
@@ -762,12 +735,20 @@ static int pci_setup_device(struct pci_dev * dev)
                         u8 progif;
                         pci_read_config_byte(dev, PCI_CLASS_PROG, &progif);
                         if ((progif & 1) == 0) {
-                                change_legacy_io_resource(dev, 0, 0x1F0, 0x1F7);
-                                change_legacy_io_resource(dev, 1, 0x3F6, 0x3F6);
+                                dev->resource[0].start = 0x1F0;
+                                dev->resource[0].end = 0x1F7;
+                                dev->resource[0].flags = LEGACY_IO_RESOURCE;
+                                dev->resource[1].start = 0x3F6;
+                                dev->resource[1].end = 0x3F6;
+                                dev->resource[1].flags = LEGACY_IO_RESOURCE;
                         }
                         if ((progif & 4) == 0) {
-                                change_legacy_io_resource(dev, 2, 0x170, 0x177);
-                                change_legacy_io_resource(dev, 3, 0x376, 0x376);
+                                dev->resource[2].start = 0x170;
+                                dev->resource[2].end = 0x177;
+                                dev->resource[2].flags = LEGACY_IO_RESOURCE;
+                                dev->resource[3].start = 0x376;
+                                dev->resource[3].end = 0x376;
+                                dev->resource[3].flags = LEGACY_IO_RESOURCE;
                         }
                 }
                 break;
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index eb5dc62f0d9c..e71929db8b06 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -398,6 +398,9 @@ dasd_change_state(struct dasd_device *device)
 
         if (device->state == device->target)
                 wake_up(&dasd_init_waitq);
+
+        /* let user-space know that the device status changed */
+        kobject_uevent(&device->cdev->dev.kobj, KOBJ_CHANGE);
 }
 
 /*
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index ed70852cc915..6a89cefe99bb 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -19,6 +19,7 @@
 
 #include <asm/debug.h>
 #include <asm/uaccess.h>
+#include <asm/ipl.h>
 
 /* This is ugly... */
 #define PRINTK_HEADER "dasd_devmap:"
@@ -133,6 +134,8 @@ dasd_call_setup(char *str)
 __setup ("dasd=", dasd_call_setup);
 #endif  /* #ifndef MODULE */
 
+#define DASD_IPLDEV     "ipldev"
+
 /*
  * Read a device busid/devno from a string.
  */
@@ -141,6 +144,20 @@ dasd_busid(char **str, int *id0, int *id1, int *devno)
 {
         int val, old_style;
 
+        /* Interpret ipldev busid */
+        if (strncmp(DASD_IPLDEV, *str, strlen(DASD_IPLDEV)) == 0) {
+                if (ipl_info.type != IPL_TYPE_CCW) {
+                        MESSAGE(KERN_ERR, "%s", "ipl device is not a ccw "
+                                "device");
+                        return -EINVAL;
+                }
+                *id0 = 0;
+                *id1 = ipl_info.data.ccw.dev_id.ssid;
+                *devno = ipl_info.data.ccw.dev_id.devno;
+                *str += strlen(DASD_IPLDEV);
+
+                return 0;
+        }
         /* check for leading '0x' */
         old_style = 0;
         if ((*str)[0] == '0' && (*str)[1] == 'x') {
@@ -829,6 +846,46 @@ dasd_discipline_show(struct device *dev, struct device_attribute *attr,
 static DEVICE_ATTR(discipline, 0444, dasd_discipline_show, NULL);
 
 static ssize_t
+dasd_device_status_show(struct device *dev, struct device_attribute *attr,
+                     char *buf)
+{
+        struct dasd_device *device;
+        ssize_t len;
+
+        device = dasd_device_from_cdev(to_ccwdev(dev));
+        if (!IS_ERR(device)) {
+                switch (device->state) {
+                case DASD_STATE_NEW:
+                        len = snprintf(buf, PAGE_SIZE, "new\n");
+                        break;
+                case DASD_STATE_KNOWN:
+                        len = snprintf(buf, PAGE_SIZE, "detected\n");
+                        break;
+                case DASD_STATE_BASIC:
+                        len = snprintf(buf, PAGE_SIZE, "basic\n");
+                        break;
+                case DASD_STATE_UNFMT:
+                        len = snprintf(buf, PAGE_SIZE, "unformatted\n");
+                        break;
+                case DASD_STATE_READY:
+                        len = snprintf(buf, PAGE_SIZE, "ready\n");
+                        break;
+                case DASD_STATE_ONLINE:
+                        len = snprintf(buf, PAGE_SIZE, "online\n");
+                        break;
+                default:
+                        len = snprintf(buf, PAGE_SIZE, "no stat\n");
+                        break;
+                }
+                dasd_put_device(device);
+        } else
+                len = snprintf(buf, PAGE_SIZE, "unknown\n");
+        return len;
+}
+
+static DEVICE_ATTR(status, 0444, dasd_device_status_show, NULL);
+
+static ssize_t
 dasd_alias_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct dasd_devmap *devmap;
@@ -939,6 +996,7 @@ static DEVICE_ATTR(eer_enabled, 0644, dasd_eer_show, dasd_eer_store);
 static struct attribute * dasd_attrs[] = {
         &dev_attr_readonly.attr,
         &dev_attr_discipline.attr,
+        &dev_attr_status.attr,
         &dev_attr_alias.attr,
         &dev_attr_vendor.attr,
         &dev_attr_uid.attr,
diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
index 293e667b50f2..c210784bdf46 100644
--- a/drivers/s390/char/Makefile
+++ b/drivers/s390/char/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-y += ctrlchar.o keyboard.o defkeymap.o sclp.o sclp_rw.o sclp_quiesce.o \
-         sclp_info.o
+         sclp_info.o sclp_config.o sclp_chp.o
 
 obj-$(CONFIG_TN3270) += raw3270.o
 obj-$(CONFIG_TN3270_CONSOLE) += con3270.o
@@ -29,3 +29,6 @@ obj-$(CONFIG_S390_TAPE_34XX) += tape_34xx.o
 obj-$(CONFIG_S390_TAPE_3590) += tape_3590.o
 obj-$(CONFIG_MONREADER) += monreader.o
 obj-$(CONFIG_MONWRITER) += monwriter.o
+
+zcore_mod-objs := sclp_sdias.o zcore.o
+obj-$(CONFIG_ZFCPDUMP) += zcore_mod.o
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 9a328f14a641..6000bdee4082 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -813,12 +813,6 @@ con3215_unblank(void)
         spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags);
 }
 
-static int __init 
-con3215_consetup(struct console *co, char *options)
-{
-        return 0;
-}
-
 /*
  *  The console structure for the 3215 console
  */
@@ -827,7 +821,6 @@ static struct console con3215 = {
         .write   = con3215_write,
         .device  = con3215_device,
         .unblank = con3215_unblank,
-        .setup   = con3215_consetup,
         .flags   = CON_PRINTBUFFER,
 };
 
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index 8e7f2d7633d6..fd3479119eb4 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -555,12 +555,6 @@ con3270_unblank(void)
         spin_unlock_irqrestore(&cp->view.lock, flags);
 }
 
-static int __init 
-con3270_consetup(struct console *co, char *options)
-{
-        return 0;
-}
-
 /*
  *  The console structure for the 3270 console
  */
@@ -569,7 +563,6 @@ static struct console con3270 = {
         .write   = con3270_write,
         .device  = con3270_device,
         .unblank = con3270_unblank,
-        .setup   = con3270_consetup,
         .flags   = CON_PRINTBUFFER,
 };
 
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index f171de3b0b11..fa62e6944057 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -15,6 +15,7 @@
 #include <linux/timer.h>
 #include <linux/reboot.h>
 #include <linux/jiffies.h>
+#include <linux/init.h>
 #include <asm/types.h>
 #include <asm/s390_ext.h>
 
@@ -510,7 +511,7 @@ sclp_state_change_cb(struct evbuf_header *evbuf)
 }
 
 static struct sclp_register sclp_state_change_event = {
-        .receive_mask = EvTyp_StateChange_Mask,
+        .receive_mask = EVTYP_STATECHANGE_MASK,
         .receiver_fn = sclp_state_change_cb
 };
 
@@ -930,3 +931,10 @@ sclp_init(void)
         sclp_init_mask(1);
         return 0;
 }
+
+static __init int sclp_initcall(void)
+{
+        return sclp_init();
+}
+
+arch_initcall(sclp_initcall);
diff --git a/drivers/s390/char/sclp.h b/drivers/s390/char/sclp.h
index 7d29ab45a6ed..87ac4a3ad49d 100644
--- a/drivers/s390/char/sclp.h
+++ b/drivers/s390/char/sclp.h
@@ -19,33 +19,37 @@
 #define MAX_KMEM_PAGES (sizeof(unsigned long) << 3)
 #define MAX_CONSOLE_PAGES       4
 
-#define EvTyp_OpCmd             0x01
-#define EvTyp_Msg               0x02
-#define EvTyp_StateChange       0x08
-#define EvTyp_PMsgCmd           0x09
-#define EvTyp_CntlProgOpCmd     0x20
-#define EvTyp_CntlProgIdent     0x0B
-#define EvTyp_SigQuiesce        0x1D
-#define EvTyp_VT220Msg          0x1A
-
-#define EvTyp_OpCmd_Mask        0x80000000
-#define EvTyp_Msg_Mask          0x40000000
-#define EvTyp_StateChange_Mask  0x01000000
-#define EvTyp_PMsgCmd_Mask      0x00800000
-#define EvTyp_CtlProgOpCmd_Mask 0x00000001
-#define EvTyp_CtlProgIdent_Mask 0x00200000
-#define EvTyp_SigQuiesce_Mask   0x00000008
-#define EvTyp_VT220Msg_Mask     0x00000040
-
-#define GnrlMsgFlgs_DOM         0x8000
-#define GnrlMsgFlgs_SndAlrm     0x4000
-#define GnrlMsgFlgs_HoldMsg     0x2000
-
-#define LnTpFlgs_CntlText       0x8000
-#define LnTpFlgs_LabelText      0x4000
-#define LnTpFlgs_DataText       0x2000
-#define LnTpFlgs_EndText        0x1000
-#define LnTpFlgs_PromptText     0x0800
+#define EVTYP_OPCMD             0x01
+#define EVTYP_MSG               0x02
+#define EVTYP_STATECHANGE       0x08
+#define EVTYP_PMSGCMD           0x09
+#define EVTYP_CNTLPROGOPCMD     0x20
+#define EVTYP_CNTLPROGIDENT     0x0B
+#define EVTYP_SIGQUIESCE        0x1D
+#define EVTYP_VT220MSG          0x1A
+#define EVTYP_CONFMGMDATA       0x04
+#define EVTYP_SDIAS             0x1C
+
+#define EVTYP_OPCMD_MASK        0x80000000
+#define EVTYP_MSG_MASK          0x40000000
+#define EVTYP_STATECHANGE_MASK  0x01000000
+#define EVTYP_PMSGCMD_MASK      0x00800000
+#define EVTYP_CTLPROGOPCMD_MASK 0x00000001
+#define EVTYP_CTLPROGIDENT_MASK 0x00200000
+#define EVTYP_SIGQUIESCE_MASK   0x00000008
+#define EVTYP_VT220MSG_MASK     0x00000040
+#define EVTYP_CONFMGMDATA_MASK  0x10000000
+#define EVTYP_SDIAS_MASK        0x00000010
+
+#define GNRLMSGFLGS_DOM         0x8000
+#define GNRLMSGFLGS_SNDALRM     0x4000
+#define GNRLMSGFLGS_HOLDMSG     0x2000
+
+#define LNTPFLGS_CNTLTEXT       0x8000
+#define LNTPFLGS_LABELTEXT      0x4000
+#define LNTPFLGS_DATATEXT       0x2000
+#define LNTPFLGS_ENDTEXT        0x1000
+#define LNTPFLGS_PROMPTTEXT     0x0800
 
 typedef unsigned int sclp_cmdw_t;
 
@@ -56,15 +60,15 @@ typedef unsigned int sclp_cmdw_t;
 #define SCLP_CMDW_READ_SCP_INFO_FORCED  0x00120001
 
 #define GDS_ID_MDSMU            0x1310
-#define GDS_ID_MDSRouteInfo     0x1311
-#define GDS_ID_AgUnWrkCorr      0x1549
-#define GDS_ID_SNACondReport    0x1532
+#define GDS_ID_MDSROUTEINFO     0x1311
+#define GDS_ID_AGUNWRKCORR      0x1549
+#define GDS_ID_SNACONDREPORT    0x1532
 #define GDS_ID_CPMSU            0x1212
-#define GDS_ID_RoutTargInstr    0x154D
-#define GDS_ID_OpReq            0x8070
-#define GDS_ID_TextCmd          0x1320
+#define GDS_ID_ROUTTARGINSTR    0x154D
+#define GDS_ID_OPREQ            0x8070
+#define GDS_ID_TEXTCMD          0x1320
 
-#define GDS_KEY_SelfDefTextMsg  0x31
+#define GDS_KEY_SELFDEFTEXTMSG  0x31
 
 typedef u32 sccb_mask_t;        /* ATTENTION: assumes 32bit mask !!! */
 
diff --git a/drivers/s390/char/sclp_chp.c b/drivers/s390/char/sclp_chp.c
new file mode 100644
index 000000000000..a66b914519b5
--- /dev/null
+++ b/drivers/s390/char/sclp_chp.c
@@ -0,0 +1,196 @@
+/*
+ *  drivers/s390/char/sclp_chp.c
+ *
+ *    Copyright IBM Corp. 2007
+ *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#include <linux/types.h>
+#include <linux/gfp.h>
+#include <linux/errno.h>
+#include <linux/completion.h>
+#include <asm/sclp.h>
+#include <asm/chpid.h>
+
+#include "sclp.h"
+
+#define TAG     "sclp_chp: "
+
+#define SCLP_CMDW_CONFIGURE_CHANNEL_PATH        0x000f0001
+#define SCLP_CMDW_DECONFIGURE_CHANNEL_PATH      0x000e0001
+#define SCLP_CMDW_READ_CHANNEL_PATH_INFORMATION 0x00030001
+
+static inline sclp_cmdw_t get_configure_cmdw(struct chp_id chpid)
+{
+        return SCLP_CMDW_CONFIGURE_CHANNEL_PATH | chpid.id << 8;
+}
+
+static inline sclp_cmdw_t get_deconfigure_cmdw(struct chp_id chpid)
+{
+        return SCLP_CMDW_DECONFIGURE_CHANNEL_PATH | chpid.id << 8;
+}
+
+static void chp_callback(struct sclp_req *req, void *data)
+{
+        struct completion *completion = data;
+
+        complete(completion);
+}
+
+struct chp_cfg_sccb {
+        struct sccb_header header;
+        u8 ccm;
+        u8 reserved[6];
+        u8 cssid;
+} __attribute__((packed));
+
+struct chp_cfg_data {
+        struct chp_cfg_sccb sccb;
+        struct sclp_req req;
+        struct completion completion;
+} __attribute__((packed));
+
+static int do_configure(sclp_cmdw_t cmd)
+{
+        struct chp_cfg_data *data;
+        int rc;
+
+        /* Prepare sccb. */
+        data = (struct chp_cfg_data *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        if (!data)
+                return -ENOMEM;
+        data->sccb.header.length = sizeof(struct chp_cfg_sccb);
+        data->req.command = cmd;
+        data->req.sccb = &(data->sccb);
+        data->req.status = SCLP_REQ_FILLED;
+        data->req.callback = chp_callback;
+        data->req.callback_data = &(data->completion);
+        init_completion(&data->completion);
+
+        /* Perform sclp request. */
+        rc = sclp_add_request(&(data->req));
+        if (rc)
+                goto out;
+        wait_for_completion(&data->completion);
+
+        /* Check response .*/
+        if (data->req.status != SCLP_REQ_DONE) {
+                printk(KERN_WARNING TAG "configure channel-path request failed "
+                       "(status=0x%02x)\n", data->req.status);
+                rc = -EIO;
+                goto out;
+        }
+        switch (data->sccb.header.response_code) {
+        case 0x0020:
+        case 0x0120:
+        case 0x0440:
+        case 0x0450:
+                break;
+        default:
+                printk(KERN_WARNING TAG "configure channel-path failed "
+                       "(cmd=0x%08x, response=0x%04x)\n", cmd,
+                       data->sccb.header.response_code);
+                rc = -EIO;
+                break;
+        }
+out:
+        free_page((unsigned long) data);
+
+        return rc;
+}
+
+/**
+ * sclp_chp_configure - perform configure channel-path sclp command
+ * @chpid: channel-path ID
+ *
+ * Perform configure channel-path command sclp command for specified chpid.
+ * Return 0 after command successfully finished, non-zero otherwise.
+ */
+int sclp_chp_configure(struct chp_id chpid)
+{
+        return do_configure(get_configure_cmdw(chpid));
+}
+
+/**
+ * sclp_chp_deconfigure - perform deconfigure channel-path sclp command
+ * @chpid: channel-path ID
+ *
+ * Perform deconfigure channel-path command sclp command for specified chpid
+ * and wait for completion. On success return 0. Return non-zero otherwise.
+ */
+int sclp_chp_deconfigure(struct chp_id chpid)
+{
+        return do_configure(get_deconfigure_cmdw(chpid));
+}
+
+struct chp_info_sccb {
+        struct sccb_header header;
+        u8 recognized[SCLP_CHP_INFO_MASK_SIZE];
+        u8 standby[SCLP_CHP_INFO_MASK_SIZE];
+        u8 configured[SCLP_CHP_INFO_MASK_SIZE];
+        u8 ccm;
+        u8 reserved[6];
+        u8 cssid;
+} __attribute__((packed));
+
+struct chp_info_data {
+        struct chp_info_sccb sccb;
+        struct sclp_req req;
+        struct completion completion;
+} __attribute__((packed));
+
+/**
+ * sclp_chp_read_info - perform read channel-path information sclp command
+ * @info: resulting channel-path information data
+ *
+ * Perform read channel-path information sclp command and wait for completion.
+ * On success, store channel-path information in @info and return 0. Return
+ * non-zero otherwise.
+ */
+int sclp_chp_read_info(struct sclp_chp_info *info)
+{
+        struct chp_info_data *data;
+        int rc;
+
+        /* Prepare sccb. */
+        data = (struct chp_info_data *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        if (!data)
+                return -ENOMEM;
+        data->sccb.header.length = sizeof(struct chp_info_sccb);
+        data->req.command = SCLP_CMDW_READ_CHANNEL_PATH_INFORMATION;
+        data->req.sccb = &(data->sccb);
+        data->req.status = SCLP_REQ_FILLED;
+        data->req.callback = chp_callback;
+        data->req.callback_data = &(data->completion);
+        init_completion(&data->completion);
+
+        /* Perform sclp request. */
+        rc = sclp_add_request(&(data->req));
+        if (rc)
+                goto out;
+        wait_for_completion(&data->completion);
+
+        /* Check response .*/
+        if (data->req.status != SCLP_REQ_DONE) {
+                printk(KERN_WARNING TAG "read channel-path info request failed "
+                       "(status=0x%02x)\n", data->req.status);
+                rc = -EIO;
+                goto out;
+        }
+        if (data->sccb.header.response_code != 0x0010) {
+                printk(KERN_WARNING TAG "read channel-path info failed "
+                       "(response=0x%04x)\n", data->sccb.header.response_code);
+                rc = -EIO;
+                goto out;
+        }
+        memcpy(info->recognized, data->sccb.recognized,
+               SCLP_CHP_INFO_MASK_SIZE);
+        memcpy(info->standby, data->sccb.standby,
+               SCLP_CHP_INFO_MASK_SIZE);
+        memcpy(info->configured, data->sccb.configured,
+               SCLP_CHP_INFO_MASK_SIZE);
+out:
+        free_page((unsigned long) data);
+
+        return rc;
+}
diff --git a/drivers/s390/char/sclp_config.c b/drivers/s390/char/sclp_config.c
new file mode 100644
index 000000000000..5322e5e54a98
--- /dev/null
+++ b/drivers/s390/char/sclp_config.c
@@ -0,0 +1,75 @@
+/*
+ *  drivers/s390/char/sclp_config.c
+ *
+ *    Copyright IBM Corp. 2007
+ *    Author(s): Heiko Carstens <heiko.carstens@de.ibm.com>
+ */
+
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/cpu.h>
+#include <linux/sysdev.h>
+#include <linux/workqueue.h>
+#include "sclp.h"
+
+#define TAG     "sclp_config: "
+
+struct conf_mgm_data {
+        u8 reserved;
+        u8 ev_qualifier;
+} __attribute__((packed));
+
+#define EV_QUAL_CAP_CHANGE      3
+
+static struct work_struct sclp_cpu_capability_work;
+
+static void sclp_cpu_capability_notify(struct work_struct *work)
+{
+        int cpu;
+        struct sys_device *sysdev;
+
+        printk(KERN_WARNING TAG "cpu capability changed.\n");
+        lock_cpu_hotplug();
+        for_each_online_cpu(cpu) {
+                sysdev = get_cpu_sysdev(cpu);
+                kobject_uevent(&sysdev->kobj, KOBJ_CHANGE);
+        }
+        unlock_cpu_hotplug();
+}
+
+static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
+{
+        struct conf_mgm_data *cdata;
+
+        cdata = (struct conf_mgm_data *)(evbuf + 1);
+        if (cdata->ev_qualifier == EV_QUAL_CAP_CHANGE)
+                schedule_work(&sclp_cpu_capability_work);
+}
+
+static struct sclp_register sclp_conf_register =
+{
+        .receive_mask = EVTYP_CONFMGMDATA_MASK,
+        .receiver_fn  = sclp_conf_receiver_fn,
+};
+
+static int __init sclp_conf_init(void)
+{
+        int rc;
+
+        INIT_WORK(&sclp_cpu_capability_work, sclp_cpu_capability_notify);
+
+        rc = sclp_register(&sclp_conf_register);
+        if (rc) {
+                printk(KERN_ERR TAG "failed to register (%d).\n", rc);
+                return rc;
+        }
+
+        if (!(sclp_conf_register.sclp_receive_mask & EVTYP_CONFMGMDATA_MASK)) {
+                printk(KERN_WARNING TAG "no configuration management.\n");
+                sclp_unregister(&sclp_conf_register);
+                rc = -ENOSYS;
+        }
+        return rc;
+}
+
+__initcall(sclp_conf_init);
diff --git a/drivers/s390/char/sclp_cpi.c b/drivers/s390/char/sclp_cpi.c
index 65aa2c85737f..29fe2a5ec2fe 100644
--- a/drivers/s390/char/sclp_cpi.c
+++ b/drivers/s390/char/sclp_cpi.c
@@ -46,7 +46,7 @@ struct cpi_sccb {
 /* Event type structure for write message and write priority message */
 static struct sclp_register sclp_cpi_event =
 {
-        .send_mask = EvTyp_CtlProgIdent_Mask
+        .send_mask = EVTYP_CTLPROGIDENT_MASK
 };
 
 MODULE_LICENSE("GPL");
@@ -201,7 +201,7 @@ cpi_module_init(void)
                        "console.\n");
                 return -EINVAL;
         }
-        if (!(sclp_cpi_event.sclp_send_mask & EvTyp_CtlProgIdent_Mask)) {
+        if (!(sclp_cpi_event.sclp_send_mask & EVTYP_CTLPROGIDENT_MASK)) {
                 printk(KERN_WARNING "cpi: no control program identification "
                        "support\n");
                 sclp_unregister(&sclp_cpi_event);
diff --git a/drivers/s390/char/sclp_quiesce.c b/drivers/s390/char/sclp_quiesce.c
index baa8fe669ed2..45ff25e787cb 100644
--- a/drivers/s390/char/sclp_quiesce.c
+++ b/drivers/s390/char/sclp_quiesce.c
@@ -43,7 +43,7 @@ sclp_quiesce_handler(struct evbuf_header *evbuf)
 }
 
 static struct sclp_register sclp_quiesce_event = {
-        .receive_mask = EvTyp_SigQuiesce_Mask,
+        .receive_mask = EVTYP_SIGQUIESCE_MASK,
         .receiver_fn = sclp_quiesce_handler
 };
 
diff --git a/drivers/s390/char/sclp_rw.c b/drivers/s390/char/sclp_rw.c
index 2486783ea58e..bbd5b8b66f42 100644
--- a/drivers/s390/char/sclp_rw.c
+++ b/drivers/s390/char/sclp_rw.c
@@ -30,7 +30,7 @@
 
 /* Event type structure for write message and write priority message */
 static struct sclp_register sclp_rw_event = {
-        .send_mask = EvTyp_Msg_Mask | EvTyp_PMsgCmd_Mask
+        .send_mask = EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK
 };
 
 /*
@@ -64,7 +64,7 @@ sclp_make_buffer(void *page, unsigned short columns, unsigned short htab)
         memset(sccb, 0, sizeof(struct write_sccb));
         sccb->header.length = sizeof(struct write_sccb);
         sccb->msg_buf.header.length = sizeof(struct msg_buf);
-        sccb->msg_buf.header.type = EvTyp_Msg;
+        sccb->msg_buf.header.type = EVTYP_MSG;
         sccb->msg_buf.mdb.header.length = sizeof(struct mdb);
         sccb->msg_buf.mdb.header.type = 1;
         sccb->msg_buf.mdb.header.tag = 0xD4C4C240;      /* ebcdic "MDB " */
@@ -114,7 +114,7 @@ sclp_initialize_mto(struct sclp_buffer *buffer, int max_len)
         memset(mto, 0, sizeof(struct mto));
         mto->length = sizeof(struct mto);
         mto->type = 4;  /* message text object */
-        mto->line_type_flags = LnTpFlgs_EndText; /* end text */
+        mto->line_type_flags = LNTPFLGS_ENDTEXT; /* end text */
 
         /* set pointer to first byte after struct mto. */
         buffer->current_line = (char *) (mto + 1);
@@ -215,7 +215,7 @@ sclp_write(struct sclp_buffer *buffer, const unsigned char *msg, int count)
                 case '\a':      /* bell, one for several times  */
                         /* set SCLP sound alarm bit in General Object */
                         buffer->sccb->msg_buf.mdb.go.general_msg_flags |=
-                                GnrlMsgFlgs_SndAlrm;
+                                GNRLMSGFLGS_SNDALRM;
                         break;
                 case '\t':      /* horizontal tabulator  */
                         /* check if new mto needs to be created */
@@ -452,12 +452,12 @@ sclp_emit_buffer(struct sclp_buffer *buffer,
                 return -EIO;
 
         sccb = buffer->sccb;
-        if (sclp_rw_event.sclp_send_mask & EvTyp_Msg_Mask)
+        if (sclp_rw_event.sclp_send_mask & EVTYP_MSG_MASK)
                 /* Use normal write message */
-                sccb->msg_buf.header.type = EvTyp_Msg;
-        else if (sclp_rw_event.sclp_send_mask & EvTyp_PMsgCmd_Mask)
+                sccb->msg_buf.header.type = EVTYP_MSG;
+        else if (sclp_rw_event.sclp_send_mask & EVTYP_PMSGCMD_MASK)
                 /* Use write priority message */
-                sccb->msg_buf.header.type = EvTyp_PMsgCmd;
+                sccb->msg_buf.header.type = EVTYP_PMSGCMD;
         else
                 return -ENOSYS;
         buffer->request.command = SCLP_CMDW_WRITE_EVENT_DATA;
diff --git a/drivers/s390/char/sclp_sdias.c b/drivers/s390/char/sclp_sdias.c
new file mode 100644
index 000000000000..52283daddaef
--- /dev/null
+++ b/drivers/s390/char/sclp_sdias.c
@@ -0,0 +1,255 @@
+/*
+ * Sclp "store data in absolut storage"
+ *
+ * Copyright IBM Corp. 2003,2007
+ * Author(s): Michael Holzheu
+ */
+
+#include <linux/sched.h>
+#include <asm/sclp.h>
+#include <asm/debug.h>
+#include <asm/ipl.h>
+#include "sclp.h"
+#include "sclp_rw.h"
+
+#define TRACE(x...) debug_sprintf_event(sdias_dbf, 1, x)
+#define ERROR_MSG(x...) printk ( KERN_ALERT "SDIAS: " x )
+
+#define SDIAS_RETRIES 300
+#define SDIAS_SLEEP_TICKS 50
+
+#define EQ_STORE_DATA   0x0
+#define EQ_SIZE         0x1
+#define DI_FCP_DUMP     0x0
+#define ASA_SIZE_32     0x0
+#define ASA_SIZE_64     0x1
+#define EVSTATE_ALL_STORED      0x0
+#define EVSTATE_NO_DATA         0x3
+#define EVSTATE_PART_STORED     0x10
+
+static struct debug_info *sdias_dbf;
+
+static struct sclp_register sclp_sdias_register = {
+        .send_mask = EVTYP_SDIAS_MASK,
+};
+
+struct sdias_evbuf {
+        struct  evbuf_header hdr;
+        u8      event_qual;
+        u8      data_id;
+        u64     reserved2;
+        u32     event_id;
+        u16     reserved3;
+        u8      asa_size;
+        u8      event_status;
+        u32     reserved4;
+        u32     blk_cnt;
+        u64     asa;
+        u32     reserved5;
+        u32     fbn;
+        u32     reserved6;
+        u32     lbn;
+        u16     reserved7;
+        u16     dbs;
+} __attribute__((packed));
+
+struct sdias_sccb {
+        struct sccb_header  hdr;
+        struct sdias_evbuf  evbuf;
+} __attribute__((packed));
+
+static struct sdias_sccb sccb __attribute__((aligned(4096)));
+
+static int sclp_req_done;
+static wait_queue_head_t sdias_wq;
+static DEFINE_MUTEX(sdias_mutex);
+
+static void sdias_callback(struct sclp_req *request, void *data)
+{
+        struct sdias_sccb *sccb;
+
+        sccb = (struct sdias_sccb *) request->sccb;
+        sclp_req_done = 1;
+        wake_up(&sdias_wq); /* Inform caller, that request is complete */
+        TRACE("callback done\n");
+}
+
+static int sdias_sclp_send(struct sclp_req *req)
+{
+        int retries;
+        int rc;
+
+        for (retries = SDIAS_RETRIES; retries; retries--) {
+                sclp_req_done = 0;
+                TRACE("add request\n");
+                rc = sclp_add_request(req);
+                if (rc) {
+                        /* not initiated, wait some time and retry */
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        TRACE("add request failed: rc = %i\n",rc);
+                        schedule_timeout(SDIAS_SLEEP_TICKS);
+                        continue;
+                }
+                /* initiated, wait for completion of service call */
+                wait_event(sdias_wq, (sclp_req_done == 1));
+                if (req->status == SCLP_REQ_FAILED) {
+                        TRACE("sclp request failed\n");
+                        rc = -EIO;
+                        continue;
+                }
+                TRACE("request done\n");
+                break;
+        }
+        return rc;
+}
+
+/*
+ * Get number of blocks (4K) available in the HSA
+ */
+int sclp_sdias_blk_count(void)
+{
+        struct sclp_req request;
+        int rc;
+
+        mutex_lock(&sdias_mutex);
+
+        memset(&sccb, 0, sizeof(sccb));
+        memset(&request, 0, sizeof(request));
+
+        sccb.hdr.length = sizeof(sccb);
+        sccb.evbuf.hdr.length = sizeof(struct sdias_evbuf);
+        sccb.evbuf.hdr.type = EVTYP_SDIAS;
+        sccb.evbuf.event_qual = EQ_SIZE;
+        sccb.evbuf.data_id = DI_FCP_DUMP;
+        sccb.evbuf.event_id = 4712;
+        sccb.evbuf.dbs = 1;
+
+        request.sccb = &sccb;
+        request.command = SCLP_CMDW_WRITE_EVENT_DATA;
+        request.status = SCLP_REQ_FILLED;
+        request.callback = sdias_callback;
+
+        rc = sdias_sclp_send(&request);
+        if (rc) {
+                ERROR_MSG("sclp_send failed for get_nr_blocks\n");
+                goto out;
+        }
+        if (sccb.hdr.response_code != 0x0020) {
+                TRACE("send failed: %x\n", sccb.hdr.response_code);
+                rc = -EIO;
+                goto out;
+        }
+
+        switch (sccb.evbuf.event_status) {
+                case 0:
+                        rc = sccb.evbuf.blk_cnt;
+                        break;
+                default:
+                        ERROR_MSG("SCLP error: %x\n", sccb.evbuf.event_status);
+                        rc = -EIO;
+                        goto out;
+        }
+        TRACE("%i blocks\n", rc);
+out:
+        mutex_unlock(&sdias_mutex);
+        return rc;
+}
+
+/*
+ * Copy from HSA to absolute storage (not reentrant):
+ *
+ * @dest     : Address of buffer where data should be copied
+ * @start_blk: Start Block (beginning with 1)
+ * @nr_blks  : Number of 4K blocks to copy
+ *
+ * Return Value: 0 : Requested 'number' of blocks of data copied
+ *               <0: ERROR - negative event status
+ */
+int sclp_sdias_copy(void *dest, int start_blk, int nr_blks)
+{
+        struct sclp_req request;
+        int rc;
+
+        mutex_lock(&sdias_mutex);
+
+        memset(&sccb, 0, sizeof(sccb));
+        memset(&request, 0, sizeof(request));
+
+        sccb.hdr.length = sizeof(sccb);
+        sccb.evbuf.hdr.length = sizeof(struct sdias_evbuf);
+        sccb.evbuf.hdr.type = EVTYP_SDIAS;
+        sccb.evbuf.hdr.flags = 0;
+        sccb.evbuf.event_qual = EQ_STORE_DATA;
+        sccb.evbuf.data_id = DI_FCP_DUMP;
+        sccb.evbuf.event_id = 4712;
+#ifdef __s390x__
+        sccb.evbuf.asa_size = ASA_SIZE_64;
+#else
+        sccb.evbuf.asa_size = ASA_SIZE_32;
+#endif
+        sccb.evbuf.event_status = 0;
+        sccb.evbuf.blk_cnt = nr_blks;
+        sccb.evbuf.asa = (unsigned long)dest;
+        sccb.evbuf.fbn = start_blk;
+        sccb.evbuf.lbn = 0;
+        sccb.evbuf.dbs = 1;
+
+        request.sccb     = &sccb;
+        request.command  = SCLP_CMDW_WRITE_EVENT_DATA;
+        request.status   = SCLP_REQ_FILLED;
+        request.callback = sdias_callback;
+
+        rc = sdias_sclp_send(&request);
+        if (rc) {
+                ERROR_MSG("sclp_send failed: %x\n", rc);
+                goto out;
+        }
+        if (sccb.hdr.response_code != 0x0020) {
+                TRACE("copy failed: %x\n", sccb.hdr.response_code);
+                rc = -EIO;
+                goto out;
+        }
+
+        switch (sccb.evbuf.event_status) {
+                case EVSTATE_ALL_STORED:
+                        TRACE("all stored\n");
+                case EVSTATE_PART_STORED:
+                        TRACE("part stored: %i\n", sccb.evbuf.blk_cnt);
+                        break;
+                case EVSTATE_NO_DATA:
+                        TRACE("no data\n");
+                default:
+                        ERROR_MSG("Error from SCLP while copying hsa. "
+                                  "Event status = %x\n",
+                                sccb.evbuf.event_status);
+                        rc = -EIO;
+        }
+out:
+        mutex_unlock(&sdias_mutex);
+        return rc;
+}
+
+int __init sdias_init(void)
+{
+        int rc;
+
+        if (ipl_info.type != IPL_TYPE_FCP_DUMP)
+                return 0;
+        sdias_dbf = debug_register("dump_sdias", 4, 1, 4 * sizeof(long));
+        debug_register_view(sdias_dbf, &debug_sprintf_view);
+        debug_set_level(sdias_dbf, 6);
+        rc = sclp_register(&sclp_sdias_register);
+        if (rc) {
+                ERROR_MSG("sclp register failed\n");
+                return rc;
+        }
+        init_waitqueue_head(&sdias_wq);
+        TRACE("init done\n");
+        return 0;
+}
+
+void __exit sdias_exit(void)
+{
+        debug_unregister(sdias_dbf);
+        sclp_unregister(&sclp_sdias_register);
+}
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index 076816b9d528..e3b3d390b4a3 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -648,7 +648,7 @@ sclp_eval_textcmd(struct gds_subvector *start,
         subvec = start;
         while (subvec < end) {
                 subvec = find_gds_subvector(subvec, end,
-                                            GDS_KEY_SelfDefTextMsg);
+                                            GDS_KEY_SELFDEFTEXTMSG);
                 if (!subvec)
                         break;
                 sclp_eval_selfdeftextmsg((struct gds_subvector *)(subvec + 1),
@@ -664,7 +664,7 @@ sclp_eval_cpmsu(struct gds_vector *start, struct gds_vector *end)
 
         vec = start;
         while (vec < end) {
-                vec = find_gds_vector(vec, end, GDS_ID_TextCmd);
+                vec = find_gds_vector(vec, end, GDS_ID_TEXTCMD);
                 if (!vec)
                         break;
                 sclp_eval_textcmd((struct gds_subvector *)(vec + 1),
@@ -703,7 +703,7 @@ sclp_tty_state_change(struct sclp_register *reg)
 
 static struct sclp_register sclp_input_event =
 {
-        .receive_mask = EvTyp_OpCmd_Mask | EvTyp_PMsgCmd_Mask,
+        .receive_mask = EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK,
         .state_change_fn = sclp_tty_state_change,
         .receiver_fn = sclp_tty_receiver
 };
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index f77dc33b5f8d..726334757bbf 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -99,8 +99,8 @@ static void sclp_vt220_emit_current(void);
 
 /* Registration structure for our interest in SCLP event buffers */
 static struct sclp_register sclp_vt220_register = {
-        .send_mask              = EvTyp_VT220Msg_Mask,
-        .receive_mask           = EvTyp_VT220Msg_Mask,
+        .send_mask              = EVTYP_VT220MSG_MASK,
+        .receive_mask           = EVTYP_VT220MSG_MASK,
         .state_change_fn        = NULL,
         .receiver_fn            = sclp_vt220_receiver_fn
 };
@@ -202,7 +202,7 @@ sclp_vt220_callback(struct sclp_req *request, void *data)
 static int
 __sclp_vt220_emit(struct sclp_vt220_request *request)
 {
-        if (!(sclp_vt220_register.sclp_send_mask & EvTyp_VT220Msg_Mask)) {
+        if (!(sclp_vt220_register.sclp_send_mask & EVTYP_VT220MSG_MASK)) {
                 request->sclp_req.status = SCLP_REQ_FAILED;
                 return -EIO;
         }
@@ -284,7 +284,7 @@ sclp_vt220_initialize_page(void *page)
         sccb->header.length = sizeof(struct sclp_vt220_sccb);
         sccb->header.function_code = SCLP_NORMAL_WRITE;
         sccb->header.response_code = 0x0000;
-        sccb->evbuf.type = EvTyp_VT220Msg;
+        sccb->evbuf.type = EVTYP_VT220MSG;
         sccb->evbuf.length = sizeof(struct evbuf_header);
 
         return request;
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index b87d3b019936..a5a00e9ae4d0 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -125,7 +125,7 @@ static struct vmlogrdr_priv_t sys_ser[] = {
           .recording_name = "EREP",
           .minor_num      = 0,
           .buffer_free    = 1,
-          .priv_lock      = SPIN_LOCK_UNLOCKED,
+          .priv_lock      = __SPIN_LOCK_UNLOCKED(sys_ser[0].priv_lock),
           .autorecording  = 1,
           .autopurge      = 1,
         },
@@ -134,7 +134,7 @@ static struct vmlogrdr_priv_t sys_ser[] = {
           .recording_name = "ACCOUNT",
           .minor_num      = 1,
           .buffer_free    = 1,
-          .priv_lock      = SPIN_LOCK_UNLOCKED,
+          .priv_lock      = __SPIN_LOCK_UNLOCKED(sys_ser[1].priv_lock),
           .autorecording  = 1,
           .autopurge      = 1,
         },
@@ -143,7 +143,7 @@ static struct vmlogrdr_priv_t sys_ser[] = {
           .recording_name = "SYMPTOM",
           .minor_num      = 2,
           .buffer_free    = 1,
-          .priv_lock      = SPIN_LOCK_UNLOCKED,
+          .priv_lock      = __SPIN_LOCK_UNLOCKED(sys_ser[2].priv_lock),
           .autorecording  = 1,
           .autopurge      = 1,
         }
@@ -385,6 +385,9 @@ static int vmlogrdr_release (struct inode *inode, struct file *filp)
 
         struct vmlogrdr_priv_t * logptr = filp->private_data;
 
+        iucv_path_sever(logptr->path, NULL);
+        kfree(logptr->path);
+        logptr->path = NULL;
         if (logptr->autorecording) {
                 ret = vmlogrdr_recording(logptr,0,logptr->autopurge);
                 if (ret)
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
new file mode 100644
index 000000000000..89d439316a53
--- /dev/null
+++ b/drivers/s390/char/zcore.c
@@ -0,0 +1,651 @@
+/*
+ * zcore module to export memory content and register sets for creating system
+ * dumps on SCSI disks (zfcpdump). The "zcore/mem" debugfs file shows the same
+ * dump format as s390 standalone dumps.
+ *
+ * For more information please refer to Documentation/s390/zfcpdump.txt
+ *
+ * Copyright IBM Corp. 2003,2007
+ * Author(s): Michael Holzheu
+ */
+
+#include <linux/init.h>
+#include <linux/miscdevice.h>
+#include <linux/utsname.h>
+#include <linux/debugfs.h>
+#include <asm/ipl.h>
+#include <asm/sclp.h>
+#include <asm/setup.h>
+#include <asm/sigp.h>
+#include <asm/uaccess.h>
+#include <asm/debug.h>
+#include <asm/processor.h>
+#include <asm/irqflags.h>
+
+#define TRACE(x...) debug_sprintf_event(zcore_dbf, 1, x)
+#define MSG(x...) printk( KERN_ALERT x )
+#define ERROR_MSG(x...) printk ( KERN_ALERT "DUMP: " x )
+
+#define TO_USER         0
+#define TO_KERNEL       1
+
+enum arch_id {
+        ARCH_S390       = 0,
+        ARCH_S390X      = 1,
+};
+
+/* dump system info */
+
+struct sys_info {
+        enum arch_id    arch;
+        unsigned long   sa_base;
+        u32             sa_size;
+        int             cpu_map[NR_CPUS];
+        unsigned long   mem_size;
+        union save_area lc_mask;
+};
+
+static struct sys_info sys_info;
+static struct debug_info *zcore_dbf;
+static int hsa_available;
+static struct dentry *zcore_dir;
+static struct dentry *zcore_file;
+
+/*
+ * Copy memory from HSA to kernel or user memory (not reentrant):
+ *
+ * @dest:  Kernel or user buffer where memory should be copied to
+ * @src:   Start address within HSA where data should be copied
+ * @count: Size of buffer, which should be copied
+ * @mode:  Either TO_KERNEL or TO_USER
+ */
+static int memcpy_hsa(void *dest, unsigned long src, size_t count, int mode)
+{
+        int offs, blk_num;
+        static char buf[PAGE_SIZE] __attribute__((__aligned__(PAGE_SIZE)));
+
+        if (count == 0)
+                return 0;
+
+        /* copy first block */
+        offs = 0;
+        if ((src % PAGE_SIZE) != 0) {
+                blk_num = src / PAGE_SIZE + 2;
+                if (sclp_sdias_copy(buf, blk_num, 1)) {
+                        TRACE("sclp_sdias_copy() failed\n");
+                        return -EIO;
+                }
+                offs = min((PAGE_SIZE - (src % PAGE_SIZE)), count);
+                if (mode == TO_USER) {
+                        if (copy_to_user((__force __user void*) dest,
+                                         buf + (src % PAGE_SIZE), offs))
+                                return -EFAULT;
+                } else
+                        memcpy(dest, buf + (src % PAGE_SIZE), offs);
+        }
+        if (offs == count)
+                goto out;
+
+        /* copy middle */
+        for (; (offs + PAGE_SIZE) <= count; offs += PAGE_SIZE) {
+                blk_num = (src + offs) / PAGE_SIZE + 2;
+                if (sclp_sdias_copy(buf, blk_num, 1)) {
+                        TRACE("sclp_sdias_copy() failed\n");
+                        return -EIO;
+                }
+                if (mode == TO_USER) {
+                        if (copy_to_user((__force __user void*) dest + offs,
+                                         buf, PAGE_SIZE))
+                                return -EFAULT;
+                } else
+                        memcpy(dest + offs, buf, PAGE_SIZE);
+        }
+        if (offs == count)
+                goto out;
+
+        /* copy last block */
+        blk_num = (src + offs) / PAGE_SIZE + 2;
+        if (sclp_sdias_copy(buf, blk_num, 1)) {
+                TRACE("sclp_sdias_copy() failed\n");
+                return -EIO;
+        }
+        if (mode == TO_USER) {
+                if (copy_to_user((__force __user void*) dest + offs, buf,
+                                 PAGE_SIZE))
+                        return -EFAULT;
+        } else
+                memcpy(dest + offs, buf, count - offs);
+out:
+        return 0;
+}
+
+static int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)
+{
+        return memcpy_hsa((void __force *) dest, src, count, TO_USER);
+}
+
+static int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
+{
+        return memcpy_hsa(dest, src, count, TO_KERNEL);
+}
+
+static int memcpy_real(void *dest, unsigned long src, size_t count)
+{
+        unsigned long flags;
+        int rc = -EFAULT;
+        register unsigned long _dest asm("2") = (unsigned long) dest;
+        register unsigned long _len1 asm("3") = (unsigned long) count;
+        register unsigned long _src  asm("4") = src;
+        register unsigned long _len2 asm("5") = (unsigned long) count;
+
+        if (count == 0)
+                return 0;
+        flags = __raw_local_irq_stnsm(0xf8); /* switch to real mode */
+        asm volatile (
+                "0:     mvcle   %1,%2,0x0\n"
+                "1:     jo      0b\n"
+                "       lhi     %0,0x0\n"
+                "2:\n"
+                EX_TABLE(1b,2b)
+                : "+d" (rc)
+                : "d" (_dest), "d" (_src), "d" (_len1), "d" (_len2)
+                : "cc", "memory");
+        __raw_local_irq_ssm(flags);
+
+        return rc;
+}
+
+static int memcpy_real_user(__user void *dest, unsigned long src, size_t count)
+{
+        static char buf[4096];
+        int offs = 0, size;
+
+        while (offs < count) {
+                size = min(sizeof(buf), count - offs);
+                if (memcpy_real(buf, src + offs, size))
+                        return -EFAULT;
+                if (copy_to_user(dest + offs, buf, size))
+                        return -EFAULT;
+                offs += size;
+        }
+        return 0;
+}
+
+#ifdef __s390x__
+/*
+ * Convert s390x (64 bit) cpu info to s390 (32 bit) cpu info
+ */
+static void __init s390x_to_s390_regs(union save_area *out, union save_area *in,
+                                      int cpu)
+{
+        int i;
+
+        for (i = 0; i < 16; i++) {
+                out->s390.gp_regs[i] = in->s390x.gp_regs[i] & 0x00000000ffffffff;
+                out->s390.acc_regs[i] = in->s390x.acc_regs[i];
+                out->s390.ctrl_regs[i] =
+                        in->s390x.ctrl_regs[i] & 0x00000000ffffffff;
+        }
+        /* locore for 31 bit has only space for fpregs 0,2,4,6 */
+        out->s390.fp_regs[0] = in->s390x.fp_regs[0];
+        out->s390.fp_regs[1] = in->s390x.fp_regs[2];
+        out->s390.fp_regs[2] = in->s390x.fp_regs[4];
+        out->s390.fp_regs[3] = in->s390x.fp_regs[6];
+        memcpy(&(out->s390.psw[0]), &(in->s390x.psw[0]), 4);
+        out->s390.psw[1] |= 0x8; /* set bit 12 */
+        memcpy(&(out->s390.psw[4]),&(in->s390x.psw[12]), 4);
+        out->s390.psw[4] |= 0x80; /* set (31bit) addressing bit */
+        out->s390.pref_reg = in->s390x.pref_reg;
+        out->s390.timer = in->s390x.timer;
+        out->s390.clk_cmp = in->s390x.clk_cmp;
+}
+
+static void __init s390x_to_s390_save_areas(void)
+{
+        int i = 1;
+        static union save_area tmp;
+
+        while (zfcpdump_save_areas[i]) {
+                s390x_to_s390_regs(&tmp, zfcpdump_save_areas[i], i);
+                memcpy(zfcpdump_save_areas[i], &tmp, sizeof(tmp));
+                i++;
+        }
+}
+
+#endif /* __s390x__ */
+
+static int __init init_cpu_info(enum arch_id arch)
+{
+        union save_area *sa;
+
+        /* get info for boot cpu from lowcore, stored in the HSA */
+
+        sa = kmalloc(sizeof(*sa), GFP_KERNEL);
+        if (!sa) {
+                ERROR_MSG("kmalloc failed: %s: %i\n",__FUNCTION__, __LINE__);
+                return -ENOMEM;
+        }
+        if (memcpy_hsa_kernel(sa, sys_info.sa_base, sys_info.sa_size) < 0) {
+                ERROR_MSG("could not copy from HSA\n");
+                kfree(sa);
+                return -EIO;
+        }
+        zfcpdump_save_areas[0] = sa;
+
+#ifdef __s390x__
+        /* convert s390x regs to s390, if we are dumping an s390 Linux */
+
+        if (arch == ARCH_S390)
+                s390x_to_s390_save_areas();
+#endif
+
+        return 0;
+}
+
+static DEFINE_MUTEX(zcore_mutex);
+
+#define DUMP_VERSION    0x3
+#define DUMP_MAGIC      0xa8190173618f23fdULL
+#define DUMP_ARCH_S390X 2
+#define DUMP_ARCH_S390  1
+#define HEADER_SIZE     4096
+
+/* dump header dumped according to s390 crash dump format */
+
+struct zcore_header {
+        u64 magic;
+        u32 version;
+        u32 header_size;
+        u32 dump_level;
+        u32 page_size;
+        u64 mem_size;
+        u64 mem_start;
+        u64 mem_end;
+        u32 num_pages;
+        u32 pad1;
+        u64 tod;
+        cpuid_t cpu_id;
+        u32 arch_id;
+        u32 build_arch;
+        char pad2[4016];
+} __attribute__((packed,__aligned__(16)));
+
+static struct zcore_header zcore_header = {
+        .magic          = DUMP_MAGIC,
+        .version        = DUMP_VERSION,
+        .header_size    = 4096,
+        .dump_level     = 0,
+        .page_size      = PAGE_SIZE,
+        .mem_start      = 0,
+#ifdef __s390x__
+        .build_arch     = DUMP_ARCH_S390X,
+#else
+        .build_arch     = DUMP_ARCH_S390,
+#endif
+};
+
+/*
+ * Copy lowcore info to buffer. Use map in order to copy only register parts.
+ *
+ * @buf:    User buffer
+ * @sa:     Pointer to save area
+ * @sa_off: Offset in save area to copy
+ * @len:    Number of bytes to copy
+ */
+static int copy_lc(void __user *buf, void *sa, int sa_off, int len)
+{
+        int i;
+        char *lc_mask = (char*)&sys_info.lc_mask;
+
+        for (i = 0; i < len; i++) {
+                if (!lc_mask[i + sa_off])
+                        continue;
+                if (copy_to_user(buf + i, sa + sa_off + i, 1))
+                        return -EFAULT;
+        }
+        return 0;
+}
+
+/*
+ * Copy lowcores info to memory, if necessary
+ *
+ * @buf:   User buffer
+ * @addr:  Start address of buffer in dump memory
+ * @count: Size of buffer
+ */
+static int zcore_add_lc(char __user *buf, unsigned long start, size_t count)
+{
+        unsigned long end;
+        int i = 0;
+
+        if (count == 0)
+                return 0;
+
+        end = start + count;
+        while (zfcpdump_save_areas[i]) {
+                unsigned long cp_start, cp_end; /* copy range */
+                unsigned long sa_start, sa_end; /* save area range */
+                unsigned long prefix;
+                unsigned long sa_off, len, buf_off;
+
+                if (sys_info.arch == ARCH_S390)
+                        prefix = zfcpdump_save_areas[i]->s390.pref_reg;
+                else
+                        prefix = zfcpdump_save_areas[i]->s390x.pref_reg;
+
+                sa_start = prefix + sys_info.sa_base;
+                sa_end = prefix + sys_info.sa_base + sys_info.sa_size;
+
+                if ((end < sa_start) || (start > sa_end))
+                        goto next;
+                cp_start = max(start, sa_start);
+                cp_end = min(end, sa_end);
+
+                buf_off = cp_start - start;
+                sa_off = cp_start - sa_start;
+                len = cp_end - cp_start;
+
+                TRACE("copy_lc for: %lx\n", start);
+                if (copy_lc(buf + buf_off, zfcpdump_save_areas[i], sa_off, len))
+                        return -EFAULT;
+next:
+                i++;
+        }
+        return 0;
+}
+
+/*
+ * Read routine for zcore character device
+ * First 4K are dump header
+ * Next 32MB are HSA Memory
+ * Rest is read from absolute Memory
+ */
+static ssize_t zcore_read(struct file *file, char __user *buf, size_t count,
+                          loff_t *ppos)
+{
+        unsigned long mem_start; /* Start address in memory */
+        size_t mem_offs;         /* Offset in dump memory */
+        size_t hdr_count;        /* Size of header part of output buffer */
+        size_t size;
+        int rc;
+
+        mutex_lock(&zcore_mutex);
+
+        if (*ppos > (sys_info.mem_size + HEADER_SIZE)) {
+                rc = -EINVAL;
+                goto fail;
+        }
+
+        count = min(count, (size_t) (sys_info.mem_size + HEADER_SIZE - *ppos));
+
+        /* Copy dump header */
+        if (*ppos < HEADER_SIZE) {
+                size = min(count, (size_t) (HEADER_SIZE - *ppos));
+                if (copy_to_user(buf, &zcore_header + *ppos, size)) {
+                        rc = -EFAULT;
+                        goto fail;
+                }
+                hdr_count = size;
+                mem_start = 0;
+        } else {
+                hdr_count = 0;
+                mem_start = *ppos - HEADER_SIZE;
+        }
+
+        mem_offs = 0;
+
+        /* Copy from HSA data */
+        if (*ppos < (ZFCPDUMP_HSA_SIZE + HEADER_SIZE)) {
+                size = min((count - hdr_count), (size_t) (ZFCPDUMP_HSA_SIZE
+                           - mem_start));
+                rc = memcpy_hsa_user(buf + hdr_count, mem_start, size);
+                if (rc)
+                        goto fail;
+
+                mem_offs += size;
+        }
+
+        /* Copy from real mem */
+        size = count - mem_offs - hdr_count;
+        rc = memcpy_real_user(buf + hdr_count + mem_offs, mem_start + mem_offs,
+                              size);
+        if (rc)
+                goto fail;
+
+        /*
+         * Since s390 dump analysis tools like lcrash or crash
+         * expect register sets in the prefix pages of the cpus,
+         * we copy them into the read buffer, if necessary.
+         * buf + hdr_count: Start of memory part of output buffer
+         * mem_start: Start memory address to copy from
+         * count - hdr_count: Size of memory area to copy
+         */
+        if (zcore_add_lc(buf + hdr_count, mem_start, count - hdr_count)) {
+                rc = -EFAULT;
+                goto fail;
+        }
+        *ppos += count;
+fail:
+        mutex_unlock(&zcore_mutex);
+        return (rc < 0) ? rc : count;
+}
+
+static int zcore_open(struct inode *inode, struct file *filp)
+{
+        if (!hsa_available)
+                return -ENODATA;
+        else
+                return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
+}
+
+static int zcore_release(struct inode *inode, struct file *filep)
+{
+        diag308(DIAG308_REL_HSA, NULL);
+        hsa_available = 0;
+        return 0;
+}
+
+static loff_t zcore_lseek(struct file *file, loff_t offset, int orig)
+{
+        loff_t rc;
+
+        mutex_lock(&zcore_mutex);
+        switch (orig) {
+        case 0:
+                file->f_pos = offset;
+                rc = file->f_pos;
+                break;
+        case 1:
+                file->f_pos += offset;
+                rc = file->f_pos;
+                break;
+        default:
+                rc = -EINVAL;
+        }
+        mutex_unlock(&zcore_mutex);
+        return rc;
+}
+
+static struct file_operations zcore_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = zcore_lseek,
+        .read           = zcore_read,
+        .open           = zcore_open,
+        .release        = zcore_release,
+};
+
+
+static void __init set_s390_lc_mask(union save_area *map)
+{
+        memset(&map->s390.ext_save, 0xff, sizeof(map->s390.ext_save));
+        memset(&map->s390.timer, 0xff, sizeof(map->s390.timer));
+        memset(&map->s390.clk_cmp, 0xff, sizeof(map->s390.clk_cmp));
+        memset(&map->s390.psw, 0xff, sizeof(map->s390.psw));
+        memset(&map->s390.pref_reg, 0xff, sizeof(map->s390.pref_reg));
+        memset(&map->s390.acc_regs, 0xff, sizeof(map->s390.acc_regs));
+        memset(&map->s390.fp_regs, 0xff, sizeof(map->s390.fp_regs));
+        memset(&map->s390.gp_regs, 0xff, sizeof(map->s390.gp_regs));
+        memset(&map->s390.ctrl_regs, 0xff, sizeof(map->s390.ctrl_regs));
+}
+
+static void __init set_s390x_lc_mask(union save_area *map)
+{
+        memset(&map->s390x.fp_regs, 0xff, sizeof(map->s390x.fp_regs));
+        memset(&map->s390x.gp_regs, 0xff, sizeof(map->s390x.gp_regs));
+        memset(&map->s390x.psw, 0xff, sizeof(map->s390x.psw));
+        memset(&map->s390x.pref_reg, 0xff, sizeof(map->s390x.pref_reg));
+        memset(&map->s390x.fp_ctrl_reg, 0xff, sizeof(map->s390x.fp_ctrl_reg));
+        memset(&map->s390x.tod_reg, 0xff, sizeof(map->s390x.tod_reg));
+        memset(&map->s390x.timer, 0xff, sizeof(map->s390x.timer));
+        memset(&map->s390x.clk_cmp, 0xff, sizeof(map->s390x.clk_cmp));
+        memset(&map->s390x.acc_regs, 0xff, sizeof(map->s390x.acc_regs));
+        memset(&map->s390x.ctrl_regs, 0xff, sizeof(map->s390x.ctrl_regs));
+}
+
+/*
+ * Initialize dump globals for a given architecture
+ */
+static int __init sys_info_init(enum arch_id arch)
+{
+        switch (arch) {
+        case ARCH_S390X:
+                MSG("DETECTED 'S390X (64 bit) OS'\n");
+                sys_info.sa_base = SAVE_AREA_BASE_S390X;
+                sys_info.sa_size = sizeof(struct save_area_s390x);
+                set_s390x_lc_mask(&sys_info.lc_mask);
+                break;
+        case ARCH_S390:
+                MSG("DETECTED 'S390 (32 bit) OS'\n");
+                sys_info.sa_base = SAVE_AREA_BASE_S390;
+                sys_info.sa_size = sizeof(struct save_area_s390);
+                set_s390_lc_mask(&sys_info.lc_mask);
+                break;
+        default:
+                ERROR_MSG("unknown architecture 0x%x.\n",arch);
+                return -EINVAL;
+        }
+        sys_info.arch = arch;
+        if (init_cpu_info(arch)) {
+                ERROR_MSG("get cpu info failed\n");
+                return -ENOMEM;
+        }
+        sys_info.mem_size = real_memory_size;
+
+        return 0;
+}
+
+static int __init check_sdias(void)
+{
+        int rc, act_hsa_size;
+
+        rc = sclp_sdias_blk_count();
+        if (rc < 0) {
+                ERROR_MSG("Could not determine HSA size\n");
+                return rc;
+        }
+        act_hsa_size = (rc - 1) * PAGE_SIZE;
+        if (act_hsa_size < ZFCPDUMP_HSA_SIZE) {
+                ERROR_MSG("HSA size too small: %i\n", act_hsa_size);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static void __init zcore_header_init(int arch, struct zcore_header *hdr)
+{
+        if (arch == ARCH_S390X)
+                hdr->arch_id = DUMP_ARCH_S390X;
+        else
+                hdr->arch_id = DUMP_ARCH_S390;
+        hdr->mem_size = sys_info.mem_size;
+        hdr->mem_end = sys_info.mem_size;
+        hdr->num_pages = sys_info.mem_size / PAGE_SIZE;
+        hdr->tod = get_clock();
+        get_cpu_id(&hdr->cpu_id);
+}
+
+extern int sdias_init(void);
+
+static int __init zcore_init(void)
+{
+        unsigned char arch;
+        int rc;
+
+        if (ipl_info.type != IPL_TYPE_FCP_DUMP)
+                return -ENODATA;
+
+        zcore_dbf = debug_register("zcore", 4, 1, 4 * sizeof(long));
+        debug_register_view(zcore_dbf, &debug_sprintf_view);
+        debug_set_level(zcore_dbf, 6);
+
+        TRACE("devno:  %x\n", ipl_info.data.fcp.dev_id.devno);
+        TRACE("wwpn:   %llx\n", (unsigned long long) ipl_info.data.fcp.wwpn);
+        TRACE("lun:    %llx\n", (unsigned long long) ipl_info.data.fcp.lun);
+
+        rc = sdias_init();
+        if (rc)
+                goto fail;
+
+        rc = check_sdias();
+        if (rc) {
+                ERROR_MSG("Dump initialization failed\n");
+                goto fail;
+        }
+
+        rc = memcpy_hsa_kernel(&arch, __LC_AR_MODE_ID, 1);
+        if (rc) {
+                ERROR_MSG("sdial memcpy for arch id failed\n");
+                goto fail;
+        }
+
+#ifndef __s390x__
+        if (arch == ARCH_S390X) {
+                ERROR_MSG("32 bit dumper can't dump 64 bit system!\n");
+                rc = -EINVAL;
+                goto fail;
+        }
+#endif
+
+        rc = sys_info_init(arch);
+        if (rc) {
+                ERROR_MSG("arch init failed\n");
+                goto fail;
+        }
+
+        zcore_header_init(arch, &zcore_header);
+
+        zcore_dir = debugfs_create_dir("zcore" , NULL);
+        if (!zcore_dir) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+        zcore_file = debugfs_create_file("mem", S_IRUSR, zcore_dir, NULL,
+                                         &zcore_fops);
+        if (!zcore_file) {
+                debugfs_remove(zcore_dir);
+                rc = -ENOMEM;
+                goto fail;
+        }
+        hsa_available = 1;
+        return 0;
+
+fail:
+        diag308(DIAG308_REL_HSA, NULL);
+        return rc;
+}
+
+extern void sdias_exit(void);
+
+static void __exit zcore_exit(void)
+{
+        debug_unregister(zcore_dbf);
+        sdias_exit();
+        diag308(DIAG308_REL_HSA, NULL);
+}
+
+MODULE_AUTHOR("Copyright IBM Corp. 2003,2007");
+MODULE_DESCRIPTION("zcore module for zfcpdump support");
+MODULE_LICENSE("GPL");
+
+subsys_initcall(zcore_init);
+module_exit(zcore_exit);
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index c490c2a1c2fc..cfaf77b320f5 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the S/390 common i/o drivers
 #
 
-obj-y += airq.o blacklist.o chsc.o cio.o css.o
+obj-y += airq.o blacklist.o chsc.o cio.o css.o chp.o idset.o
 ccw_device-objs += device.o device_fsm.o device_ops.o
 ccw_device-objs += device_id.o device_pgid.o device_status.o
 obj-y += ccw_device.o cmf.o
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 5aeb68e732b0..e5ccda63e883 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -75,8 +75,10 @@ static void ccwgroup_ungroup_callback(struct device *dev)
 {
         struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
 
+        mutex_lock(&gdev->reg_mutex);
         __ccwgroup_remove_symlinks(gdev);
         device_unregister(dev);
+        mutex_unlock(&gdev->reg_mutex);
 }
 
 static ssize_t
@@ -173,7 +175,8 @@ ccwgroup_create(struct device *root,
                 return -ENOMEM;
 
         atomic_set(&gdev->onoff, 0);
-
+        mutex_init(&gdev->reg_mutex);
+        mutex_lock(&gdev->reg_mutex);
         for (i = 0; i < argc; i++) {
                 gdev->cdev[i] = get_ccwdev_by_busid(cdrv, argv[i]);
 
@@ -183,12 +186,12 @@ ccwgroup_create(struct device *root,
                     || gdev->cdev[i]->id.driver_info !=
                     gdev->cdev[0]->id.driver_info) {
                         rc = -EINVAL;
-                        goto free_dev;
+                        goto error;
                 }
                 /* Don't allow a device to belong to more than one group. */
                 if (gdev->cdev[i]->dev.driver_data) {
                         rc = -EINVAL;
-                        goto free_dev;
+                        goto error;
                 }
                 gdev->cdev[i]->dev.driver_data = gdev;
         }
@@ -203,9 +206,8 @@ ccwgroup_create(struct device *root,
                         gdev->cdev[0]->dev.bus_id);
 
         rc = device_register(&gdev->dev);
-        
         if (rc)
-                goto free_dev;
+                goto error;
         get_device(&gdev->dev);
         rc = device_create_file(&gdev->dev, &dev_attr_ungroup);
 
@@ -216,6 +218,7 @@ ccwgroup_create(struct device *root,
 
         rc = __ccwgroup_create_symlinks(gdev);
         if (!rc) {
+                mutex_unlock(&gdev->reg_mutex);
                 put_device(&gdev->dev);
                 return 0;
         }
@@ -224,19 +227,12 @@ ccwgroup_create(struct device *root,
 error:
         for (i = 0; i < argc; i++)
                 if (gdev->cdev[i]) {
-                        put_device(&gdev->cdev[i]->dev);
-                        gdev->cdev[i]->dev.driver_data = NULL;
-                }
-        put_device(&gdev->dev);
-        return rc;
-free_dev:
-        for (i = 0; i < argc; i++)
-                if (gdev->cdev[i]) {
                         if (gdev->cdev[i]->dev.driver_data == gdev)
                                 gdev->cdev[i]->dev.driver_data = NULL;
                         put_device(&gdev->cdev[i]->dev);
                 }
-        kfree(gdev);
+        mutex_unlock(&gdev->reg_mutex);
+        put_device(&gdev->dev);
         return rc;
 }
 
@@ -422,8 +418,12 @@ ccwgroup_driver_unregister (struct ccwgroup_driver *cdriver)
         get_driver(&cdriver->driver);
         while ((dev = driver_find_device(&cdriver->driver, NULL, NULL,
                                          __ccwgroup_match_all))) {
-                __ccwgroup_remove_symlinks(to_ccwgroupdev(dev));
+                struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
+
+                mutex_lock(&gdev->reg_mutex);
+                __ccwgroup_remove_symlinks(gdev);
                 device_unregister(dev);
+                mutex_unlock(&gdev->reg_mutex);
                 put_device(dev);
         }
         put_driver(&cdriver->driver);
@@ -444,8 +444,10 @@ __ccwgroup_get_gdev_by_cdev(struct ccw_device *cdev)
         if (cdev->dev.driver_data) {
                 gdev = (struct ccwgroup_device *)cdev->dev.driver_data;
                 if (get_device(&gdev->dev)) {
+                        mutex_lock(&gdev->reg_mutex);
                         if (device_is_registered(&gdev->dev))
                                 return gdev;
+                        mutex_unlock(&gdev->reg_mutex);
                         put_device(&gdev->dev);
                 }
                 return NULL;
@@ -465,6 +467,7 @@ ccwgroup_remove_ccwdev(struct ccw_device *cdev)
         if (gdev) {
                 __ccwgroup_remove_symlinks(gdev);
                 device_unregister(&gdev->dev);
+                mutex_unlock(&gdev->reg_mutex);
                 put_device(&gdev->dev);
         }
 }
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
new file mode 100644
index 000000000000..ac289e6eadfe
--- /dev/null
+++ b/drivers/s390/cio/chp.c
@@ -0,0 +1,683 @@
+/*
+ *  drivers/s390/cio/chp.c
+ *
+ *    Copyright IBM Corp. 1999,2007
+ *    Author(s): Cornelia Huck (cornelia.huck@de.ibm.com)
+ *               Arnd Bergmann (arndb@de.ibm.com)
+ *               Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#include <linux/bug.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+#include <linux/init.h>
+#include <linux/jiffies.h>
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include <asm/errno.h>
+#include <asm/chpid.h>
+#include <asm/sclp.h>
+
+#include "cio.h"
+#include "css.h"
+#include "ioasm.h"
+#include "cio_debug.h"
+#include "chp.h"
+
+#define to_channelpath(device) container_of(device, struct channel_path, dev)
+#define CHP_INFO_UPDATE_INTERVAL        1*HZ
+
+enum cfg_task_t {
+        cfg_none,
+        cfg_configure,
+        cfg_deconfigure
+};
+
+/* Map for pending configure tasks. */
+static enum cfg_task_t chp_cfg_task[__MAX_CSSID + 1][__MAX_CHPID + 1];
+static DEFINE_MUTEX(cfg_lock);
+static int cfg_busy;
+
+/* Map for channel-path status. */
+static struct sclp_chp_info chp_info;
+static DEFINE_MUTEX(info_lock);
+
+/* Time after which channel-path status may be outdated. */
+static unsigned long chp_info_expires;
+
+/* Workqueue to perform pending configure tasks. */
+static struct workqueue_struct *chp_wq;
+static struct work_struct cfg_work;
+
+/* Wait queue for configure completion events. */
+static wait_queue_head_t cfg_wait_queue;
+
+/* Return channel_path struct for given chpid. */
+static inline struct channel_path *chpid_to_chp(struct chp_id chpid)
+{
+        return css[chpid.cssid]->chps[chpid.id];
+}
+
+/* Set vary state for given chpid. */
+static void set_chp_logically_online(struct chp_id chpid, int onoff)
+{
+        chpid_to_chp(chpid)->state = onoff;
+}
+
+/* On succes return 0 if channel-path is varied offline, 1 if it is varied
+ * online. Return -ENODEV if channel-path is not registered. */
+int chp_get_status(struct chp_id chpid)
+{
+        return (chpid_to_chp(chpid) ? chpid_to_chp(chpid)->state : -ENODEV);
+}
+
+/**
+ * chp_get_sch_opm - return opm for subchannel
+ * @sch: subchannel
+ *
+ * Calculate and return the operational path mask (opm) based on the chpids
+ * used by the subchannel and the status of the associated channel-paths.
+ */
+u8 chp_get_sch_opm(struct subchannel *sch)
+{
+        struct chp_id chpid;
+        int opm;
+        int i;
+
+        opm = 0;
+        chp_id_init(&chpid);
+        for (i=0; i < 8; i++) {
+                opm <<= 1;
+                chpid.id = sch->schib.pmcw.chpid[i];
+                if (chp_get_status(chpid) != 0)
+                        opm |= 1;
+        }
+        return opm;
+}
+
+/**
+ * chp_is_registered - check if a channel-path is registered
+ * @chpid: channel-path ID
+ *
+ * Return non-zero if a channel-path with the given chpid is registered,
+ * zero otherwise.
+ */
+int chp_is_registered(struct chp_id chpid)
+{
+        return chpid_to_chp(chpid) != NULL;
+}
+
+/*
+ * Function: s390_vary_chpid
+ * Varies the specified chpid online or offline
+ */
+static int s390_vary_chpid(struct chp_id chpid, int on)
+{
+        char dbf_text[15];
+        int status;
+
+        sprintf(dbf_text, on?"varyon%x.%02x":"varyoff%x.%02x", chpid.cssid,
+                chpid.id);
+        CIO_TRACE_EVENT( 2, dbf_text);
+
+        status = chp_get_status(chpid);
+        if (status < 0) {
+                printk(KERN_ERR "Can't vary unknown chpid %x.%02x\n",
+                       chpid.cssid, chpid.id);
+                return -EINVAL;
+        }
+
+        if (!on && !status) {
+                printk(KERN_ERR "chpid %x.%02x is already offline\n",
+                       chpid.cssid, chpid.id);
+                return -EINVAL;
+        }
+
+        set_chp_logically_online(chpid, on);
+        chsc_chp_vary(chpid, on);
+        return 0;
+}
+
+/*
+ * Channel measurement related functions
+ */
+static ssize_t chp_measurement_chars_read(struct kobject *kobj, char *buf,
+                                          loff_t off, size_t count)
+{
+        struct channel_path *chp;
+        unsigned int size;
+
+        chp = to_channelpath(container_of(kobj, struct device, kobj));
+        if (!chp->cmg_chars)
+                return 0;
+
+        size = sizeof(struct cmg_chars);
+
+        if (off > size)
+                return 0;
+        if (off + count > size)
+                count = size - off;
+        memcpy(buf, chp->cmg_chars + off, count);
+        return count;
+}
+
+static struct bin_attribute chp_measurement_chars_attr = {
+        .attr = {
+                .name = "measurement_chars",
+                .mode = S_IRUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = sizeof(struct cmg_chars),
+        .read = chp_measurement_chars_read,
+};
+
+static void chp_measurement_copy_block(struct cmg_entry *buf,
+                                       struct channel_subsystem *css,
+                                       struct chp_id chpid)
+{
+        void *area;
+        struct cmg_entry *entry, reference_buf;
+        int idx;
+
+        if (chpid.id < 128) {
+                area = css->cub_addr1;
+                idx = chpid.id;
+        } else {
+                area = css->cub_addr2;
+                idx = chpid.id - 128;
+        }
+        entry = area + (idx * sizeof(struct cmg_entry));
+        do {
+                memcpy(buf, entry, sizeof(*entry));
+                memcpy(&reference_buf, entry, sizeof(*entry));
+        } while (reference_buf.values[0] != buf->values[0]);
+}
+
+static ssize_t chp_measurement_read(struct kobject *kobj, char *buf,
+                                    loff_t off, size_t count)
+{
+        struct channel_path *chp;
+        struct channel_subsystem *css;
+        unsigned int size;
+
+        chp = to_channelpath(container_of(kobj, struct device, kobj));
+        css = to_css(chp->dev.parent);
+
+        size = sizeof(struct cmg_entry);
+
+        /* Only allow single reads. */
+        if (off || count < size)
+                return 0;
+        chp_measurement_copy_block((struct cmg_entry *)buf, css, chp->chpid);
+        count = size;
+        return count;
+}
+
+static struct bin_attribute chp_measurement_attr = {
+        .attr = {
+                .name = "measurement",
+                .mode = S_IRUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = sizeof(struct cmg_entry),
+        .read = chp_measurement_read,
+};
+
+void chp_remove_cmg_attr(struct channel_path *chp)
+{
+        device_remove_bin_file(&chp->dev, &chp_measurement_chars_attr);
+        device_remove_bin_file(&chp->dev, &chp_measurement_attr);
+}
+
+int chp_add_cmg_attr(struct channel_path *chp)
+{
+        int ret;
+
+        ret = device_create_bin_file(&chp->dev, &chp_measurement_chars_attr);
+        if (ret)
+                return ret;
+        ret = device_create_bin_file(&chp->dev, &chp_measurement_attr);
+        if (ret)
+                device_remove_bin_file(&chp->dev, &chp_measurement_chars_attr);
+        return ret;
+}
+
+/*
+ * Files for the channel path entries.
+ */
+static ssize_t chp_status_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct channel_path *chp = container_of(dev, struct channel_path, dev);
+
+        if (!chp)
+                return 0;
+        return (chp_get_status(chp->chpid) ? sprintf(buf, "online\n") :
+                sprintf(buf, "offline\n"));
+}
+
+static ssize_t chp_status_write(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct channel_path *cp = container_of(dev, struct channel_path, dev);
+        char cmd[10];
+        int num_args;
+        int error;
+
+        num_args = sscanf(buf, "%5s", cmd);
+        if (!num_args)
+                return count;
+
+        if (!strnicmp(cmd, "on", 2) || !strcmp(cmd, "1"))
+                error = s390_vary_chpid(cp->chpid, 1);
+        else if (!strnicmp(cmd, "off", 3) || !strcmp(cmd, "0"))
+                error = s390_vary_chpid(cp->chpid, 0);
+        else
+                error = -EINVAL;
+
+        return error < 0 ? error : count;
+
+}
+
+static DEVICE_ATTR(status, 0644, chp_status_show, chp_status_write);
+
+static ssize_t chp_configure_show(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
+{
+        struct channel_path *cp;
+        int status;
+
+        cp = container_of(dev, struct channel_path, dev);
+        status = chp_info_get_status(cp->chpid);
+        if (status < 0)
+                return status;
+
+        return snprintf(buf, PAGE_SIZE, "%d\n", status);
+}
+
+static int cfg_wait_idle(void);
+
+static ssize_t chp_configure_write(struct device *dev,
+                                   struct device_attribute *attr,
+                                   const char *buf, size_t count)
+{
+        struct channel_path *cp;
+        int val;
+        char delim;
+
+        if (sscanf(buf, "%d %c", &val, &delim) != 1)
+                return -EINVAL;
+        if (val != 0 && val != 1)
+                return -EINVAL;
+        cp = container_of(dev, struct channel_path, dev);
+        chp_cfg_schedule(cp->chpid, val);
+        cfg_wait_idle();
+
+        return count;
+}
+
+static DEVICE_ATTR(configure, 0644, chp_configure_show, chp_configure_write);
+
+static ssize_t chp_type_show(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        struct channel_path *chp = container_of(dev, struct channel_path, dev);
+
+        if (!chp)
+                return 0;
+        return sprintf(buf, "%x\n", chp->desc.desc);
+}
+
+static DEVICE_ATTR(type, 0444, chp_type_show, NULL);
+
+static ssize_t chp_cmg_show(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct channel_path *chp = to_channelpath(dev);
+
+        if (!chp)
+                return 0;
+        if (chp->cmg == -1) /* channel measurements not available */
+                return sprintf(buf, "unknown\n");
+        return sprintf(buf, "%x\n", chp->cmg);
+}
+
+static DEVICE_ATTR(cmg, 0444, chp_cmg_show, NULL);
+
+static ssize_t chp_shared_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct channel_path *chp = to_channelpath(dev);
+
+        if (!chp)
+                return 0;
+        if (chp->shared == -1) /* channel measurements not available */
+                return sprintf(buf, "unknown\n");
+        return sprintf(buf, "%x\n", chp->shared);
+}
+
+static DEVICE_ATTR(shared, 0444, chp_shared_show, NULL);
+
+static struct attribute * chp_attrs[] = {
+        &dev_attr_status.attr,
+        &dev_attr_configure.attr,
+        &dev_attr_type.attr,
+        &dev_attr_cmg.attr,
+        &dev_attr_shared.attr,
+        NULL,
+};
+
+static struct attribute_group chp_attr_group = {
+        .attrs = chp_attrs,
+};
+
+static void chp_release(struct device *dev)
+{
+        struct channel_path *cp;
+
+        cp = container_of(dev, struct channel_path, dev);
+        kfree(cp);
+}
+
+/**
+ * chp_new - register a new channel-path
+ * @chpid - channel-path ID
+ *
+ * Create and register data structure representing new channel-path. Return
+ * zero on success, non-zero otherwise.
+ */
+int chp_new(struct chp_id chpid)
+{
+        struct channel_path *chp;
+        int ret;
+
+        if (chp_is_registered(chpid))
+                return 0;
+        chp = kzalloc(sizeof(struct channel_path), GFP_KERNEL);
+        if (!chp)
+                return -ENOMEM;
+
+        /* fill in status, etc. */
+        chp->chpid = chpid;
+        chp->state = 1;
+        chp->dev.parent = &css[chpid.cssid]->device;
+        chp->dev.release = chp_release;
+        snprintf(chp->dev.bus_id, BUS_ID_SIZE, "chp%x.%02x", chpid.cssid,
+                 chpid.id);
+
+        /* Obtain channel path description and fill it in. */
+        ret = chsc_determine_channel_path_description(chpid, &chp->desc);
+        if (ret)
+                goto out_free;
+        if ((chp->desc.flags & 0x80) == 0) {
+                ret = -ENODEV;
+                goto out_free;
+        }
+        /* Get channel-measurement characteristics. */
+        if (css_characteristics_avail && css_chsc_characteristics.scmc
+            && css_chsc_characteristics.secm) {
+                ret = chsc_get_channel_measurement_chars(chp);
+                if (ret)
+                        goto out_free;
+        } else {
+                static int msg_done;
+
+                if (!msg_done) {
+                        printk(KERN_WARNING "cio: Channel measurements not "
+                               "available, continuing.\n");
+                        msg_done = 1;
+                }
+                chp->cmg = -1;
+        }
+
+        /* make it known to the system */
+        ret = device_register(&chp->dev);
+        if (ret) {
+                printk(KERN_WARNING "%s: could not register %x.%02x\n",
+                       __func__, chpid.cssid, chpid.id);
+                goto out_free;
+        }
+        ret = sysfs_create_group(&chp->dev.kobj, &chp_attr_group);
+        if (ret) {
+                device_unregister(&chp->dev);
+                goto out_free;
+        }
+        mutex_lock(&css[chpid.cssid]->mutex);
+        if (css[chpid.cssid]->cm_enabled) {
+                ret = chp_add_cmg_attr(chp);
+                if (ret) {
+                        sysfs_remove_group(&chp->dev.kobj, &chp_attr_group);
+                        device_unregister(&chp->dev);
+                        mutex_unlock(&css[chpid.cssid]->mutex);
+                        goto out_free;
+                }
+        }
+        css[chpid.cssid]->chps[chpid.id] = chp;
+        mutex_unlock(&css[chpid.cssid]->mutex);
+        return ret;
+out_free:
+        kfree(chp);
+        return ret;
+}
+
+/**
+ * chp_get_chp_desc - return newly allocated channel-path description
+ * @chpid: channel-path ID
+ *
+ * On success return a newly allocated copy of the channel-path description
+ * data associated with the given channel-path ID. Return %NULL on error.
+ */
+void *chp_get_chp_desc(struct chp_id chpid)
+{
+        struct channel_path *chp;
+        struct channel_path_desc *desc;
+
+        chp = chpid_to_chp(chpid);
+        if (!chp)
+                return NULL;
+        desc = kmalloc(sizeof(struct channel_path_desc), GFP_KERNEL);
+        if (!desc)
+                return NULL;
+        memcpy(desc, &chp->desc, sizeof(struct channel_path_desc));
+        return desc;
+}
+
+/**
+ * chp_process_crw - process channel-path status change
+ * @id: channel-path ID number
+ * @status: non-zero if channel-path has become available, zero otherwise
+ *
+ * Handle channel-report-words indicating that the status of a channel-path
+ * has changed.
+ */
+void chp_process_crw(int id, int status)
+{
+        struct chp_id chpid;
+
+        chp_id_init(&chpid);
+        chpid.id = id;
+        if (status) {
+                if (!chp_is_registered(chpid))
+                        chp_new(chpid);
+                chsc_chp_online(chpid);
+        } else
+                chsc_chp_offline(chpid);
+}
+
+static inline int info_bit_num(struct chp_id id)
+{
+        return id.id + id.cssid * (__MAX_CHPID + 1);
+}
+
+/* Force chp_info refresh on next call to info_validate(). */
+static void info_expire(void)
+{
+        mutex_lock(&info_lock);
+        chp_info_expires = jiffies - 1;
+        mutex_unlock(&info_lock);
+}
+
+/* Ensure that chp_info is up-to-date. */
+static int info_update(void)
+{
+        int rc;
+
+        mutex_lock(&info_lock);
+        rc = 0;
+        if (time_after(jiffies, chp_info_expires)) {
+                /* Data is too old, update. */
+                rc = sclp_chp_read_info(&chp_info);
+                chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL ;
+        }
+        mutex_unlock(&info_lock);
+
+        return rc;
+}
+
+/**
+ * chp_info_get_status - retrieve configure status of a channel-path
+ * @chpid: channel-path ID
+ *
+ * On success, return 0 for standby, 1 for configured, 2 for reserved,
+ * 3 for not recognized. Return negative error code on error.
+ */
+int chp_info_get_status(struct chp_id chpid)
+{
+        int rc;
+        int bit;
+
+        rc = info_update();
+        if (rc)
+                return rc;
+
+        bit = info_bit_num(chpid);
+        mutex_lock(&info_lock);
+        if (!chp_test_bit(chp_info.recognized, bit))
+                rc = CHP_STATUS_NOT_RECOGNIZED;
+        else if (chp_test_bit(chp_info.configured, bit))
+                rc = CHP_STATUS_CONFIGURED;
+        else if (chp_test_bit(chp_info.standby, bit))
+                rc = CHP_STATUS_STANDBY;
+        else
+                rc = CHP_STATUS_RESERVED;
+        mutex_unlock(&info_lock);
+
+        return rc;
+}
+
+/* Return configure task for chpid. */
+static enum cfg_task_t cfg_get_task(struct chp_id chpid)
+{
+        return chp_cfg_task[chpid.cssid][chpid.id];
+}
+
+/* Set configure task for chpid. */
+static void cfg_set_task(struct chp_id chpid, enum cfg_task_t cfg)
+{
+        chp_cfg_task[chpid.cssid][chpid.id] = cfg;
+}
+
+/* Perform one configure/deconfigure request. Reschedule work function until
+ * last request. */
+static void cfg_func(struct work_struct *work)
+{
+        struct chp_id chpid;
+        enum cfg_task_t t;
+
+        mutex_lock(&cfg_lock);
+        t = cfg_none;
+        chp_id_for_each(&chpid) {
+                t = cfg_get_task(chpid);
+                if (t != cfg_none) {
+                        cfg_set_task(chpid, cfg_none);
+                        break;
+                }
+        }
+        mutex_unlock(&cfg_lock);
+
+        switch (t) {
+        case cfg_configure:
+                sclp_chp_configure(chpid);
+                info_expire();
+                chsc_chp_online(chpid);
+                break;
+        case cfg_deconfigure:
+                sclp_chp_deconfigure(chpid);
+                info_expire();
+                chsc_chp_offline(chpid);
+                break;
+        case cfg_none:
+                /* Get updated information after last change. */
+                info_update();
+                mutex_lock(&cfg_lock);
+                cfg_busy = 0;
+                mutex_unlock(&cfg_lock);
+                wake_up_interruptible(&cfg_wait_queue);
+                return;
+        }
+        queue_work(chp_wq, &cfg_work);
+}
+
+/**
+ * chp_cfg_schedule - schedule chpid configuration request
+ * @chpid - channel-path ID
+ * @configure - Non-zero for configure, zero for deconfigure
+ *
+ * Schedule a channel-path configuration/deconfiguration request.
+ */
+void chp_cfg_schedule(struct chp_id chpid, int configure)
+{
+        CIO_MSG_EVENT(2, "chp_cfg_sched%x.%02x=%d\n", chpid.cssid, chpid.id,
+                      configure);
+        mutex_lock(&cfg_lock);
+        cfg_set_task(chpid, configure ? cfg_configure : cfg_deconfigure);
+        cfg_busy = 1;
+        mutex_unlock(&cfg_lock);
+        queue_work(chp_wq, &cfg_work);
+}
+
+/**
+ * chp_cfg_cancel_deconfigure - cancel chpid deconfiguration request
+ * @chpid - channel-path ID
+ *
+ * Cancel an active channel-path deconfiguration request if it has not yet
+ * been performed.
+ */
+void chp_cfg_cancel_deconfigure(struct chp_id chpid)
+{
+        CIO_MSG_EVENT(2, "chp_cfg_cancel:%x.%02x\n", chpid.cssid, chpid.id);
+        mutex_lock(&cfg_lock);
+        if (cfg_get_task(chpid) == cfg_deconfigure)
+                cfg_set_task(chpid, cfg_none);
+        mutex_unlock(&cfg_lock);
+}
+
+static int cfg_wait_idle(void)
+{
+        if (wait_event_interruptible(cfg_wait_queue, !cfg_busy))
+                return -ERESTARTSYS;
+        return 0;
+}
+
+static int __init chp_init(void)
+{
+        struct chp_id chpid;
+
+        chp_wq = create_singlethread_workqueue("cio_chp");
+        if (!chp_wq)
+                return -ENOMEM;
+        INIT_WORK(&cfg_work, cfg_func);
+        init_waitqueue_head(&cfg_wait_queue);
+        if (info_update())
+                return 0;
+        /* Register available channel-paths. */
+        chp_id_for_each(&chpid) {
+                if (chp_info_get_status(chpid) != CHP_STATUS_NOT_RECOGNIZED)
+                        chp_new(chpid);
+        }
+
+        return 0;
+}
+
+subsys_initcall(chp_init);
diff --git a/drivers/s390/cio/chp.h b/drivers/s390/cio/chp.h
new file mode 100644
index 000000000000..65286563c592
--- /dev/null
+++ b/drivers/s390/cio/chp.h
@@ -0,0 +1,53 @@
+/*
+ *  drivers/s390/cio/chp.h
+ *
+ *    Copyright IBM Corp. 2007
+ *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#ifndef S390_CHP_H
+#define S390_CHP_H S390_CHP_H
+
+#include <linux/types.h>
+#include <linux/device.h>
+#include <asm/chpid.h>
+#include "chsc.h"
+
+#define CHP_STATUS_STANDBY              0
+#define CHP_STATUS_CONFIGURED           1
+#define CHP_STATUS_RESERVED             2
+#define CHP_STATUS_NOT_RECOGNIZED       3
+
+static inline int chp_test_bit(u8 *bitmap, int num)
+{
+        int byte = num >> 3;
+        int mask = 128 >> (num & 7);
+
+        return (bitmap[byte] & mask) ? 1 : 0;
+}
+
+
+struct channel_path {
+        struct chp_id chpid;
+        int state;
+        struct channel_path_desc desc;
+        /* Channel-measurement related stuff: */
+        int cmg;
+        int shared;
+        void *cmg_chars;
+        struct device dev;
+};
+
+int chp_get_status(struct chp_id chpid);
+u8 chp_get_sch_opm(struct subchannel *sch);
+int chp_is_registered(struct chp_id chpid);
+void *chp_get_chp_desc(struct chp_id chpid);
+void chp_process_crw(int id, int available);
+void chp_remove_cmg_attr(struct channel_path *chp);
+int chp_add_cmg_attr(struct channel_path *chp);
+int chp_new(struct chp_id chpid);
+void chp_cfg_schedule(struct chp_id chpid, int configure);
+void chp_cfg_cancel_deconfigure(struct chp_id chpid);
+int chp_info_get_status(struct chp_id chpid);
+
+#endif /* S390_CHP_H */
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6f05a44e3817..ea92ac4d6577 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -15,202 +15,124 @@
 #include <linux/device.h>
 
 #include <asm/cio.h>
+#include <asm/chpid.h>
 
 #include "css.h"
 #include "cio.h"
 #include "cio_debug.h"
 #include "ioasm.h"
+#include "chp.h"
 #include "chsc.h"
 
 static void *sei_page;
 
-static int new_channel_path(int chpid);
-
-static inline void
-set_chp_logically_online(int chp, int onoff)
-{
-        css[0]->chps[chp]->state = onoff;
-}
-
-static int
-get_chp_status(int chp)
-{
-        return (css[0]->chps[chp] ? css[0]->chps[chp]->state : -ENODEV);
-}
-
-void
-chsc_validate_chpids(struct subchannel *sch)
-{
-        int mask, chp;
-
-        for (chp = 0; chp <= 7; chp++) {
-                mask = 0x80 >> chp;
-                if (!get_chp_status(sch->schib.pmcw.chpid[chp]))
-                        /* disable using this path */
-                        sch->opm &= ~mask;
-        }
-}
-
-void
-chpid_is_actually_online(int chp)
-{
-        int state;
-
-        state = get_chp_status(chp);
-        if (state < 0) {
-                need_rescan = 1;
-                queue_work(slow_path_wq, &slow_path_work);
-        } else
-                WARN_ON(!state);
-}
+struct chsc_ssd_area {
+        struct chsc_header request;
+        u16 :10;
+        u16 ssid:2;
+        u16 :4;
+        u16 f_sch;        /* first subchannel */
+        u16 :16;
+        u16 l_sch;        /* last subchannel */
+        u32 :32;
+        struct chsc_header response;
+        u32 :32;
+        u8 sch_valid : 1;
+        u8 dev_valid : 1;
+        u8 st        : 3; /* subchannel type */
+        u8 zeroes    : 3;
+        u8  unit_addr;    /* unit address */
+        u16 devno;        /* device number */
+        u8 path_mask;
+        u8 fla_valid_mask;
+        u16 sch;          /* subchannel */
+        u8 chpid[8];      /* chpids 0-7 */
+        u16 fla[8];       /* full link addresses 0-7 */
+} __attribute__ ((packed));
 
-/* FIXME: this is _always_ called for every subchannel. shouldn't we
- *        process more than one at a time? */
-static int
-chsc_get_sch_desc_irq(struct subchannel *sch, void *page)
+int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
 {
-        int ccode, j;
-
-        struct {
-                struct chsc_header request;
-                u16 reserved1a:10;
-                u16 ssid:2;
-                u16 reserved1b:4;
-                u16 f_sch;        /* first subchannel */
-                u16 reserved2;
-                u16 l_sch;        /* last subchannel */
-                u32 reserved3;
-                struct chsc_header response;
-                u32 reserved4;
-                u8 sch_valid : 1;
-                u8 dev_valid : 1;
-                u8 st        : 3; /* subchannel type */
-                u8 zeroes    : 3;
-                u8  unit_addr;    /* unit address */
-                u16 devno;        /* device number */
-                u8 path_mask;
-                u8 fla_valid_mask;
-                u16 sch;          /* subchannel */
-                u8 chpid[8];      /* chpids 0-7 */
-                u16 fla[8];       /* full link addresses 0-7 */
-        } __attribute__ ((packed)) *ssd_area;
-
-        ssd_area = page;
+        unsigned long page;
+        struct chsc_ssd_area *ssd_area;
+        int ccode;
+        int ret;
+        int i;
+        int mask;
 
+        page = get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        if (!page)
+                return -ENOMEM;
+        ssd_area = (struct chsc_ssd_area *) page;
         ssd_area->request.length = 0x0010;
         ssd_area->request.code = 0x0004;
-
-        ssd_area->ssid = sch->schid.ssid;
-        ssd_area->f_sch = sch->schid.sch_no;
-        ssd_area->l_sch = sch->schid.sch_no;
+        ssd_area->ssid = schid.ssid;
+        ssd_area->f_sch = schid.sch_no;
+        ssd_area->l_sch = schid.sch_no;
 
         ccode = chsc(ssd_area);
+        /* Check response. */
         if (ccode > 0) {
-                pr_debug("chsc returned with ccode = %d\n", ccode);
-                return (ccode == 3) ? -ENODEV : -EBUSY;
+                ret = (ccode == 3) ? -ENODEV : -EBUSY;
+                goto out_free;
         }
-
-        switch (ssd_area->response.code) {
-        case 0x0001: /* everything ok */
-                break;
-        case 0x0002:
-                CIO_CRW_EVENT(2, "Invalid command!\n");
-                return -EINVAL;
-        case 0x0003:
-                CIO_CRW_EVENT(2, "Error in chsc request block!\n");
-                return -EINVAL;
-        case 0x0004:
-                CIO_CRW_EVENT(2, "Model does not provide ssd\n");
-                return -EOPNOTSUPP;
-        default:
-                CIO_CRW_EVENT(2, "Unknown CHSC response %d\n",
+        if (ssd_area->response.code != 0x0001) {
+                CIO_MSG_EVENT(2, "chsc: ssd failed for 0.%x.%04x (rc=%04x)\n",
+                              schid.ssid, schid.sch_no,
                               ssd_area->response.code);
-                return -EIO;
+                ret = -EIO;
+                goto out_free;
         }
-
-        /*
-         * ssd_area->st stores the type of the detected
-         * subchannel, with the following definitions:
-         *
-         * 0: I/O subchannel:     All fields have meaning
-         * 1: CHSC subchannel:    Only sch_val, st and sch
-         *                        have meaning
-         * 2: Message subchannel: All fields except unit_addr
-         *                        have meaning
-         * 3: ADM subchannel:     Only sch_val, st and sch
-         *                        have meaning
-         *
-         * Other types are currently undefined.
-         */
-        if (ssd_area->st > 3) { /* uhm, that looks strange... */
-                CIO_CRW_EVENT(0, "Strange subchannel type %d"
-                              " for sch 0.%x.%04x\n", ssd_area->st,
-                              sch->schid.ssid, sch->schid.sch_no);
-                /*
-                 * There may have been a new subchannel type defined in the
-                 * time since this code was written; since we don't know which
-                 * fields have meaning and what to do with it we just jump out
-                 */
-                return 0;
-        } else {
-                const char *type[4] = {"I/O", "chsc", "message", "ADM"};
-                CIO_CRW_EVENT(6, "ssd: sch 0.%x.%04x is %s subchannel\n",
-                              sch->schid.ssid, sch->schid.sch_no,
-                              type[ssd_area->st]);
-
-                sch->ssd_info.valid = 1;
-                sch->ssd_info.type = ssd_area->st;
+        if (!ssd_area->sch_valid) {
+                ret = -ENODEV;
+                goto out_free;
         }
-
-        if (ssd_area->st == 0 || ssd_area->st == 2) {
-                for (j = 0; j < 8; j++) {
-                        if (!((0x80 >> j) & ssd_area->path_mask &
-                              ssd_area->fla_valid_mask))
-                                continue;
-                        sch->ssd_info.chpid[j] = ssd_area->chpid[j];
-                        sch->ssd_info.fla[j]   = ssd_area->fla[j];
+        /* Copy data */
+        ret = 0;
+        memset(ssd, 0, sizeof(struct chsc_ssd_info));
+        if ((ssd_area->st != 0) && (ssd_area->st != 2))
+                goto out_free;
+        ssd->path_mask = ssd_area->path_mask;
+        ssd->fla_valid_mask = ssd_area->fla_valid_mask;
+        for (i = 0; i < 8; i++) {
+                mask = 0x80 >> i;
+                if (ssd_area->path_mask & mask) {
+                        chp_id_init(&ssd->chpid[i]);
+                        ssd->chpid[i].id = ssd_area->chpid[i];
                 }
+                if (ssd_area->fla_valid_mask & mask)
+                        ssd->fla[i] = ssd_area->fla[i];
         }
-        return 0;
+out_free:
+        free_page(page);
+        return ret;
 }
 
-int
-css_get_ssd_info(struct subchannel *sch)
+static int check_for_io_on_path(struct subchannel *sch, int mask)
 {
-        int ret;
-        void *page;
+        int cc;
 
-        page = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
-        if (!page)
-                return -ENOMEM;
-        spin_lock_irq(sch->lock);
-        ret = chsc_get_sch_desc_irq(sch, page);
-        if (ret) {
-                static int cio_chsc_err_msg;
-                
-                if (!cio_chsc_err_msg) {
-                        printk(KERN_ERR
-                               "chsc_get_sch_descriptions:"
-                               " Error %d while doing chsc; "
-                               "processing some machine checks may "
-                               "not work\n", ret);
-                        cio_chsc_err_msg = 1;
-                }
-        }
-        spin_unlock_irq(sch->lock);
-        free_page((unsigned long)page);
-        if (!ret) {
-                int j, chpid, mask;
-                /* Allocate channel path structures, if needed. */
-                for (j = 0; j < 8; j++) {
-                        mask = 0x80 >> j;
-                        chpid = sch->ssd_info.chpid[j];
-                        if ((sch->schib.pmcw.pim & mask) &&
-                            (get_chp_status(chpid) < 0))
-                            new_channel_path(chpid);
-                }
+        cc = stsch(sch->schid, &sch->schib);
+        if (cc)
+                return 0;
+        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == mask)
+                return 1;
+        return 0;
+}
+
+static void terminate_internal_io(struct subchannel *sch)
+{
+        if (cio_clear(sch)) {
+                /* Recheck device in case clear failed. */
+                sch->lpm = 0;
+                if (device_trigger_verify(sch) != 0)
+                        css_schedule_eval(sch->schid);
+                return;
         }
-        return ret;
+        /* Request retry of internal operation. */
+        device_set_intretry(sch);
+        /* Call handler. */
+        if (sch->driver && sch->driver->termination)
+                sch->driver->termination(&sch->dev);
 }
 
 static int
@@ -219,7 +141,7 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         int j;
         int mask;
         struct subchannel *sch;
-        struct channel_path *chpid;
+        struct chp_id *chpid;
         struct schib schib;
 
         sch = to_subchannel(dev);
@@ -243,106 +165,50 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         if (sch->schib.pmcw.pim == 0x80)
                 goto out_unreg;
 
-        if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
-            (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
-            (sch->schib.pmcw.lpum == mask)) {
-                int cc;
-
-                cc = cio_clear(sch);
-                if (cc == -ENODEV)
+        if (check_for_io_on_path(sch, mask)) {
+                if (device_is_online(sch))
+                        device_kill_io(sch);
+                else {
+                        terminate_internal_io(sch);
+                        /* Re-start path verification. */
+                        if (sch->driver && sch->driver->verify)
+                                sch->driver->verify(&sch->dev);
+                }
+        } else {
+                /* trigger path verification. */
+                if (sch->driver && sch->driver->verify)
+                        sch->driver->verify(&sch->dev);
+                else if (sch->lpm == mask)
                         goto out_unreg;
-                /* Request retry of internal operation. */
-                device_set_intretry(sch);
-                /* Call handler. */
-                if (sch->driver && sch->driver->termination)
-                        sch->driver->termination(&sch->dev);
-                goto out_unlock;
         }
 
-        /* trigger path verification. */
-        if (sch->driver && sch->driver->verify)
-                sch->driver->verify(&sch->dev);
-        else if (sch->lpm == mask)
-                goto out_unreg;
-out_unlock:
         spin_unlock_irq(sch->lock);
         return 0;
+
 out_unreg:
-        spin_unlock_irq(sch->lock);
         sch->lpm = 0;
-        if (css_enqueue_subchannel_slow(sch->schid)) {
-                css_clear_subchannel_slow_list();
-                need_rescan = 1;
-        }
+        spin_unlock_irq(sch->lock);
+        css_schedule_eval(sch->schid);
         return 0;
 }
 
-static void
-s390_set_chpid_offline( __u8 chpid)
+void chsc_chp_offline(struct chp_id chpid)
 {
         char dbf_txt[15];
-        struct device *dev;
 
-        sprintf(dbf_txt, "chpr%x", chpid);
+        sprintf(dbf_txt, "chpr%x.%02x", chpid.cssid, chpid.id);
         CIO_TRACE_EVENT(2, dbf_txt);
 
-        if (get_chp_status(chpid) <= 0)
+        if (chp_get_status(chpid) <= 0)
                 return;
-        dev = get_device(&css[0]->chps[chpid]->dev);
-        bus_for_each_dev(&css_bus_type, NULL, to_channelpath(dev),
+        bus_for_each_dev(&css_bus_type, NULL, &chpid,
                          s390_subchannel_remove_chpid);
-
-        if (need_rescan || css_slow_subchannels_exist())
-                queue_work(slow_path_wq, &slow_path_work);
-        put_device(dev);
-}
-
-struct res_acc_data {
-        struct channel_path *chp;
-        u32 fla_mask;
-        u16 fla;
-};
-
-static int
-s390_process_res_acc_sch(struct res_acc_data *res_data, struct subchannel *sch)
-{
-        int found;
-        int chp;
-        int ccode;
-        
-        found = 0;
-        for (chp = 0; chp <= 7; chp++)
-                /*
-                 * check if chpid is in information updated by ssd
-                 */
-                if (sch->ssd_info.valid &&
-                    sch->ssd_info.chpid[chp] == res_data->chp->id &&
-                    (sch->ssd_info.fla[chp] & res_data->fla_mask)
-                    == res_data->fla) {
-                        found = 1;
-                        break;
-                }
-        
-        if (found == 0)
-                return 0;
-
-        /*
-         * Do a stsch to update our subchannel structure with the
-         * new path information and eventually check for logically
-         * offline chpids.
-         */
-        ccode = stsch(sch->schid, &sch->schib);
-        if (ccode > 0)
-                return 0;
-
-        return 0x80 >> chp;
 }
 
 static int
 s390_process_res_acc_new_sch(struct subchannel_id schid)
 {
         struct schib schib;
-        int ret;
         /*
          * We don't know the device yet, but since a path
          * may be available now to the device we'll have
@@ -353,14 +219,35 @@ s390_process_res_acc_new_sch(struct subchannel_id schid)
          */
         if (stsch_err(schid, &schib))
                 /* We're through */
-                return need_rescan ? -EAGAIN : -ENXIO;
+                return -ENXIO;
 
         /* Put it on the slow path. */
-        ret = css_enqueue_subchannel_slow(schid);
-        if (ret) {
-                css_clear_subchannel_slow_list();
-                need_rescan = 1;
-                return -EAGAIN;
+        css_schedule_eval(schid);
+        return 0;
+}
+
+struct res_acc_data {
+        struct chp_id chpid;
+        u32 fla_mask;
+        u16 fla;
+};
+
+static int get_res_chpid_mask(struct chsc_ssd_info *ssd,
+                              struct res_acc_data *data)
+{
+        int i;
+        int mask;
+
+        for (i = 0; i < 8; i++) {
+                mask = 0x80 >> i;
+                if (!(ssd->path_mask & mask))
+                        continue;
+                if (!chp_id_is_equal(&ssd->chpid[i], &data->chpid))
+                        continue;
+                if ((ssd->fla_valid_mask & mask) &&
+                    ((ssd->fla[i] & data->fla_mask) != data->fla))
+                        continue;
+                return mask;
         }
         return 0;
 }
@@ -379,14 +266,11 @@ __s390_process_res_acc(struct subchannel_id schid, void *data)
                 return s390_process_res_acc_new_sch(schid);
 
         spin_lock_irq(sch->lock);
-
-        chp_mask = s390_process_res_acc_sch(res_data, sch);
-
-        if (chp_mask == 0) {
-                spin_unlock_irq(sch->lock);
-                put_device(&sch->dev);
-                return 0;
-        }
+        chp_mask = get_res_chpid_mask(&sch->ssd_info, res_data);
+        if (chp_mask == 0)
+                goto out;
+        if (stsch(sch->schid, &sch->schib))
+                goto out;
         old_lpm = sch->lpm;
         sch->lpm = ((sch->schib.pmcw.pim &
                      sch->schib.pmcw.pam &
@@ -396,20 +280,18 @@ __s390_process_res_acc(struct subchannel_id schid, void *data)
                 device_trigger_reprobe(sch);
         else if (sch->driver && sch->driver->verify)
                 sch->driver->verify(&sch->dev);
-
+out:
         spin_unlock_irq(sch->lock);
         put_device(&sch->dev);
         return 0;
 }
 
-
-static int
-s390_process_res_acc (struct res_acc_data *res_data)
+static void s390_process_res_acc (struct res_acc_data *res_data)
 {
-        int rc;
         char dbf_txt[15];
 
-        sprintf(dbf_txt, "accpr%x", res_data->chp->id);
+        sprintf(dbf_txt, "accpr%x.%02x", res_data->chpid.cssid,
+                res_data->chpid.id);
         CIO_TRACE_EVENT( 2, dbf_txt);
         if (res_data->fla != 0) {
                 sprintf(dbf_txt, "fla%x", res_data->fla);
@@ -423,12 +305,7 @@ s390_process_res_acc (struct res_acc_data *res_data)
          * The more information we have (info), the less scanning
          * will we have to do.
          */
-        rc = for_each_subchannel(__s390_process_res_acc, res_data);
-        if (css_slow_subchannels_exist())
-                rc = -EAGAIN;
-        else if (rc != -EAGAIN)
-                rc = 0;
-        return rc;
+        for_each_subchannel(__s390_process_res_acc, res_data);
 }
 
 static int
@@ -480,43 +357,45 @@ struct chsc_sei_area {
         /* ccdf has to be big enough for a link-incident record */
 } __attribute__ ((packed));
 
-static int chsc_process_sei_link_incident(struct chsc_sei_area *sei_area)
+static void chsc_process_sei_link_incident(struct chsc_sei_area *sei_area)
 {
-        int chpid;
+        struct chp_id chpid;
+        int id;
 
         CIO_CRW_EVENT(4, "chsc: link incident (rs=%02x, rs_id=%04x)\n",
                       sei_area->rs, sei_area->rsid);
         if (sei_area->rs != 4)
-                return 0;
-        chpid = __get_chpid_from_lir(sei_area->ccdf);
-        if (chpid < 0)
+                return;
+        id = __get_chpid_from_lir(sei_area->ccdf);
+        if (id < 0)
                 CIO_CRW_EVENT(4, "chsc: link incident - invalid LIR\n");
-        else
-                s390_set_chpid_offline(chpid);
-
-        return 0;
+        else {
+                chp_id_init(&chpid);
+                chpid.id = id;
+                chsc_chp_offline(chpid);
+        }
 }
 
-static int chsc_process_sei_res_acc(struct chsc_sei_area *sei_area)
+static void chsc_process_sei_res_acc(struct chsc_sei_area *sei_area)
 {
         struct res_acc_data res_data;
-        struct device *dev;
+        struct chp_id chpid;
         int status;
-        int rc;
 
         CIO_CRW_EVENT(4, "chsc: resource accessibility event (rs=%02x, "
                       "rs_id=%04x)\n", sei_area->rs, sei_area->rsid);
         if (sei_area->rs != 4)
-                return 0;
+                return;
+        chp_id_init(&chpid);
+        chpid.id = sei_area->rsid;
         /* allocate a new channel path structure, if needed */
-        status = get_chp_status(sei_area->rsid);
+        status = chp_get_status(chpid);
         if (status < 0)
-                new_channel_path(sei_area->rsid);
+                chp_new(chpid);
         else if (!status)
-                return 0;
-        dev = get_device(&css[0]->chps[sei_area->rsid]->dev);
+                return;
         memset(&res_data, 0, sizeof(struct res_acc_data));
-        res_data.chp = to_channelpath(dev);
+        res_data.chpid = chpid;
         if ((sei_area->vf & 0xc0) != 0) {
                 res_data.fla = sei_area->fla;
                 if ((sei_area->vf & 0xc0) == 0xc0)
@@ -526,51 +405,82 @@ static int chsc_process_sei_res_acc(struct chsc_sei_area *sei_area)
                         /* link address */
                         res_data.fla_mask = 0xff00;
         }
-        rc = s390_process_res_acc(&res_data);
-        put_device(dev);
-
-        return rc;
+        s390_process_res_acc(&res_data);
 }
 
-static int chsc_process_sei(struct chsc_sei_area *sei_area)
+struct chp_config_data {
+        u8 map[32];
+        u8 op;
+        u8 pc;
+};
+
+static void chsc_process_sei_chp_config(struct chsc_sei_area *sei_area)
 {
-        int rc;
+        struct chp_config_data *data;
+        struct chp_id chpid;
+        int num;
+
+        CIO_CRW_EVENT(4, "chsc: channel-path-configuration notification\n");
+        if (sei_area->rs != 0)
+                return;
+        data = (struct chp_config_data *) &(sei_area->ccdf);
+        chp_id_init(&chpid);
+        for (num = 0; num <= __MAX_CHPID; num++) {
+                if (!chp_test_bit(data->map, num))
+                        continue;
+                chpid.id = num;
+                printk(KERN_WARNING "cio: processing configure event %d for "
+                       "chpid %x.%02x\n", data->op, chpid.cssid, chpid.id);
+                switch (data->op) {
+                case 0:
+                        chp_cfg_schedule(chpid, 1);
+                        break;
+                case 1:
+                        chp_cfg_schedule(chpid, 0);
+                        break;
+                case 2:
+                        chp_cfg_cancel_deconfigure(chpid);
+                        break;
+                }
+        }
+}
 
+static void chsc_process_sei(struct chsc_sei_area *sei_area)
+{
         /* Check if we might have lost some information. */
-        if (sei_area->flags & 0x40)
+        if (sei_area->flags & 0x40) {
                 CIO_CRW_EVENT(2, "chsc: event overflow\n");
+                css_schedule_eval_all();
+        }
         /* which kind of information was stored? */
-        rc = 0;
         switch (sei_area->cc) {
         case 1: /* link incident*/
-                rc = chsc_process_sei_link_incident(sei_area);
+                chsc_process_sei_link_incident(sei_area);
                 break;
         case 2: /* i/o resource accessibiliy */
-                rc = chsc_process_sei_res_acc(sei_area);
+                chsc_process_sei_res_acc(sei_area);
+                break;
+        case 8: /* channel-path-configuration notification */
+                chsc_process_sei_chp_config(sei_area);
                 break;
         default: /* other stuff */
                 CIO_CRW_EVENT(4, "chsc: unhandled sei content code %d\n",
                               sei_area->cc);
                 break;
         }
-
-        return rc;
 }
 
-int chsc_process_crw(void)
+void chsc_process_crw(void)
 {
         struct chsc_sei_area *sei_area;
-        int ret;
-        int rc;
 
         if (!sei_page)
-                return 0;
+                return;
         /* Access to sei_page is serialized through machine check handler
          * thread, so no need for locking. */
         sei_area = sei_page;
 
         CIO_TRACE_EVENT( 2, "prcss");
-        ret = 0;
         do {
                 memset(sei_area, 0, sizeof(*sei_area));
                 sei_area->request.length = 0x0010;
@@ -580,37 +490,26 @@ int chsc_process_crw(void)
 
                 if (sei_area->response.code == 0x0001) {
                         CIO_CRW_EVENT(4, "chsc: sei successful\n");
-                        rc = chsc_process_sei(sei_area);
-                        if (rc)
-                                ret = rc;
+                        chsc_process_sei(sei_area);
                 } else {
                         CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
                                       sei_area->response.code);
-                        ret = 0;
                         break;
                 }
         } while (sei_area->flags & 0x80);
-
-        return ret;
 }
 
 static int
 __chp_add_new_sch(struct subchannel_id schid)
 {
         struct schib schib;
-        int ret;
 
         if (stsch_err(schid, &schib))
                 /* We're through */
-                return need_rescan ? -EAGAIN : -ENXIO;
+                return -ENXIO;
 
         /* Put it on the slow path. */
-        ret = css_enqueue_subchannel_slow(schid);
-        if (ret) {
-                css_clear_subchannel_slow_list();
-                need_rescan = 1;
-                return -EAGAIN;
-        }
+        css_schedule_eval(schid);
         return 0;
 }
 
@@ -619,10 +518,10 @@ static int
 __chp_add(struct subchannel_id schid, void *data)
 {
         int i, mask;
-        struct channel_path *chp;
+        struct chp_id *chpid;
         struct subchannel *sch;
 
-        chp = data;
+        chpid = data;
         sch = get_subchannel_by_schid(schid);
         if (!sch)
                 /* Check if the subchannel is now available. */
@@ -631,7 +530,7 @@ __chp_add(struct subchannel_id schid, void *data)
         for (i=0; i<8; i++) {
                 mask = 0x80 >> i;
                 if ((sch->schib.pmcw.pim & mask) &&
-                    (sch->schib.pmcw.chpid[i] == chp->id)) {
+                    (sch->schib.pmcw.chpid[i] == chpid->id)) {
                         if (stsch(sch->schid, &sch->schib) != 0) {
                                 /* Endgame. */
                                 spin_unlock_irq(sch->lock);
@@ -657,122 +556,58 @@ __chp_add(struct subchannel_id schid, void *data)
         return 0;
 }
 
-static int
-chp_add(int chpid)
+void chsc_chp_online(struct chp_id chpid)
 {
-        int rc;
         char dbf_txt[15];
-        struct device *dev;
 
-        if (!get_chp_status(chpid))
-                return 0; /* no need to do the rest */
-        
-        sprintf(dbf_txt, "cadd%x", chpid);
+        sprintf(dbf_txt, "cadd%x.%02x", chpid.cssid, chpid.id);
         CIO_TRACE_EVENT(2, dbf_txt);
 
-        dev = get_device(&css[0]->chps[chpid]->dev);
-        rc = for_each_subchannel(__chp_add, to_channelpath(dev));
-        if (css_slow_subchannels_exist())
-                rc = -EAGAIN;
-        if (rc != -EAGAIN)
-                rc = 0;
-        put_device(dev);
-        return rc;
+        if (chp_get_status(chpid) != 0)
+                for_each_subchannel(__chp_add, &chpid);
 }
 
-/* 
- * Handling of crw machine checks with channel path source.
- */
-int
-chp_process_crw(int chpid, int on)
-{
-        if (on == 0) {
-                /* Path has gone. We use the link incident routine.*/
-                s390_set_chpid_offline(chpid);
-                return 0; /* De-register is async anyway. */
-        }
-        /*
-         * Path has come. Allocate a new channel path structure,
-         * if needed.
-         */
-        if (get_chp_status(chpid) < 0)
-                new_channel_path(chpid);
-        /* Avoid the extra overhead in process_rec_acc. */
-        return chp_add(chpid);
-}
-
-static int check_for_io_on_path(struct subchannel *sch, int index)
-{
-        int cc;
-
-        cc = stsch(sch->schid, &sch->schib);
-        if (cc)
-                return 0;
-        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == (0x80 >> index))
-                return 1;
-        return 0;
-}
-
-static void terminate_internal_io(struct subchannel *sch)
-{
-        if (cio_clear(sch)) {
-                /* Recheck device in case clear failed. */
-                sch->lpm = 0;
-                if (device_trigger_verify(sch) != 0) {
-                        if(css_enqueue_subchannel_slow(sch->schid)) {
-                                css_clear_subchannel_slow_list();
-                                need_rescan = 1;
-                        }
-                }
-                return;
-        }
-        /* Request retry of internal operation. */
-        device_set_intretry(sch);
-        /* Call handler. */
-        if (sch->driver && sch->driver->termination)
-                sch->driver->termination(&sch->dev);
-}
-
-static void
-__s390_subchannel_vary_chpid(struct subchannel *sch, __u8 chpid, int on)
+static void __s390_subchannel_vary_chpid(struct subchannel *sch,
+                                         struct chp_id chpid, int on)
 {
         int chp, old_lpm;
+        int mask;
         unsigned long flags;
 
-        if (!sch->ssd_info.valid)
-                return;
-        
         spin_lock_irqsave(sch->lock, flags);
         old_lpm = sch->lpm;
         for (chp = 0; chp < 8; chp++) {
-                if (sch->ssd_info.chpid[chp] != chpid)
+                mask = 0x80 >> chp;
+                if (!(sch->ssd_info.path_mask & mask))
+                        continue;
+                if (!chp_id_is_equal(&sch->ssd_info.chpid[chp], &chpid))
                         continue;
 
                 if (on) {
-                        sch->opm |= (0x80 >> chp);
-                        sch->lpm |= (0x80 >> chp);
+                        sch->opm |= mask;
+                        sch->lpm |= mask;
                         if (!old_lpm)
                                 device_trigger_reprobe(sch);
                         else if (sch->driver && sch->driver->verify)
                                 sch->driver->verify(&sch->dev);
                         break;
                 }
-                sch->opm &= ~(0x80 >> chp);
-                sch->lpm &= ~(0x80 >> chp);
-                if (check_for_io_on_path(sch, chp)) {
+                sch->opm &= ~mask;
+                sch->lpm &= ~mask;
+                if (check_for_io_on_path(sch, mask)) {
                         if (device_is_online(sch))
                                 /* Path verification is done after killing. */
                                 device_kill_io(sch);
-                        else
+                        else {
                                 /* Kill and retry internal I/O. */
                                 terminate_internal_io(sch);
-                } else if (!sch->lpm) {
-                        if (device_trigger_verify(sch) != 0) {
-                                if (css_enqueue_subchannel_slow(sch->schid)) {
-                                        css_clear_subchannel_slow_list();
-                                        need_rescan = 1;
-                                }
+                                /* Re-start path verification. */
+                                if (sch->driver && sch->driver->verify)
+                                        sch->driver->verify(&sch->dev);
                         }
+                } else if (!sch->lpm) {
+                        if (device_trigger_verify(sch) != 0)
+                                css_schedule_eval(sch->schid);
                 } else if (sch->driver && sch->driver->verify)
                         sch->driver->verify(&sch->dev);
                 break;
@@ -780,11 +615,10 @@ __s390_subchannel_vary_chpid(struct subchannel *sch, __u8 chpid, int on)
         spin_unlock_irqrestore(sch->lock, flags);
 }
 
-static int
-s390_subchannel_vary_chpid_off(struct device *dev, void *data)
+static int s390_subchannel_vary_chpid_off(struct device *dev, void *data)
 {
         struct subchannel *sch;
-        __u8 *chpid;
+        struct chp_id *chpid;
 
         sch = to_subchannel(dev);
         chpid = data;
@@ -793,11 +627,10 @@ s390_subchannel_vary_chpid_off(struct device *dev, void *data)
         return 0;
 }
 
-static int
-s390_subchannel_vary_chpid_on(struct device *dev, void *data)
+static int s390_subchannel_vary_chpid_on(struct device *dev, void *data)
 {
         struct subchannel *sch;
-        __u8 *chpid;
+        struct chp_id *chpid;
 
         sch = to_subchannel(dev);
         chpid = data;
@@ -821,40 +654,17 @@ __s390_vary_chpid_on(struct subchannel_id schid, void *data)
                 /* We're through */
                 return -ENXIO;
         /* Put it on the slow path. */
-        if (css_enqueue_subchannel_slow(schid)) {
-                css_clear_subchannel_slow_list();
-                need_rescan = 1;
-                return -EAGAIN;
-        }
+        css_schedule_eval(schid);
         return 0;
 }
 
-/*
- * Function: s390_vary_chpid
- * Varies the specified chpid online or offline
+/**
+ * chsc_chp_vary - propagate channel-path vary operation to subchannels
+ * @chpid: channl-path ID
+ * @on: non-zero for vary online, zero for vary offline
  */
-static int
-s390_vary_chpid( __u8 chpid, int on)
+int chsc_chp_vary(struct chp_id chpid, int on)
 {
-        char dbf_text[15];
-        int status;
-
-        sprintf(dbf_text, on?"varyon%x":"varyoff%x", chpid);
-        CIO_TRACE_EVENT( 2, dbf_text);
-
-        status = get_chp_status(chpid);
-        if (status < 0) {
-                printk(KERN_ERR "Can't vary unknown chpid %02X\n", chpid);
-                return -EINVAL;
-        }
-
-        if (!on && !status) {
-                printk(KERN_ERR "chpid %x is already offline\n", chpid);
-                return -EINVAL;
-        }
-
-        set_chp_logically_online(chpid, on);
-
         /*
          * Redo PathVerification on the devices the chpid connects to
          */
@@ -865,118 +675,9 @@ s390_vary_chpid( __u8 chpid, int on)
         if (on)
                 /* Scan for new devices on varied on path. */
                 for_each_subchannel(__s390_vary_chpid_on, NULL);
-        if (need_rescan || css_slow_subchannels_exist())
-                queue_work(slow_path_wq, &slow_path_work);
         return 0;
 }
 
-/*
- * Channel measurement related functions
- */
-static ssize_t
-chp_measurement_chars_read(struct kobject *kobj, char *buf, loff_t off,
-                           size_t count)
-{
-        struct channel_path *chp;
-        unsigned int size;
-
-        chp = to_channelpath(container_of(kobj, struct device, kobj));
-        if (!chp->cmg_chars)
-                return 0;
-
-        size = sizeof(struct cmg_chars);
-
-        if (off > size)
-                return 0;
-        if (off + count > size)
-                count = size - off;
-        memcpy(buf, chp->cmg_chars + off, count);
-        return count;
-}
-
-static struct bin_attribute chp_measurement_chars_attr = {
-        .attr = {
-                .name = "measurement_chars",
-                .mode = S_IRUSR,
-                .owner = THIS_MODULE,
-        },
-        .size = sizeof(struct cmg_chars),
-        .read = chp_measurement_chars_read,
-};
-
-static void
-chp_measurement_copy_block(struct cmg_entry *buf,
-                           struct channel_subsystem *css, int chpid)
-{
-        void *area;
-        struct cmg_entry *entry, reference_buf;
-        int idx;
-
-        if (chpid < 128) {
-                area = css->cub_addr1;
-                idx = chpid;
-        } else {
-                area = css->cub_addr2;
-                idx = chpid - 128;
-        }
-        entry = area + (idx * sizeof(struct cmg_entry));
-        do {
-                memcpy(buf, entry, sizeof(*entry));
-                memcpy(&reference_buf, entry, sizeof(*entry));
-        } while (reference_buf.values[0] != buf->values[0]);
-}
-
-static ssize_t
-chp_measurement_read(struct kobject *kobj, char *buf, loff_t off, size_t count)
-{
-        struct channel_path *chp;
-        struct channel_subsystem *css;
-        unsigned int size;
-
-        chp = to_channelpath(container_of(kobj, struct device, kobj));
-        css = to_css(chp->dev.parent);
-
-        size = sizeof(struct cmg_entry);
-
-        /* Only allow single reads. */
-        if (off || count < size)
-                return 0;
-        chp_measurement_copy_block((struct cmg_entry *)buf, css, chp->id);
-        count = size;
-        return count;
-}
-
-static struct bin_attribute chp_measurement_attr = {
-        .attr = {
-                .name = "measurement",
-                .mode = S_IRUSR,
-                .owner = THIS_MODULE,
-        },
-        .size = sizeof(struct cmg_entry),
-        .read = chp_measurement_read,
-};
-
-static void
-chsc_remove_chp_cmg_attr(struct channel_path *chp)
-{
-        device_remove_bin_file(&chp->dev, &chp_measurement_chars_attr);
-        device_remove_bin_file(&chp->dev, &chp_measurement_attr);
-}
-
-static int
-chsc_add_chp_cmg_attr(struct channel_path *chp)
-{
-        int ret;
-
-        ret = device_create_bin_file(&chp->dev, &chp_measurement_chars_attr);
-        if (ret)
-                return ret;
-        ret = device_create_bin_file(&chp->dev, &chp_measurement_attr);
-        if (ret)
-                device_remove_bin_file(&chp->dev, &chp_measurement_chars_attr);
-        return ret;
-}
-
 static void
 chsc_remove_cmg_attr(struct channel_subsystem *css)
 {
@@ -985,7 +686,7 @@ chsc_remove_cmg_attr(struct channel_subsystem *css)
         for (i = 0; i <= __MAX_CHPID; i++) {
                 if (!css->chps[i])
                         continue;
-                chsc_remove_chp_cmg_attr(css->chps[i]);
+                chp_remove_cmg_attr(css->chps[i]);
         }
 }
 
@@ -998,7 +699,7 @@ chsc_add_cmg_attr(struct channel_subsystem *css)
         for (i = 0; i <= __MAX_CHPID; i++) {
                 if (!css->chps[i])
                         continue;
-                ret = chsc_add_chp_cmg_attr(css->chps[i]);
+                ret = chp_add_cmg_attr(css->chps[i]);
                 if (ret)
                         goto cleanup;
         }
@@ -1007,12 +708,11 @@ cleanup:
         for (--i; i >= 0; i--) {
                 if (!css->chps[i])
                         continue;
-                chsc_remove_chp_cmg_attr(css->chps[i]);
+                chp_remove_cmg_attr(css->chps[i]);
         }
         return ret;
 }
 
-
 static int
 __chsc_do_secm(struct channel_subsystem *css, int enable, void *page)
 {
@@ -1118,7 +818,7 @@ chsc_secm(struct channel_subsystem *css, int enable)
                 } else
                         chsc_remove_cmg_attr(css);
         }
-        if (enable && !css->cm_enabled) {
+        if (!css->cm_enabled) {
                 free_page((unsigned long)css->cub_addr1);
                 free_page((unsigned long)css->cub_addr2);
         }
@@ -1127,109 +827,8 @@ chsc_secm(struct channel_subsystem *css, int enable)
         return ret;
 }
 
-/*
- * Files for the channel path entries.
- */
-static ssize_t
-chp_status_show(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct channel_path *chp = container_of(dev, struct channel_path, dev);
-
-        if (!chp)
-                return 0;
-        return (get_chp_status(chp->id) ? sprintf(buf, "online\n") :
-                sprintf(buf, "offline\n"));
-}
-
-static ssize_t
-chp_status_write(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
-{
-        struct channel_path *cp = container_of(dev, struct channel_path, dev);
-        char cmd[10];
-        int num_args;
-        int error;
-
-        num_args = sscanf(buf, "%5s", cmd);
-        if (!num_args)
-                return count;
-
-        if (!strnicmp(cmd, "on", 2))
-                error = s390_vary_chpid(cp->id, 1);
-        else if (!strnicmp(cmd, "off", 3))
-                error = s390_vary_chpid(cp->id, 0);
-        else
-                error = -EINVAL;
-
-        return error < 0 ? error : count;
-
-}
-
-static DEVICE_ATTR(status, 0644, chp_status_show, chp_status_write);
-
-static ssize_t
-chp_type_show(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct channel_path *chp = container_of(dev, struct channel_path, dev);
-
-        if (!chp)
-                return 0;
-        return sprintf(buf, "%x\n", chp->desc.desc);
-}
-
-static DEVICE_ATTR(type, 0444, chp_type_show, NULL);
-
-static ssize_t
-chp_cmg_show(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct channel_path *chp = to_channelpath(dev);
-
-        if (!chp)
-                return 0;
-        if (chp->cmg == -1) /* channel measurements not available */
-                return sprintf(buf, "unknown\n");
-        return sprintf(buf, "%x\n", chp->cmg);
-}
-
-static DEVICE_ATTR(cmg, 0444, chp_cmg_show, NULL);
-
-static ssize_t
-chp_shared_show(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct channel_path *chp = to_channelpath(dev);
-
-        if (!chp)
-                return 0;
-        if (chp->shared == -1) /* channel measurements not available */
-                return sprintf(buf, "unknown\n");
-        return sprintf(buf, "%x\n", chp->shared);
-}
-
-static DEVICE_ATTR(shared, 0444, chp_shared_show, NULL);
-
-static struct attribute * chp_attrs[] = {
-        &dev_attr_status.attr,
-        &dev_attr_type.attr,
-        &dev_attr_cmg.attr,
-        &dev_attr_shared.attr,
-        NULL,
-};
-
-static struct attribute_group chp_attr_group = {
-        .attrs = chp_attrs,
-};
-
-static void
-chp_release(struct device *dev)
-{
-        struct channel_path *cp;
-        
-        cp = container_of(dev, struct channel_path, dev);
-        kfree(cp);
-}
-
-static int
-chsc_determine_channel_path_description(int chpid,
-                                        struct channel_path_desc *desc)
+int chsc_determine_channel_path_description(struct chp_id chpid,
+                                            struct channel_path_desc *desc)
 {
         int ccode, ret;
 
@@ -1252,8 +851,8 @@ chsc_determine_channel_path_description(int chpid,
         scpd_area->request.length = 0x0010;
         scpd_area->request.code = 0x0002;
 
-        scpd_area->first_chpid = chpid;
-        scpd_area->last_chpid = chpid;
+        scpd_area->first_chpid = chpid.id;
+        scpd_area->last_chpid = chpid.id;
 
         ccode = chsc(scpd_area);
         if (ccode > 0) {
@@ -1316,8 +915,7 @@ chsc_initialize_cmg_chars(struct channel_path *chp, u8 cmcv,
         }
 }
 
-static int
-chsc_get_channel_measurement_chars(struct channel_path *chp)
+int chsc_get_channel_measurement_chars(struct channel_path *chp)
 {
         int ccode, ret;
 
@@ -1349,8 +947,8 @@ chsc_get_channel_measurement_chars(struct channel_path *chp)
         scmc_area->request.length = 0x0010;
         scmc_area->request.code = 0x0022;
 
-        scmc_area->first_chpid = chp->id;
-        scmc_area->last_chpid = chp->id;
+        scmc_area->first_chpid = chp->chpid.id;
+        scmc_area->last_chpid = chp->chpid.id;
 
         ccode = chsc(scmc_area);
         if (ccode > 0) {
@@ -1392,94 +990,6 @@ out:
         return ret;
 }
 
-/*
- * Entries for chpids on the system bus.
- * This replaces /proc/chpids.
- */
-static int
-new_channel_path(int chpid)
-{
-        struct channel_path *chp;
-        int ret;
-
-        chp = kzalloc(sizeof(struct channel_path), GFP_KERNEL);
-        if (!chp)
-                return -ENOMEM;
-
-        /* fill in status, etc. */
-        chp->id = chpid;
-        chp->state = 1;
-        chp->dev.parent = &css[0]->device;
-        chp->dev.release = chp_release;
-        snprintf(chp->dev.bus_id, BUS_ID_SIZE, "chp0.%x", chpid);
-
-        /* Obtain channel path description and fill it in. */
-        ret = chsc_determine_channel_path_description(chpid, &chp->desc);
-        if (ret)
-                goto out_free;
-        /* Get channel-measurement characteristics. */
-        if (css_characteristics_avail && css_chsc_characteristics.scmc
-            && css_chsc_characteristics.secm) {
-                ret = chsc_get_channel_measurement_chars(chp);
-                if (ret)
-                        goto out_free;
-        } else {
-                static int msg_done;
-
-                if (!msg_done) {
-                        printk(KERN_WARNING "cio: Channel measurements not "
-                               "available, continuing.\n");
-                        msg_done = 1;
-                }
-                chp->cmg = -1;
-        }
-
-        /* make it known to the system */
-        ret = device_register(&chp->dev);
-        if (ret) {
-                printk(KERN_WARNING "%s: could not register %02x\n",
-                       __func__, chpid);
-                goto out_free;
-        }
-        ret = sysfs_create_group(&chp->dev.kobj, &chp_attr_group);
-        if (ret) {
-                device_unregister(&chp->dev);
-                goto out_free;
-        }
-        mutex_lock(&css[0]->mutex);
-        if (css[0]->cm_enabled) {
-                ret = chsc_add_chp_cmg_attr(chp);
-                if (ret) {
-                        sysfs_remove_group(&chp->dev.kobj, &chp_attr_group);
-                        device_unregister(&chp->dev);
-                        mutex_unlock(&css[0]->mutex);
-                        goto out_free;
-                }
-        }
-        css[0]->chps[chpid] = chp;
-        mutex_unlock(&css[0]->mutex);
-        return ret;
-out_free:
-        kfree(chp);
-        return ret;
-}
-
-void *
-chsc_get_chp_desc(struct subchannel *sch, int chp_no)
-{
-        struct channel_path *chp;
-        struct channel_path_desc *desc;
-
-        chp = css[0]->chps[sch->schib.pmcw.chpid[chp_no]];
-        if (!chp)
-                return NULL;
-        desc = kmalloc(sizeof(struct channel_path_desc), GFP_KERNEL);
-        if (!desc)
-                return NULL;
-        memcpy(desc, &chp->desc, sizeof(struct channel_path_desc));
-        return desc;
-}
-
 static int __init
 chsc_alloc_sei_area(void)
 {
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 0fb2b024208f..2ad81d11cf7b 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -1,9 +1,10 @@
 #ifndef S390_CHSC_H
 #define S390_CHSC_H
 
-#define CHSC_SEI_ACC_CHPID        1
-#define CHSC_SEI_ACC_LINKADDR     2
-#define CHSC_SEI_ACC_FULLLINKADDR 3
+#include <linux/types.h>
+#include <linux/device.h>
+#include <asm/chpid.h>
+#include "schid.h"
 
 #define CHSC_SDA_OC_MSS   0x2
 
@@ -33,23 +34,9 @@ struct channel_path_desc {
         u8 chpp;
 } __attribute__ ((packed));
 
-struct channel_path {
-        int id;
-        int state;
-        struct channel_path_desc desc;
-        /* Channel-measurement related stuff: */
-        int cmg;
-        int shared;
-        void *cmg_chars;
-        struct device dev;
-};
+struct channel_path;
 
-extern void s390_process_css( void );
-extern void chsc_validate_chpids(struct subchannel *);
-extern void chpid_is_actually_online(int);
-extern int css_get_ssd_info(struct subchannel *);
-extern int chsc_process_crw(void);
-extern int chp_process_crw(int, int);
+extern void chsc_process_crw(void);
 
 struct css_general_char {
         u64 : 41;
@@ -82,15 +69,26 @@ struct css_chsc_char {
 extern struct css_general_char css_general_characteristics;
 extern struct css_chsc_char css_chsc_characteristics;
 
+struct chsc_ssd_info {
+        u8 path_mask;
+        u8 fla_valid_mask;
+        struct chp_id chpid[8];
+        u16 fla[8];
+};
+extern int chsc_get_ssd_info(struct subchannel_id schid,
+                             struct chsc_ssd_info *ssd);
 extern int chsc_determine_css_characteristics(void);
 extern int css_characteristics_avail;
 
-extern void *chsc_get_chp_desc(struct subchannel*, int);
-
 extern int chsc_enable_facility(int);
 struct channel_subsystem;
 extern int chsc_secm(struct channel_subsystem *, int);
 
-#define to_channelpath(device) container_of(device, struct channel_path, dev)
+int chsc_chp_vary(struct chp_id chpid, int on);
+int chsc_determine_channel_path_description(struct chp_id chpid,
+                                            struct channel_path_desc *desc);
+void chsc_chp_online(struct chp_id chpid);
+void chsc_chp_offline(struct chp_id chpid);
+int chsc_get_channel_measurement_chars(struct channel_path *chp);
 
 #endif
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 9cb129ab5be5..ea1defba5693 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -22,6 +22,7 @@
 #include <asm/setup.h>
 #include <asm/reset.h>
 #include <asm/ipl.h>
+#include <asm/chpid.h>
 #include "airq.h"
 #include "cio.h"
 #include "css.h"
@@ -29,6 +30,7 @@
 #include "ioasm.h"
 #include "blacklist.h"
 #include "cio_debug.h"
+#include "chp.h"
 #include "../s390mach.h"
 
 debug_info_t *cio_debug_msg_id;
@@ -592,9 +594,10 @@ cio_validate_subchannel (struct subchannel *sch, struct subchannel_id schid)
                 err = -ENODEV;
                 goto out;
         }
-        sch->opm = 0xff;
-        if (!cio_is_console(sch->schid))
-                chsc_validate_chpids(sch);
+        if (cio_is_console(sch->schid))
+                sch->opm = 0xff;
+        else
+                sch->opm = chp_get_sch_opm(sch);
         sch->lpm = sch->schib.pmcw.pam & sch->opm;
 
         CIO_DEBUG(KERN_INFO, 0,
@@ -954,6 +957,7 @@ static void css_reset(void)
 {
         int i, ret;
         unsigned long long timeout;
+        struct chp_id chpid;
 
         /* Reset subchannels. */
         for_each_subchannel(__shutdown_subchannel_easy,  NULL);
@@ -963,8 +967,10 @@ static void css_reset(void)
         __ctl_set_bit(14, 28);
         /* Temporarily reenable machine checks. */
         local_mcck_enable();
+        chp_id_init(&chpid);
         for (i = 0; i <= __MAX_CHPID; i++) {
-                ret = rchp(i);
+                chpid.id = i;
+                ret = rchp(chpid);
                 if ((ret == 0) || (ret == 2))
                         /*
                          * rchp either succeeded, or another rchp is already
@@ -1048,37 +1054,19 @@ void reipl_ccw_dev(struct ccw_dev_id *devid)
         do_reipl_asm(*((__u32*)&schid));
 }
 
-static struct schib __initdata ipl_schib;
-
-/*
- * ipl_save_parameters gets called very early. It is not allowed to access
- * anything in the bss section at all. The bss section is not cleared yet,
- * but may contain some ipl parameters written by the firmware.
- * These parameters (if present) are copied to 0x2000.
- * To avoid corruption of the ipl parameters, all variables used by this
- * function must reside on the stack or in the data section.
- */
-void ipl_save_parameters(void)
+int __init cio_get_iplinfo(struct cio_iplinfo *iplinfo)
 {
         struct subchannel_id schid;
-        unsigned int *ipl_ptr;
-        void *src, *dst;
+        struct schib schib;
 
         schid = *(struct subchannel_id *)__LC_SUBCHANNEL_ID;
         if (!schid.one)
-                return;
-        if (stsch(schid, &ipl_schib))
-                return;
-        if (!ipl_schib.pmcw.dnv)
-                return;
-        ipl_devno = ipl_schib.pmcw.dev;
-        ipl_flags |= IPL_DEVNO_VALID;
-        if (!ipl_schib.pmcw.qf)
-                return;
-        ipl_flags |= IPL_PARMBLOCK_VALID;
-        ipl_ptr = (unsigned int *)__LC_IPL_PARMBLOCK_PTR;
-        src = (void *)(unsigned long)*ipl_ptr;
-        dst = (void *)IPL_PARMBLOCK_ORIGIN;
-        memmove(dst, src, PAGE_SIZE);
-        *ipl_ptr = IPL_PARMBLOCK_ORIGIN;
+                return -ENODEV;
+        if (stsch(schid, &schib))
+                return -ENODEV;
+        if (!schib.pmcw.dnv)
+                return -ENODEV;
+        iplinfo->devno = schib.pmcw.dev;
+        iplinfo->is_qdio = schib.pmcw.qf;
+        return 0;
 }
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 35154a210357..7446c39951a7 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -1,18 +1,11 @@
 #ifndef S390_CIO_H
 #define S390_CIO_H
 
-#include "schid.h"
 #include <linux/mutex.h>
-
-/*
- * where we put the ssd info
- */
-struct ssd_info {
-        __u8  valid:1;
-        __u8  type:7;           /* subchannel type */
-        __u8  chpid[8];         /* chpids */
-        __u16 fla[8];           /* full link addresses */
-} __attribute__ ((packed));
+#include <linux/device.h>
+#include <asm/chpid.h>
+#include "chsc.h"
+#include "schid.h"
 
 /*
  * path management control word
@@ -108,7 +101,7 @@ struct subchannel {
         struct schib schib;     /* subchannel information block */
         struct orb orb;         /* operation request block */
         struct ccw1 sense_ccw;  /* static ccw for sense command */
-        struct ssd_info ssd_info;       /* subchannel description */
+        struct chsc_ssd_info ssd_info;  /* subchannel description */
         struct device dev;      /* entry in device tree */
         struct css_driver *driver;
 } __attribute__ ((aligned(8)));
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 90b22faabbf7..28abd697be1a 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -476,7 +476,7 @@ struct cmb_area {
 };
 
 static struct cmb_area cmb_area = {
-        .lock = SPIN_LOCK_UNLOCKED,
+        .lock = __SPIN_LOCK_UNLOCKED(cmb_area.lock),
         .list = LIST_HEAD_INIT(cmb_area.list),
         .num_channels  = 1024,
 };
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index fe0ace7aece8..27c6d9e55b23 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -20,8 +20,9 @@
 #include "ioasm.h"
 #include "chsc.h"
 #include "device.h"
+#include "idset.h"
+#include "chp.h"
 
-int need_rescan = 0;
 int css_init_done = 0;
 static int need_reprobe = 0;
 static int max_ssid = 0;
@@ -125,8 +126,52 @@ void css_sch_device_unregister(struct subchannel *sch)
         mutex_unlock(&sch->reg_mutex);
 }
 
-static int
-css_register_subchannel(struct subchannel *sch)
+static void ssd_from_pmcw(struct chsc_ssd_info *ssd, struct pmcw *pmcw)
+{
+        int i;
+        int mask;
+
+        memset(ssd, 0, sizeof(struct chsc_ssd_info));
+        ssd->path_mask = pmcw->pim;
+        for (i = 0; i < 8; i++) {
+                mask = 0x80 >> i;
+                if (pmcw->pim & mask) {
+                        chp_id_init(&ssd->chpid[i]);
+                        ssd->chpid[i].id = pmcw->chpid[i];
+                }
+        }
+}
+
+static void ssd_register_chpids(struct chsc_ssd_info *ssd)
+{
+        int i;
+        int mask;
+
+        for (i = 0; i < 8; i++) {
+                mask = 0x80 >> i;
+                if (ssd->path_mask & mask)
+                        if (!chp_is_registered(ssd->chpid[i]))
+                                chp_new(ssd->chpid[i]);
+        }
+}
+
+void css_update_ssd_info(struct subchannel *sch)
+{
+        int ret;
+
+        if (cio_is_console(sch->schid)) {
+                /* Console is initialized too early for functions requiring
+                 * memory allocation. */
+                ssd_from_pmcw(&sch->ssd_info, &sch->schib.pmcw);
+        } else {
+                ret = chsc_get_ssd_info(sch->schid, &sch->ssd_info);
+                if (ret)
+                        ssd_from_pmcw(&sch->ssd_info, &sch->schib.pmcw);
+                ssd_register_chpids(&sch->ssd_info);
+        }
+}
+
+static int css_register_subchannel(struct subchannel *sch)
 {
         int ret;
 
@@ -135,9 +180,7 @@ css_register_subchannel(struct subchannel *sch)
         sch->dev.bus = &css_bus_type;
         sch->dev.release = &css_subchannel_release;
         sch->dev.groups = subch_attr_groups;
-
-        css_get_ssd_info(sch);
-
+        css_update_ssd_info(sch);
         /* make it known to the system */
         ret = css_sch_device_register(sch);
         if (ret) {
@@ -306,7 +349,7 @@ static int css_evaluate_new_subchannel(struct subchannel_id schid, int slow)
         return css_probe_device(schid);
 }
 
-static int css_evaluate_subchannel(struct subchannel_id schid, int slow)
+static void css_evaluate_subchannel(struct subchannel_id schid, int slow)
 {
         struct subchannel *sch;
         int ret;
@@ -317,53 +360,66 @@ static int css_evaluate_subchannel(struct subchannel_id schid, int slow)
                 put_device(&sch->dev);
         } else
                 ret = css_evaluate_new_subchannel(schid, slow);
-
-        return ret;
+        if (ret == -EAGAIN)
+                css_schedule_eval(schid);
 }
 
-static int
-css_rescan_devices(struct subchannel_id schid, void *data)
+static struct idset *slow_subchannel_set;
+static spinlock_t slow_subchannel_lock;
+
+static int __init slow_subchannel_init(void)
 {
-        return css_evaluate_subchannel(schid, 1);
+        spin_lock_init(&slow_subchannel_lock);
+        slow_subchannel_set = idset_sch_new();
+        if (!slow_subchannel_set) {
+                printk(KERN_WARNING "cio: could not allocate slow subchannel "
+                       "set\n");
+                return -ENOMEM;
+        }
+        return 0;
 }
 
-struct slow_subchannel {
-        struct list_head slow_list;
-        struct subchannel_id schid;
-};
-
-static LIST_HEAD(slow_subchannels_head);
-static DEFINE_SPINLOCK(slow_subchannel_lock);
+subsys_initcall(slow_subchannel_init);
 
-static void
-css_trigger_slow_path(struct work_struct *unused)
+static void css_slow_path_func(struct work_struct *unused)
 {
-        CIO_TRACE_EVENT(4, "slowpath");
-
-        if (need_rescan) {
-                need_rescan = 0;
-                for_each_subchannel(css_rescan_devices, NULL);
-                return;
-        }
+        struct subchannel_id schid;
 
+        CIO_TRACE_EVENT(4, "slowpath");
         spin_lock_irq(&slow_subchannel_lock);
-        while (!list_empty(&slow_subchannels_head)) {
-                struct slow_subchannel *slow_sch =
-                        list_entry(slow_subchannels_head.next,
-                                   struct slow_subchannel, slow_list);
-
-                list_del_init(slow_subchannels_head.next);
+        init_subchannel_id(&schid);
+        while (idset_sch_get_first(slow_subchannel_set, &schid)) {
+                idset_sch_del(slow_subchannel_set, schid);
                 spin_unlock_irq(&slow_subchannel_lock);
-                css_evaluate_subchannel(slow_sch->schid, 1);
+                css_evaluate_subchannel(schid, 1);
                 spin_lock_irq(&slow_subchannel_lock);
-                kfree(slow_sch);
         }
         spin_unlock_irq(&slow_subchannel_lock);
 }
 
-DECLARE_WORK(slow_path_work, css_trigger_slow_path);
+static DECLARE_WORK(slow_path_work, css_slow_path_func);
 struct workqueue_struct *slow_path_wq;
 
+void css_schedule_eval(struct subchannel_id schid)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&slow_subchannel_lock, flags);
+        idset_sch_add(slow_subchannel_set, schid);
+        queue_work(slow_path_wq, &slow_path_work);
+        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
+}
+
+void css_schedule_eval_all(void)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&slow_subchannel_lock, flags);
+        idset_fill(slow_subchannel_set);
+        queue_work(slow_path_wq, &slow_path_work);
+        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
+}
+
 /* Reprobe subchannel if unregistered. */
 static int reprobe_subchannel(struct subchannel_id schid, void *data)
 {
@@ -426,33 +482,14 @@ void css_schedule_reprobe(void)
 EXPORT_SYMBOL_GPL(css_schedule_reprobe);
 
 /*
- * Rescan for new devices. FIXME: This is slow.
- * This function is called when we have lost CRWs due to overflows and we have
- * to do subchannel housekeeping.
- */
-void
-css_reiterate_subchannels(void)
-{
-        css_clear_subchannel_slow_list();
-        need_rescan = 1;
-}
-
-/*
  * Called from the machine check handler for subchannel report words.
  */
-int
-css_process_crw(int rsid1, int rsid2)
+void css_process_crw(int rsid1, int rsid2)
 {
-        int ret;
         struct subchannel_id mchk_schid;
 
         CIO_CRW_EVENT(2, "source is subchannel %04X, subsystem id %x\n",
                       rsid1, rsid2);
-
-        if (need_rescan)
-                /* We need to iterate all subchannels anyway. */
-                return -EAGAIN;
-
         init_subchannel_id(&mchk_schid);
         mchk_schid.sch_no = rsid1;
         if (rsid2 != 0)
@@ -463,14 +500,7 @@ css_process_crw(int rsid1, int rsid2)
          * use stsch() to find out if the subchannel in question has come
          * or gone.
          */
-        ret = css_evaluate_subchannel(mchk_schid, 0);
-        if (ret == -EAGAIN) {
-                if (css_enqueue_subchannel_slow(mchk_schid)) {
-                        css_clear_subchannel_slow_list();
-                        need_rescan = 1;
-                }
-        }
-        return ret;
+        css_evaluate_subchannel(mchk_schid, 0);
 }
 
 static int __init
@@ -745,47 +775,6 @@ struct bus_type css_bus_type = {
 
 subsys_initcall(init_channel_subsystem);
 
-int
-css_enqueue_subchannel_slow(struct subchannel_id schid)
-{
-        struct slow_subchannel *new_slow_sch;
-        unsigned long flags;
-
-        new_slow_sch = kzalloc(sizeof(struct slow_subchannel), GFP_ATOMIC);
-        if (!new_slow_sch)
-                return -ENOMEM;
-        new_slow_sch->schid = schid;
-        spin_lock_irqsave(&slow_subchannel_lock, flags);
-        list_add_tail(&new_slow_sch->slow_list, &slow_subchannels_head);
-        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
-        return 0;
-}
-
-void
-css_clear_subchannel_slow_list(void)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&slow_subchannel_lock, flags);
-        while (!list_empty(&slow_subchannels_head)) {
-                struct slow_subchannel *slow_sch =
-                        list_entry(slow_subchannels_head.next,
-                                   struct slow_subchannel, slow_list);
-
-                list_del_init(slow_subchannels_head.next);
-                kfree(slow_sch);
-        }
-        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
-}
-
-
-
-int
-css_slow_subchannels_exist(void)
-{
-        return (!list_empty(&slow_subchannels_head));
-}
-
 MODULE_LICENSE("GPL");
 EXPORT_SYMBOL(css_bus_type);
 EXPORT_SYMBOL_GPL(css_characteristics_avail);
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index ca2bab932a8a..71fcfdc42800 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -4,8 +4,11 @@
 #include <linux/mutex.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
+#include <linux/device.h>
+#include <linux/types.h>
 
 #include <asm/cio.h>
+#include <asm/chpid.h>
 
 #include "schid.h"
 
@@ -143,13 +146,12 @@ extern void css_sch_device_unregister(struct subchannel *);
 extern struct subchannel * get_subchannel_by_schid(struct subchannel_id);
 extern int css_init_done;
 extern int for_each_subchannel(int(*fn)(struct subchannel_id, void *), void *);
-extern int css_process_crw(int, int);
+extern void css_process_crw(int, int);
 extern void css_reiterate_subchannels(void);
+void css_update_ssd_info(struct subchannel *sch);
 
 #define __MAX_SUBCHANNEL 65535
 #define __MAX_SSID 3
-#define __MAX_CHPID 255
-#define __MAX_CSSID 0
 
 struct channel_subsystem {
         u8 cssid;
@@ -185,16 +187,12 @@ int device_trigger_verify(struct subchannel *sch);
 void device_kill_pending_timer(struct subchannel *);
 
 /* Helper functions to build lists for the slow path. */
-extern int css_enqueue_subchannel_slow(struct subchannel_id schid);
-void css_walk_subchannel_slow_list(void (*fn)(unsigned long));
-void css_clear_subchannel_slow_list(void);
-int css_slow_subchannels_exist(void);
-extern int need_rescan;
+void css_schedule_eval(struct subchannel_id schid);
+void css_schedule_eval_all(void);
 
 int sch_is_pseudo_sch(struct subchannel *);
 
 extern struct workqueue_struct *slow_path_wq;
-extern struct work_struct slow_path_work;
 
 int subchannel_add_files (struct device *);
 extern struct attribute_group *subch_attr_groups[];
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e322111fb369..03355902c582 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -56,13 +56,12 @@ ccw_bus_match (struct device * dev, struct device_driver * drv)
 /* Store modalias string delimited by prefix/suffix string into buffer with
  * specified size. Return length of resulting string (excluding trailing '\0')
  * even if string doesn't fit buffer (snprintf semantics). */
-static int snprint_alias(char *buf, size_t size, const char *prefix,
+static int snprint_alias(char *buf, size_t size,
                          struct ccw_device_id *id, const char *suffix)
 {
         int len;
 
-        len = snprintf(buf, size, "%sccw:t%04Xm%02X", prefix, id->cu_type,
-                       id->cu_model);
+        len = snprintf(buf, size, "ccw:t%04Xm%02X", id->cu_type, id->cu_model);
         if (len > size)
                 return len;
         buf += len;
@@ -85,53 +84,40 @@ static int ccw_uevent(struct device *dev, char **envp, int num_envp,
         struct ccw_device *cdev = to_ccwdev(dev);
         struct ccw_device_id *id = &(cdev->id);
         int i = 0;
-        int len;
+        int len = 0;
+        int ret;
+        char modalias_buf[30];
 
         /* CU_TYPE= */
-        len = snprintf(buffer, buffer_size, "CU_TYPE=%04X", id->cu_type) + 1;
-        if (len > buffer_size || i >= num_envp)
-                return -ENOMEM;
-        envp[i++] = buffer;
-        buffer += len;
-        buffer_size -= len;
+        ret = add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+                             "CU_TYPE=%04X", id->cu_type);
+        if (ret)
+                return ret;
 
         /* CU_MODEL= */
-        len = snprintf(buffer, buffer_size, "CU_MODEL=%02X", id->cu_model) + 1;
-        if (len > buffer_size || i >= num_envp)
-                return -ENOMEM;
-        envp[i++] = buffer;
-        buffer += len;
-        buffer_size -= len;
+        ret = add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+                             "CU_MODEL=%02X", id->cu_model);
+        if (ret)
+                return ret;
 
         /* The next two can be zero, that's ok for us */
         /* DEV_TYPE= */
-        len = snprintf(buffer, buffer_size, "DEV_TYPE=%04X", id->dev_type) + 1;
-        if (len > buffer_size || i >= num_envp)
-                return -ENOMEM;
-        envp[i++] = buffer;
-        buffer += len;
-        buffer_size -= len;
+        ret = add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+                             "DEV_TYPE=%04X", id->dev_type);
+        if (ret)
+                return ret;
 
         /* DEV_MODEL= */
-        len = snprintf(buffer, buffer_size, "DEV_MODEL=%02X",
-                        (unsigned char) id->dev_model) + 1;
-        if (len > buffer_size || i >= num_envp)
-                return -ENOMEM;
-        envp[i++] = buffer;
-        buffer += len;
-        buffer_size -= len;
+        ret = add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+                             "DEV_MODEL=%02X", id->dev_model);
+        if (ret)
+                return ret;
 
         /* MODALIAS=  */
-        len = snprint_alias(buffer, buffer_size, "MODALIAS=", id, "") + 1;
-        if (len > buffer_size || i >= num_envp)
-                return -ENOMEM;
-        envp[i++] = buffer;
-        buffer += len;
-        buffer_size -= len;
-
-        envp[i] = NULL;
-
-        return 0;
+        snprint_alias(modalias_buf, sizeof(modalias_buf), id, "");
+        ret = add_uevent_var(envp, num_envp, &i, buffer, buffer_size, &len,
+                             "MODALIAS=%s", modalias_buf);
+        return ret;
 }
 
 struct bus_type ccw_bus_type;
@@ -230,12 +216,18 @@ static ssize_t
 chpids_show (struct device * dev, struct device_attribute *attr, char * buf)
 {
         struct subchannel *sch = to_subchannel(dev);
-        struct ssd_info *ssd = &sch->ssd_info;
+        struct chsc_ssd_info *ssd = &sch->ssd_info;
         ssize_t ret = 0;
         int chp;
+        int mask;
 
-        for (chp = 0; chp < 8; chp++)
-                ret += sprintf (buf+ret, "%02x ", ssd->chpid[chp]);
+        for (chp = 0; chp < 8; chp++) {
+                mask = 0x80 >> chp;
+                if (ssd->path_mask & mask)
+                        ret += sprintf(buf + ret, "%02x ", ssd->chpid[chp].id);
+                else
+                        ret += sprintf(buf + ret, "00 ");
+        }
         ret += sprintf (buf+ret, "\n");
         return min((ssize_t)PAGE_SIZE, ret);
 }
@@ -280,7 +272,7 @@ modalias_show (struct device *dev, struct device_attribute *attr, char *buf)
         struct ccw_device_id *id = &(cdev->id);
         int len;
 
-        len = snprint_alias(buf, PAGE_SIZE, "", id, "\n") + 1;
+        len = snprint_alias(buf, PAGE_SIZE, id, "\n") + 1;
 
         return len > PAGE_SIZE ? PAGE_SIZE : len;
 }
@@ -298,16 +290,10 @@ int ccw_device_is_orphan(struct ccw_device *cdev)
         return sch_is_pseudo_sch(to_subchannel(cdev->dev.parent));
 }
 
-static void ccw_device_unregister(struct work_struct *work)
+static void ccw_device_unregister(struct ccw_device *cdev)
 {
-        struct ccw_device_private *priv;
-        struct ccw_device *cdev;
-
-        priv = container_of(work, struct ccw_device_private, kick_work);
-        cdev = priv->cdev;
         if (test_and_clear_bit(1, &cdev->private->registered))
-                device_unregister(&cdev->dev);
-        put_device(&cdev->dev);
+                device_del(&cdev->dev);
 }
 
 static void
@@ -324,11 +310,8 @@ ccw_device_remove_disconnected(struct ccw_device *cdev)
                 spin_lock_irqsave(cdev->ccwlock, flags);
                 cdev->private->state = DEV_STATE_NOT_OPER;
                 spin_unlock_irqrestore(cdev->ccwlock, flags);
-                if (get_device(&cdev->dev)) {
-                        PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_unregister);
-                        queue_work(ccw_device_work, &cdev->private->kick_work);
-                }
+                ccw_device_unregister(cdev);
+                put_device(&cdev->dev);
                 return ;
         }
         sch = to_subchannel(cdev->dev.parent);
@@ -413,11 +396,60 @@ ccw_device_set_online(struct ccw_device *cdev)
         return (ret == 0) ? -ENODEV : ret;
 }
 
-static ssize_t
-online_store (struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+static void online_store_handle_offline(struct ccw_device *cdev)
+{
+        if (cdev->private->state == DEV_STATE_DISCONNECTED)
+                ccw_device_remove_disconnected(cdev);
+        else if (cdev->drv && cdev->drv->set_offline)
+                ccw_device_set_offline(cdev);
+}
+
+static int online_store_recog_and_online(struct ccw_device *cdev)
+{
+        int ret;
+
+        /* Do device recognition, if needed. */
+        if (cdev->id.cu_type == 0) {
+                ret = ccw_device_recognition(cdev);
+                if (ret) {
+                        printk(KERN_WARNING"Couldn't start recognition "
+                               "for device %s (ret=%d)\n",
+                               cdev->dev.bus_id, ret);
+                        return ret;
+                }
+                wait_event(cdev->private->wait_q,
+                           cdev->private->flags.recog_done);
+        }
+        if (cdev->drv && cdev->drv->set_online)
+                ccw_device_set_online(cdev);
+        return 0;
+}
+static void online_store_handle_online(struct ccw_device *cdev, int force)
+{
+        int ret;
+
+        ret = online_store_recog_and_online(cdev);
+        if (ret)
+                return;
+        if (force && cdev->private->state == DEV_STATE_BOXED) {
+                ret = ccw_device_stlck(cdev);
+                if (ret) {
+                        printk(KERN_WARNING"ccw_device_stlck for device %s "
+                               "returned %d!\n", cdev->dev.bus_id, ret);
+                        return;
+                }
+                if (cdev->id.cu_type == 0)
+                        cdev->private->state = DEV_STATE_NOT_OPER;
+                online_store_recog_and_online(cdev);
+        }
+
+}
+
+static ssize_t online_store (struct device *dev, struct device_attribute *attr,
+                             const char *buf, size_t count)
 {
         struct ccw_device *cdev = to_ccwdev(dev);
-        int i, force, ret;
+        int i, force;
         char *tmp;
 
         if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
@@ -434,51 +466,17 @@ online_store (struct device *dev, struct device_attribute *attr, const char *buf
                 force = 0;
                 i = simple_strtoul(buf, &tmp, 16);
         }
-        if (i == 1) {
-                /* Do device recognition, if needed. */
-                if (cdev->id.cu_type == 0) {
-                        ret = ccw_device_recognition(cdev);
-                        if (ret) {
-                                printk(KERN_WARNING"Couldn't start recognition "
-                                       "for device %s (ret=%d)\n",
-                                       cdev->dev.bus_id, ret);
-                                goto out;
-                        }
-                        wait_event(cdev->private->wait_q,
-                                   cdev->private->flags.recog_done);
-                }
-                if (cdev->drv && cdev->drv->set_online)
-                        ccw_device_set_online(cdev);
-        } else if (i == 0) {
-                if (cdev->private->state == DEV_STATE_DISCONNECTED)
-                        ccw_device_remove_disconnected(cdev);
-                else if (cdev->drv && cdev->drv->set_offline)
-                        ccw_device_set_offline(cdev);
-        }
-        if (force && cdev->private->state == DEV_STATE_BOXED) {
-                ret = ccw_device_stlck(cdev);
-                if (ret) {
-                        printk(KERN_WARNING"ccw_device_stlck for device %s "
-                               "returned %d!\n", cdev->dev.bus_id, ret);
-                        goto out;
-                }
-                /* Do device recognition, if needed. */
-                if (cdev->id.cu_type == 0) {
-                        cdev->private->state = DEV_STATE_NOT_OPER;
-                        ret = ccw_device_recognition(cdev);
-                        if (ret) {
-                                printk(KERN_WARNING"Couldn't start recognition "
-                                       "for device %s (ret=%d)\n",
-                                       cdev->dev.bus_id, ret);
-                                goto out;
-                        }
-                        wait_event(cdev->private->wait_q,
-                                   cdev->private->flags.recog_done);
-                }
-                if (cdev->drv && cdev->drv->set_online)
-                        ccw_device_set_online(cdev);
+
+        switch (i) {
+        case 0:
+                online_store_handle_offline(cdev);
+                break;
+        case 1:
+                online_store_handle_online(cdev, force);
+                break;
+        default:
+                count = -EINVAL;
         }
-        out:
         if (cdev->drv)
                 module_put(cdev->drv->owner);
         atomic_set(&cdev->private->onoff, 0);
@@ -548,17 +546,10 @@ static struct attribute_group ccwdev_attr_group = {
         .attrs = ccwdev_attrs,
 };
 
-static int
-device_add_files (struct device *dev)
-{
-        return sysfs_create_group(&dev->kobj, &ccwdev_attr_group);
-}
-
-static void
-device_remove_files(struct device *dev)
-{
-        sysfs_remove_group(&dev->kobj, &ccwdev_attr_group);
-}
+struct attribute_group *ccwdev_attr_groups[] = {
+        &ccwdev_attr_group,
+        NULL,
+};
 
 /* this is a simple abstraction for device_register that sets the
  * correct bus type and adds the bus specific files */
@@ -573,10 +564,6 @@ static int ccw_device_register(struct ccw_device *cdev)
                 return ret;
 
         set_bit(1, &cdev->private->registered);
-        if ((ret = device_add_files(dev))) {
-                if (test_and_clear_bit(1, &cdev->private->registered))
-                        device_del(dev);
-        }
         return ret;
 }
 
@@ -648,10 +635,6 @@ ccw_device_add_changed(struct work_struct *work)
                 return;
         }
         set_bit(1, &cdev->private->registered);
-        if (device_add_files(&cdev->dev)) {
-                if (test_and_clear_bit(1, &cdev->private->registered))
-                        device_unregister(&cdev->dev);
-        }
 }
 
 void ccw_device_do_unreg_rereg(struct work_struct *work)
@@ -664,9 +647,7 @@ void ccw_device_do_unreg_rereg(struct work_struct *work)
         cdev = priv->cdev;
         sch = to_subchannel(cdev->dev.parent);
 
-        device_remove_files(&cdev->dev);
-        if (test_and_clear_bit(1, &cdev->private->registered))
-                device_del(&cdev->dev);
+        ccw_device_unregister(cdev);
         PREPARE_WORK(&cdev->private->kick_work,
                      ccw_device_add_changed);
         queue_work(ccw_device_work, &cdev->private->kick_work);
@@ -705,6 +686,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
         cdev->dev.parent = &sch->dev;
         cdev->dev.release = ccw_device_release;
         INIT_LIST_HEAD(&cdev->private->kick_work.entry);
+        cdev->dev.groups = ccwdev_attr_groups;
         /* Do first half of device_register. */
         device_initialize(&cdev->dev);
         if (!get_device(&sch->dev)) {
@@ -736,6 +718,7 @@ static int io_subchannel_recog(struct ccw_device *, struct subchannel *);
 static void sch_attach_device(struct subchannel *sch,
                               struct ccw_device *cdev)
 {
+        css_update_ssd_info(sch);
         spin_lock_irq(sch->lock);
         sch->dev.driver_data = cdev;
         cdev->private->schid = sch->schid;
@@ -871,7 +854,7 @@ io_subchannel_register(struct work_struct *work)
         priv = container_of(work, struct ccw_device_private, kick_work);
         cdev = priv->cdev;
         sch = to_subchannel(cdev->dev.parent);
-
+        css_update_ssd_info(sch);
         /*
          * io_subchannel_register() will also be called after device
          * recognition has been done for a boxed device (which will already
@@ -1133,15 +1116,8 @@ io_subchannel_remove (struct subchannel *sch)
         sch->dev.driver_data = NULL;
         cdev->private->state = DEV_STATE_NOT_OPER;
         spin_unlock_irqrestore(cdev->ccwlock, flags);
-        /*
-         * Put unregistration on workqueue to avoid livelocks on the css bus
-         * semaphore.
-         */
-        if (get_device(&cdev->dev)) {
-                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_unregister);
-                queue_work(ccw_device_work, &cdev->private->kick_work);
-        }
+        ccw_device_unregister(cdev);
+        put_device(&cdev->dev);
         return 0;
 }
 
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 089a3ddd6265..898ec3b2bebb 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -15,6 +15,7 @@
 
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
+#include <asm/chpid.h>
 
 #include "cio.h"
 #include "cio_debug.h"
@@ -22,6 +23,7 @@
 #include "device.h"
 #include "chsc.h"
 #include "ioasm.h"
+#include "chp.h"
 
 int
 device_is_online(struct subchannel *sch)
@@ -210,14 +212,18 @@ static void
 __recover_lost_chpids(struct subchannel *sch, int old_lpm)
 {
         int mask, i;
+        struct chp_id chpid;
 
+        chp_id_init(&chpid);
         for (i = 0; i<8; i++) {
                 mask = 0x80 >> i;
                 if (!(sch->lpm & mask))
                         continue;
                 if (old_lpm & mask)
                         continue;
-                chpid_is_actually_online(sch->schib.pmcw.chpid[i]);
+                chpid.id = sch->schib.pmcw.chpid[i];
+                if (!chp_is_registered(chpid))
+                        css_schedule_eval_all();
         }
 }
 
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 7c7775aae38a..16f59fcb66b1 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -16,12 +16,14 @@
 
 #include <asm/ccwdev.h>
 #include <asm/idals.h>
+#include <asm/chpid.h>
 
 #include "cio.h"
 #include "cio_debug.h"
 #include "css.h"
 #include "chsc.h"
 #include "device.h"
+#include "chp.h"
 
 int ccw_device_set_options_mask(struct ccw_device *cdev, unsigned long flags)
 {
@@ -606,9 +608,12 @@ void *
 ccw_device_get_chp_desc(struct ccw_device *cdev, int chp_no)
 {
         struct subchannel *sch;
+        struct chp_id chpid;
 
         sch = to_subchannel(cdev->dev.parent);
-        return chsc_get_chp_desc(sch, chp_no);
+        chp_id_init(&chpid);
+        chpid.id = sch->schib.pmcw.chpid[chp_no];
+        return chp_get_chp_desc(chpid);
 }
 
 // FIXME: these have to go:
diff --git a/drivers/s390/cio/idset.c b/drivers/s390/cio/idset.c
new file mode 100644
index 000000000000..16ea828e99f7
--- /dev/null
+++ b/drivers/s390/cio/idset.c
@@ -0,0 +1,112 @@
+/*
+ *  drivers/s390/cio/idset.c
+ *
+ *    Copyright IBM Corp. 2007
+ *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#include <linux/slab.h>
+#include <asm/bitops.h>
+#include "idset.h"
+#include "css.h"
+
+struct idset {
+        int num_ssid;
+        int num_id;
+        unsigned long bitmap[0];
+};
+
+static inline unsigned long bitmap_size(int num_ssid, int num_id)
+{
+        return __BITOPS_WORDS(num_ssid * num_id) * sizeof(unsigned long);
+}
+
+static struct idset *idset_new(int num_ssid, int num_id)
+{
+        struct idset *set;
+
+        set = kzalloc(sizeof(struct idset) + bitmap_size(num_ssid, num_id),
+                      GFP_KERNEL);
+        if (set) {
+                set->num_ssid = num_ssid;
+                set->num_id = num_id;
+        }
+        return set;
+}
+
+void idset_free(struct idset *set)
+{
+        kfree(set);
+}
+
+void idset_clear(struct idset *set)
+{
+        memset(set->bitmap, 0, bitmap_size(set->num_ssid, set->num_id));
+}
+
+void idset_fill(struct idset *set)
+{
+        memset(set->bitmap, 0xff, bitmap_size(set->num_ssid, set->num_id));
+}
+
+static inline void idset_add(struct idset *set, int ssid, int id)
+{
+        set_bit(ssid * set->num_id + id, set->bitmap);
+}
+
+static inline void idset_del(struct idset *set, int ssid, int id)
+{
+        clear_bit(ssid * set->num_id + id, set->bitmap);
+}
+
+static inline int idset_contains(struct idset *set, int ssid, int id)
+{
+        return test_bit(ssid * set->num_id + id, set->bitmap);
+}
+
+static inline int idset_get_first(struct idset *set, int *ssid, int *id)
+{
+        int bitnum;
+
+        bitnum = find_first_bit(set->bitmap, set->num_ssid * set->num_id);
+        if (bitnum >= set->num_ssid * set->num_id)
+                return 0;
+        *ssid = bitnum / set->num_id;
+        *id = bitnum % set->num_id;
+        return 1;
+}
+
+struct idset *idset_sch_new(void)
+{
+        return idset_new(__MAX_SSID + 1, __MAX_SUBCHANNEL + 1);
+}
+
+void idset_sch_add(struct idset *set, struct subchannel_id schid)
+{
+        idset_add(set, schid.ssid, schid.sch_no);
+}
+
+void idset_sch_del(struct idset *set, struct subchannel_id schid)
+{
+        idset_del(set, schid.ssid, schid.sch_no);
+}
+
+int idset_sch_contains(struct idset *set, struct subchannel_id schid)
+{
+        return idset_contains(set, schid.ssid, schid.sch_no);
+}
+
+int idset_sch_get_first(struct idset *set, struct subchannel_id *schid)
+{
+        int ssid = 0;
+        int id = 0;
+        int rc;
+
+        rc = idset_get_first(set, &ssid, &id);
+        if (rc) {
+                init_subchannel_id(schid);
+                schid->ssid = ssid;
+                schid->sch_no = id;
+        }
+        return rc;
+}
diff --git a/drivers/s390/cio/idset.h b/drivers/s390/cio/idset.h
new file mode 100644
index 000000000000..144466ab8c15
--- /dev/null
+++ b/drivers/s390/cio/idset.h
@@ -0,0 +1,25 @@
+/*
+ *  drivers/s390/cio/idset.h
+ *
+ *    Copyright IBM Corp. 2007
+ *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#ifndef S390_IDSET_H
+#define S390_IDSET_H S390_IDSET_H
+
+#include "schid.h"
+
+struct idset;
+
+void idset_free(struct idset *set);
+void idset_clear(struct idset *set);
+void idset_fill(struct idset *set);
+
+struct idset *idset_sch_new(void);
+void idset_sch_add(struct idset *set, struct subchannel_id id);
+void idset_sch_del(struct idset *set, struct subchannel_id id);
+int idset_sch_contains(struct idset *set, struct subchannel_id id);
+int idset_sch_get_first(struct idset *set, struct subchannel_id *id);
+
+#endif /* S390_IDSET_H */
diff --git a/drivers/s390/cio/ioasm.h b/drivers/s390/cio/ioasm.h
index ad6d82940069..7153dd959082 100644
--- a/drivers/s390/cio/ioasm.h
+++ b/drivers/s390/cio/ioasm.h
@@ -1,6 +1,7 @@
 #ifndef S390_CIO_IOASM_H
 #define S390_CIO_IOASM_H
 
+#include <asm/chpid.h>
 #include "schid.h"
 
 /*
@@ -189,9 +190,9 @@ static inline int chsc(void *chsc_area)
         return cc;
 }
 
-static inline int rchp(int chpid)
+static inline int rchp(struct chp_id chpid)
 {
-        register unsigned int reg1 asm ("1") = chpid;
+        register struct chp_id reg1 asm ("1") = chpid;
         int ccode;
 
         asm volatile(
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 7809a79feec7..6dd64d0c8d45 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -3525,8 +3525,8 @@ unpack_next:
                                 memcpy(skb_put(skb,len_of_data),
                                         privptr->p_mtc_envelope,
                                         len_of_data);
-                                skb->mac.raw=skb->data;
                                 skb->dev=dev;
+                                skb_reset_mac_header(skb);
                                 skb->protocol=htons(ETH_P_IP);
                                 skb->ip_summed=CHECKSUM_UNNECESSARY;
                                 privptr->stats.rx_packets++;
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 0d6d5fcc128b..b20fd0681733 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -455,7 +455,7 @@ ctc_unpack_skb(struct channel *ch, struct sk_buff *pskb)
                         return;
                 }
                 skb_put(pskb, header->length);
-                pskb->mac.raw = pskb->data;
+                skb_reset_mac_header(pskb);
                 len -= header->length;
                 skb = dev_alloc_skb(pskb->len);
                 if (!skb) {
@@ -472,8 +472,9 @@ ctc_unpack_skb(struct channel *ch, struct sk_buff *pskb)
                         privptr->stats.rx_dropped++;
                         return;
                 }
-                memcpy(skb_put(skb, pskb->len), pskb->data, pskb->len);
-                skb->mac.raw = skb->data;
+                skb_copy_from_linear_data(pskb, skb_put(skb, pskb->len),
+                                          pskb->len);
+                skb_reset_mac_header(skb);
                 skb->dev = pskb->dev;
                 skb->protocol = pskb->protocol;
                 pskb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -706,7 +707,8 @@ ch_action_txdone(fsm_instance * fi, int event, void *arg)
                         spin_unlock(&ch->collect_lock);
                         return;
                 }
-                ch->trans_skb->tail = ch->trans_skb->data = ch->trans_skb_data;
+                ch->trans_skb->data = ch->trans_skb_data;
+                skb_reset_tail_pointer(ch->trans_skb);
                 ch->trans_skb->len = 0;
                 if (ch->prof.maxmulti < (ch->collect_len + 2))
                         ch->prof.maxmulti = ch->collect_len + 2;
@@ -715,8 +717,9 @@ ch_action_txdone(fsm_instance * fi, int event, void *arg)
                 *((__u16 *) skb_put(ch->trans_skb, 2)) = ch->collect_len + 2;
                 i = 0;
                 while ((skb = skb_dequeue(&ch->collect_queue))) {
-                        memcpy(skb_put(ch->trans_skb, skb->len), skb->data,
-                               skb->len);
+                        skb_copy_from_linear_data(skb, skb_put(ch->trans_skb,
+                                                               skb->len),
+                                                  skb->len);
                         privptr->stats.tx_packets++;
                         privptr->stats.tx_bytes += skb->len - LL_HEADER_LENGTH;
                         atomic_dec(&skb->users);
@@ -831,7 +834,8 @@ ch_action_rx(fsm_instance * fi, int event, void *arg)
                 ctc_unpack_skb(ch, skb);
         }
  again:
-        skb->data = skb->tail = ch->trans_skb_data;
+        skb->data = ch->trans_skb_data;
+        skb_reset_tail_pointer(skb);
         skb->len = 0;
         if (ctc_checkalloc_buffer(ch, 1))
                 return;
@@ -1638,21 +1642,19 @@ add_channel(struct ccw_device *cdev, enum channel_types type)
         struct channel *ch;
 
         DBF_TEXT(trace, 2, __FUNCTION__);
-        if ((ch =
-             (struct channel *) kmalloc(sizeof (struct channel),
-                                        GFP_KERNEL)) == NULL) {
+        ch = kzalloc(sizeof(struct channel), GFP_KERNEL);
+        if (!ch) {
                 ctc_pr_warn("ctc: Out of memory in add_channel\n");
                 return -1;
         }
-        memset(ch, 0, sizeof (struct channel));
-        if ((ch->ccw = kmalloc(8*sizeof(struct ccw1),
-                                               GFP_KERNEL | GFP_DMA)) == NULL) {
+        /* assure all flags and counters are reset */
+        ch->ccw = kzalloc(8 * sizeof(struct ccw1), GFP_KERNEL | GFP_DMA);
+        if (!ch->ccw) {
                 kfree(ch);
                 ctc_pr_warn("ctc: Out of memory in add_channel\n");
                 return -1;
         }
 
-        memset(ch->ccw, 0, 8*sizeof(struct ccw1));      // assure all flags and counters are reset
 
         /**
          * "static" ccws are used in the following way:
@@ -1692,15 +1694,14 @@ add_channel(struct ccw_device *cdev, enum channel_types type)
                 return -1;
         }
         fsm_newstate(ch->fsm, CH_STATE_IDLE);
-        if ((ch->irb = kmalloc(sizeof (struct irb),
-                                              GFP_KERNEL)) == NULL) {
+        ch->irb = kzalloc(sizeof(struct irb), GFP_KERNEL);
+        if (!ch->irb) {
                 ctc_pr_warn("ctc: Out of memory in add_channel\n");
                 kfree_fsm(ch->fsm);
                 kfree(ch->ccw);
                 kfree(ch);
                 return -1;
         }
-        memset(ch->irb, 0, sizeof (struct irb));
         while (*c && less_than((*c)->id, ch->id))
                 c = &(*c)->next;
         if (*c && (!strncmp((*c)->id, ch->id, CTC_ID_SIZE))) {
@@ -2226,7 +2227,8 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                  * IDAL support in CTC is broken, so we have to
                  * care about skb's above 2G ourselves.
                  */
-                hi = ((unsigned long) skb->tail + LL_HEADER_LENGTH) >> 31;
+                hi = ((unsigned long)skb_tail_pointer(skb) +
+                      LL_HEADER_LENGTH) >> 31;
                 if (hi) {
                         nskb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                         if (!nskb) {
@@ -2262,11 +2264,12 @@ transmit_skb(struct channel *ch, struct sk_buff *skb)
                                 return -EBUSY;
                         }
 
-                        ch->trans_skb->tail = ch->trans_skb->data;
+                        skb_reset_tail_pointer(ch->trans_skb);
                         ch->trans_skb->len = 0;
                         ch->ccw[1].count = skb->len;
-                        memcpy(skb_put(ch->trans_skb, skb->len), skb->data,
-                               skb->len);
+                        skb_copy_from_linear_data(skb, skb_put(ch->trans_skb,
+                                                               skb->len),
+                                                  skb->len);
                         atomic_dec(&skb->users);
                         dev_kfree_skb_irq(skb);
                         ccw_idx = 0;
@@ -2745,14 +2748,13 @@ ctc_probe_device(struct ccwgroup_device *cgdev)
         if (!get_device(&cgdev->dev))
                 return -ENODEV;
 
-        priv = kmalloc(sizeof (struct ctc_priv), GFP_KERNEL);
+        priv = kzalloc(sizeof(struct ctc_priv), GFP_KERNEL);
         if (!priv) {
                 ctc_pr_err("%s: Out of memory\n", __func__);
                 put_device(&cgdev->dev);
                 return -ENOMEM;
         }
 
-        memset(priv, 0, sizeof (struct ctc_priv));
         rc = ctc_add_files(&cgdev->dev);
         if (rc) {
                 kfree(priv);
@@ -2793,10 +2795,9 @@ ctc_init_netdevice(struct net_device * dev, int alloc_device,
         DBF_TEXT(setup, 3, __FUNCTION__);
 
         if (alloc_device) {
-                dev = kmalloc(sizeof (struct net_device), GFP_KERNEL);
+                dev = kzalloc(sizeof(struct net_device), GFP_KERNEL);
                 if (!dev)
                         return NULL;
-                memset(dev, 0, sizeof (struct net_device));
         }
 
         dev->priv = privptr;
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index ecca1046714e..08a994fdd1a4 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -1576,7 +1576,7 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
         header->offset = card->tx_buffer->count;
         header->type = card->lan_type;
         header->slot = card->portno;
-        memcpy(header + 1, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, header + 1, skb->len);
         spin_unlock(&card->lock);
         card->stats.tx_bytes += skb->len;
         card->stats.tx_packets++;
@@ -1784,7 +1784,6 @@ lcs_get_skb(struct lcs_card *card, char *skb_data, unsigned int skb_len)
                 card->stats.rx_dropped++;
                 return;
         }
-        skb->dev = card->dev;
         memcpy(skb_put(skb, skb_len), skb_data, skb_len);
         skb->protocol = card->lan_type_trans(skb, card->dev);
         card->stats.rx_bytes += skb_len;
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 594320ca1b7c..e10e85e85c84 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -635,7 +635,7 @@ static void netiucv_unpack_skb(struct iucv_connection *conn,
                         return;
                 }
                 skb_put(pskb, header->next);
-                pskb->mac.raw = pskb->data;
+                skb_reset_mac_header(pskb);
                 skb = dev_alloc_skb(pskb->len);
                 if (!skb) {
                         PRINT_WARN("%s Out of memory in netiucv_unpack_skb\n",
@@ -645,8 +645,9 @@ static void netiucv_unpack_skb(struct iucv_connection *conn,
                         privptr->stats.rx_dropped++;
                         return;
                 }
-                memcpy(skb_put(skb, pskb->len), pskb->data, pskb->len);
-                skb->mac.raw = skb->data;
+                skb_copy_from_linear_data(pskb, skb_put(skb, pskb->len),
+                                          pskb->len);
+                skb_reset_mac_header(skb);
                 skb->dev = pskb->dev;
                 skb->protocol = pskb->protocol;
                 pskb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -689,7 +690,8 @@ static void conn_action_rx(fsm_instance *fi, int event, void *arg)
                                msg->length, conn->max_buffsize);
                 return;
         }
-        conn->rx_buff->data = conn->rx_buff->tail = conn->rx_buff->head;
+        conn->rx_buff->data = conn->rx_buff->head;
+        skb_reset_tail_pointer(conn->rx_buff);
         conn->rx_buff->len = 0;
         rc = iucv_message_receive(conn->path, msg, 0, conn->rx_buff->data,
                                   msg->length, NULL);
@@ -735,14 +737,17 @@ static void conn_action_txdone(fsm_instance *fi, int event, void *arg)
                         }
                 }
         }
-        conn->tx_buff->data = conn->tx_buff->tail = conn->tx_buff->head;
+        conn->tx_buff->data = conn->tx_buff->head;
+        skb_reset_tail_pointer(conn->tx_buff);
         conn->tx_buff->len = 0;
         spin_lock_irqsave(&conn->collect_lock, saveflags);
         while ((skb = skb_dequeue(&conn->collect_queue))) {
                 header.next = conn->tx_buff->len + skb->len + NETIUCV_HDRLEN;
                 memcpy(skb_put(conn->tx_buff, NETIUCV_HDRLEN), &header,
                        NETIUCV_HDRLEN);
-                memcpy(skb_put(conn->tx_buff, skb->len), skb->data, skb->len);
+                skb_copy_from_linear_data(skb,
+                                          skb_put(conn->tx_buff, skb->len),
+                                          skb->len);
                 txbytes += skb->len;
                 txpackets++;
                 stat_maxcq++;
@@ -1164,8 +1169,8 @@ static int netiucv_transmit_skb(struct iucv_connection *conn,
                  * Copy the skb to a new allocated skb in lowmem only if the
                  * data is located above 2G in memory or tailroom is < 2.
                  */
-                unsigned long hi =
-                        ((unsigned long)(skb->tail + NETIUCV_HDRLEN)) >> 31;
+                unsigned long hi = ((unsigned long)(skb_tail_pointer(skb) +
+                                    NETIUCV_HDRLEN)) >> 31;
                 int copied = 0;
                 if (hi || (skb_tailroom(skb) < 2)) {
                         nskb = alloc_skb(skb->len + NETIUCV_HDRLEN +
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index 7c735e1fe063..dd7034fbfff8 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -267,7 +267,8 @@ qeth_eddp_copy_data_tcp(char *dst, struct qeth_eddp_data *eddp, int len,
 
         QETH_DBF_TEXT(trace, 5, "eddpcdtc");
         if (skb_shinfo(eddp->skb)->nr_frags == 0) {
-                memcpy(dst, eddp->skb->data + eddp->skb_offset, len);
+                skb_copy_from_linear_data_offset(eddp->skb, eddp->skb_offset,
+                                                 dst, len);
                 *hcsum = csum_partial(eddp->skb->data + eddp->skb_offset, len,
                                       *hcsum);
                 eddp->skb_offset += len;
@@ -416,7 +417,7 @@ __qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
                        eddp->skb_offset += VLAN_HLEN;
 #endif /* CONFIG_QETH_VLAN */
        }
-        tcph = eddp->skb->h.th;
+        tcph = tcp_hdr(eddp->skb);
         while (eddp->skb_offset < eddp->skb->len) {
                 data_len = min((int)skb_shinfo(eddp->skb)->gso_size,
                                (int)(eddp->skb->len - eddp->skb_offset));
@@ -473,20 +474,24 @@ qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
         QETH_DBF_TEXT(trace, 5, "eddpficx");
         /* create our segmentation headers and copy original headers */
         if (skb->protocol == htons(ETH_P_IP))
-                eddp = qeth_eddp_create_eddp_data(qhdr, (u8 *)skb->nh.iph,
-                                skb->nh.iph->ihl*4,
-                                (u8 *)skb->h.th, skb->h.th->doff*4);
+                eddp = qeth_eddp_create_eddp_data(qhdr,
+                                                  skb_network_header(skb),
+                                                  ip_hdrlen(skb),
+                                                  skb_transport_header(skb),
+                                                  tcp_hdrlen(skb));
         else
-                eddp = qeth_eddp_create_eddp_data(qhdr, (u8 *)skb->nh.ipv6h,
-                                sizeof(struct ipv6hdr),
-                                (u8 *)skb->h.th, skb->h.th->doff*4);
+                eddp = qeth_eddp_create_eddp_data(qhdr,
+                                                  skb_network_header(skb),
+                                                  sizeof(struct ipv6hdr),
+                                                  skb_transport_header(skb),
+                                                  tcp_hdrlen(skb));
 
         if (eddp == NULL) {
                 QETH_DBF_TEXT(trace, 2, "eddpfcnm");
                 return -ENOMEM;
         }
         if (qhdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2) {
-                skb->mac.raw = (skb->data) + sizeof(struct qeth_hdr);
+                skb_set_mac_header(skb, sizeof(struct qeth_hdr));
                 memcpy(&eddp->mac, eth_hdr(skb), ETH_HLEN);
 #ifdef CONFIG_QETH_VLAN
                 if (eddp->mac.h_proto == __constant_htons(ETH_P_8021Q)) {
@@ -590,12 +595,13 @@ qeth_eddp_create_context_tcp(struct qeth_card *card, struct sk_buff *skb,
         QETH_DBF_TEXT(trace, 5, "creddpct");
         if (skb->protocol == htons(ETH_P_IP))
                 ctx = qeth_eddp_create_context_generic(card, skb,
-                        sizeof(struct qeth_hdr) + skb->nh.iph->ihl*4 +
-                        skb->h.th->doff*4);
+                                                       (sizeof(struct qeth_hdr) +
+                                                        ip_hdrlen(skb) +
+                                                        tcp_hdrlen(skb)));
         else if (skb->protocol == htons(ETH_P_IPV6))
                 ctx = qeth_eddp_create_context_generic(card, skb,
                         sizeof(struct qeth_hdr) + sizeof(struct ipv6hdr) +
-                        skb->h.th->doff*4);
+                        tcp_hdrlen(skb));
         else
                 QETH_DBF_TEXT(trace, 2, "cetcpinv");
 
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index d8a86f5af379..ad7792dc1a04 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -2278,7 +2278,7 @@ qeth_type_trans(struct sk_buff *skb, struct net_device *dev)
             (card->info.link_type == QETH_LINK_TYPE_LANE_TR))
                 return tr_type_trans(skb,dev);
 #endif /* CONFIG_TR */
-        skb->mac.raw = skb->data;
+        skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN );
         eth = eth_hdr(skb);
 
@@ -2306,9 +2306,9 @@ qeth_rebuild_skb_fake_ll_tr(struct qeth_card *card, struct sk_buff *skb,
         struct iphdr *ip_hdr;
 
         QETH_DBF_TEXT(trace,5,"skbfktr");
-        skb->mac.raw = skb->data - QETH_FAKE_LL_LEN_TR;
+        skb_set_mac_header(skb, -QETH_FAKE_LL_LEN_TR);
         /* this is a fake ethernet header */
-        fake_hdr = (struct trh_hdr *) skb->mac.raw;
+        fake_hdr = tr_hdr(skb);
 
         /* the destination MAC address */
         switch (skb->pkt_type){
@@ -2359,9 +2359,9 @@ qeth_rebuild_skb_fake_ll_eth(struct qeth_card *card, struct sk_buff *skb,
         struct iphdr *ip_hdr;
 
         QETH_DBF_TEXT(trace,5,"skbfketh");
-        skb->mac.raw = skb->data - QETH_FAKE_LL_LEN_ETH;
+        skb_set_mac_header(skb, -QETH_FAKE_LL_LEN_ETH);
         /* this is a fake ethernet header */
-        fake_hdr = (struct ethhdr *) skb->mac.raw;
+        fake_hdr = eth_hdr(skb);
 
         /* the destination MAC address */
         switch (skb->pkt_type){
@@ -2461,7 +2461,7 @@ qeth_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
         if (card->options.fake_ll)
                 qeth_rebuild_skb_fake_ll(card, skb, hdr);
         else
-                skb->mac.raw = skb->data;
+                skb_reset_mac_header(skb);
         skb->ip_summed = card->options.checksum_type;
         if (card->options.checksum_type == HW_CHECKSUMMING){
                 if ( (hdr->hdr.l3.ext_flags &
@@ -2501,7 +2501,8 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                         vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                 else { /*in case of OSN*/
                         skb_push(skb, sizeof(struct qeth_hdr));
-                        memcpy(skb->data, hdr, sizeof(struct qeth_hdr));
+                        skb_copy_to_linear_data(skb, hdr,
+                                                sizeof(struct qeth_hdr));
                 }
                 /* is device UP ? */
                 if (!(card->dev->flags & IFF_UP)){
@@ -3778,9 +3779,11 @@ qeth_get_cast_type(struct qeth_card *card, struct sk_buff *skb)
         }
         /* try something else */
         if (skb->protocol == ETH_P_IPV6)
-                return (skb->nh.raw[24] == 0xff) ? RTN_MULTICAST : 0;
+                return (skb_network_header(skb)[24] == 0xff) ?
+                                RTN_MULTICAST : 0;
         else if (skb->protocol == ETH_P_IP)
-                return ((skb->nh.raw[16] & 0xf0) == 0xe0) ? RTN_MULTICAST : 0;
+                return ((skb_network_header(skb)[16] & 0xf0) == 0xe0) ?
+                                RTN_MULTICAST : 0;
         /* ... */
         if (!memcmp(skb->data, skb->dev->broadcast, 6))
                 return RTN_BROADCAST;
@@ -3818,18 +3821,20 @@ qeth_get_priority_queue(struct qeth_card *card, struct sk_buff *skb,
                         return card->info.is_multicast_different &
                                 (card->qdio.no_out_queues - 1);
                 if (card->qdio.do_prio_queueing && (ipv == 4)) {
+                        const u8 tos = ip_hdr(skb)->tos;
+
                         if (card->qdio.do_prio_queueing==QETH_PRIO_Q_ING_TOS){
-                                if (skb->nh.iph->tos & IP_TOS_NOTIMPORTANT)
+                                if (tos & IP_TOS_NOTIMPORTANT)
                                         return 3;
-                                if (skb->nh.iph->tos & IP_TOS_HIGHRELIABILITY)
+                                if (tos & IP_TOS_HIGHRELIABILITY)
                                         return 2;
-                                if (skb->nh.iph->tos & IP_TOS_HIGHTHROUGHPUT)
+                                if (tos & IP_TOS_HIGHTHROUGHPUT)
                                         return 1;
-                                if (skb->nh.iph->tos & IP_TOS_LOWDELAY)
+                                if (tos & IP_TOS_LOWDELAY)
                                         return 0;
                         }
                         if (card->qdio.do_prio_queueing==QETH_PRIO_Q_ING_PREC)
-                                return 3 - (skb->nh.iph->tos >> 6);
+                                return 3 - (tos >> 6);
                 } else if (card->qdio.do_prio_queueing && (ipv == 6)) {
                         /* TODO: IPv6!!! */
                 }
@@ -3866,9 +3871,9 @@ __qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb, int ipv)
                  * memcpys instead of one memmove to save cycles.
                  */
                 skb_push(skb, VLAN_HLEN);
-                memcpy(skb->data, skb->data + 4, 4);
-                memcpy(skb->data + 4, skb->data + 8, 4);
-                memcpy(skb->data + 8, skb->data + 12, 4);
+                skb_copy_to_linear_data(skb, skb->data + 4, 4);
+                skb_copy_to_linear_data_offset(skb, 4, skb->data + 8, 4);
+                skb_copy_to_linear_data_offset(skb, 8, skb->data + 12, 4);
                 tag = (u16 *)(skb->data + 12);
                 /*
                  * first two bytes  = ETH_P_8021Q (0x8100)
@@ -4039,7 +4044,8 @@ qeth_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                             *((u32 *) skb->dst->neighbour->primary_key);
                 } else {
                         /* fill in destination address used in ip header */
-                        *((u32 *) (&hdr->hdr.l3.dest_addr[12])) = skb->nh.iph->daddr;
+                        *((u32 *)(&hdr->hdr.l3.dest_addr[12])) =
+                                                           ip_hdr(skb)->daddr;
                 }
         } else if (ipv == 6) { /* IPv6 or passthru */
                 hdr->hdr.l3.flags = qeth_get_qeth_hdr_flags6(cast_type);
@@ -4048,7 +4054,8 @@ qeth_fill_header(struct qeth_card *card, struct qeth_hdr *hdr,
                                skb->dst->neighbour->primary_key, 16);
                 } else {
                         /* fill in destination address used in ip header */
-                        memcpy(hdr->hdr.l3.dest_addr, &skb->nh.ipv6h->daddr, 16);
+                        memcpy(hdr->hdr.l3.dest_addr,
+                               &ipv6_hdr(skb)->daddr, 16);
                 }
         } else { /* passthrough */
                 if((skb->dev->type == ARPHRD_IEEE802_TR) &&
diff --git a/drivers/s390/net/qeth_tso.h b/drivers/s390/net/qeth_tso.h
index 14504afb044e..c20e923cf9ad 100644
--- a/drivers/s390/net/qeth_tso.h
+++ b/drivers/s390/net/qeth_tso.h
@@ -40,8 +40,8 @@ qeth_tso_fill_header(struct qeth_card *card, struct sk_buff *skb)
         QETH_DBF_TEXT(trace, 5, "tsofhdr");
 
         hdr  = (struct qeth_hdr_tso *) skb->data;
-        iph  = skb->nh.iph;
-        tcph = skb->h.th;
+        iph  = ip_hdr(skb);
+        tcph = tcp_hdr(skb);
         /*fix header to TSO values ...*/
         hdr->hdr.hdr.l3.id = QETH_HEADER_TYPE_TSO;
         /*set values which are fix for the first approach ...*/
@@ -63,13 +63,9 @@ qeth_tso_fill_header(struct qeth_card *card, struct sk_buff *skb)
 static inline void
 qeth_tso_set_tcpip_header(struct qeth_card *card, struct sk_buff *skb)
 {
-        struct iphdr *iph;
-        struct ipv6hdr *ip6h;
-        struct tcphdr *tcph;
-
-        iph  = skb->nh.iph;
-        ip6h = skb->nh.ipv6h;
-        tcph = skb->h.th;
+        struct iphdr *iph    = ip_hdr(skb);
+        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        struct tcphdr *tcph  = tcp_hdr(skb);
 
         tcph->check = 0;
         if (skb->protocol == ETH_P_IPV6) {
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 806bb1a921eb..644a06eba828 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -21,6 +21,7 @@
 #include "cio/cio.h"
 #include "cio/chsc.h"
 #include "cio/css.h"
+#include "cio/chp.h"
 #include "s390mach.h"
 
 static struct semaphore m_sem;
@@ -44,14 +45,13 @@ static int
 s390_collect_crw_info(void *param)
 {
         struct crw crw[2];
-        int ccode, ret, slow;
+        int ccode;
         struct semaphore *sem;
         unsigned int chain;
 
         sem = (struct semaphore *)param;
 repeat:
         down_interruptible(sem);
-        slow = 0;
         chain = 0;
         while (1) {
                 if (unlikely(chain > 1)) {
@@ -84,9 +84,8 @@ repeat:
                 /* Check for overflows. */
                 if (crw[chain].oflw) {
                         pr_debug("%s: crw overflow detected!\n", __FUNCTION__);
-                        css_reiterate_subchannels();
+                        css_schedule_eval_all();
                         chain = 0;
-                        slow = 1;
                         continue;
                 }
                 switch (crw[chain].rsc) {
@@ -94,10 +93,7 @@ repeat:
                         if (crw[0].chn && !chain)
                                 break;
                         pr_debug("source is subchannel %04X\n", crw[0].rsid);
-                        ret = css_process_crw (crw[0].rsid,
-                                               chain ? crw[1].rsid : 0);
-                        if (ret == -EAGAIN)
-                                slow = 1;
+                        css_process_crw(crw[0].rsid, chain ? crw[1].rsid : 0);
                         break;
                 case CRW_RSC_MONITOR:
                         pr_debug("source is monitoring facility\n");
@@ -116,28 +112,23 @@ repeat:
                         }
                         switch (crw[0].erc) {
                         case CRW_ERC_IPARM: /* Path has come. */
-                                ret = chp_process_crw(crw[0].rsid, 1);
+                                chp_process_crw(crw[0].rsid, 1);
                                 break;
                         case CRW_ERC_PERRI: /* Path has gone. */
                         case CRW_ERC_PERRN:
-                                ret = chp_process_crw(crw[0].rsid, 0);
+                                chp_process_crw(crw[0].rsid, 0);
                                 break;
                         default:
                                 pr_debug("Don't know how to handle erc=%x\n",
                                          crw[0].erc);
-                                ret = 0;
                         }
-                        if (ret == -EAGAIN)
-                                slow = 1;
                         break;
                 case CRW_RSC_CONFIG:
                         pr_debug("source is configuration-alert facility\n");
                         break;
                 case CRW_RSC_CSS:
                         pr_debug("source is channel subsystem\n");
-                        ret = chsc_process_crw();
-                        if (ret == -EAGAIN)
-                                slow = 1;
+                        chsc_process_crw();
                         break;
                 default:
                         pr_debug("unknown source\n");
@@ -146,8 +137,6 @@ repeat:
                 /* chain is always 0 or 1 here. */
                 chain = crw[chain].chn ? chain + 1 : 0;
         }
-        if (slow)
-                queue_work(slow_path_wq, &slow_path_work);
         goto repeat;
         return 0;
 }
diff --git a/drivers/s390/sysinfo.c b/drivers/s390/sysinfo.c
index 090743d2f914..19343f9675c3 100644
--- a/drivers/s390/sysinfo.c
+++ b/drivers/s390/sysinfo.c
@@ -357,6 +357,24 @@ static __init int create_proc_sysinfo(void)
 
 __initcall(create_proc_sysinfo);
 
+int get_cpu_capability(unsigned int *capability)
+{
+        struct sysinfo_1_2_2 *info;
+        int rc;
+
+        info = (void *) get_zeroed_page(GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+        rc = stsi(info, 1, 2, 2);
+        if (rc == -ENOSYS)
+                goto out;
+        rc = 0;
+        *capability = info->capability;
+out:
+        free_page((unsigned long) info);
+        return rc;
+}
+
 /*
  * CPU capability might have changed. Therefore recalculate loops_per_jiffy.
  */
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 2cea4f5d2084..f2be2ead8742 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -726,7 +726,7 @@ static struct miscdevice envctrl_dev = {
  * Return: None.
  */
 static void envctrl_set_mon(struct i2c_child_t *pchild,
-                            char *chnl_desc,
+                            const char *chnl_desc,
                             int chnl_no)
 {
         /* Firmware only has temperature type.  It does not distinguish
@@ -763,8 +763,8 @@ static void envctrl_set_mon(struct i2c_child_t *pchild,
 static void envctrl_init_adc(struct i2c_child_t *pchild, struct device_node *dp)
 {
         int i = 0, len;
-        char *pos;
-        unsigned int *pval;
+        const char *pos;
+        const unsigned int *pval;
 
         /* Firmware describe channels into a stream separated by a '\0'. */
         pos = of_get_property(dp, "channels-description", &len);
@@ -859,7 +859,7 @@ static void envctrl_init_i2c_child(struct linux_ebus_child *edev_child,
 {
         int len, i, tbls_size = 0;
         struct device_node *dp = edev_child->prom_node;
-        void *pval;
+        const void *pval;
 
         /* Get device address. */
         pval = of_get_property(dp, "reg", &len);
diff --git a/drivers/sbus/char/flash.c b/drivers/sbus/char/flash.c
index 6e99507aeb12..262f01e68592 100644
--- a/drivers/sbus/char/flash.c
+++ b/drivers/sbus/char/flash.c
@@ -190,7 +190,7 @@ static int __init flash_init(void)
         }
         if (!sdev) {
 #ifdef CONFIG_PCI
-                struct linux_prom_registers *ebus_regs;
+                const struct linux_prom_registers *ebus_regs;
 
                 for_each_ebus(ebus) {
                         for_each_ebusdev(edev, ebus) {
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index eec28c142a59..fbfeb89a6f32 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -44,7 +44,6 @@
 #include <asm/openpromio.h>
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
-#include <asm/pbm.h>
 #endif
 
 MODULE_AUTHOR("Thomas K. Dyas (tdyas@noc.rutgers.edu) and Eddie C. Dost  (ecd@skynet.be)");
@@ -141,7 +140,7 @@ static int copyout(void __user *info, struct openpromio *opp, int len)
 
 static int opromgetprop(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize)
 {
-        void *pval;
+        const void *pval;
         int len;
 
         if (!dp ||
@@ -248,18 +247,18 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
         if (bufsize >= 2*sizeof(int)) {
 #ifdef CONFIG_PCI
                 struct pci_dev *pdev;
-                struct pcidev_cookie *pcp;
-                pdev = pci_find_slot (((int *) op->oprom_array)[0],
+                struct device_node *dp;
+
+                pdev = pci_get_bus_and_slot (((int *) op->oprom_array)[0],
                                       ((int *) op->oprom_array)[1]);
 
-                pcp = pdev->sysdata;
-                if (pcp != NULL) {
-                        dp = pcp->prom_node;
-                        data->current_node = dp;
-                        *((int *)op->oprom_array) = dp->node;
-                        op->oprom_size = sizeof(int);
-                        err = copyout(argp, op, bufsize + sizeof(int));
-                }
+                dp = pci_device_to_OF_node(pdev);
+                data->current_node = dp;
+                *((int *)op->oprom_array) = dp->node;
+                op->oprom_size = sizeof(int);
+                err = copyout(argp, op, bufsize + sizeof(int));
+
+                pci_dev_put(pdev);
 #endif
         }
 
@@ -409,7 +408,7 @@ static int opiocget(void __user *argp, DATA *data)
         struct opiocdesc op;
         struct device_node *dp;
         char *str;
-        void *pval;
+        const void *pval;
         int err, len;
 
         if (copy_from_user(&op, argp, sizeof(op)))
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 8bfb67ccdcd4..c3135e2fbd5a 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -259,11 +259,10 @@ static int vfc_debug(struct vfc_dev *dev, int cmd, void __user *argp)
                 if (copy_from_user(&inout, argp, sizeof(inout)))
                         return -EFAULT;
 
-                buffer = kmalloc(inout.len, GFP_KERNEL);
+                buffer = kzalloc(inout.len, GFP_KERNEL);
                 if (buffer == NULL)
                         return -ENOMEM;
 
-                memset(buffer,0,inout.len);
                 vfc_lock_device(dev);
                 inout.ret=
                         vfc_i2c_recvbuf(dev,inout.addr & 0xff
diff --git a/drivers/sbus/sbus.c b/drivers/sbus/sbus.c
index 6349dd617f85..eee590a51d8a 100644
--- a/drivers/sbus/sbus.c
+++ b/drivers/sbus/sbus.c
@@ -35,7 +35,7 @@ struct sbus_bus *sbus_root;
 static void __init fill_sbus_device(struct device_node *dp, struct sbus_dev *sdev)
 {
         unsigned long base;
-        void *pval;
+        const void *pval;
         int len, err;
 
         sdev->prom_node = dp->node;
@@ -86,7 +86,7 @@ static void __init fill_sbus_device(struct device_node *dp, struct sbus_dev *sde
 
 static void __init sbus_bus_ranges_init(struct device_node *dp, struct sbus_bus *sbus)
 {
-        void *pval;
+        const void *pval;
         int len;
 
         pval = of_get_property(dp, "ranges", &len);
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 4cd280e86966..fcc4cb6c7f46 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1763,9 +1763,15 @@ config SUN3X_ESP
           The ESP was an on-board SCSI controller used on Sun 3/80
           machines.  Say Y here to compile in support for it.
 
+config SCSI_ESP_CORE
+        tristate "ESP Scsi Driver Core"
+        depends on SCSI
+        select SCSI_SPI_ATTRS
+
 config SCSI_SUNESP
         tristate "Sparc ESP Scsi Driver"
         depends on SBUS && SCSI
+        select SCSI_ESP_CORE
         help
           This is the driver for the Sun ESP SCSI host adapter. The ESP
           chipset is present in most SPARC SBUS-based computers.
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 79ecf4ebe6eb..70cff4c599d7 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -106,7 +106,8 @@ obj-$(CONFIG_MEGARAID_LEGACY)	+= megaraid.o
 obj-$(CONFIG_MEGARAID_NEWGEN)   += megaraid/
 obj-$(CONFIG_MEGARAID_SAS)      += megaraid/
 obj-$(CONFIG_SCSI_ACARD)        += atp870u.o
-obj-$(CONFIG_SCSI_SUNESP)       += esp.o
+obj-$(CONFIG_SCSI_ESP_CORE)     += esp_scsi.o
+obj-$(CONFIG_SCSI_SUNESP)       += sun_esp.o
 obj-$(CONFIG_SCSI_GDTH)         += gdth.o
 obj-$(CONFIG_SCSI_INITIO)       += initio.o
 obj-$(CONFIG_SCSI_INIA100)      += a100u2w.o
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
deleted file mode 100644
index 2c2fe80bc42a..000000000000
--- a/drivers/scsi/esp.c
+++ /dev/null
@@ -1,4394 +0,0 @@
-/* esp.c: ESP Sun SCSI driver.
- *
- * Copyright (C) 1995, 1998, 2006 David S. Miller (davem@davemloft.net)
- */
-
-/* TODO:
- *
- * 1) Maybe disable parity checking in config register one for SCSI1
- *    targets.  (Gilmore says parity error on the SBus can lock up
- *    old sun4c's)
- * 2) Add support for DMA2 pipelining.
- * 3) Add tagged queueing.
- */
-
-#include <linux/kernel.h>
-#include <linux/delay.h>
-#include <linux/types.h>
-#include <linux/string.h>
-#include <linux/slab.h>
-#include <linux/blkdev.h>
-#include <linux/proc_fs.h>
-#include <linux/stat.h>
-#include <linux/init.h>
-#include <linux/spinlock.h>
-#include <linux/interrupt.h>
-#include <linux/module.h>
-
-#include "esp.h"
-
-#include <asm/sbus.h>
-#include <asm/dma.h>
-#include <asm/system.h>
-#include <asm/ptrace.h>
-#include <asm/pgtable.h>
-#include <asm/oplib.h>
-#include <asm/io.h>
-#include <asm/irq.h>
-#ifndef __sparc_v9__
-#include <asm/machines.h>
-#include <asm/idprom.h>
-#endif
-
-#include <scsi/scsi.h>
-#include <scsi/scsi_cmnd.h>
-#include <scsi/scsi_device.h>
-#include <scsi/scsi_eh.h>
-#include <scsi/scsi_host.h>
-#include <scsi/scsi_tcq.h>
-
-#define DRV_VERSION "1.101"
-
-#define DEBUG_ESP
-/* #define DEBUG_ESP_HME */
-/* #define DEBUG_ESP_DATA */
-/* #define DEBUG_ESP_QUEUE */
-/* #define DEBUG_ESP_DISCONNECT */
-/* #define DEBUG_ESP_STATUS */
-/* #define DEBUG_ESP_PHASES */
-/* #define DEBUG_ESP_WORKBUS */
-/* #define DEBUG_STATE_MACHINE */
-/* #define DEBUG_ESP_CMDS */
-/* #define DEBUG_ESP_IRQS */
-/* #define DEBUG_SDTR */
-/* #define DEBUG_ESP_SG */
-
-/* Use the following to sprinkle debugging messages in a way which
- * suits you if combinations of the above become too verbose when
- * trying to track down a specific problem.
- */
-/* #define DEBUG_ESP_MISC */
-
-#if defined(DEBUG_ESP)
-#define ESPLOG(foo)  printk foo
-#else
-#define ESPLOG(foo)
-#endif /* (DEBUG_ESP) */
-
-#if defined(DEBUG_ESP_HME)
-#define ESPHME(foo)  printk foo
-#else
-#define ESPHME(foo)
-#endif
-
-#if defined(DEBUG_ESP_DATA)
-#define ESPDATA(foo)  printk foo
-#else
-#define ESPDATA(foo)
-#endif
-
-#if defined(DEBUG_ESP_QUEUE)
-#define ESPQUEUE(foo)  printk foo
-#else
-#define ESPQUEUE(foo)
-#endif
-
-#if defined(DEBUG_ESP_DISCONNECT)
-#define ESPDISC(foo)  printk foo
-#else
-#define ESPDISC(foo)
-#endif
-
-#if defined(DEBUG_ESP_STATUS)
-#define ESPSTAT(foo)  printk foo
-#else
-#define ESPSTAT(foo)
-#endif
-
-#if defined(DEBUG_ESP_PHASES)
-#define ESPPHASE(foo)  printk foo
-#else
-#define ESPPHASE(foo)
-#endif
-
-#if defined(DEBUG_ESP_WORKBUS)
-#define ESPBUS(foo)  printk foo
-#else
-#define ESPBUS(foo)
-#endif
-
-#if defined(DEBUG_ESP_IRQS)
-#define ESPIRQ(foo)  printk foo
-#else
-#define ESPIRQ(foo)
-#endif
-
-#if defined(DEBUG_SDTR)
-#define ESPSDTR(foo)  printk foo
-#else
-#define ESPSDTR(foo)
-#endif
-
-#if defined(DEBUG_ESP_MISC)
-#define ESPMISC(foo)  printk foo
-#else
-#define ESPMISC(foo)
-#endif
-
-/* Command phase enumeration. */
-enum {
-        not_issued    = 0x00,  /* Still in the issue_SC queue.          */
-
-        /* Various forms of selecting a target. */
-#define in_slct_mask    0x10
-        in_slct_norm  = 0x10,  /* ESP is arbitrating, normal selection  */
-        in_slct_stop  = 0x11,  /* ESP will select, then stop with IRQ   */
-        in_slct_msg   = 0x12,  /* select, then send a message           */
-        in_slct_tag   = 0x13,  /* select and send tagged queue msg      */
-        in_slct_sneg  = 0x14,  /* select and acquire sync capabilities  */
-
-        /* Any post selection activity. */
-#define in_phases_mask  0x20
-        in_datain     = 0x20,  /* Data is transferring from the bus     */
-        in_dataout    = 0x21,  /* Data is transferring to the bus       */
-        in_data_done  = 0x22,  /* Last DMA data operation done (maybe)  */
-        in_msgin      = 0x23,  /* Eating message from target            */
-        in_msgincont  = 0x24,  /* Eating more msg bytes from target     */
-        in_msgindone  = 0x25,  /* Decide what to do with what we got    */
-        in_msgout     = 0x26,  /* Sending message to target             */
-        in_msgoutdone = 0x27,  /* Done sending msg out                  */
-        in_cmdbegin   = 0x28,  /* Sending cmd after abnormal selection  */
-        in_cmdend     = 0x29,  /* Done sending slow cmd                 */
-        in_status     = 0x2a,  /* Was in status phase, finishing cmd    */
-        in_freeing    = 0x2b,  /* freeing the bus for cmd cmplt or disc */
-        in_the_dark   = 0x2c,  /* Don't know what bus phase we are in   */
-
-        /* Special states, ie. not normal bus transitions... */
-#define in_spec_mask    0x80
-        in_abortone   = 0x80,  /* Aborting one command currently        */
-        in_abortall   = 0x81,  /* Blowing away all commands we have     */
-        in_resetdev   = 0x82,  /* SCSI target reset in progress         */
-        in_resetbus   = 0x83,  /* SCSI bus reset in progress            */
-        in_tgterror   = 0x84,  /* Target did something stupid           */
-};
-
-enum {
-        /* Zero has special meaning, see skipahead[12]. */
-/*0*/   do_never,
-
-/*1*/   do_phase_determine,
-/*2*/   do_reset_bus,
-/*3*/   do_reset_complete,
-/*4*/   do_work_bus,
-/*5*/   do_intr_end
-};
-
-/* Forward declarations. */
-static irqreturn_t esp_intr(int irq, void *dev_id);
-
-/* Debugging routines */
-struct esp_cmdstrings {
-        u8 cmdchar;
-        char *text;
-} esp_cmd_strings[] = {
-        /* Miscellaneous */
-        { ESP_CMD_NULL, "ESP_NOP", },
-        { ESP_CMD_FLUSH, "FIFO_FLUSH", },
-        { ESP_CMD_RC, "RSTESP", },
-        { ESP_CMD_RS, "RSTSCSI", },
-        /* Disconnected State Group */
-        { ESP_CMD_RSEL, "RESLCTSEQ", },
-        { ESP_CMD_SEL, "SLCTNATN", },
-        { ESP_CMD_SELA, "SLCTATN", },
-        { ESP_CMD_SELAS, "SLCTATNSTOP", },
-        { ESP_CMD_ESEL, "ENSLCTRESEL", },
-        { ESP_CMD_DSEL, "DISSELRESEL", },
-        { ESP_CMD_SA3, "SLCTATN3", },
-        { ESP_CMD_RSEL3, "RESLCTSEQ", },
-        /* Target State Group */
-        { ESP_CMD_SMSG, "SNDMSG", },
-        { ESP_CMD_SSTAT, "SNDSTATUS", },
-        { ESP_CMD_SDATA, "SNDDATA", },
-        { ESP_CMD_DSEQ, "DISCSEQ", },
-        { ESP_CMD_TSEQ, "TERMSEQ", },
-        { ESP_CMD_TCCSEQ, "TRGTCMDCOMPSEQ", },
-        { ESP_CMD_DCNCT, "DISC", },
-        { ESP_CMD_RMSG, "RCVMSG", },
-        { ESP_CMD_RCMD, "RCVCMD", },
-        { ESP_CMD_RDATA, "RCVDATA", },
-        { ESP_CMD_RCSEQ, "RCVCMDSEQ", },
-        /* Initiator State Group */
-        { ESP_CMD_TI, "TRANSINFO", },
-        { ESP_CMD_ICCSEQ, "INICMDSEQCOMP", },
-        { ESP_CMD_MOK, "MSGACCEPTED", },
-        { ESP_CMD_TPAD, "TPAD", },
-        { ESP_CMD_SATN, "SATN", },
-        { ESP_CMD_RATN, "RATN", },
-};
-#define NUM_ESP_COMMANDS  ((sizeof(esp_cmd_strings)) / (sizeof(struct esp_cmdstrings)))
-
-/* Print textual representation of an ESP command */
-static inline void esp_print_cmd(u8 espcmd)
-{
-        u8 dma_bit = espcmd & ESP_CMD_DMA;
-        int i;
-
-        espcmd &= ~dma_bit;
-        for (i = 0; i < NUM_ESP_COMMANDS; i++)
-                if (esp_cmd_strings[i].cmdchar == espcmd)
-                        break;
-        if (i == NUM_ESP_COMMANDS)
-                printk("ESP_Unknown");
-        else
-                printk("%s%s", esp_cmd_strings[i].text,
-                       ((dma_bit) ? "+DMA" : ""));
-}
-
-/* Print the status register's value */
-static inline void esp_print_statreg(u8 statreg)
-{
-        u8 phase;
-
-        printk("STATUS<");
-        phase = statreg & ESP_STAT_PMASK;
-        printk("%s,", (phase == ESP_DOP ? "DATA-OUT" :
-                       (phase == ESP_DIP ? "DATA-IN" :
-                        (phase == ESP_CMDP ? "COMMAND" :
-                         (phase == ESP_STATP ? "STATUS" :
-                          (phase == ESP_MOP ? "MSG-OUT" :
-                           (phase == ESP_MIP ? "MSG_IN" :
-                            "unknown")))))));
-        if (statreg & ESP_STAT_TDONE)
-                printk("TRANS_DONE,");
-        if (statreg & ESP_STAT_TCNT)
-                printk("TCOUNT_ZERO,");
-        if (statreg & ESP_STAT_PERR)
-                printk("P_ERROR,");
-        if (statreg & ESP_STAT_SPAM)
-                printk("SPAM,");
-        if (statreg & ESP_STAT_INTR)
-                printk("IRQ,");
-        printk(">");
-}
-
-/* Print the interrupt register's value */
-static inline void esp_print_ireg(u8 intreg)
-{
-        printk("INTREG< ");
-        if (intreg & ESP_INTR_S)
-                printk("SLCT_NATN ");
-        if (intreg & ESP_INTR_SATN)
-                printk("SLCT_ATN ");
-        if (intreg & ESP_INTR_RSEL)
-                printk("RSLCT ");
-        if (intreg & ESP_INTR_FDONE)
-                printk("FDONE ");
-        if (intreg & ESP_INTR_BSERV)
-                printk("BSERV ");
-        if (intreg & ESP_INTR_DC)
-                printk("DISCNCT ");
-        if (intreg & ESP_INTR_IC)
-                printk("ILL_CMD ");
-        if (intreg & ESP_INTR_SR)
-                printk("SCSI_BUS_RESET ");
-        printk(">");
-}
-
-/* Print the sequence step registers contents */
-static inline void esp_print_seqreg(u8 stepreg)
-{
-        stepreg &= ESP_STEP_VBITS;
-        printk("STEP<%s>",
-               (stepreg == ESP_STEP_ASEL ? "SLCT_ARB_CMPLT" :
-                (stepreg == ESP_STEP_SID ? "1BYTE_MSG_SENT" :
-                 (stepreg == ESP_STEP_NCMD ? "NOT_IN_CMD_PHASE" :
-                  (stepreg == ESP_STEP_PPC ? "CMD_BYTES_LOST" :
-                   (stepreg == ESP_STEP_FINI4 ? "CMD_SENT_OK" :
-                    "UNKNOWN"))))));
-}
-
-static char *phase_string(int phase)
-{
-        switch (phase) {
-        case not_issued:
-                return "UNISSUED";
-        case in_slct_norm:
-                return "SLCTNORM";
-        case in_slct_stop:
-                return "SLCTSTOP";
-        case in_slct_msg:
-                return "SLCTMSG";
-        case in_slct_tag:
-                return "SLCTTAG";
-        case in_slct_sneg:
-                return "SLCTSNEG";
-        case in_datain:
-                return "DATAIN";
-        case in_dataout:
-                return "DATAOUT";
-        case in_data_done:
-                return "DATADONE";
-        case in_msgin:
-                return "MSGIN";
-        case in_msgincont:
-                return "MSGINCONT";
-        case in_msgindone:
-                return "MSGINDONE";
-        case in_msgout:
-                return "MSGOUT";
-        case in_msgoutdone:
-                return "MSGOUTDONE";
-        case in_cmdbegin:
-                return "CMDBEGIN";
-        case in_cmdend:
-                return "CMDEND";
-        case in_status:
-                return "STATUS";
-        case in_freeing:
-                return "FREEING";
-        case in_the_dark:
-                return "CLUELESS";
-        case in_abortone:
-                return "ABORTONE";
-        case in_abortall:
-                return "ABORTALL";
-        case in_resetdev:
-                return "RESETDEV";
-        case in_resetbus:
-                return "RESETBUS";
-        case in_tgterror:
-                return "TGTERROR";
-        default:
-                return "UNKNOWN";
-        };
-}
-
-#ifdef DEBUG_STATE_MACHINE
-static inline void esp_advance_phase(struct scsi_cmnd *s, int newphase)
-{
-        ESPLOG(("<%s>", phase_string(newphase)));
-        s->SCp.sent_command = s->SCp.phase;
-        s->SCp.phase = newphase;
-}
-#else
-#define esp_advance_phase(__s, __newphase) \
-        (__s)->SCp.sent_command = (__s)->SCp.phase; \
-        (__s)->SCp.phase = (__newphase);
-#endif
-
-#ifdef DEBUG_ESP_CMDS
-static inline void esp_cmd(struct esp *esp, u8 cmd)
-{
-        esp->espcmdlog[esp->espcmdent] = cmd;
-        esp->espcmdent = (esp->espcmdent + 1) & 31;
-        sbus_writeb(cmd, esp->eregs + ESP_CMD);
-}
-#else
-#define esp_cmd(__esp, __cmd)   \
-        sbus_writeb((__cmd), ((__esp)->eregs) + ESP_CMD)
-#endif
-
-#define ESP_INTSOFF(__dregs)    \
-        sbus_writel(sbus_readl((__dregs)+DMA_CSR)&~(DMA_INT_ENAB), (__dregs)+DMA_CSR)
-#define ESP_INTSON(__dregs)     \
-        sbus_writel(sbus_readl((__dregs)+DMA_CSR)|DMA_INT_ENAB, (__dregs)+DMA_CSR)
-#define ESP_IRQ_P(__dregs)      \
-        (sbus_readl((__dregs)+DMA_CSR) & (DMA_HNDL_INTR|DMA_HNDL_ERROR))
-
-/* How we use the various Linux SCSI data structures for operation.
- *
- * struct scsi_cmnd:
- *
- *   We keep track of the synchronous capabilities of a target
- *   in the device member, using sync_min_period and
- *   sync_max_offset.  These are the values we directly write
- *   into the ESP registers while running a command.  If offset
- *   is zero the ESP will use asynchronous transfers.
- *   If the borken flag is set we assume we shouldn't even bother
- *   trying to negotiate for synchronous transfer as this target
- *   is really stupid.  If we notice the target is dropping the
- *   bus, and we have been allowing it to disconnect, we clear
- *   the disconnect flag.
- */
-
-
-/* Manipulation of the ESP command queues.  Thanks to the aha152x driver
- * and its author, Juergen E. Fischer, for the methods used here.
- * Note that these are per-ESP queues, not global queues like
- * the aha152x driver uses.
- */
-static inline void append_SC(struct scsi_cmnd **SC, struct scsi_cmnd *new_SC)
-{
-        struct scsi_cmnd *end;
-
-        new_SC->host_scribble = (unsigned char *) NULL;
-        if (!*SC)
-                *SC = new_SC;
-        else {
-                for (end=*SC;end->host_scribble;end=(struct scsi_cmnd *)end->host_scribble)
-                        ;
-                end->host_scribble = (unsigned char *) new_SC;
-        }
-}
-
-static inline void prepend_SC(struct scsi_cmnd **SC, struct scsi_cmnd *new_SC)
-{
-        new_SC->host_scribble = (unsigned char *) *SC;
-        *SC = new_SC;
-}
-
-static inline struct scsi_cmnd *remove_first_SC(struct scsi_cmnd **SC)
-{
-        struct scsi_cmnd *ptr;
-        ptr = *SC;
-        if (ptr)
-                *SC = (struct scsi_cmnd *) (*SC)->host_scribble;
-        return ptr;
-}
-
-static inline struct scsi_cmnd *remove_SC(struct scsi_cmnd **SC, int target, int lun)
-{
-        struct scsi_cmnd *ptr, *prev;
-
-        for (ptr = *SC, prev = NULL;
-             ptr && ((ptr->device->id != target) || (ptr->device->lun != lun));
-             prev = ptr, ptr = (struct scsi_cmnd *) ptr->host_scribble)
-                ;
-        if (ptr) {
-                if (prev)
-                        prev->host_scribble=ptr->host_scribble;
-                else
-                        *SC=(struct scsi_cmnd *)ptr->host_scribble;
-        }
-        return ptr;
-}
-
-/* Resetting various pieces of the ESP scsi driver chipset/buses. */
-static void esp_reset_dma(struct esp *esp)
-{
-        int can_do_burst16, can_do_burst32, can_do_burst64;
-        int can_do_sbus64;
-        u32 tmp;
-
-        can_do_burst16 = (esp->bursts & DMA_BURST16) != 0;
-        can_do_burst32 = (esp->bursts & DMA_BURST32) != 0;
-        can_do_burst64 = 0;
-        can_do_sbus64 = 0;
-        if (sbus_can_dma_64bit(esp->sdev))
-                can_do_sbus64 = 1;
-        if (sbus_can_burst64(esp->sdev))
-                can_do_burst64 = (esp->bursts & DMA_BURST64) != 0;
-
-        /* Punt the DVMA into a known state. */
-        if (esp->dma->revision != dvmahme) {
-                tmp = sbus_readl(esp->dregs + DMA_CSR);
-                sbus_writel(tmp | DMA_RST_SCSI, esp->dregs + DMA_CSR);
-                sbus_writel(tmp & ~DMA_RST_SCSI, esp->dregs + DMA_CSR);
-        }
-        switch (esp->dma->revision) {
-        case dvmahme:
-                /* This is the HME DVMA gate array. */
-
-                sbus_writel(DMA_RESET_FAS366, esp->dregs + DMA_CSR);
-                sbus_writel(DMA_RST_SCSI, esp->dregs + DMA_CSR);
-
-                esp->prev_hme_dmacsr = (DMA_PARITY_OFF|DMA_2CLKS|DMA_SCSI_DISAB|DMA_INT_ENAB);
-                esp->prev_hme_dmacsr &= ~(DMA_ENABLE|DMA_ST_WRITE|DMA_BRST_SZ);
-
-                if (can_do_burst64)
-                        esp->prev_hme_dmacsr |= DMA_BRST64;
-                else if (can_do_burst32)
-                        esp->prev_hme_dmacsr |= DMA_BRST32;
-
-                if (can_do_sbus64) {
-                        esp->prev_hme_dmacsr |= DMA_SCSI_SBUS64;
-                        sbus_set_sbus64(esp->sdev, esp->bursts);
-                }
-
-                /* This chip is horrible. */
-                while (sbus_readl(esp->dregs + DMA_CSR) & DMA_PEND_READ)
-                        udelay(1);
-
-                sbus_writel(0, esp->dregs + DMA_CSR);
-                sbus_writel(esp->prev_hme_dmacsr, esp->dregs + DMA_CSR);
-
-                /* This is necessary to avoid having the SCSI channel
-                 * engine lock up on us.
-                 */
-                sbus_writel(0, esp->dregs + DMA_ADDR);
-
-                break;
-        case dvmarev2:
-                /* This is the gate array found in the sun4m
-                 * NCR SBUS I/O subsystem.
-                 */
-                if (esp->erev != esp100) {
-                        tmp = sbus_readl(esp->dregs + DMA_CSR);
-                        sbus_writel(tmp | DMA_3CLKS, esp->dregs + DMA_CSR);
-                }
-                break;
-        case dvmarev3:
-                tmp = sbus_readl(esp->dregs + DMA_CSR);
-                tmp &= ~DMA_3CLKS;
-                tmp |= DMA_2CLKS;
-                if (can_do_burst32) {
-                        tmp &= ~DMA_BRST_SZ;
-                        tmp |= DMA_BRST32;
-                }
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-                break;
-        case dvmaesc1:
-                /* This is the DMA unit found on SCSI/Ether cards. */
-                tmp = sbus_readl(esp->dregs + DMA_CSR);
-                tmp |= DMA_ADD_ENABLE;
-                tmp &= ~DMA_BCNT_ENAB;
-                if (!can_do_burst32 && can_do_burst16) {
-                        tmp |= DMA_ESC_BURST;
-                } else {
-                        tmp &= ~(DMA_ESC_BURST);
-                }
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-                break;
-        default:
-                break;
-        };
-        ESP_INTSON(esp->dregs);
-}
-
-/* Reset the ESP chip, _not_ the SCSI bus. */
-static void __init esp_reset_esp(struct esp *esp)
-{
-        u8 family_code, version;
-        int i;
-
-        /* Now reset the ESP chip */
-        esp_cmd(esp, ESP_CMD_RC);
-        esp_cmd(esp, ESP_CMD_NULL | ESP_CMD_DMA);
-        esp_cmd(esp, ESP_CMD_NULL | ESP_CMD_DMA);
-
-        /* Reload the configuration registers */
-        sbus_writeb(esp->cfact, esp->eregs + ESP_CFACT);
-        esp->prev_stp = 0;
-        sbus_writeb(esp->prev_stp, esp->eregs + ESP_STP);
-        esp->prev_soff = 0;
-        sbus_writeb(esp->prev_soff, esp->eregs + ESP_SOFF);
-        sbus_writeb(esp->neg_defp, esp->eregs + ESP_TIMEO);
-
-        /* This is the only point at which it is reliable to read
-         * the ID-code for a fast ESP chip variants.
-         */
-        esp->max_period = ((35 * esp->ccycle) / 1000);
-        if (esp->erev == fast) {
-                version = sbus_readb(esp->eregs + ESP_UID);
-                family_code = (version & 0xf8) >> 3;
-                if (family_code == 0x02)
-                        esp->erev = fas236;
-                else if (family_code == 0x0a)
-                        esp->erev = fashme; /* Version is usually '5'. */
-                else
-                        esp->erev = fas100a;
-                ESPMISC(("esp%d: FAST chip is %s (family=%d, version=%d)\n",
-                         esp->esp_id,
-                         (esp->erev == fas236) ? "fas236" :
-                         ((esp->erev == fas100a) ? "fas100a" :
-                          "fasHME"), family_code, (version & 7)));
-
-                esp->min_period = ((4 * esp->ccycle) / 1000);
-        } else {
-                esp->min_period = ((5 * esp->ccycle) / 1000);
-        }
-        esp->max_period = (esp->max_period + 3)>>2;
-        esp->min_period = (esp->min_period + 3)>>2;
-
-        sbus_writeb(esp->config1, esp->eregs + ESP_CFG1);
-        switch (esp->erev) {
-        case esp100:
-                /* nothing to do */
-                break;
-        case esp100a:
-                sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                break;
-        case esp236:
-                /* Slow 236 */
-                sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                esp->prev_cfg3 = esp->config3[0];
-                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                break;
-        case fashme:
-                esp->config2 |= (ESP_CONFIG2_HME32 | ESP_CONFIG2_HMEFENAB);
-                /* fallthrough... */
-        case fas236:
-                /* Fast 236 or HME */
-                sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                for (i = 0; i < 16; i++) {
-                        if (esp->erev == fashme) {
-                                u8 cfg3;
-
-                                cfg3 = ESP_CONFIG3_FCLOCK | ESP_CONFIG3_OBPUSH;
-                                if (esp->scsi_id >= 8)
-                                        cfg3 |= ESP_CONFIG3_IDBIT3;
-                                esp->config3[i] |= cfg3;
-                        } else {
-                                esp->config3[i] |= ESP_CONFIG3_FCLK;
-                        }
-                }
-                esp->prev_cfg3 = esp->config3[0];
-                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                if (esp->erev == fashme) {
-                        esp->radelay = 80;
-                } else {
-                        if (esp->diff)
-                                esp->radelay = 0;
-                        else
-                                esp->radelay = 96;
-                }
-                break;
-        case fas100a:
-                /* Fast 100a */
-                sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                for (i = 0; i < 16; i++)
-                        esp->config3[i] |= ESP_CONFIG3_FCLOCK;
-                esp->prev_cfg3 = esp->config3[0];
-                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                esp->radelay = 32;
-                break;
-        default:
-                panic("esp: what could it be... I wonder...");
-                break;
-        };
-
-        /* Eat any bitrot in the chip */
-        sbus_readb(esp->eregs + ESP_INTRPT);
-        udelay(100);
-}
-
-/* This places the ESP into a known state at boot time. */
-static void __init esp_bootup_reset(struct esp *esp)
-{
-        u8 tmp;
-
-        /* Reset the DMA */
-        esp_reset_dma(esp);
-
-        /* Reset the ESP */
-        esp_reset_esp(esp);
-
-        /* Reset the SCSI bus, but tell ESP not to generate an irq */
-        tmp = sbus_readb(esp->eregs + ESP_CFG1);
-        tmp |= ESP_CONFIG1_SRRDISAB;
-        sbus_writeb(tmp, esp->eregs + ESP_CFG1);
-
-        esp_cmd(esp, ESP_CMD_RS);
-        udelay(400);
-
-        sbus_writeb(esp->config1, esp->eregs + ESP_CFG1);
-
-        /* Eat any bitrot in the chip and we are done... */
-        sbus_readb(esp->eregs + ESP_INTRPT);
-}
-
-static int __init esp_find_dvma(struct esp *esp, struct sbus_dev *dma_sdev)
-{
-        struct sbus_dev *sdev = esp->sdev;
-        struct sbus_dma *dma;
-
-        if (dma_sdev != NULL) {
-                for_each_dvma(dma) {
-                        if (dma->sdev == dma_sdev)
-                                break;
-                }
-        } else {
-                for_each_dvma(dma) {
-                        /* If allocated already, can't use it. */
-                        if (dma->allocated)
-                                continue;
-
-                        if (dma->sdev == NULL)
-                                break;
-
-                        /* If bus + slot are the same and it has the
-                         * correct OBP name, it's ours.
-                         */
-                        if (sdev->bus == dma->sdev->bus &&
-                            sdev->slot == dma->sdev->slot &&
-                            (!strcmp(dma->sdev->prom_name, "dma") ||
-                             !strcmp(dma->sdev->prom_name, "espdma")))
-                                break;
-                }
-        }
-
-        /* If we don't know how to handle the dvma,
-         * do not use this device.
-         */
-        if (dma == NULL) {
-                printk("Cannot find dvma for ESP%d's SCSI\n", esp->esp_id);
-                return -1;
-        }
-        if (dma->allocated) {
-                printk("esp%d: can't use my espdma\n", esp->esp_id);
-                return -1;
-        }
-        dma->allocated = 1;
-        esp->dma = dma;
-        esp->dregs = dma->regs;
-
-        return 0;
-}
-
-static int __init esp_map_regs(struct esp *esp, int hme)
-{
-        struct sbus_dev *sdev = esp->sdev;
-        struct resource *res;
-
-        /* On HME, two reg sets exist, first is DVMA,
-         * second is ESP registers.
-         */
-        if (hme)
-                res = &sdev->resource[1];
-        else
-                res = &sdev->resource[0];
-
-        esp->eregs = sbus_ioremap(res, 0, ESP_REG_SIZE, "ESP Registers");
-
-        if (esp->eregs == 0)
-                return -1;
-        return 0;
-}
-
-static int __init esp_map_cmdarea(struct esp *esp)
-{
-        struct sbus_dev *sdev = esp->sdev;
-
-        esp->esp_command = sbus_alloc_consistent(sdev, 16,
-                                                 &esp->esp_command_dvma);
-        if (esp->esp_command == NULL ||
-            esp->esp_command_dvma == 0)
-                return -1;
-        return 0;
-}
-
-static int __init esp_register_irq(struct esp *esp)
-{
-        esp->ehost->irq = esp->irq = esp->sdev->irqs[0];
-
-        /* We used to try various overly-clever things to
-         * reduce the interrupt processing overhead on
-         * sun4c/sun4m when multiple ESP's shared the
-         * same IRQ.  It was too complex and messy to
-         * sanely maintain.
-         */
-        if (request_irq(esp->ehost->irq, esp_intr,
-                        IRQF_SHARED, "ESP SCSI", esp)) {
-                printk("esp%d: Cannot acquire irq line\n",
-                       esp->esp_id);
-                return -1;
-        }
-
-        printk("esp%d: IRQ %d ", esp->esp_id,
-               esp->ehost->irq);
-
-        return 0;
-}
-
-static void __init esp_get_scsi_id(struct esp *esp)
-{
-        struct sbus_dev *sdev = esp->sdev;
-        struct device_node *dp = sdev->ofdev.node;
-
-        esp->scsi_id = of_getintprop_default(dp,
-                                             "initiator-id",
-                                             -1);
-        if (esp->scsi_id == -1)
-                esp->scsi_id = of_getintprop_default(dp,
-                                                     "scsi-initiator-id",
-                                                     -1);
-        if (esp->scsi_id == -1)
-                esp->scsi_id = (sdev->bus == NULL) ? 7 :
-                        of_getintprop_default(sdev->bus->ofdev.node,
-                                              "scsi-initiator-id",
-                                              7);
-        esp->ehost->this_id = esp->scsi_id;
-        esp->scsi_id_mask = (1 << esp->scsi_id);
-
-}
-
-static void __init esp_get_clock_params(struct esp *esp)
-{
-        struct sbus_dev *sdev = esp->sdev;
-        int prom_node = esp->prom_node;
-        int sbus_prom_node;
-        unsigned int fmhz;
-        u8 ccf;
-
-        if (sdev != NULL && sdev->bus != NULL)
-                sbus_prom_node = sdev->bus->prom_node;
-        else
-                sbus_prom_node = 0;
-
-        /* This is getting messy but it has to be done
-         * correctly or else you get weird behavior all
-         * over the place.  We are trying to basically
-         * figure out three pieces of information.
-         *
-         * a) Clock Conversion Factor
-         *
-         *    This is a representation of the input
-         *    crystal clock frequency going into the
-         *    ESP on this machine.  Any operation whose
-         *    timing is longer than 400ns depends on this
-         *    value being correct.  For example, you'll
-         *    get blips for arbitration/selection during
-         *    high load or with multiple targets if this
-         *    is not set correctly.
-         *
-         * b) Selection Time-Out
-         *
-         *    The ESP isn't very bright and will arbitrate
-         *    for the bus and try to select a target
-         *    forever if you let it.  This value tells
-         *    the ESP when it has taken too long to
-         *    negotiate and that it should interrupt
-         *    the CPU so we can see what happened.
-         *    The value is computed as follows (from
-         *    NCR/Symbios chip docs).
-         *
-         *          (Time Out Period) *  (Input Clock)
-         *    STO = ----------------------------------
-         *          (8192) * (Clock Conversion Factor)
-         *
-         *    You usually want the time out period to be
-         *    around 250ms, I think we'll set it a little
-         *    bit higher to account for fully loaded SCSI
-         *    bus's and slow devices that don't respond so
-         *    quickly to selection attempts. (yeah, I know
-         *    this is out of spec. but there is a lot of
-         *    buggy pieces of firmware out there so bite me)
-         *
-         * c) Imperical constants for synchronous offset
-         *    and transfer period register values
-         *
-         *    This entails the smallest and largest sync
-         *    period we could ever handle on this ESP.
-         */
-
-        fmhz = prom_getintdefault(prom_node, "clock-frequency", -1);
-        if (fmhz == -1)
-                fmhz = (!sbus_prom_node) ? 0 :
-                        prom_getintdefault(sbus_prom_node, "clock-frequency", -1);
-
-        if (fmhz <= (5000000))
-                ccf = 0;
-        else
-                ccf = (((5000000 - 1) + (fmhz))/(5000000));
-
-        if (!ccf || ccf > 8) {
-                /* If we can't find anything reasonable,
-                 * just assume 20MHZ.  This is the clock
-                 * frequency of the older sun4c's where I've
-                 * been unable to find the clock-frequency
-                 * PROM property.  All other machines provide
-                 * useful values it seems.
-                 */
-                ccf = ESP_CCF_F4;
-                fmhz = (20000000);
-        }
-
-        if (ccf == (ESP_CCF_F7 + 1))
-                esp->cfact = ESP_CCF_F0;
-        else if (ccf == ESP_CCF_NEVER)
-                esp->cfact = ESP_CCF_F2;
-        else
-                esp->cfact = ccf;
-        esp->raw_cfact = ccf;
-
-        esp->cfreq = fmhz;
-        esp->ccycle = ESP_MHZ_TO_CYCLE(fmhz);
-        esp->ctick = ESP_TICK(ccf, esp->ccycle);
-        esp->neg_defp = ESP_NEG_DEFP(fmhz, ccf);
-        esp->sync_defp = SYNC_DEFP_SLOW;
-
-        printk("SCSI ID %d Clk %dMHz CCYC=%d CCF=%d TOut %d ",
-               esp->scsi_id, (fmhz / 1000000),
-               (int)esp->ccycle, (int)ccf, (int) esp->neg_defp);
-}
-
-static void __init esp_get_bursts(struct esp *esp, struct sbus_dev *dma)
-{
-        struct sbus_dev *sdev = esp->sdev;
-        u8 bursts;
-
-        bursts = prom_getintdefault(esp->prom_node, "burst-sizes", 0xff);
-
-        if (dma) {
-                u8 tmp = prom_getintdefault(dma->prom_node,
-                                            "burst-sizes", 0xff);
-                if (tmp != 0xff)
-                        bursts &= tmp;
-        }
-
-        if (sdev->bus) {
-                u8 tmp = prom_getintdefault(sdev->bus->prom_node,
-                                            "burst-sizes", 0xff);
-                if (tmp != 0xff)
-                        bursts &= tmp;
-        }
-
-        if (bursts == 0xff ||
-            (bursts & DMA_BURST16) == 0 ||
-            (bursts & DMA_BURST32) == 0)
-                bursts = (DMA_BURST32 - 1);
-
-        esp->bursts = bursts;
-}
-
-static void __init esp_get_revision(struct esp *esp)
-{
-        u8 tmp;
-
-        esp->config1 = (ESP_CONFIG1_PENABLE | (esp->scsi_id & 7));
-        esp->config2 = (ESP_CONFIG2_SCSI2ENAB | ESP_CONFIG2_REGPARITY);
-        sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-
-        tmp = sbus_readb(esp->eregs + ESP_CFG2);
-        tmp &= ~ESP_CONFIG2_MAGIC;
-        if (tmp != (ESP_CONFIG2_SCSI2ENAB | ESP_CONFIG2_REGPARITY)) {
-                /* If what we write to cfg2 does not come back, cfg2
-                 * is not implemented, therefore this must be a plain
-                 * esp100.
-                 */
-                esp->erev = esp100;
-                printk("NCR53C90(esp100)\n");
-        } else {
-                esp->config2 = 0;
-                esp->prev_cfg3 = esp->config3[0] = 5;
-                sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                sbus_writeb(0, esp->eregs + ESP_CFG3);
-                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-
-                tmp = sbus_readb(esp->eregs + ESP_CFG3);
-                if (tmp != 5) {
-                        /* The cfg2 register is implemented, however
-                         * cfg3 is not, must be esp100a.
-                         */
-                        esp->erev = esp100a;
-                        printk("NCR53C90A(esp100a)\n");
-                } else {
-                        int target;
-
-                        for (target = 0; target < 16; target++)
-                                esp->config3[target] = 0;
-                        esp->prev_cfg3 = 0;
-                        sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-
-                        /* All of cfg{1,2,3} implemented, must be one of
-                         * the fas variants, figure out which one.
-                         */
-                        if (esp->raw_cfact > ESP_CCF_F5) {
-                                esp->erev = fast;
-                                esp->sync_defp = SYNC_DEFP_FAST;
-                                printk("NCR53C9XF(espfast)\n");
-                        } else {
-                                esp->erev = esp236;
-                                printk("NCR53C9x(esp236)\n");
-                        }
-                        esp->config2 = 0;
-                        sbus_writeb(esp->config2, esp->eregs + ESP_CFG2);
-                }
-        }
-}
-
-static void __init esp_init_swstate(struct esp *esp)
-{
-        int i;
-
-        /* Command queues... */
-        esp->current_SC = NULL;
-        esp->disconnected_SC = NULL;
-        esp->issue_SC = NULL;
-
-        /* Target and current command state... */
-        esp->targets_present = 0;
-        esp->resetting_bus = 0;
-        esp->snip = 0;
-
-        init_waitqueue_head(&esp->reset_queue);
-
-        /* Debugging... */
-        for(i = 0; i < 32; i++)
-                esp->espcmdlog[i] = 0;
-        esp->espcmdent = 0;
-
-        /* MSG phase state... */
-        for(i = 0; i < 16; i++) {
-                esp->cur_msgout[i] = 0;
-                esp->cur_msgin[i] = 0;
-        }
-        esp->prevmsgout = esp->prevmsgin = 0;
-        esp->msgout_len = esp->msgin_len = 0;
-
-        /* Clear the one behind caches to hold unmatchable values. */
-        esp->prev_soff = esp->prev_stp = esp->prev_cfg3 = 0xff;
-        esp->prev_hme_dmacsr = 0xffffffff;
-}
-
-static int __init detect_one_esp(struct scsi_host_template *tpnt,
-                                 struct device *dev,
-                                 struct sbus_dev *esp_dev,
-                                 struct sbus_dev *espdma,
-                                 struct sbus_bus *sbus,
-                                 int hme)
-{
-        static int instance;
-        struct Scsi_Host *esp_host = scsi_host_alloc(tpnt, sizeof(struct esp));
-        struct esp *esp;
-        
-        if (!esp_host)
-                return -ENOMEM;
-
-        if (hme)
-                esp_host->max_id = 16;
-        esp = (struct esp *) esp_host->hostdata;
-        esp->ehost = esp_host;
-        esp->sdev = esp_dev;
-        esp->esp_id = instance;
-        esp->prom_node = esp_dev->prom_node;
-        prom_getstring(esp->prom_node, "name", esp->prom_name,
-                       sizeof(esp->prom_name));
-
-        if (esp_find_dvma(esp, espdma) < 0)
-                goto fail_unlink;
-        if (esp_map_regs(esp, hme) < 0) {
-                printk("ESP registers unmappable");
-                goto fail_dvma_release;
-        }
-        if (esp_map_cmdarea(esp) < 0) {
-                printk("ESP DVMA transport area unmappable");
-                goto fail_unmap_regs;
-        }
-        if (esp_register_irq(esp) < 0)
-                goto fail_unmap_cmdarea;
-
-        esp_get_scsi_id(esp);
-
-        esp->diff = prom_getbool(esp->prom_node, "differential");
-        if (esp->diff)
-                printk("Differential ");
-
-        esp_get_clock_params(esp);
-        esp_get_bursts(esp, espdma);
-        esp_get_revision(esp);
-        esp_init_swstate(esp);
-
-        esp_bootup_reset(esp);
-
-        if (scsi_add_host(esp_host, dev))
-                goto fail_free_irq;
-
-        dev_set_drvdata(&esp_dev->ofdev.dev, esp);
-
-        scsi_scan_host(esp_host);
-        instance++;
-
-        return 0;
-
-fail_free_irq:
-        free_irq(esp->ehost->irq, esp);
-
-fail_unmap_cmdarea:
-        sbus_free_consistent(esp->sdev, 16,
-                             (void *) esp->esp_command,
-                             esp->esp_command_dvma);
-
-fail_unmap_regs:
-        sbus_iounmap(esp->eregs, ESP_REG_SIZE);
-
-fail_dvma_release:
-        esp->dma->allocated = 0;
-
-fail_unlink:
-        scsi_host_put(esp_host);
-        return -1;
-}
-
-/* Detecting ESP chips on the machine.  This is the simple and easy
- * version.
- */
-static int __devexit esp_remove_common(struct esp *esp)
-{
-        unsigned int irq = esp->ehost->irq;
-
-        scsi_remove_host(esp->ehost);
-
-        ESP_INTSOFF(esp->dregs);
-#if 0
-        esp_reset_dma(esp);
-        esp_reset_esp(esp);
-#endif
-
-        free_irq(irq, esp);
-        sbus_free_consistent(esp->sdev, 16,
-                             (void *) esp->esp_command, esp->esp_command_dvma);
-        sbus_iounmap(esp->eregs, ESP_REG_SIZE);
-        esp->dma->allocated = 0;
-
-        scsi_host_put(esp->ehost);
-
-        return 0;
-}
-
-
-#ifdef CONFIG_SUN4
-
-#include <asm/sun4paddr.h>
-
-static struct sbus_dev sun4_esp_dev;
-
-static int __init esp_sun4_probe(struct scsi_host_template *tpnt)
-{
-        if (sun4_esp_physaddr) {
-                memset(&sun4_esp_dev, 0, sizeof(sun4_esp_dev));
-                sun4_esp_dev.reg_addrs[0].phys_addr = sun4_esp_physaddr;
-                sun4_esp_dev.irqs[0] = 4;
-                sun4_esp_dev.resource[0].start = sun4_esp_physaddr;
-                sun4_esp_dev.resource[0].end =
-                        sun4_esp_physaddr + ESP_REG_SIZE - 1;
-                sun4_esp_dev.resource[0].flags = IORESOURCE_IO;
-
-                return detect_one_esp(tpnt, NULL,
-                                      &sun4_esp_dev, NULL, NULL, 0);
-        }
-        return 0;
-}
-
-static int __devexit esp_sun4_remove(void)
-{
-        struct of_device *dev = &sun4_esp_dev.ofdev;
-        struct esp *esp = dev_get_drvdata(&dev->dev);
-
-        return esp_remove_common(esp);
-}
-
-#else /* !CONFIG_SUN4 */
-
-static int __devinit esp_sbus_probe(struct of_device *dev, const struct of_device_id *match)
-{
-        struct sbus_dev *sdev = to_sbus_device(&dev->dev);
-        struct device_node *dp = dev->node;
-        struct sbus_dev *dma_sdev = NULL;
-        int hme = 0;
-
-        if (dp->parent &&
-            (!strcmp(dp->parent->name, "espdma") ||
-             !strcmp(dp->parent->name, "dma")))
-                dma_sdev = sdev->parent;
-        else if (!strcmp(dp->name, "SUNW,fas")) {
-                dma_sdev = sdev;
-                hme = 1;
-        }
-
-        return detect_one_esp(match->data, &dev->dev,
-                              sdev, dma_sdev, sdev->bus, hme);
-}
-
-static int __devexit esp_sbus_remove(struct of_device *dev)
-{
-        struct esp *esp = dev_get_drvdata(&dev->dev);
-
-        return esp_remove_common(esp);
-}
-
-#endif /* !CONFIG_SUN4 */
-
-/* The info function will return whatever useful
- * information the developer sees fit.  If not provided, then
- * the name field will be used instead.
- */
-static const char *esp_info(struct Scsi_Host *host)
-{
-        struct esp *esp;
-
-        esp = (struct esp *) host->hostdata;
-        switch (esp->erev) {
-        case esp100:
-                return "Sparc ESP100 (NCR53C90)";
-        case esp100a:
-                return "Sparc ESP100A (NCR53C90A)";
-        case esp236:
-                return "Sparc ESP236";
-        case fas236:
-                return "Sparc ESP236-FAST";
-        case fashme:
-                return "Sparc ESP366-HME";
-        case fas100a:
-                return "Sparc ESP100A-FAST";
-        default:
-                return "Bogon ESP revision";
-        };
-}
-
-/* From Wolfgang Stanglmeier's NCR scsi driver. */
-struct info_str
-{
-        char *buffer;
-        int length;
-        int offset;
-        int pos;
-};
-
-static void copy_mem_info(struct info_str *info, char *data, int len)
-{
-        if (info->pos + len > info->length)
-                len = info->length - info->pos;
-
-        if (info->pos + len < info->offset) {
-                info->pos += len;
-                return;
-        }
-        if (info->pos < info->offset) {
-                data += (info->offset - info->pos);
-                len  -= (info->offset - info->pos);
-        }
-
-        if (len > 0) {
-                memcpy(info->buffer + info->pos, data, len);
-                info->pos += len;
-        }
-}
-
-static int copy_info(struct info_str *info, char *fmt, ...)
-{
-        va_list args;
-        char buf[81];
-        int len;
-
-        va_start(args, fmt);
-        len = vsprintf(buf, fmt, args);
-        va_end(args);
-
-        copy_mem_info(info, buf, len);
-        return len;
-}
-
-static int esp_host_info(struct esp *esp, char *ptr, off_t offset, int len)
-{
-        struct scsi_device *sdev;
-        struct info_str info;
-        int i;
-
-        info.buffer     = ptr;
-        info.length     = len;
-        info.offset     = offset;
-        info.pos        = 0;
-
-        copy_info(&info, "Sparc ESP Host Adapter:\n");
-        copy_info(&info, "\tPROM node\t\t%08x\n", (unsigned int) esp->prom_node);
-        copy_info(&info, "\tPROM name\t\t%s\n", esp->prom_name);
-        copy_info(&info, "\tESP Model\t\t");
-        switch (esp->erev) {
-        case esp100:
-                copy_info(&info, "ESP100\n");
-                break;
-        case esp100a:
-                copy_info(&info, "ESP100A\n");
-                break;
-        case esp236:
-                copy_info(&info, "ESP236\n");
-                break;
-        case fas236:
-                copy_info(&info, "FAS236\n");
-                break;
-        case fas100a:
-                copy_info(&info, "FAS100A\n");
-                break;
-        case fast:
-                copy_info(&info, "FAST\n");
-                break;
-        case fashme:
-                copy_info(&info, "Happy Meal FAS\n");
-                break;
-        case espunknown:
-        default:
-                copy_info(&info, "Unknown!\n");
-                break;
-        };
-        copy_info(&info, "\tDMA Revision\t\t");
-        switch (esp->dma->revision) {
-        case dvmarev0:
-                copy_info(&info, "Rev 0\n");
-                break;
-        case dvmaesc1:
-                copy_info(&info, "ESC Rev 1\n");
-                break;
-        case dvmarev1:
-                copy_info(&info, "Rev 1\n");
-                break;
-        case dvmarev2:
-                copy_info(&info, "Rev 2\n");
-                break;
-        case dvmarev3:
-                copy_info(&info, "Rev 3\n");
-                break;
-        case dvmarevplus:
-                copy_info(&info, "Rev 1+\n");
-                break;
-        case dvmahme:
-                copy_info(&info, "Rev HME/FAS\n");
-                break;
-        default:
-                copy_info(&info, "Unknown!\n");
-                break;
-        };
-        copy_info(&info, "\tLive Targets\t\t[ ");
-        for (i = 0; i < 15; i++) {
-                if (esp->targets_present & (1 << i))
-                        copy_info(&info, "%d ", i);
-        }
-        copy_info(&info, "]\n\n");
-        
-        /* Now describe the state of each existing target. */
-        copy_info(&info, "Target #\tconfig3\t\tSync Capabilities\tDisconnect\tWide\n");
-
-        shost_for_each_device(sdev, esp->ehost) {
-                struct esp_device *esp_dev = sdev->hostdata;
-                uint id = sdev->id;
-
-                if (!(esp->targets_present & (1 << id)))
-                        continue;
-
-                copy_info(&info, "%d\t\t", id);
-                copy_info(&info, "%08lx\t", esp->config3[id]);
-                copy_info(&info, "[%02lx,%02lx]\t\t\t",
-                        esp_dev->sync_max_offset,
-                        esp_dev->sync_min_period);
-                copy_info(&info, "%s\t\t",
-                        esp_dev->disconnect ? "yes" : "no");
-                copy_info(&info, "%s\n",
-                        (esp->config3[id] & ESP_CONFIG3_EWIDE) ? "yes" : "no");
-        }
-        return info.pos > info.offset? info.pos - info.offset : 0;
-}
-
-/* ESP proc filesystem code. */
-static int esp_proc_info(struct Scsi_Host *host, char *buffer, char **start, off_t offset,
-                         int length, int inout)
-{
-        struct esp *esp = (struct esp *) host->hostdata;
-
-        if (inout)
-                return -EINVAL; /* not yet */
-
-        if (start)
-                *start = buffer;
-
-        return esp_host_info(esp, buffer, offset, length);
-}
-
-static void esp_get_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
-{
-        if (sp->use_sg == 0) {
-                sp->SCp.this_residual = sp->request_bufflen;
-                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
-                sp->SCp.buffers_residual = 0;
-                if (sp->request_bufflen) {
-                        sp->SCp.have_data_in = sbus_map_single(esp->sdev, sp->SCp.buffer,
-                                                               sp->SCp.this_residual,
-                                                               sp->sc_data_direction);
-                        sp->SCp.ptr = (char *) ((unsigned long)sp->SCp.have_data_in);
-                } else {
-                        sp->SCp.ptr = NULL;
-                }
-        } else {
-                sp->SCp.buffer = (struct scatterlist *) sp->request_buffer;
-                sp->SCp.buffers_residual = sbus_map_sg(esp->sdev,
-                                                       sp->SCp.buffer,
-                                                       sp->use_sg,
-                                                       sp->sc_data_direction);
-                sp->SCp.this_residual = sg_dma_len(sp->SCp.buffer);
-                sp->SCp.ptr = (char *) ((unsigned long)sg_dma_address(sp->SCp.buffer));
-        }
-}
-
-static void esp_release_dmabufs(struct esp *esp, struct scsi_cmnd *sp)
-{
-        if (sp->use_sg) {
-                sbus_unmap_sg(esp->sdev, sp->request_buffer, sp->use_sg,
-                              sp->sc_data_direction);
-        } else if (sp->request_bufflen) {
-                sbus_unmap_single(esp->sdev,
-                                  sp->SCp.have_data_in,
-                                  sp->request_bufflen,
-                                  sp->sc_data_direction);
-        }
-}
-
-static void esp_restore_pointers(struct esp *esp, struct scsi_cmnd *sp)
-{
-        struct esp_pointers *ep = &esp->data_pointers[sp->device->id];
-
-        sp->SCp.ptr = ep->saved_ptr;
-        sp->SCp.buffer = ep->saved_buffer;
-        sp->SCp.this_residual = ep->saved_this_residual;
-        sp->SCp.buffers_residual = ep->saved_buffers_residual;
-}
-
-static void esp_save_pointers(struct esp *esp, struct scsi_cmnd *sp)
-{
-        struct esp_pointers *ep = &esp->data_pointers[sp->device->id];
-
-        ep->saved_ptr = sp->SCp.ptr;
-        ep->saved_buffer = sp->SCp.buffer;
-        ep->saved_this_residual = sp->SCp.this_residual;
-        ep->saved_buffers_residual = sp->SCp.buffers_residual;
-}
-
-/* Some rules:
- *
- *   1) Never ever panic while something is live on the bus.
- *      If there is to be any chance of syncing the disks this
- *      rule is to be obeyed.
- *
- *   2) Any target that causes a foul condition will no longer
- *      have synchronous transfers done to it, no questions
- *      asked.
- *
- *   3) Keep register accesses to a minimum.  Think about some
- *      day when we have Xbus machines this is running on and
- *      the ESP chip is on the other end of the machine on a
- *      different board from the cpu where this is running.
- */
-
-/* Fire off a command.  We assume the bus is free and that the only
- * case where we could see an interrupt is where we have disconnected
- * commands active and they are trying to reselect us.
- */
-static inline void esp_check_cmd(struct esp *esp, struct scsi_cmnd *sp)
-{
-        switch (sp->cmd_len) {
-        case 6:
-        case 10:
-        case 12:
-                esp->esp_slowcmd = 0;
-                break;
-
-        default:
-                esp->esp_slowcmd = 1;
-                esp->esp_scmdleft = sp->cmd_len;
-                esp->esp_scmdp = &sp->cmnd[0];
-                break;
-        };
-}
-
-static inline void build_sync_nego_msg(struct esp *esp, int period, int offset)
-{
-        esp->cur_msgout[0] = EXTENDED_MESSAGE;
-        esp->cur_msgout[1] = 3;
-        esp->cur_msgout[2] = EXTENDED_SDTR;
-        esp->cur_msgout[3] = period;
-        esp->cur_msgout[4] = offset;
-        esp->msgout_len = 5;
-}
-
-/* SIZE is in bits, currently HME only supports 16 bit wide transfers. */
-static inline void build_wide_nego_msg(struct esp *esp, int size)
-{
-        esp->cur_msgout[0] = EXTENDED_MESSAGE;
-        esp->cur_msgout[1] = 2;
-        esp->cur_msgout[2] = EXTENDED_WDTR;
-        switch (size) {
-        case 32:
-                esp->cur_msgout[3] = 2;
-                break;
-        case 16:
-                esp->cur_msgout[3] = 1;
-                break;
-        case 8:
-        default:
-                esp->cur_msgout[3] = 0;
-                break;
-        };
-
-        esp->msgout_len = 4;
-}
-
-static void esp_exec_cmd(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr;
-        struct scsi_device *SDptr;
-        struct esp_device *esp_dev;
-        volatile u8 *cmdp = esp->esp_command;
-        u8 the_esp_command;
-        int lun, target;
-        int i;
-
-        /* Hold off if we have disconnected commands and
-         * an IRQ is showing...
-         */
-        if (esp->disconnected_SC && ESP_IRQ_P(esp->dregs))
-                return;
-
-        /* Grab first member of the issue queue. */
-        SCptr = esp->current_SC = remove_first_SC(&esp->issue_SC);
-
-        /* Safe to panic here because current_SC is null. */
-        if (!SCptr)
-                panic("esp: esp_exec_cmd and issue queue is NULL");
-
-        SDptr = SCptr->device;
-        esp_dev = SDptr->hostdata;
-        lun = SCptr->device->lun;
-        target = SCptr->device->id;
-
-        esp->snip = 0;
-        esp->msgout_len = 0;
-
-        /* Send it out whole, or piece by piece?   The ESP
-         * only knows how to automatically send out 6, 10,
-         * and 12 byte commands.  I used to think that the
-         * Linux SCSI code would never throw anything other
-         * than that to us, but then again there is the
-         * SCSI generic driver which can send us anything.
-         */
-        esp_check_cmd(esp, SCptr);
-
-        /* If arbitration/selection is successful, the ESP will leave
-         * ATN asserted, causing the target to go into message out
-         * phase.  The ESP will feed the target the identify and then
-         * the target can only legally go to one of command,
-         * datain/out, status, or message in phase, or stay in message
-         * out phase (should we be trying to send a sync negotiation
-         * message after the identify).  It is not allowed to drop
-         * BSY, but some buggy targets do and we check for this
-         * condition in the selection complete code.  Most of the time
-         * we'll make the command bytes available to the ESP and it
-         * will not interrupt us until it finishes command phase, we
-         * cannot do this for command sizes the ESP does not
-         * understand and in this case we'll get interrupted right
-         * when the target goes into command phase.
-         *
-         * It is absolutely _illegal_ in the presence of SCSI-2 devices
-         * to use the ESP select w/o ATN command.  When SCSI-2 devices are
-         * present on the bus we _must_ always go straight to message out
-         * phase with an identify message for the target.  Being that
-         * selection attempts in SCSI-1 w/o ATN was an option, doing SCSI-2
-         * selections should not confuse SCSI-1 we hope.
-         */
-
-        if (esp_dev->sync) {
-                /* this targets sync is known */
-#ifndef __sparc_v9__
-do_sync_known:
-#endif
-                if (esp_dev->disconnect)
-                        *cmdp++ = IDENTIFY(1, lun);
-                else
-                        *cmdp++ = IDENTIFY(0, lun);
-
-                if (esp->esp_slowcmd) {
-                        the_esp_command = (ESP_CMD_SELAS | ESP_CMD_DMA);
-                        esp_advance_phase(SCptr, in_slct_stop);
-                } else {
-                        the_esp_command = (ESP_CMD_SELA | ESP_CMD_DMA);
-                        esp_advance_phase(SCptr, in_slct_norm);
-                }
-        } else if (!(esp->targets_present & (1<<target)) || !(esp_dev->disconnect)) {
-                /* After the bootup SCSI code sends both the
-                 * TEST_UNIT_READY and INQUIRY commands we want
-                 * to at least attempt allowing the device to
-                 * disconnect.
-                 */
-                ESPMISC(("esp: Selecting device for first time. target=%d "
-                         "lun=%d\n", target, SCptr->device->lun));
-                if (!SDptr->borken && !esp_dev->disconnect)
-                        esp_dev->disconnect = 1;
-
-                *cmdp++ = IDENTIFY(0, lun);
-                esp->prevmsgout = NOP;
-                esp_advance_phase(SCptr, in_slct_norm);
-                the_esp_command = (ESP_CMD_SELA | ESP_CMD_DMA);
-
-                /* Take no chances... */
-                esp_dev->sync_max_offset = 0;
-                esp_dev->sync_min_period = 0;
-        } else {
-                /* Sorry, I have had way too many problems with
-                 * various CDROM devices on ESP. -DaveM
-                 */
-                int cdrom_hwbug_wkaround = 0;
-
-#ifndef __sparc_v9__
-                /* Never allow disconnects or synchronous transfers on
-                 * SparcStation1 and SparcStation1+.  Allowing those
-                 * to be enabled seems to lockup the machine completely.
-                 */
-                if ((idprom->id_machtype == (SM_SUN4C | SM_4C_SS1)) ||
-                    (idprom->id_machtype == (SM_SUN4C | SM_4C_SS1PLUS))) {
-                        /* But we are nice and allow tapes and removable
-                         * disks (but not CDROMs) to disconnect.
-                         */
-                        if(SDptr->type == TYPE_TAPE ||
-                           (SDptr->type != TYPE_ROM && SDptr->removable))
-                                esp_dev->disconnect = 1;
-                        else
-                                esp_dev->disconnect = 0;
-                        esp_dev->sync_max_offset = 0;
-                        esp_dev->sync_min_period = 0;
-                        esp_dev->sync = 1;
-                        esp->snip = 0;
-                        goto do_sync_known;
-                }
-#endif /* !(__sparc_v9__) */
-
-                /* We've talked to this guy before,
-                 * but never negotiated.  Let's try,
-                 * need to attempt WIDE first, before
-                 * sync nego, as per SCSI 2 standard.
-                 */
-                if (esp->erev == fashme && !esp_dev->wide) {
-                        if (!SDptr->borken &&
-                           SDptr->type != TYPE_ROM &&
-                           SDptr->removable == 0) {
-                                build_wide_nego_msg(esp, 16);
-                                esp_dev->wide = 1;
-                                esp->wnip = 1;
-                                goto after_nego_msg_built;
-                        } else {
-                                esp_dev->wide = 1;
-                                /* Fall through and try sync. */
-                        }
-                }
-
-                if (!SDptr->borken) {
-                        if ((SDptr->type == TYPE_ROM)) {
-                                /* Nice try sucker... */
-                                ESPMISC(("esp%d: Disabling sync for buggy "
-                                         "CDROM.\n", esp->esp_id));
-                                cdrom_hwbug_wkaround = 1;
-                                build_sync_nego_msg(esp, 0, 0);
-                        } else if (SDptr->removable != 0) {
-                                ESPMISC(("esp%d: Not negotiating sync/wide but "
-                                         "allowing disconnect for removable media.\n",
-                                         esp->esp_id));
-                                build_sync_nego_msg(esp, 0, 0);
-                        } else {
-                                build_sync_nego_msg(esp, esp->sync_defp, 15);
-                        }
-                } else {
-                        build_sync_nego_msg(esp, 0, 0);
-                }
-                esp_dev->sync = 1;
-                esp->snip = 1;
-
-after_nego_msg_built:
-                /* A fix for broken SCSI1 targets, when they disconnect
-                 * they lock up the bus and confuse ESP.  So disallow
-                 * disconnects for SCSI1 targets for now until we
-                 * find a better fix.
-                 *
-                 * Addendum: This is funny, I figured out what was going
-                 *           on.  The blotzed SCSI1 target would disconnect,
-                 *           one of the other SCSI2 targets or both would be
-                 *           disconnected as well.  The SCSI1 target would
-                 *           stay disconnected long enough that we start
-                 *           up a command on one of the SCSI2 targets.  As
-                 *           the ESP is arbitrating for the bus the SCSI1
-                 *           target begins to arbitrate as well to reselect
-                 *           the ESP.  The SCSI1 target refuses to drop it's
-                 *           ID bit on the data bus even though the ESP is
-                 *           at ID 7 and is the obvious winner for any
-                 *           arbitration.  The ESP is a poor sport and refuses
-                 *           to lose arbitration, it will continue indefinitely
-                 *           trying to arbitrate for the bus and can only be
-                 *           stopped via a chip reset or SCSI bus reset.
-                 *           Therefore _no_ disconnects for SCSI1 targets
-                 *           thank you very much. ;-)
-                 */
-                if(((SDptr->scsi_level < 3) &&
-                    (SDptr->type != TYPE_TAPE) &&
-                    SDptr->removable == 0) ||
-                    cdrom_hwbug_wkaround || SDptr->borken) {
-                        ESPMISC((KERN_INFO "esp%d: Disabling DISCONNECT for target %d "
-                                 "lun %d\n", esp->esp_id, SCptr->device->id, SCptr->device->lun));
-                        esp_dev->disconnect = 0;
-                        *cmdp++ = IDENTIFY(0, lun);
-                } else {
-                        *cmdp++ = IDENTIFY(1, lun);
-                }
-
-                /* ESP fifo is only so big...
-                 * Make this look like a slow command.
-                 */
-                esp->esp_slowcmd = 1;
-                esp->esp_scmdleft = SCptr->cmd_len;
-                esp->esp_scmdp = &SCptr->cmnd[0];
-
-                the_esp_command = (ESP_CMD_SELAS | ESP_CMD_DMA);
-                esp_advance_phase(SCptr, in_slct_msg);
-        }
-
-        if (!esp->esp_slowcmd)
-                for (i = 0; i < SCptr->cmd_len; i++)
-                        *cmdp++ = SCptr->cmnd[i];
-
-        /* HME sucks... */
-        if (esp->erev == fashme)
-                sbus_writeb((target & 0xf) | (ESP_BUSID_RESELID | ESP_BUSID_CTR32BIT),
-                            esp->eregs + ESP_BUSID);
-        else
-                sbus_writeb(target & 7, esp->eregs + ESP_BUSID);
-        if (esp->prev_soff != esp_dev->sync_max_offset ||
-            esp->prev_stp  != esp_dev->sync_min_period ||
-            (esp->erev > esp100a &&
-             esp->prev_cfg3 != esp->config3[target])) {
-                esp->prev_soff = esp_dev->sync_max_offset;
-                esp->prev_stp = esp_dev->sync_min_period;
-                sbus_writeb(esp->prev_soff, esp->eregs + ESP_SOFF);
-                sbus_writeb(esp->prev_stp, esp->eregs + ESP_STP);
-                if (esp->erev > esp100a) {
-                        esp->prev_cfg3 = esp->config3[target];
-                        sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                }
-        }
-        i = (cmdp - esp->esp_command);
-
-        if (esp->erev == fashme) {
-                esp_cmd(esp, ESP_CMD_FLUSH); /* Grrr! */
-
-                /* Set up the DMA and HME counters */
-                sbus_writeb(i, esp->eregs + ESP_TCLOW);
-                sbus_writeb(0, esp->eregs + ESP_TCMED);
-                sbus_writeb(0, esp->eregs + FAS_RLO);
-                sbus_writeb(0, esp->eregs + FAS_RHI);
-                esp_cmd(esp, the_esp_command);
-
-                /* Talk about touchy hardware... */
-                esp->prev_hme_dmacsr = ((esp->prev_hme_dmacsr |
-                                         (DMA_SCSI_DISAB | DMA_ENABLE)) &
-                                        ~(DMA_ST_WRITE));
-                sbus_writel(16, esp->dregs + DMA_COUNT);
-                sbus_writel(esp->esp_command_dvma, esp->dregs + DMA_ADDR);
-                sbus_writel(esp->prev_hme_dmacsr, esp->dregs + DMA_CSR);
-        } else {
-                u32 tmp;
-
-                /* Set up the DMA and ESP counters */
-                sbus_writeb(i, esp->eregs + ESP_TCLOW);
-                sbus_writeb(0, esp->eregs + ESP_TCMED);
-                tmp = sbus_readl(esp->dregs + DMA_CSR);
-                tmp &= ~DMA_ST_WRITE;
-                tmp |= DMA_ENABLE;
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-                if (esp->dma->revision == dvmaesc1) {
-                        if (i) /* Workaround ESC gate array SBUS rerun bug. */
-                                sbus_writel(PAGE_SIZE, esp->dregs + DMA_COUNT);
-                }
-                sbus_writel(esp->esp_command_dvma, esp->dregs + DMA_ADDR);
-
-                /* Tell ESP to "go". */
-                esp_cmd(esp, the_esp_command);
-        }
-}
-
-/* Queue a SCSI command delivered from the mid-level Linux SCSI code. */
-static int esp_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
-{
-        struct esp *esp;
-
-        /* Set up func ptr and initial driver cmd-phase. */
-        SCpnt->scsi_done = done;
-        SCpnt->SCp.phase = not_issued;
-
-        /* We use the scratch area. */
-        ESPQUEUE(("esp_queue: target=%d lun=%d ", SCpnt->device->id, SCpnt->device->lun));
-        ESPDISC(("N<%02x,%02x>", SCpnt->device->id, SCpnt->device->lun));
-
-        esp = (struct esp *) SCpnt->device->host->hostdata;
-        esp_get_dmabufs(esp, SCpnt);
-        esp_save_pointers(esp, SCpnt); /* FIXME for tag queueing */
-
-        SCpnt->SCp.Status           = CHECK_CONDITION;
-        SCpnt->SCp.Message          = 0xff;
-        SCpnt->SCp.sent_command     = 0;
-
-        /* Place into our queue. */
-        if (SCpnt->cmnd[0] == REQUEST_SENSE) {
-                ESPQUEUE(("RQSENSE\n"));
-                prepend_SC(&esp->issue_SC, SCpnt);
-        } else {
-                ESPQUEUE(("\n"));
-                append_SC(&esp->issue_SC, SCpnt);
-        }
-
-        /* Run it now if we can. */
-        if (!esp->current_SC && !esp->resetting_bus)
-                esp_exec_cmd(esp);
-
-        return 0;
-}
-
-/* Dump driver state. */
-static void esp_dump_cmd(struct scsi_cmnd *SCptr)
-{
-        ESPLOG(("[tgt<%02x> lun<%02x> "
-                "pphase<%s> cphase<%s>]",
-                SCptr->device->id, SCptr->device->lun,
-                phase_string(SCptr->SCp.sent_command),
-                phase_string(SCptr->SCp.phase)));
-}
-
-static void esp_dump_state(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-#ifdef DEBUG_ESP_CMDS
-        int i;
-#endif
-
-        ESPLOG(("esp%d: dumping state\n", esp->esp_id));
-        ESPLOG(("esp%d: dma -- cond_reg<%08x> addr<%08x>\n",
-                esp->esp_id,
-                sbus_readl(esp->dregs + DMA_CSR),
-                sbus_readl(esp->dregs + DMA_ADDR)));
-        ESPLOG(("esp%d: SW [sreg<%02x> sstep<%02x> ireg<%02x>]\n",
-                esp->esp_id, esp->sreg, esp->seqreg, esp->ireg));
-        ESPLOG(("esp%d: HW reread [sreg<%02x> sstep<%02x> ireg<%02x>]\n",
-                esp->esp_id,
-                sbus_readb(esp->eregs + ESP_STATUS),
-                sbus_readb(esp->eregs + ESP_SSTEP),
-                sbus_readb(esp->eregs + ESP_INTRPT)));
-#ifdef DEBUG_ESP_CMDS
-        printk("esp%d: last ESP cmds [", esp->esp_id);
-        i = (esp->espcmdent - 1) & 31;
-        printk("<"); esp_print_cmd(esp->espcmdlog[i]); printk(">");
-        i = (i - 1) & 31;
-        printk("<"); esp_print_cmd(esp->espcmdlog[i]); printk(">");
-        i = (i - 1) & 31;
-        printk("<"); esp_print_cmd(esp->espcmdlog[i]); printk(">");
-        i = (i - 1) & 31;
-        printk("<"); esp_print_cmd(esp->espcmdlog[i]); printk(">");
-        printk("]\n");
-#endif /* (DEBUG_ESP_CMDS) */
-
-        if (SCptr) {
-                ESPLOG(("esp%d: current command ", esp->esp_id));
-                esp_dump_cmd(SCptr);
-        }
-        ESPLOG(("\n"));
-        SCptr = esp->disconnected_SC;
-        ESPLOG(("esp%d: disconnected ", esp->esp_id));
-        while (SCptr) {
-                esp_dump_cmd(SCptr);
-                SCptr = (struct scsi_cmnd *) SCptr->host_scribble;
-        }
-        ESPLOG(("\n"));
-}
-
-/* Abort a command.  The host_lock is acquired by caller. */
-static int esp_abort(struct scsi_cmnd *SCptr)
-{
-        struct esp *esp = (struct esp *) SCptr->device->host->hostdata;
-        int don;
-
-        ESPLOG(("esp%d: Aborting command\n", esp->esp_id));
-        esp_dump_state(esp);
-
-        /* Wheee, if this is the current command on the bus, the
-         * best we can do is assert ATN and wait for msgout phase.
-         * This should even fix a hung SCSI bus when we lose state
-         * in the driver and timeout because the eventual phase change
-         * will cause the ESP to (eventually) give an interrupt.
-         */
-        if (esp->current_SC == SCptr) {
-                esp->cur_msgout[0] = ABORT;
-                esp->msgout_len = 1;
-                esp->msgout_ctr = 0;
-                esp_cmd(esp, ESP_CMD_SATN);
-                return SUCCESS;
-        }
-
-        /* If it is still in the issue queue then we can safely
-         * call the completion routine and report abort success.
-         */
-        don = (sbus_readl(esp->dregs + DMA_CSR) & DMA_INT_ENAB);
-        if (don) {
-                ESP_INTSOFF(esp->dregs);
-        }
-        if (esp->issue_SC) {
-                struct scsi_cmnd **prev, *this;
-                for (prev = (&esp->issue_SC), this = esp->issue_SC;
-                     this != NULL;
-                     prev = (struct scsi_cmnd **) &(this->host_scribble),
-                             this = (struct scsi_cmnd *) this->host_scribble) {
-
-                        if (this == SCptr) {
-                                *prev = (struct scsi_cmnd *) this->host_scribble;
-                                this->host_scribble = NULL;
-
-                                esp_release_dmabufs(esp, this);
-                                this->result = DID_ABORT << 16;
-                                this->scsi_done(this);
-
-                                if (don)
-                                        ESP_INTSON(esp->dregs);
-
-                                return SUCCESS;
-                        }
-                }
-        }
-
-        /* Yuck, the command to abort is disconnected, it is not
-         * worth trying to abort it now if something else is live
-         * on the bus at this time.  So, we let the SCSI code wait
-         * a little bit and try again later.
-         */
-        if (esp->current_SC) {
-                if (don)
-                        ESP_INTSON(esp->dregs);
-                return FAILED;
-        }
-
-        /* It's disconnected, we have to reconnect to re-establish
-         * the nexus and tell the device to abort.  However, we really
-         * cannot 'reconnect' per se.  Don't try to be fancy, just
-         * indicate failure, which causes our caller to reset the whole
-         * bus.
-         */
-
-        if (don)
-                ESP_INTSON(esp->dregs);
-
-        return FAILED;
-}
-
-/* We've sent ESP_CMD_RS to the ESP, the interrupt had just
- * arrived indicating the end of the SCSI bus reset.  Our job
- * is to clean out the command queues and begin re-execution
- * of SCSI commands once more.
- */
-static int esp_finish_reset(struct esp *esp)
-{
-        struct scsi_cmnd *sp = esp->current_SC;
-
-        /* Clean up currently executing command, if any. */
-        if (sp != NULL) {
-                esp->current_SC = NULL;
-
-                esp_release_dmabufs(esp, sp);
-                sp->result = (DID_RESET << 16);
-
-                sp->scsi_done(sp);
-        }
-
-        /* Clean up disconnected queue, they have been invalidated
-         * by the bus reset.
-         */
-        if (esp->disconnected_SC) {
-                while ((sp = remove_first_SC(&esp->disconnected_SC)) != NULL) {
-                        esp_release_dmabufs(esp, sp);
-                        sp->result = (DID_RESET << 16);
-
-                        sp->scsi_done(sp);
-                }
-        }
-
-        /* SCSI bus reset is complete. */
-        esp->resetting_bus = 0;
-        wake_up(&esp->reset_queue);
-
-        /* Ok, now it is safe to get commands going once more. */
-        if (esp->issue_SC)
-                esp_exec_cmd(esp);
-
-        return do_intr_end;
-}
-
-static int esp_do_resetbus(struct esp *esp)
-{
-        ESPLOG(("esp%d: Resetting scsi bus\n", esp->esp_id));
-        esp->resetting_bus = 1;
-        esp_cmd(esp, ESP_CMD_RS);
-
-        return do_intr_end;
-}
-
-/* Reset ESP chip, reset hanging bus, then kill active and
- * disconnected commands for targets without soft reset.
- *
- * The host_lock is acquired by caller.
- */
-static int esp_reset(struct scsi_cmnd *SCptr)
-{
-        struct esp *esp = (struct esp *) SCptr->device->host->hostdata;
-
-        spin_lock_irq(esp->ehost->host_lock);
-        (void) esp_do_resetbus(esp);
-        spin_unlock_irq(esp->ehost->host_lock);
-
-        wait_event(esp->reset_queue, (esp->resetting_bus == 0));
-
-        return SUCCESS;
-}
-
-/* Internal ESP done function. */
-static void esp_done(struct esp *esp, int error)
-{
-        struct scsi_cmnd *done_SC = esp->current_SC;
-
-        esp->current_SC = NULL;
-
-        esp_release_dmabufs(esp, done_SC);
-        done_SC->result = error;
-
-        done_SC->scsi_done(done_SC);
-
-        /* Bus is free, issue any commands in the queue. */
-        if (esp->issue_SC && !esp->current_SC)
-                esp_exec_cmd(esp);
-
-}
-
-/* Wheee, ESP interrupt engine. */  
-
-/* Forward declarations. */
-static int esp_do_phase_determine(struct esp *esp);
-static int esp_do_data_finale(struct esp *esp);
-static int esp_select_complete(struct esp *esp);
-static int esp_do_status(struct esp *esp);
-static int esp_do_msgin(struct esp *esp);
-static int esp_do_msgindone(struct esp *esp);
-static int esp_do_msgout(struct esp *esp);
-static int esp_do_cmdbegin(struct esp *esp);
-
-#define sreg_datainp(__sreg)  (((__sreg) & ESP_STAT_PMASK) == ESP_DIP)
-#define sreg_dataoutp(__sreg) (((__sreg) & ESP_STAT_PMASK) == ESP_DOP)
-
-/* Read any bytes found in the FAS366 fifo, storing them into
- * the ESP driver software state structure.
- */
-static void hme_fifo_read(struct esp *esp)
-{
-        u8 count = 0;
-        u8 status = esp->sreg;
-
-        /* Cannot safely frob the fifo for these following cases, but
-         * we must always read the fifo when the reselect interrupt
-         * is pending.
-         */
-        if (((esp->ireg & ESP_INTR_RSEL) == 0)  &&
-            (sreg_datainp(status)               ||
-             sreg_dataoutp(status)              ||
-             (esp->current_SC &&
-              esp->current_SC->SCp.phase == in_data_done))) {
-                ESPHME(("<wkaround_skipped>"));
-        } else {
-                unsigned long fcnt = sbus_readb(esp->eregs + ESP_FFLAGS) & ESP_FF_FBYTES;
-
-                /* The HME stores bytes in multiples of 2 in the fifo. */
-                ESPHME(("hme_fifo[fcnt=%d", (int)fcnt));
-                while (fcnt) {
-                        esp->hme_fifo_workaround_buffer[count++] =
-                                sbus_readb(esp->eregs + ESP_FDATA);
-                        esp->hme_fifo_workaround_buffer[count++] =
-                                sbus_readb(esp->eregs + ESP_FDATA);
-                        ESPHME(("<%02x,%02x>", esp->hme_fifo_workaround_buffer[count-2], esp->hme_fifo_workaround_buffer[count-1]));
-                        fcnt--;
-                }
-                if (sbus_readb(esp->eregs + ESP_STATUS2) & ESP_STAT2_F1BYTE) {
-                        ESPHME(("<poke_byte>"));
-                        sbus_writeb(0, esp->eregs + ESP_FDATA);
-                        esp->hme_fifo_workaround_buffer[count++] =
-                                sbus_readb(esp->eregs + ESP_FDATA);
-                        ESPHME(("<%02x,0x00>", esp->hme_fifo_workaround_buffer[count-1]));
-                        ESPHME(("CMD_FLUSH"));
-                        esp_cmd(esp, ESP_CMD_FLUSH);
-                } else {
-                        ESPHME(("no_xtra_byte"));
-                }
-        }
-        ESPHME(("wkarnd_cnt=%d]", (int)count));
-        esp->hme_fifo_workaround_count = count;
-}
-
-static inline void hme_fifo_push(struct esp *esp, u8 *bytes, u8 count)
-{
-        esp_cmd(esp, ESP_CMD_FLUSH);
-        while (count) {
-                u8 tmp = *bytes++;
-                sbus_writeb(tmp, esp->eregs + ESP_FDATA);
-                sbus_writeb(0, esp->eregs + ESP_FDATA);
-                count--;
-        }
-}
-
-/* We try to avoid some interrupts by jumping ahead and see if the ESP
- * has gotten far enough yet.  Hence the following.
- */
-static inline int skipahead1(struct esp *esp, struct scsi_cmnd *scp,
-                             int prev_phase, int new_phase)
-{
-        if (scp->SCp.sent_command != prev_phase)
-                return 0;
-        if (ESP_IRQ_P(esp->dregs)) {
-                /* Yes, we are able to save an interrupt. */
-                if (esp->erev == fashme)
-                        esp->sreg2 = sbus_readb(esp->eregs + ESP_STATUS2);
-                esp->sreg = (sbus_readb(esp->eregs + ESP_STATUS) & ~(ESP_STAT_INTR));
-                esp->ireg = sbus_readb(esp->eregs + ESP_INTRPT);
-                if (esp->erev == fashme) {
-                        /* This chip is really losing. */
-                        ESPHME(("HME["));
-                        /* Must latch fifo before reading the interrupt
-                         * register else garbage ends up in the FIFO
-                         * which confuses the driver utterly.
-                         * Happy Meal indeed....
-                         */
-                        ESPHME(("fifo_workaround]"));
-                        if (!(esp->sreg2 & ESP_STAT2_FEMPTY) ||
-                            (esp->sreg2 & ESP_STAT2_F1BYTE))
-                                hme_fifo_read(esp);
-                }
-                if (!(esp->ireg & ESP_INTR_SR))
-                        return 0;
-                else
-                        return do_reset_complete;
-        }
-        /* Ho hum, target is taking forever... */
-        scp->SCp.sent_command = new_phase; /* so we don't recurse... */
-        return do_intr_end;
-}
-
-static inline int skipahead2(struct esp *esp, struct scsi_cmnd *scp,
-                             int prev_phase1, int prev_phase2, int new_phase)
-{
-        if (scp->SCp.sent_command != prev_phase1 &&
-            scp->SCp.sent_command != prev_phase2)
-                return 0;
-        if (ESP_IRQ_P(esp->dregs)) {
-                /* Yes, we are able to save an interrupt. */
-                if (esp->erev == fashme)
-                        esp->sreg2 = sbus_readb(esp->eregs + ESP_STATUS2);
-                esp->sreg = (sbus_readb(esp->eregs + ESP_STATUS) & ~(ESP_STAT_INTR));
-                esp->ireg = sbus_readb(esp->eregs + ESP_INTRPT);
-                if (esp->erev == fashme) {
-                        /* This chip is really losing. */
-                        ESPHME(("HME["));
-
-                        /* Must latch fifo before reading the interrupt
-                         * register else garbage ends up in the FIFO
-                         * which confuses the driver utterly.
-                         * Happy Meal indeed....
-                         */
-                        ESPHME(("fifo_workaround]"));
-                        if (!(esp->sreg2 & ESP_STAT2_FEMPTY) ||
-                            (esp->sreg2 & ESP_STAT2_F1BYTE))
-                                hme_fifo_read(esp);
-                }
-                if (!(esp->ireg & ESP_INTR_SR))
-                        return 0;
-                else
-                        return do_reset_complete;
-        }
-        /* Ho hum, target is taking forever... */
-        scp->SCp.sent_command = new_phase; /* so we don't recurse... */
-        return do_intr_end;
-}
-
-/* Now some dma helpers. */
-static void dma_setup(struct esp *esp, __u32 addr, int count, int write)
-{
-        u32 nreg = sbus_readl(esp->dregs + DMA_CSR);
-
-        if (write)
-                nreg |= DMA_ST_WRITE;
-        else
-                nreg &= ~(DMA_ST_WRITE);
-        nreg |= DMA_ENABLE;
-        sbus_writel(nreg, esp->dregs + DMA_CSR);
-        if (esp->dma->revision == dvmaesc1) {
-                /* This ESC gate array sucks! */
-                __u32 src = addr;
-                __u32 dest = src + count;
-
-                if (dest & (PAGE_SIZE - 1))
-                        count = PAGE_ALIGN(count);
-                sbus_writel(count, esp->dregs + DMA_COUNT);
-        }
-        sbus_writel(addr, esp->dregs + DMA_ADDR);
-}
-
-static void dma_drain(struct esp *esp)
-{
-        u32 tmp;
-
-        if (esp->dma->revision == dvmahme)
-                return;
-        if ((tmp = sbus_readl(esp->dregs + DMA_CSR)) & DMA_FIFO_ISDRAIN) {
-                switch (esp->dma->revision) {
-                default:
-                        tmp |= DMA_FIFO_STDRAIN;
-                        sbus_writel(tmp, esp->dregs + DMA_CSR);
-
-                case dvmarev3:
-                case dvmaesc1:
-                        while (sbus_readl(esp->dregs + DMA_CSR) & DMA_FIFO_ISDRAIN)
-                                udelay(1);
-                };
-        }
-}
-
-static void dma_invalidate(struct esp *esp)
-{
-        u32 tmp;
-
-        if (esp->dma->revision == dvmahme) {
-                sbus_writel(DMA_RST_SCSI, esp->dregs + DMA_CSR);
-
-                esp->prev_hme_dmacsr = ((esp->prev_hme_dmacsr |
-                                         (DMA_PARITY_OFF | DMA_2CLKS |
-                                          DMA_SCSI_DISAB | DMA_INT_ENAB)) &
-                                        ~(DMA_ST_WRITE | DMA_ENABLE));
-
-                sbus_writel(0, esp->dregs + DMA_CSR);
-                sbus_writel(esp->prev_hme_dmacsr, esp->dregs + DMA_CSR);
-
-                /* This is necessary to avoid having the SCSI channel
-                 * engine lock up on us.
-                 */
-                sbus_writel(0, esp->dregs + DMA_ADDR);
-        } else {
-                while ((tmp = sbus_readl(esp->dregs + DMA_CSR)) & DMA_PEND_READ)
-                        udelay(1);
-
-                tmp &= ~(DMA_ENABLE | DMA_ST_WRITE | DMA_BCNT_ENAB);
-                tmp |= DMA_FIFO_INV;
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-                tmp &= ~DMA_FIFO_INV;
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-        }
-}
-
-static inline void dma_flashclear(struct esp *esp)
-{
-        dma_drain(esp);
-        dma_invalidate(esp);
-}
-
-static int dma_can_transfer(struct esp *esp, struct scsi_cmnd *sp)
-{
-        __u32 base, end, sz;
-
-        if (esp->dma->revision == dvmarev3) {
-                sz = sp->SCp.this_residual;
-                if (sz > 0x1000000)
-                        sz = 0x1000000;
-        } else {
-                base = ((__u32)((unsigned long)sp->SCp.ptr));
-                base &= (0x1000000 - 1);
-                end = (base + sp->SCp.this_residual);
-                if (end > 0x1000000)
-                        end = 0x1000000;
-                sz = (end - base);
-        }
-        return sz;
-}
-
-/* Misc. esp helper macros. */
-#define esp_setcount(__eregs, __cnt, __hme) \
-        sbus_writeb(((__cnt)&0xff), (__eregs) + ESP_TCLOW); \
-        sbus_writeb((((__cnt)>>8)&0xff), (__eregs) + ESP_TCMED); \
-        if (__hme) { \
-                sbus_writeb((((__cnt)>>16)&0xff), (__eregs) + FAS_RLO); \
-                sbus_writeb(0, (__eregs) + FAS_RHI); \
-        }
-
-#define esp_getcount(__eregs, __hme) \
-        ((sbus_readb((__eregs) + ESP_TCLOW)&0xff) | \
-         ((sbus_readb((__eregs) + ESP_TCMED)&0xff) << 8) | \
-         ((__hme) ? sbus_readb((__eregs) + FAS_RLO) << 16 : 0))
-
-#define fcount(__esp) \
-        (((__esp)->erev == fashme) ? \
-          (__esp)->hme_fifo_workaround_count : \
-          sbus_readb(((__esp)->eregs) + ESP_FFLAGS) & ESP_FF_FBYTES)
-
-#define fnzero(__esp) \
-        (((__esp)->erev == fashme) ? 0 : \
-         sbus_readb(((__esp)->eregs) + ESP_FFLAGS) & ESP_FF_ONOTZERO)
-
-/* XXX speculative nops unnecessary when continuing amidst a data phase
- * XXX even on esp100!!!  another case of flooding the bus with I/O reg
- * XXX writes...
- */
-#define esp_maybe_nop(__esp) \
-        if ((__esp)->erev == esp100) \
-                esp_cmd((__esp), ESP_CMD_NULL)
-
-#define sreg_to_dataphase(__sreg) \
-        ((((__sreg) & ESP_STAT_PMASK) == ESP_DOP) ? in_dataout : in_datain)
-
-/* The ESP100 when in synchronous data phase, can mistake a long final
- * REQ pulse from the target as an extra byte, it places whatever is on
- * the data lines into the fifo.  For now, we will assume when this
- * happens that the target is a bit quirky and we don't want to
- * be talking synchronously to it anyways.  Regardless, we need to
- * tell the ESP to eat the extraneous byte so that we can proceed
- * to the next phase.
- */
-static int esp100_sync_hwbug(struct esp *esp, struct scsi_cmnd *sp, int fifocnt)
-{
-        /* Do not touch this piece of code. */
-        if ((!(esp->erev == esp100)) ||
-            (!(sreg_datainp((esp->sreg = sbus_readb(esp->eregs + ESP_STATUS))) &&
-               !fifocnt) &&
-             !(sreg_dataoutp(esp->sreg) && !fnzero(esp)))) {
-                if (sp->SCp.phase == in_dataout)
-                        esp_cmd(esp, ESP_CMD_FLUSH);
-                return 0;
-        } else {
-                /* Async mode for this guy. */
-                build_sync_nego_msg(esp, 0, 0);
-
-                /* Ack the bogus byte, but set ATN first. */
-                esp_cmd(esp, ESP_CMD_SATN);
-                esp_cmd(esp, ESP_CMD_MOK);
-                return 1;
-        }
-}
-
-/* This closes the window during a selection with a reselect pending, because
- * we use DMA for the selection process the FIFO should hold the correct
- * contents if we get reselected during this process.  So we just need to
- * ack the possible illegal cmd interrupt pending on the esp100.
- */
-static inline int esp100_reconnect_hwbug(struct esp *esp)
-{
-        u8 tmp;
-
-        if (esp->erev != esp100)
-                return 0;
-        tmp = sbus_readb(esp->eregs + ESP_INTRPT);
-        if (tmp & ESP_INTR_SR)
-                return 1;
-        return 0;
-}
-
-/* This verifies the BUSID bits during a reselection so that we know which
- * target is talking to us.
- */
-static inline int reconnect_target(struct esp *esp)
-{
-        int it, me = esp->scsi_id_mask, targ = 0;
-
-        if (2 != fcount(esp))
-                return -1;
-        if (esp->erev == fashme) {
-                /* HME does not latch it's own BUS ID bits during
-                 * a reselection.  Also the target number is given
-                 * as an unsigned char, not as a sole bit number
-                 * like the other ESP's do.
-                 * Happy Meal indeed....
-                 */
-                targ = esp->hme_fifo_workaround_buffer[0];
-        } else {
-                it = sbus_readb(esp->eregs + ESP_FDATA);
-                if (!(it & me))
-                        return -1;
-                it &= ~me;
-                if (it & (it - 1))
-                        return -1;
-                while (!(it & 1))
-                        targ++, it >>= 1;
-        }
-        return targ;
-}
-
-/* This verifies the identify from the target so that we know which lun is
- * being reconnected.
- */
-static inline int reconnect_lun(struct esp *esp)
-{
-        int lun;
-
-        if ((esp->sreg & ESP_STAT_PMASK) != ESP_MIP)
-                return -1;
-        if (esp->erev == fashme)
-                lun = esp->hme_fifo_workaround_buffer[1];
-        else
-                lun = sbus_readb(esp->eregs + ESP_FDATA);
-
-        /* Yes, you read this correctly.  We report lun of zero
-         * if we see parity error.  ESP reports parity error for
-         * the lun byte, and this is the only way to hope to recover
-         * because the target is connected.
-         */
-        if (esp->sreg & ESP_STAT_PERR)
-                return 0;
-
-        /* Check for illegal bits being set in the lun. */
-        if ((lun & 0x40) || !(lun & 0x80))
-                return -1;
-
-        return lun & 7;
-}
-
-/* This puts the driver in a state where it can revitalize a command that
- * is being continued due to reselection.
- */
-static inline void esp_connect(struct esp *esp, struct scsi_cmnd *sp)
-{
-        struct esp_device *esp_dev = sp->device->hostdata;
-
-        if (esp->prev_soff  != esp_dev->sync_max_offset ||
-            esp->prev_stp   != esp_dev->sync_min_period ||
-            (esp->erev > esp100a &&
-             esp->prev_cfg3 != esp->config3[sp->device->id])) {
-                esp->prev_soff = esp_dev->sync_max_offset;
-                esp->prev_stp = esp_dev->sync_min_period;
-                sbus_writeb(esp->prev_soff, esp->eregs + ESP_SOFF);
-                sbus_writeb(esp->prev_stp, esp->eregs + ESP_STP);
-                if (esp->erev > esp100a) {
-                        esp->prev_cfg3 = esp->config3[sp->device->id];
-                        sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                }
-        }
-        esp->current_SC = sp;
-}
-
-/* This will place the current working command back into the issue queue
- * if we are to receive a reselection amidst a selection attempt.
- */
-static inline void esp_reconnect(struct esp *esp, struct scsi_cmnd *sp)
-{
-        if (!esp->disconnected_SC)
-                ESPLOG(("esp%d: Weird, being reselected but disconnected "
-                        "command queue is empty.\n", esp->esp_id));
-        esp->snip = 0;
-        esp->current_SC = NULL;
-        sp->SCp.phase = not_issued;
-        append_SC(&esp->issue_SC, sp);
-}
-
-/* Begin message in phase. */
-static int esp_do_msgin(struct esp *esp)
-{
-        /* Must be very careful with the fifo on the HME */
-        if ((esp->erev != fashme) ||
-            !(sbus_readb(esp->eregs + ESP_STATUS2) & ESP_STAT2_FEMPTY))
-                esp_cmd(esp, ESP_CMD_FLUSH);
-        esp_maybe_nop(esp);
-        esp_cmd(esp, ESP_CMD_TI);
-        esp->msgin_len = 1;
-        esp->msgin_ctr = 0;
-        esp_advance_phase(esp->current_SC, in_msgindone);
-        return do_work_bus;
-}
-
-/* This uses various DMA csr fields and the fifo flags count value to
- * determine how many bytes were successfully sent/received by the ESP.
- */
-static inline int esp_bytes_sent(struct esp *esp, int fifo_count)
-{
-        int rval = sbus_readl(esp->dregs + DMA_ADDR) - esp->esp_command_dvma;
-
-        if (esp->dma->revision == dvmarev1)
-                rval -= (4 - ((sbus_readl(esp->dregs + DMA_CSR) & DMA_READ_AHEAD)>>11));
-        return rval - fifo_count;
-}
-
-static inline void advance_sg(struct scsi_cmnd *sp)
-{
-        ++sp->SCp.buffer;
-        --sp->SCp.buffers_residual;
-        sp->SCp.this_residual = sg_dma_len(sp->SCp.buffer);
-        sp->SCp.ptr = (char *)((unsigned long)sg_dma_address(sp->SCp.buffer));
-}
-
-/* Please note that the way I've coded these routines is that I _always_
- * check for a disconnect during any and all information transfer
- * phases.  The SCSI standard states that the target _can_ cause a BUS
- * FREE condition by dropping all MSG/CD/IO/BSY signals.  Also note
- * that during information transfer phases the target controls every
- * change in phase, the only thing the initiator can do is "ask" for
- * a message out phase by driving ATN true.  The target can, and sometimes
- * will, completely ignore this request so we cannot assume anything when
- * we try to force a message out phase to abort/reset a target.  Most of
- * the time the target will eventually be nice and go to message out, so
- * we may have to hold on to our state about what we want to tell the target
- * for some period of time.
- */
-
-/* I think I have things working here correctly.  Even partial transfers
- * within a buffer or sub-buffer should not upset us at all no matter
- * how bad the target and/or ESP fucks things up.
- */
-static int esp_do_data(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        int thisphase, hmuch;
-
-        ESPDATA(("esp_do_data: "));
-        esp_maybe_nop(esp);
-        thisphase = sreg_to_dataphase(esp->sreg);
-        esp_advance_phase(SCptr, thisphase);
-        ESPDATA(("newphase<%s> ", (thisphase == in_datain) ? "DATAIN" : "DATAOUT"));
-        hmuch = dma_can_transfer(esp, SCptr);
-        if (hmuch > (64 * 1024) && (esp->erev != fashme))
-                hmuch = (64 * 1024);
-        ESPDATA(("hmuch<%d> ", hmuch));
-        esp->current_transfer_size = hmuch;
-
-        if (esp->erev == fashme) {
-                u32 tmp = esp->prev_hme_dmacsr;
-
-                /* Always set the ESP count registers first. */
-                esp_setcount(esp->eregs, hmuch, 1);
-
-                /* Get the DMA csr computed. */
-                tmp |= (DMA_SCSI_DISAB | DMA_ENABLE);
-                if (thisphase == in_datain)
-                        tmp |= DMA_ST_WRITE;
-                else
-                        tmp &= ~(DMA_ST_WRITE);
-                esp->prev_hme_dmacsr = tmp;
-
-                ESPDATA(("DMA|TI --> do_intr_end\n"));
-                if (thisphase == in_datain) {
-                        sbus_writel(hmuch, esp->dregs + DMA_COUNT);
-                        esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-                } else {
-                        esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-                        sbus_writel(hmuch, esp->dregs + DMA_COUNT);
-                }
-                sbus_writel((__u32)((unsigned long)SCptr->SCp.ptr), esp->dregs+DMA_ADDR);
-                sbus_writel(esp->prev_hme_dmacsr, esp->dregs + DMA_CSR);
-        } else {
-                esp_setcount(esp->eregs, hmuch, 0);
-                dma_setup(esp, ((__u32)((unsigned long)SCptr->SCp.ptr)),
-                          hmuch, (thisphase == in_datain));
-                ESPDATA(("DMA|TI --> do_intr_end\n"));
-                esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-        }
-        return do_intr_end;
-}
-
-/* See how successful the data transfer was. */
-static int esp_do_data_finale(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        struct esp_device *esp_dev = SCptr->device->hostdata;
-        int bogus_data = 0, bytes_sent = 0, fifocnt, ecount = 0;
-
-        ESPDATA(("esp_do_data_finale: "));
-
-        if (SCptr->SCp.phase == in_datain) {
-                if (esp->sreg & ESP_STAT_PERR) {
-                        /* Yuck, parity error.  The ESP asserts ATN
-                         * so that we can go to message out phase
-                         * immediately and inform the target that
-                         * something bad happened.
-                         */
-                        ESPLOG(("esp%d: data bad parity detected.\n",
-                                esp->esp_id));
-                        esp->cur_msgout[0] = INITIATOR_ERROR;
-                        esp->msgout_len = 1;
-                }
-                dma_drain(esp);
-        }
-        dma_invalidate(esp);
-
-        /* This could happen for the above parity error case. */
-        if (esp->ireg != ESP_INTR_BSERV) {
-                /* Please go to msgout phase, please please please... */
-                ESPLOG(("esp%d: !BSERV after data, probably to msgout\n",
-                        esp->esp_id));
-                return esp_do_phase_determine(esp);
-        }       
-
-        /* Check for partial transfers and other horrible events.
-         * Note, here we read the real fifo flags register even
-         * on HME broken adapters because we skip the HME fifo
-         * workaround code in esp_handle() if we are doing data
-         * phase things.  We don't want to fuck directly with
-         * the fifo like that, especially if doing synchronous
-         * transfers!  Also, will need to double the count on
-         * HME if we are doing wide transfers, as the HME fifo
-         * will move and count 16-bit quantities during wide data.
-         * SMCC _and_ Qlogic can both bite me.
-         */
-        fifocnt = (sbus_readb(esp->eregs + ESP_FFLAGS) & ESP_FF_FBYTES);
-        if (esp->erev != fashme)
-                ecount = esp_getcount(esp->eregs, 0);
-        bytes_sent = esp->current_transfer_size;
-
-        ESPDATA(("trans_sz(%d), ", bytes_sent));
-        if (esp->erev == fashme) {
-                if (!(esp->sreg & ESP_STAT_TCNT)) {
-                        ecount = esp_getcount(esp->eregs, 1);
-                        bytes_sent -= ecount;
-                }
-
-                /* Always subtract any cruft remaining in the FIFO. */
-                if (esp->prev_cfg3 & ESP_CONFIG3_EWIDE)
-                        fifocnt <<= 1;
-                if (SCptr->SCp.phase == in_dataout)
-                        bytes_sent -= fifocnt;
-
-                /* I have an IBM disk which exhibits the following
-                 * behavior during writes to it.  It disconnects in
-                 * the middle of a partial transfer, the current sglist
-                 * buffer is 1024 bytes, the disk stops data transfer
-                 * at 512 bytes.
-                 *
-                 * However the FAS366 reports that 32 more bytes were
-                 * transferred than really were.  This is precisely
-                 * the size of a fully loaded FIFO in wide scsi mode.
-                 * The FIFO state recorded indicates that it is empty.
-                 *
-                 * I have no idea if this is a bug in the FAS366 chip
-                 * or a bug in the firmware on this IBM disk.  In any
-                 * event the following seems to be a good workaround.  -DaveM
-                 */
-                if (bytes_sent != esp->current_transfer_size &&
-                    SCptr->SCp.phase == in_dataout) {
-                        int mask = (64 - 1);
-
-                        if ((esp->prev_cfg3 & ESP_CONFIG3_EWIDE) == 0)
-                                mask >>= 1;
-
-                        if (bytes_sent & mask)
-                                bytes_sent -= (bytes_sent & mask);
-                }
-        } else {
-                if (!(esp->sreg & ESP_STAT_TCNT))
-                        bytes_sent -= ecount;
-                if (SCptr->SCp.phase == in_dataout)
-                        bytes_sent -= fifocnt;
-        }
-
-        ESPDATA(("bytes_sent(%d), ", bytes_sent));
-
-        /* If we were in synchronous mode, check for peculiarities. */
-        if (esp->erev == fashme) {
-                if (esp_dev->sync_max_offset) {
-                        if (SCptr->SCp.phase == in_dataout)
-                                esp_cmd(esp, ESP_CMD_FLUSH);
-                } else {
-                        esp_cmd(esp, ESP_CMD_FLUSH);
-                }
-        } else {
-                if (esp_dev->sync_max_offset)
-                        bogus_data = esp100_sync_hwbug(esp, SCptr, fifocnt);
-                else
-                        esp_cmd(esp, ESP_CMD_FLUSH);
-        }
-
-        /* Until we are sure of what has happened, we are certainly
-         * in the dark.
-         */
-        esp_advance_phase(SCptr, in_the_dark);
-
-        if (bytes_sent < 0) {
-                /* I've seen this happen due to lost state in this
-                 * driver.  No idea why it happened, but allowing
-                 * this value to be negative caused things to
-                 * lock up.  This allows greater chance of recovery.
-                 * In fact every time I've seen this, it has been
-                 * a driver bug without question.
-                 */
-                ESPLOG(("esp%d: yieee, bytes_sent < 0!\n", esp->esp_id));
-                ESPLOG(("esp%d: csz=%d fifocount=%d ecount=%d\n",
-                        esp->esp_id,
-                        esp->current_transfer_size, fifocnt, ecount));
-                ESPLOG(("esp%d: use_sg=%d ptr=%p this_residual=%d\n",
-                        esp->esp_id,
-                        SCptr->use_sg, SCptr->SCp.ptr, SCptr->SCp.this_residual));
-                ESPLOG(("esp%d: Forcing async for target %d\n", esp->esp_id, 
-                        SCptr->device->id));
-                SCptr->device->borken = 1;
-                esp_dev->sync = 0;
-                bytes_sent = 0;
-        }
-
-        /* Update the state of our transfer. */
-        SCptr->SCp.ptr += bytes_sent;
-        SCptr->SCp.this_residual -= bytes_sent;
-        if (SCptr->SCp.this_residual < 0) {
-                /* shit */
-                ESPLOG(("esp%d: Data transfer overrun.\n", esp->esp_id));
-                SCptr->SCp.this_residual = 0;
-        }
-
-        /* Maybe continue. */
-        if (!bogus_data) {
-                ESPDATA(("!bogus_data, "));
-
-                /* NO MATTER WHAT, we advance the scatterlist,
-                 * if the target should decide to disconnect
-                 * in between scatter chunks (which is common)
-                 * we could die horribly!  I used to have the sg
-                 * advance occur only if we are going back into
-                 * (or are staying in) a data phase, you can
-                 * imagine the hell I went through trying to
-                 * figure this out.
-                 */
-                if (SCptr->use_sg && !SCptr->SCp.this_residual)
-                        advance_sg(SCptr);
-                if (sreg_datainp(esp->sreg) || sreg_dataoutp(esp->sreg)) {
-                        ESPDATA(("to more data\n"));
-                        return esp_do_data(esp);
-                }
-                ESPDATA(("to new phase\n"));
-                return esp_do_phase_determine(esp);
-        }
-        /* Bogus data, just wait for next interrupt. */
-        ESPLOG(("esp%d: bogus_data during end of data phase\n",
-                esp->esp_id));
-        return do_intr_end;
-}
-
-/* We received a non-good status return at the end of
- * running a SCSI command.  This is used to decide if
- * we should clear our synchronous transfer state for
- * such a device when that happens.
- *
- * The idea is that when spinning up a disk or rewinding
- * a tape, we don't want to go into a loop re-negotiating
- * synchronous capabilities over and over.
- */
-static int esp_should_clear_sync(struct scsi_cmnd *sp)
-{
-        u8 cmd = sp->cmnd[0];
-
-        /* These cases are for spinning up a disk and
-         * waiting for that spinup to complete.
-         */
-        if (cmd == START_STOP)
-                return 0;
-
-        if (cmd == TEST_UNIT_READY)
-                return 0;
-
-        /* One more special case for SCSI tape drives,
-         * this is what is used to probe the device for
-         * completion of a rewind or tape load operation.
-         */
-        if (sp->device->type == TYPE_TAPE) {
-                if (cmd == MODE_SENSE)
-                        return 0;
-        }
-
-        return 1;
-}
-
-/* Either a command is completing or a target is dropping off the bus
- * to continue the command in the background so we can do other work.
- */
-static int esp_do_freebus(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        struct esp_device *esp_dev = SCptr->device->hostdata;
-        int rval;
-
-        rval = skipahead2(esp, SCptr, in_status, in_msgindone, in_freeing);
-        if (rval)
-                return rval;
-        if (esp->ireg != ESP_INTR_DC) {
-                ESPLOG(("esp%d: Target will not disconnect\n", esp->esp_id));
-                return do_reset_bus; /* target will not drop BSY... */
-        }
-        esp->msgout_len = 0;
-        esp->prevmsgout = NOP;
-        if (esp->prevmsgin == COMMAND_COMPLETE) {
-                /* Normal end of nexus. */
-                if (esp->disconnected_SC || (esp->erev == fashme))
-                        esp_cmd(esp, ESP_CMD_ESEL);
-
-                if (SCptr->SCp.Status != GOOD &&
-                    SCptr->SCp.Status != CONDITION_GOOD &&
-                    ((1<<SCptr->device->id) & esp->targets_present) &&
-                    esp_dev->sync &&
-                    esp_dev->sync_max_offset) {
-                        /* SCSI standard says that the synchronous capabilities
-                         * should be renegotiated at this point.  Most likely
-                         * we are about to request sense from this target
-                         * in which case we want to avoid using sync
-                         * transfers until we are sure of the current target
-                         * state.
-                         */
-                        ESPMISC(("esp: Status <%d> for target %d lun %d\n",
-                                 SCptr->SCp.Status, SCptr->device->id, SCptr->device->lun));
-
-                        /* But don't do this when spinning up a disk at
-                         * boot time while we poll for completion as it
-                         * fills up the console with messages.  Also, tapes
-                         * can report not ready many times right after
-                         * loading up a tape.
-                         */
-                        if (esp_should_clear_sync(SCptr) != 0)
-                                esp_dev->sync = 0;
-                }
-                ESPDISC(("F<%02x,%02x>", SCptr->device->id, SCptr->device->lun));
-                esp_done(esp, ((SCptr->SCp.Status & 0xff) |
-                               ((SCptr->SCp.Message & 0xff)<<8) |
-                               (DID_OK << 16)));
-        } else if (esp->prevmsgin == DISCONNECT) {
-                /* Normal disconnect. */
-                esp_cmd(esp, ESP_CMD_ESEL);
-                ESPDISC(("D<%02x,%02x>", SCptr->device->id, SCptr->device->lun));
-                append_SC(&esp->disconnected_SC, SCptr);
-                esp->current_SC = NULL;
-                if (esp->issue_SC)
-                        esp_exec_cmd(esp);
-        } else {
-                /* Driver bug, we do not expect a disconnect here
-                 * and should not have advanced the state engine
-                 * to in_freeing.
-                 */
-                ESPLOG(("esp%d: last msg not disc and not cmd cmplt.\n",
-                        esp->esp_id));
-                return do_reset_bus;
-        }
-        return do_intr_end;
-}
-
-/* When a reselect occurs, and we cannot find the command to
- * reconnect to in our queues, we do this.
- */
-static int esp_bad_reconnect(struct esp *esp)
-{
-        struct scsi_cmnd *sp;
-
-        ESPLOG(("esp%d: Eieeee, reconnecting unknown command!\n",
-                esp->esp_id));
-        ESPLOG(("QUEUE DUMP\n"));
-        sp = esp->issue_SC;
-        ESPLOG(("esp%d: issue_SC[", esp->esp_id));
-        while (sp) {
-                ESPLOG(("<%02x,%02x>", sp->device->id, sp->device->lun));
-                sp = (struct scsi_cmnd *) sp->host_scribble;
-        }
-        ESPLOG(("]\n"));
-        sp = esp->current_SC;
-        ESPLOG(("esp%d: current_SC[", esp->esp_id));
-        if (sp)
-                ESPLOG(("<%02x,%02x>", sp->device->id, sp->device->lun));
-        else
-                ESPLOG(("<NULL>"));
-        ESPLOG(("]\n"));
-        sp = esp->disconnected_SC;
-        ESPLOG(("esp%d: disconnected_SC[", esp->esp_id));
-        while (sp) {
-                ESPLOG(("<%02x,%02x>", sp->device->id, sp->device->lun));
-                sp = (struct scsi_cmnd *) sp->host_scribble;
-        }
-        ESPLOG(("]\n"));
-        return do_reset_bus;
-}
-
-/* Do the needy when a target tries to reconnect to us. */
-static int esp_do_reconnect(struct esp *esp)
-{
-        int lun, target;
-        struct scsi_cmnd *SCptr;
-
-        /* Check for all bogus conditions first. */
-        target = reconnect_target(esp);
-        if (target < 0) {
-                ESPDISC(("bad bus bits\n"));
-                return do_reset_bus;
-        }
-        lun = reconnect_lun(esp);
-        if (lun < 0) {
-                ESPDISC(("target=%2x, bad identify msg\n", target));
-                return do_reset_bus;
-        }
-
-        /* Things look ok... */
-        ESPDISC(("R<%02x,%02x>", target, lun));
-
-        /* Must not flush FIFO or DVMA on HME. */
-        if (esp->erev != fashme) {
-                esp_cmd(esp, ESP_CMD_FLUSH);
-                if (esp100_reconnect_hwbug(esp))
-                        return do_reset_bus;
-                esp_cmd(esp, ESP_CMD_NULL);
-        }
-
-        SCptr = remove_SC(&esp->disconnected_SC, (u8) target, (u8) lun);
-        if (!SCptr)
-                return esp_bad_reconnect(esp);
-
-        esp_connect(esp, SCptr);
-        esp_cmd(esp, ESP_CMD_MOK);
-
-        if (esp->erev == fashme)
-                sbus_writeb(((SCptr->device->id & 0xf) |
-                             (ESP_BUSID_RESELID | ESP_BUSID_CTR32BIT)),
-                            esp->eregs + ESP_BUSID);
-
-        /* Reconnect implies a restore pointers operation. */
-        esp_restore_pointers(esp, SCptr);
-
-        esp->snip = 0;
-        esp_advance_phase(SCptr, in_the_dark);
-        return do_intr_end;
-}
-
-/* End of NEXUS (hopefully), pick up status + message byte then leave if
- * all goes well.
- */
-static int esp_do_status(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        int intr, rval;
-
-        rval = skipahead1(esp, SCptr, in_the_dark, in_status);
-        if (rval)
-                return rval;
-        intr = esp->ireg;
-        ESPSTAT(("esp_do_status: "));
-        if (intr != ESP_INTR_DC) {
-                int message_out = 0; /* for parity problems */
-
-                /* Ack the message. */
-                ESPSTAT(("ack msg, "));
-                esp_cmd(esp, ESP_CMD_MOK);
-
-                if (esp->erev != fashme) {
-                        dma_flashclear(esp);
-
-                        /* Wait till the first bits settle. */
-                        while (esp->esp_command[0] == 0xff)
-                                udelay(1);
-                } else {
-                        esp->esp_command[0] = esp->hme_fifo_workaround_buffer[0];
-                        esp->esp_command[1] = esp->hme_fifo_workaround_buffer[1];
-                }
-
-                ESPSTAT(("got something, "));
-                /* ESP chimes in with one of
-                 *
-                 * 1) function done interrupt:
-                 *      both status and message in bytes
-                 *      are available
-                 *
-                 * 2) bus service interrupt:
-                 *      only status byte was acquired
-                 *
-                 * 3) Anything else:
-                 *      can't happen, but we test for it
-                 *      anyways
-                 *
-                 * ALSO: If bad parity was detected on either
-                 *       the status _or_ the message byte then
-                 *       the ESP has asserted ATN on the bus
-                 *       and we must therefore wait for the
-                 *       next phase change.
-                 */
-                if (intr & ESP_INTR_FDONE) {
-                        /* We got it all, hallejulia. */
-                        ESPSTAT(("got both, "));
-                        SCptr->SCp.Status = esp->esp_command[0];
-                        SCptr->SCp.Message = esp->esp_command[1];
-                        esp->prevmsgin = SCptr->SCp.Message;
-                        esp->cur_msgin[0] = SCptr->SCp.Message;
-                        if (esp->sreg & ESP_STAT_PERR) {
-                                /* There was bad parity for the
-                                 * message byte, the status byte
-                                 * was ok.
-                                 */
-                                message_out = MSG_PARITY_ERROR;
-                        }
-                } else if (intr == ESP_INTR_BSERV) {
-                        /* Only got status byte. */
-                        ESPLOG(("esp%d: got status only, ", esp->esp_id));
-                        if (!(esp->sreg & ESP_STAT_PERR)) {
-                                SCptr->SCp.Status = esp->esp_command[0];
-                                SCptr->SCp.Message = 0xff;
-                        } else {
-                                /* The status byte had bad parity.
-                                 * we leave the scsi_pointer Status
-                                 * field alone as we set it to a default
-                                 * of CHECK_CONDITION in esp_queue.
-                                 */
-                                message_out = INITIATOR_ERROR;
-                        }
-                } else {
-                        /* This shouldn't happen ever. */
-                        ESPSTAT(("got bolixed\n"));
-                        esp_advance_phase(SCptr, in_the_dark);
-                        return esp_do_phase_determine(esp);
-                }
-
-                if (!message_out) {
-                        ESPSTAT(("status=%2x msg=%2x, ", SCptr->SCp.Status,
-                                SCptr->SCp.Message));
-                        if (SCptr->SCp.Message == COMMAND_COMPLETE) {
-                                ESPSTAT(("and was COMMAND_COMPLETE\n"));
-                                esp_advance_phase(SCptr, in_freeing);
-                                return esp_do_freebus(esp);
-                        } else {
-                                ESPLOG(("esp%d: and _not_ COMMAND_COMPLETE\n",
-                                        esp->esp_id));
-                                esp->msgin_len = esp->msgin_ctr = 1;
-                                esp_advance_phase(SCptr, in_msgindone);
-                                return esp_do_msgindone(esp);
-                        }
-                } else {
-                        /* With luck we'll be able to let the target
-                         * know that bad parity happened, it will know
-                         * which byte caused the problems and send it
-                         * again.  For the case where the status byte
-                         * receives bad parity, I do not believe most
-                         * targets recover very well.  We'll see.
-                         */
-                        ESPLOG(("esp%d: bad parity somewhere mout=%2x\n",
-                                esp->esp_id, message_out));
-                        esp->cur_msgout[0] = message_out;
-                        esp->msgout_len = esp->msgout_ctr = 1;
-                        esp_advance_phase(SCptr, in_the_dark);
-                        return esp_do_phase_determine(esp);
-                }
-        } else {
-                /* If we disconnect now, all hell breaks loose. */
-                ESPLOG(("esp%d: whoops, disconnect\n", esp->esp_id));
-                esp_advance_phase(SCptr, in_the_dark);
-                return esp_do_phase_determine(esp);
-        }
-}
-
-static int esp_enter_status(struct esp *esp)
-{
-        u8 thecmd = ESP_CMD_ICCSEQ;
-
-        esp_cmd(esp, ESP_CMD_FLUSH);
-        if (esp->erev != fashme) {
-                u32 tmp;
-
-                esp->esp_command[0] = esp->esp_command[1] = 0xff;
-                sbus_writeb(2, esp->eregs + ESP_TCLOW);
-                sbus_writeb(0, esp->eregs + ESP_TCMED);
-                tmp = sbus_readl(esp->dregs + DMA_CSR);
-                tmp |= (DMA_ST_WRITE | DMA_ENABLE);
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-                if (esp->dma->revision == dvmaesc1)
-                        sbus_writel(0x100, esp->dregs + DMA_COUNT);
-                sbus_writel(esp->esp_command_dvma, esp->dregs + DMA_ADDR);
-                thecmd |= ESP_CMD_DMA;
-        }
-        esp_cmd(esp, thecmd);
-        esp_advance_phase(esp->current_SC, in_status);
-
-        return esp_do_status(esp);
-}
-
-static int esp_disconnect_amidst_phases(struct esp *esp)
-{
-        struct scsi_cmnd *sp = esp->current_SC;
-        struct esp_device *esp_dev = sp->device->hostdata;
-
-        /* This means real problems if we see this
-         * here.  Unless we were actually trying
-         * to force the device to abort/reset.
-         */
-        ESPLOG(("esp%d Disconnect amidst phases, ", esp->esp_id));
-        ESPLOG(("pphase<%s> cphase<%s>, ",
-                phase_string(sp->SCp.phase),
-                phase_string(sp->SCp.sent_command)));
-
-        if (esp->disconnected_SC != NULL || (esp->erev == fashme))
-                esp_cmd(esp, ESP_CMD_ESEL);
-
-        switch (esp->cur_msgout[0]) {
-        default:
-                /* We didn't expect this to happen at all. */
-                ESPLOG(("device is bolixed\n"));
-                esp_advance_phase(sp, in_tgterror);
-                esp_done(esp, (DID_ERROR << 16));
-                break;
-
-        case BUS_DEVICE_RESET:
-                ESPLOG(("device reset successful\n"));
-                esp_dev->sync_max_offset = 0;
-                esp_dev->sync_min_period = 0;
-                esp_dev->sync = 0;
-                esp_advance_phase(sp, in_resetdev);
-                esp_done(esp, (DID_RESET << 16));
-                break;
-
-        case ABORT:
-                ESPLOG(("device abort successful\n"));
-                esp_advance_phase(sp, in_abortone);
-                esp_done(esp, (DID_ABORT << 16));
-                break;
-
-        };
-        return do_intr_end;
-}
-
-static int esp_enter_msgout(struct esp *esp)
-{
-        esp_advance_phase(esp->current_SC, in_msgout);
-        return esp_do_msgout(esp);
-}
-
-static int esp_enter_msgin(struct esp *esp)
-{
-        esp_advance_phase(esp->current_SC, in_msgin);
-        return esp_do_msgin(esp);
-}
-
-static int esp_enter_cmd(struct esp *esp)
-{
-        esp_advance_phase(esp->current_SC, in_cmdbegin);
-        return esp_do_cmdbegin(esp);
-}
-
-static int esp_enter_badphase(struct esp *esp)
-{
-        ESPLOG(("esp%d: Bizarre bus phase %2x.\n", esp->esp_id,
-                esp->sreg & ESP_STAT_PMASK));
-        return do_reset_bus;
-}
-
-typedef int (*espfunc_t)(struct esp *);
-
-static espfunc_t phase_vector[] = {
-        esp_do_data,            /* ESP_DOP */
-        esp_do_data,            /* ESP_DIP */
-        esp_enter_cmd,          /* ESP_CMDP */
-        esp_enter_status,       /* ESP_STATP */
-        esp_enter_badphase,     /* ESP_STAT_PMSG */
-        esp_enter_badphase,     /* ESP_STAT_PMSG | ESP_STAT_PIO */
-        esp_enter_msgout,       /* ESP_MOP */
-        esp_enter_msgin,        /* ESP_MIP */
-};
-
-/* The target has control of the bus and we have to see where it has
- * taken us.
- */
-static int esp_do_phase_determine(struct esp *esp)
-{
-        if ((esp->ireg & ESP_INTR_DC) != 0)
-                return esp_disconnect_amidst_phases(esp);
-        return phase_vector[esp->sreg & ESP_STAT_PMASK](esp);
-}
-
-/* First interrupt after exec'ing a cmd comes here. */
-static int esp_select_complete(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        struct esp_device *esp_dev = SCptr->device->hostdata;
-        int cmd_bytes_sent, fcnt;
-
-        if (esp->erev != fashme)
-                esp->seqreg = (sbus_readb(esp->eregs + ESP_SSTEP) & ESP_STEP_VBITS);
-
-        if (esp->erev == fashme)
-                fcnt = esp->hme_fifo_workaround_count;
-        else
-                fcnt = (sbus_readb(esp->eregs + ESP_FFLAGS) & ESP_FF_FBYTES);
-
-        cmd_bytes_sent = esp_bytes_sent(esp, fcnt);
-        dma_invalidate(esp);
-
-        /* Let's check to see if a reselect happened
-         * while we we're trying to select.  This must
-         * be checked first.
-         */
-        if (esp->ireg == (ESP_INTR_RSEL | ESP_INTR_FDONE)) {
-                esp_reconnect(esp, SCptr);
-                return esp_do_reconnect(esp);
-        }
-
-        /* Looks like things worked, we should see a bus service &
-         * a function complete interrupt at this point.  Note we
-         * are doing a direct comparison because we don't want to
-         * be fooled into thinking selection was successful if
-         * ESP_INTR_DC is set, see below.
-         */
-        if (esp->ireg == (ESP_INTR_FDONE | ESP_INTR_BSERV)) {
-                /* target speaks... */
-                esp->targets_present |= (1<<SCptr->device->id);
-
-                /* What if the target ignores the sdtr? */
-                if (esp->snip)
-                        esp_dev->sync = 1;
-
-                /* See how far, if at all, we got in getting
-                 * the information out to the target.
-                 */
-                switch (esp->seqreg) {
-                default:
-
-                case ESP_STEP_ASEL:
-                        /* Arbitration won, target selected, but
-                         * we are in some phase which is not command
-                         * phase nor is it message out phase.
-                         *
-                         * XXX We've confused the target, obviously.
-                         * XXX So clear it's state, but we also end
-                         * XXX up clearing everyone elses.  That isn't
-                         * XXX so nice.  I'd like to just reset this
-                         * XXX target, but if I cannot even get it's
-                         * XXX attention and finish selection to talk
-                         * XXX to it, there is not much more I can do.
-                         * XXX If we have a loaded bus we're going to
-                         * XXX spend the next second or so renegotiating
-                         * XXX for synchronous transfers.
-                         */
-                        ESPLOG(("esp%d: STEP_ASEL for tgt %d\n",
-                                esp->esp_id, SCptr->device->id));
-
-                case ESP_STEP_SID:
-                        /* Arbitration won, target selected, went
-                         * to message out phase, sent one message
-                         * byte, then we stopped.  ATN is asserted
-                         * on the SCSI bus and the target is still
-                         * there hanging on.  This is a legal
-                         * sequence step if we gave the ESP a select
-                         * and stop command.
-                         *
-                         * XXX See above, I could set the borken flag
-                         * XXX in the device struct and retry the
-                         * XXX command.  But would that help for
-                         * XXX tagged capable targets?
-                         */
-
-                case ESP_STEP_NCMD:
-                        /* Arbitration won, target selected, maybe
-                         * sent the one message byte in message out
-                         * phase, but we did not go to command phase
-                         * in the end.  Actually, we could have sent
-                         * only some of the message bytes if we tried
-                         * to send out the entire identify and tag
-                         * message using ESP_CMD_SA3.
-                         */
-                        cmd_bytes_sent = 0;
-                        break;
-
-                case ESP_STEP_PPC:
-                        /* No, not the powerPC pinhead.  Arbitration
-                         * won, all message bytes sent if we went to
-                         * message out phase, went to command phase
-                         * but only part of the command was sent.
-                         *
-                         * XXX I've seen this, but usually in conjunction
-                         * XXX with a gross error which appears to have
-                         * XXX occurred between the time I told the
-                         * XXX ESP to arbitrate and when I got the
-                         * XXX interrupt.  Could I have misloaded the
-                         * XXX command bytes into the fifo?  Actually,
-                         * XXX I most likely missed a phase, and therefore
-                         * XXX went into never never land and didn't even
-                         * XXX know it.  That was the old driver though.
-                         * XXX What is even more peculiar is that the ESP
-                         * XXX showed the proper function complete and
-                         * XXX bus service bits in the interrupt register.
-                         */
-
-                case ESP_STEP_FINI4:
-                case ESP_STEP_FINI5:
-                case ESP_STEP_FINI6:
-                case ESP_STEP_FINI7:
-                        /* Account for the identify message */
-                        if (SCptr->SCp.phase == in_slct_norm)
-                                cmd_bytes_sent -= 1;
-                };
-
-                if (esp->erev != fashme)
-                        esp_cmd(esp, ESP_CMD_NULL);
-
-                /* Be careful, we could really get fucked during synchronous
-                 * data transfers if we try to flush the fifo now.
-                 */
-                if ((esp->erev != fashme) && /* not a Happy Meal and... */
-                    !fcnt && /* Fifo is empty and... */
-                    /* either we are not doing synchronous transfers or... */
-                    (!esp_dev->sync_max_offset ||
-                     /* We are not going into data in phase. */
-                     ((esp->sreg & ESP_STAT_PMASK) != ESP_DIP)))
-                        esp_cmd(esp, ESP_CMD_FLUSH); /* flush is safe */
-
-                /* See how far we got if this is not a slow command. */
-                if (!esp->esp_slowcmd) {
-                        if (cmd_bytes_sent < 0)
-                                cmd_bytes_sent = 0;
-                        if (cmd_bytes_sent != SCptr->cmd_len) {
-                                /* Crapola, mark it as a slowcmd
-                                 * so that we have some chance of
-                                 * keeping the command alive with
-                                 * good luck.
-                                 *
-                                 * XXX Actually, if we didn't send it all
-                                 * XXX this means either we didn't set things
-                                 * XXX up properly (driver bug) or the target
-                                 * XXX or the ESP detected parity on one of
-                                 * XXX the command bytes.  This makes much
-                                 * XXX more sense, and therefore this code
-                                 * XXX should be changed to send out a
-                                 * XXX parity error message or if the status
-                                 * XXX register shows no parity error then
-                                 * XXX just expect the target to bring the
-                                 * XXX bus into message in phase so that it
-                                 * XXX can send us the parity error message.
-                                 * XXX SCSI sucks...
-                                 */
-                                esp->esp_slowcmd = 1;
-                                esp->esp_scmdp = &(SCptr->cmnd[cmd_bytes_sent]);
-                                esp->esp_scmdleft = (SCptr->cmd_len - cmd_bytes_sent);
-                        }
-                }
-
-                /* Now figure out where we went. */
-                esp_advance_phase(SCptr, in_the_dark);
-                return esp_do_phase_determine(esp);
-        }
-
-        /* Did the target even make it? */
-        if (esp->ireg == ESP_INTR_DC) {
-                /* wheee... nobody there or they didn't like
-                 * what we told it to do, clean up.
-                 */
-
-                /* If anyone is off the bus, but working on
-                 * a command in the background for us, tell
-                 * the ESP to listen for them.
-                 */
-                if (esp->disconnected_SC)
-                        esp_cmd(esp, ESP_CMD_ESEL);
-
-                if (((1<<SCptr->device->id) & esp->targets_present) &&
-                    esp->seqreg != 0 &&
-                    (esp->cur_msgout[0] == EXTENDED_MESSAGE) &&
-                    (SCptr->SCp.phase == in_slct_msg ||
-                     SCptr->SCp.phase == in_slct_stop)) {
-                        /* shit */
-                        esp->snip = 0;
-                        ESPLOG(("esp%d: Failed synchronous negotiation for target %d "
-                                "lun %d\n", esp->esp_id, SCptr->device->id, SCptr->device->lun));
-                        esp_dev->sync_max_offset = 0;
-                        esp_dev->sync_min_period = 0;
-                        esp_dev->sync = 1; /* so we don't negotiate again */
-
-                        /* Run the command again, this time though we
-                         * won't try to negotiate for synchronous transfers.
-                         *
-                         * XXX I'd like to do something like send an
-                         * XXX INITIATOR_ERROR or ABORT message to the
-                         * XXX target to tell it, "Sorry I confused you,
-                         * XXX please come back and I will be nicer next
-                         * XXX time".  But that requires having the target
-                         * XXX on the bus, and it has dropped BSY on us.
-                         */
-                        esp->current_SC = NULL;
-                        esp_advance_phase(SCptr, not_issued);
-                        prepend_SC(&esp->issue_SC, SCptr);
-                        esp_exec_cmd(esp);
-                        return do_intr_end;
-                }
-
-                /* Ok, this is normal, this is what we see during boot
-                 * or whenever when we are scanning the bus for targets.
-                 * But first make sure that is really what is happening.
-                 */
-                if (((1<<SCptr->device->id) & esp->targets_present)) {
-                        ESPLOG(("esp%d: Warning, live target %d not responding to "
-                                "selection.\n", esp->esp_id, SCptr->device->id));
-
-                        /* This _CAN_ happen.  The SCSI standard states that
-                         * the target is to _not_ respond to selection if
-                         * _it_ detects bad parity on the bus for any reason.
-                         * Therefore, we assume that if we've talked successfully
-                         * to this target before, bad parity is the problem.
-                         */
-                        esp_done(esp, (DID_PARITY << 16));
-                } else {
-                        /* Else, there really isn't anyone there. */
-                        ESPMISC(("esp: selection failure, maybe nobody there?\n"));
-                        ESPMISC(("esp: target %d lun %d\n",
-                                 SCptr->device->id, SCptr->device->lun));
-                        esp_done(esp, (DID_BAD_TARGET << 16));
-                }
-                return do_intr_end;
-        }
-
-        ESPLOG(("esp%d: Selection failure.\n", esp->esp_id));
-        printk("esp%d: Currently -- ", esp->esp_id);
-        esp_print_ireg(esp->ireg); printk(" ");
-        esp_print_statreg(esp->sreg); printk(" ");
-        esp_print_seqreg(esp->seqreg); printk("\n");
-        printk("esp%d: New -- ", esp->esp_id);
-        esp->sreg = sbus_readb(esp->eregs + ESP_STATUS);
-        esp->seqreg = sbus_readb(esp->eregs + ESP_SSTEP);
-        esp->ireg = sbus_readb(esp->eregs + ESP_INTRPT);
-        esp_print_ireg(esp->ireg); printk(" ");
-        esp_print_statreg(esp->sreg); printk(" ");
-        esp_print_seqreg(esp->seqreg); printk("\n");
-        ESPLOG(("esp%d: resetting bus\n", esp->esp_id));
-        return do_reset_bus; /* ugh... */
-}
-
-/* Continue reading bytes for msgin phase. */
-static int esp_do_msgincont(struct esp *esp)
-{
-        if (esp->ireg & ESP_INTR_BSERV) {
-                /* in the right phase too? */
-                if ((esp->sreg & ESP_STAT_PMASK) == ESP_MIP) {
-                        /* phew... */
-                        esp_cmd(esp, ESP_CMD_TI);
-                        esp_advance_phase(esp->current_SC, in_msgindone);
-                        return do_intr_end;
-                }
-
-                /* We changed phase but ESP shows bus service,
-                 * in this case it is most likely that we, the
-                 * hacker who has been up for 20hrs straight
-                 * staring at the screen, drowned in coffee
-                 * smelling like retched cigarette ashes
-                 * have miscoded something..... so, try to
-                 * recover as best we can.
-                 */
-                ESPLOG(("esp%d: message in mis-carriage.\n", esp->esp_id));
-        }
-        esp_advance_phase(esp->current_SC, in_the_dark);
-        return do_phase_determine;
-}
-
-static int check_singlebyte_msg(struct esp *esp)
-{
-        esp->prevmsgin = esp->cur_msgin[0];
-        if (esp->cur_msgin[0] & 0x80) {
-                /* wheee... */
-                ESPLOG(("esp%d: target sends identify amidst phases\n",
-                        esp->esp_id));
-                esp_advance_phase(esp->current_SC, in_the_dark);
-                return 0;
-        } else if (((esp->cur_msgin[0] & 0xf0) == 0x20) ||
-                   (esp->cur_msgin[0] == EXTENDED_MESSAGE)) {
-                esp->msgin_len = 2;
-                esp_advance_phase(esp->current_SC, in_msgincont);
-                return 0;
-        }
-        esp_advance_phase(esp->current_SC, in_the_dark);
-        switch (esp->cur_msgin[0]) {
-        default:
-                /* We don't want to hear about it. */
-                ESPLOG(("esp%d: msg %02x which we don't know about\n", esp->esp_id,
-                        esp->cur_msgin[0]));
-                return MESSAGE_REJECT;
-
-        case NOP:
-                ESPLOG(("esp%d: target %d sends a nop\n", esp->esp_id,
-                        esp->current_SC->device->id));
-                return 0;
-
-        case RESTORE_POINTERS:
-                /* In this case we might also have to backup the
-                 * "slow command" pointer.  It is rare to get such
-                 * a save/restore pointer sequence so early in the
-                 * bus transition sequences, but cover it.
-                 */
-                if (esp->esp_slowcmd) {
-                        esp->esp_scmdleft = esp->current_SC->cmd_len;
-                        esp->esp_scmdp = &esp->current_SC->cmnd[0];
-                }
-                esp_restore_pointers(esp, esp->current_SC);
-                return 0;
-
-        case SAVE_POINTERS:
-                esp_save_pointers(esp, esp->current_SC);
-                return 0;
-
-        case COMMAND_COMPLETE:
-        case DISCONNECT:
-                /* Freeing the bus, let it go. */
-                esp->current_SC->SCp.phase = in_freeing;
-                return 0;
-
-        case MESSAGE_REJECT:
-                ESPMISC(("msg reject, "));
-                if (esp->prevmsgout == EXTENDED_MESSAGE) {
-                        struct esp_device *esp_dev = esp->current_SC->device->hostdata;
-
-                        /* Doesn't look like this target can
-                         * do synchronous or WIDE transfers.
-                         */
-                        ESPSDTR(("got reject, was trying nego, clearing sync/WIDE\n"));
-                        esp_dev->sync = 1;
-                        esp_dev->wide = 1;
-                        esp_dev->sync_min_period = 0;
-                        esp_dev->sync_max_offset = 0;
-                        return 0;
-                } else {
-                        ESPMISC(("not sync nego, sending ABORT\n"));
-                        return ABORT;
-                }
-        };
-}
-
-/* Target negotiates for synchronous transfers before we do, this
- * is legal although very strange.  What is even funnier is that
- * the SCSI2 standard specifically recommends against targets doing
- * this because so many initiators cannot cope with this occurring.
- */
-static int target_with_ants_in_pants(struct esp *esp,
-                                     struct scsi_cmnd *SCptr,
-                                     struct esp_device *esp_dev)
-{
-        if (esp_dev->sync || SCptr->device->borken) {
-                /* sorry, no can do */
-                ESPSDTR(("forcing to async, "));
-                build_sync_nego_msg(esp, 0, 0);
-                esp_dev->sync = 1;
-                esp->snip = 1;
-                ESPLOG(("esp%d: hoping for msgout\n", esp->esp_id));
-                esp_advance_phase(SCptr, in_the_dark);
-                return EXTENDED_MESSAGE;
-        }
-
-        /* Ok, we'll check them out... */
-        return 0;
-}
-
-static void sync_report(struct esp *esp)
-{
-        int msg3, msg4;
-        char *type;
-
-        msg3 = esp->cur_msgin[3];
-        msg4 = esp->cur_msgin[4];
-        if (msg4) {
-                int hz = 1000000000 / (msg3 * 4);
-                int integer = hz / 1000000;
-                int fraction = (hz - (integer * 1000000)) / 10000;
-                if ((esp->erev == fashme) &&
-                    (esp->config3[esp->current_SC->device->id] & ESP_CONFIG3_EWIDE)) {
-                        type = "FAST-WIDE";
-                        integer <<= 1;
-                        fraction <<= 1;
-                } else if ((msg3 * 4) < 200) {
-                        type = "FAST";
-                } else {
-                        type = "synchronous";
-                }
-
-                /* Do not transform this back into one big printk
-                 * again, it triggers a bug in our sparc64-gcc272
-                 * sibling call optimization.  -DaveM
-                 */
-                ESPLOG((KERN_INFO "esp%d: target %d ",
-                        esp->esp_id, esp->current_SC->device->id));
-                ESPLOG(("[period %dns offset %d %d.%02dMHz ",
-                        (int) msg3 * 4, (int) msg4,
-                        integer, fraction));
-                ESPLOG(("%s SCSI%s]\n", type,
-                        (((msg3 * 4) < 200) ? "-II" : "")));
-        } else {
-                ESPLOG((KERN_INFO "esp%d: target %d asynchronous\n",
-                        esp->esp_id, esp->current_SC->device->id));
-        }
-}
-
-static int check_multibyte_msg(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        struct esp_device *esp_dev = SCptr->device->hostdata;
-        u8 regval = 0;
-        int message_out = 0;
-
-        ESPSDTR(("chk multibyte msg: "));
-        if (esp->cur_msgin[2] == EXTENDED_SDTR) {
-                int period = esp->cur_msgin[3];
-                int offset = esp->cur_msgin[4];
-
-                ESPSDTR(("is sync nego response, "));
-                if (!esp->snip) {
-                        int rval;
-
-                        /* Target negotiates first! */
-                        ESPSDTR(("target jumps the gun, "));
-                        message_out = EXTENDED_MESSAGE; /* we must respond */
-                        rval = target_with_ants_in_pants(esp, SCptr, esp_dev);
-                        if (rval)
-                                return rval;
-                }
-
-                ESPSDTR(("examining sdtr, "));
-
-                /* Offset cannot be larger than ESP fifo size. */
-                if (offset > 15) {
-                        ESPSDTR(("offset too big %2x, ", offset));
-                        offset = 15;
-                        ESPSDTR(("sending back new offset\n"));
-                        build_sync_nego_msg(esp, period, offset);
-                        return EXTENDED_MESSAGE;
-                }
-
-                if (offset && period > esp->max_period) {
-                        /* Yeee, async for this slow device. */
-                        ESPSDTR(("period too long %2x, ", period));
-                        build_sync_nego_msg(esp, 0, 0);
-                        ESPSDTR(("hoping for msgout\n"));
-                        esp_advance_phase(esp->current_SC, in_the_dark);
-                        return EXTENDED_MESSAGE;
-                } else if (offset && period < esp->min_period) {
-                        ESPSDTR(("period too short %2x, ", period));
-                        period = esp->min_period;
-                        if (esp->erev > esp236)
-                                regval = 4;
-                        else
-                                regval = 5;
-                } else if (offset) {
-                        int tmp;
-
-                        ESPSDTR(("period is ok, "));
-                        tmp = esp->ccycle / 1000;
-                        regval = (((period << 2) + tmp - 1) / tmp);
-                        if (regval && ((esp->erev == fas100a ||
-                                        esp->erev == fas236  ||
-                                        esp->erev == fashme))) {
-                                if (period >= 50)
-                                        regval--;
-                        }
-                }
-
-                if (offset) {
-                        u8 bit;
-
-                        esp_dev->sync_min_period = (regval & 0x1f);
-                        esp_dev->sync_max_offset = (offset | esp->radelay);
-                        if (esp->erev == fas100a || esp->erev == fas236 || esp->erev == fashme) {
-                                if ((esp->erev == fas100a) || (esp->erev == fashme))
-                                        bit = ESP_CONFIG3_FAST;
-                                else
-                                        bit = ESP_CONFIG3_FSCSI;
-                                if (period < 50) {
-                                        /* On FAS366, if using fast-20 synchronous transfers
-                                         * we need to make sure the REQ/ACK assert/deassert
-                                         * control bits are clear.
-                                         */
-                                        if (esp->erev == fashme)
-                                                esp_dev->sync_max_offset &= ~esp->radelay;
-                                        esp->config3[SCptr->device->id] |= bit;
-                                } else {
-                                        esp->config3[SCptr->device->id] &= ~bit;
-                                }
-                                esp->prev_cfg3 = esp->config3[SCptr->device->id];
-                                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                        }
-                        esp->prev_soff = esp_dev->sync_max_offset;
-                        esp->prev_stp = esp_dev->sync_min_period;
-                        sbus_writeb(esp->prev_soff, esp->eregs + ESP_SOFF);
-                        sbus_writeb(esp->prev_stp, esp->eregs + ESP_STP);
-                        ESPSDTR(("soff=%2x stp=%2x cfg3=%2x\n",
-                                 esp_dev->sync_max_offset,
-                                 esp_dev->sync_min_period,
-                                 esp->config3[SCptr->device->id]));
-
-                        esp->snip = 0;
-                } else if (esp_dev->sync_max_offset) {
-                        u8 bit;
-
-                        /* back to async mode */
-                        ESPSDTR(("unaccaptable sync nego, forcing async\n"));
-                        esp_dev->sync_max_offset = 0;
-                        esp_dev->sync_min_period = 0;
-                        esp->prev_soff = 0;
-                        esp->prev_stp = 0;
-                        sbus_writeb(esp->prev_soff, esp->eregs + ESP_SOFF);
-                        sbus_writeb(esp->prev_stp, esp->eregs + ESP_STP);
-                        if (esp->erev == fas100a || esp->erev == fas236 || esp->erev == fashme) {
-                                if ((esp->erev == fas100a) || (esp->erev == fashme))
-                                        bit = ESP_CONFIG3_FAST;
-                                else
-                                        bit = ESP_CONFIG3_FSCSI;
-                                esp->config3[SCptr->device->id] &= ~bit;
-                                esp->prev_cfg3 = esp->config3[SCptr->device->id];
-                                sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-                        }
-                }
-
-                sync_report(esp);
-
-                ESPSDTR(("chk multibyte msg: sync is known, "));
-                esp_dev->sync = 1;
-
-                if (message_out) {
-                        ESPLOG(("esp%d: sending sdtr back, hoping for msgout\n",
-                                esp->esp_id));
-                        build_sync_nego_msg(esp, period, offset);
-                        esp_advance_phase(SCptr, in_the_dark);
-                        return EXTENDED_MESSAGE;
-                }
-
-                ESPSDTR(("returning zero\n"));
-                esp_advance_phase(SCptr, in_the_dark); /* ...or else! */
-                return 0;
-        } else if (esp->cur_msgin[2] == EXTENDED_WDTR) {
-                int size = 8 << esp->cur_msgin[3];
-
-                esp->wnip = 0;
-                if (esp->erev != fashme) {
-                        ESPLOG(("esp%d: AIEEE wide msg received and not HME.\n",
-                                esp->esp_id));
-                        message_out = MESSAGE_REJECT;
-                } else if (size > 16) {
-                        ESPLOG(("esp%d: AIEEE wide transfer for %d size "
-                                "not supported.\n", esp->esp_id, size));
-                        message_out = MESSAGE_REJECT;
-                } else {
-                        /* Things look good; let's see what we got. */
-                        if (size == 16) {
-                                /* Set config 3 register for this target. */
-                                esp->config3[SCptr->device->id] |= ESP_CONFIG3_EWIDE;
-                        } else {
-                                /* Just make sure it was one byte sized. */
-                                if (size != 8) {
-                                        ESPLOG(("esp%d: Aieee, wide nego of %d size.\n",
-                                                esp->esp_id, size));
-                                        message_out = MESSAGE_REJECT;
-                                        goto finish;
-                                }
-                                /* Pure paranoia. */
-                                esp->config3[SCptr->device->id] &= ~(ESP_CONFIG3_EWIDE);
-                        }
-                        esp->prev_cfg3 = esp->config3[SCptr->device->id];
-                        sbus_writeb(esp->prev_cfg3, esp->eregs + ESP_CFG3);
-
-                        /* Regardless, next try for sync transfers. */
-                        build_sync_nego_msg(esp, esp->sync_defp, 15);
-                        esp_dev->sync = 1;
-                        esp->snip = 1;
-                        message_out = EXTENDED_MESSAGE;
-                }
-        } else if (esp->cur_msgin[2] == EXTENDED_MODIFY_DATA_POINTER) {
-                ESPLOG(("esp%d: rejecting modify data ptr msg\n", esp->esp_id));
-                message_out = MESSAGE_REJECT;
-        }
-finish:
-        esp_advance_phase(SCptr, in_the_dark);
-        return message_out;
-}
-
-static int esp_do_msgindone(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        int message_out = 0, it = 0, rval;
-
-        rval = skipahead1(esp, SCptr, in_msgin, in_msgindone);
-        if (rval)
-                return rval;
-        if (SCptr->SCp.sent_command != in_status) {
-                if (!(esp->ireg & ESP_INTR_DC)) {
-                        if (esp->msgin_len && (esp->sreg & ESP_STAT_PERR)) {
-                                message_out = MSG_PARITY_ERROR;
-                                esp_cmd(esp, ESP_CMD_FLUSH);
-                        } else if (esp->erev != fashme &&
-                          (it = (sbus_readb(esp->eregs + ESP_FFLAGS) & ESP_FF_FBYTES)) != 1) {
-                                /* We certainly dropped the ball somewhere. */
-                                message_out = INITIATOR_ERROR;
-                                esp_cmd(esp, ESP_CMD_FLUSH);
-                        } else if (!esp->msgin_len) {
-                                if (esp->erev == fashme)
-                                        it = esp->hme_fifo_workaround_buffer[0];
-                                else
-                                        it = sbus_readb(esp->eregs + ESP_FDATA);
-                                esp_advance_phase(SCptr, in_msgincont);
-                        } else {
-                                /* it is ok and we want it */
-                                if (esp->erev == fashme)
-                                        it = esp->cur_msgin[esp->msgin_ctr] =
-                                                esp->hme_fifo_workaround_buffer[0];
-                                else
-                                        it = esp->cur_msgin[esp->msgin_ctr] =
-                                                sbus_readb(esp->eregs + ESP_FDATA);
-                                esp->msgin_ctr++;
-                        }
-                } else {
-                        esp_advance_phase(SCptr, in_the_dark);
-                        return do_work_bus;
-                }
-        } else {
-                it = esp->cur_msgin[0];
-        }
-        if (!message_out && esp->msgin_len) {
-                if (esp->msgin_ctr < esp->msgin_len) {
-                        esp_advance_phase(SCptr, in_msgincont);
-                } else if (esp->msgin_len == 1) {
-                        message_out = check_singlebyte_msg(esp);
-                } else if (esp->msgin_len == 2) {
-                        if (esp->cur_msgin[0] == EXTENDED_MESSAGE) {
-                                if ((it + 2) >= 15) {
-                                        message_out = MESSAGE_REJECT;
-                                } else {
-                                        esp->msgin_len = (it + 2);
-                                        esp_advance_phase(SCptr, in_msgincont);
-                                }
-                        } else {
-                                message_out = MESSAGE_REJECT; /* foo on you */
-                        }
-                } else {
-                        message_out = check_multibyte_msg(esp);
-                }
-        }
-        if (message_out < 0) {
-                return -message_out;
-        } else if (message_out) {
-                if (((message_out != 1) &&
-                     ((message_out < 0x20) || (message_out & 0x80))))
-                        esp->msgout_len = 1;
-                esp->cur_msgout[0] = message_out;
-                esp_cmd(esp, ESP_CMD_SATN);
-                esp_advance_phase(SCptr, in_the_dark);
-                esp->msgin_len = 0;
-        }
-        esp->sreg = sbus_readb(esp->eregs + ESP_STATUS);
-        esp->sreg &= ~(ESP_STAT_INTR);
-        if ((esp->sreg & (ESP_STAT_PMSG|ESP_STAT_PCD)) == (ESP_STAT_PMSG|ESP_STAT_PCD))
-                esp_cmd(esp, ESP_CMD_MOK);
-        if ((SCptr->SCp.sent_command == in_msgindone) &&
-            (SCptr->SCp.phase == in_freeing))
-                return esp_do_freebus(esp);
-        return do_intr_end;
-}
-
-static int esp_do_cmdbegin(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-
-        esp_advance_phase(SCptr, in_cmdend);
-        if (esp->erev == fashme) {
-                u32 tmp = sbus_readl(esp->dregs + DMA_CSR);
-                int i;
-
-                for (i = 0; i < esp->esp_scmdleft; i++)
-                        esp->esp_command[i] = *esp->esp_scmdp++;
-                esp->esp_scmdleft = 0;
-                esp_cmd(esp, ESP_CMD_FLUSH);
-                esp_setcount(esp->eregs, i, 1);
-                esp_cmd(esp, (ESP_CMD_DMA | ESP_CMD_TI));
-                tmp |= (DMA_SCSI_DISAB | DMA_ENABLE);
-                tmp &= ~(DMA_ST_WRITE);
-                sbus_writel(i, esp->dregs + DMA_COUNT);
-                sbus_writel(esp->esp_command_dvma, esp->dregs + DMA_ADDR);
-                sbus_writel(tmp, esp->dregs + DMA_CSR);
-        } else {
-                u8 tmp;
-
-                esp_cmd(esp, ESP_CMD_FLUSH);
-                tmp = *esp->esp_scmdp++;
-                esp->esp_scmdleft--;
-                sbus_writeb(tmp, esp->eregs + ESP_FDATA);
-                esp_cmd(esp, ESP_CMD_TI);
-        }
-        return do_intr_end;
-}
-
-static int esp_do_cmddone(struct esp *esp)
-{
-        if (esp->erev == fashme)
-                dma_invalidate(esp);
-        else
-                esp_cmd(esp, ESP_CMD_NULL);
-
-        if (esp->ireg & ESP_INTR_BSERV) {
-                esp_advance_phase(esp->current_SC, in_the_dark);
-                return esp_do_phase_determine(esp);
-        }
-
-        ESPLOG(("esp%d: in do_cmddone() but didn't get BSERV interrupt.\n",
-                esp->esp_id));
-        return do_reset_bus;
-}
-
-static int esp_do_msgout(struct esp *esp)
-{
-        esp_cmd(esp, ESP_CMD_FLUSH);
-        switch (esp->msgout_len) {
-        case 1:
-                if (esp->erev == fashme)
-                        hme_fifo_push(esp, &esp->cur_msgout[0], 1);
-                else
-                        sbus_writeb(esp->cur_msgout[0], esp->eregs + ESP_FDATA);
-
-                esp_cmd(esp, ESP_CMD_TI);
-                break;
-
-        case 2:
-                esp->esp_command[0] = esp->cur_msgout[0];
-                esp->esp_command[1] = esp->cur_msgout[1];
-
-                if (esp->erev == fashme) {
-                        hme_fifo_push(esp, &esp->cur_msgout[0], 2);
-                        esp_cmd(esp, ESP_CMD_TI);
-                } else {
-                        dma_setup(esp, esp->esp_command_dvma, 2, 0);
-                        esp_setcount(esp->eregs, 2, 0);
-                        esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-                }
-                break;
-
-        case 4:
-                esp->esp_command[0] = esp->cur_msgout[0];
-                esp->esp_command[1] = esp->cur_msgout[1];
-                esp->esp_command[2] = esp->cur_msgout[2];
-                esp->esp_command[3] = esp->cur_msgout[3];
-                esp->snip = 1;
-
-                if (esp->erev == fashme) {
-                        hme_fifo_push(esp, &esp->cur_msgout[0], 4);
-                        esp_cmd(esp, ESP_CMD_TI);
-                } else {
-                        dma_setup(esp, esp->esp_command_dvma, 4, 0);
-                        esp_setcount(esp->eregs, 4, 0);
-                        esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-                }
-                break;
-
-        case 5:
-                esp->esp_command[0] = esp->cur_msgout[0];
-                esp->esp_command[1] = esp->cur_msgout[1];
-                esp->esp_command[2] = esp->cur_msgout[2];
-                esp->esp_command[3] = esp->cur_msgout[3];
-                esp->esp_command[4] = esp->cur_msgout[4];
-                esp->snip = 1;
-
-                if (esp->erev == fashme) {
-                        hme_fifo_push(esp, &esp->cur_msgout[0], 5);
-                        esp_cmd(esp, ESP_CMD_TI);
-                } else {
-                        dma_setup(esp, esp->esp_command_dvma, 5, 0);
-                        esp_setcount(esp->eregs, 5, 0);
-                        esp_cmd(esp, ESP_CMD_DMA | ESP_CMD_TI);
-                }
-                break;
-
-        default:
-                /* whoops */
-                ESPMISC(("bogus msgout sending NOP\n"));
-                esp->cur_msgout[0] = NOP;
-
-                if (esp->erev == fashme) {
-                        hme_fifo_push(esp, &esp->cur_msgout[0], 1);
-                } else {
-                        sbus_writeb(esp->cur_msgout[0], esp->eregs + ESP_FDATA);
-                }
-
-                esp->msgout_len = 1;
-                esp_cmd(esp, ESP_CMD_TI);
-                break;
-        };
-
-        esp_advance_phase(esp->current_SC, in_msgoutdone);
-        return do_intr_end;
-}
-
-static int esp_do_msgoutdone(struct esp *esp)
-{
-        if (esp->msgout_len > 1) {
-                /* XXX HME/FAS ATN deassert workaround required,
-                 * XXX no DMA flushing, only possible ESP_CMD_FLUSH
-                 * XXX to kill the fifo.
-                 */
-                if (esp->erev != fashme) {
-                        u32 tmp;
-
-                        while ((tmp = sbus_readl(esp->dregs + DMA_CSR)) & DMA_PEND_READ)
-                                udelay(1);
-                        tmp &= ~DMA_ENABLE;
-                        sbus_writel(tmp, esp->dregs + DMA_CSR);
-                        dma_invalidate(esp);
-                } else {
-                        esp_cmd(esp, ESP_CMD_FLUSH);
-                }
-        }
-        if (!(esp->ireg & ESP_INTR_DC)) {
-                if (esp->erev != fashme)
-                        esp_cmd(esp, ESP_CMD_NULL);
-                switch (esp->sreg & ESP_STAT_PMASK) {
-                case ESP_MOP:
-                        /* whoops, parity error */
-                        ESPLOG(("esp%d: still in msgout, parity error assumed\n",
-                                esp->esp_id));
-                        if (esp->msgout_len > 1)
-                                esp_cmd(esp, ESP_CMD_SATN);
-                        esp_advance_phase(esp->current_SC, in_msgout);
-                        return do_work_bus;
-
-                case ESP_DIP:
-                        break;
-
-                default:
-                        /* Happy Meal fifo is touchy... */
-                        if ((esp->erev != fashme) &&
-                            !fcount(esp) &&
-                            !(((struct esp_device *)esp->current_SC->device->hostdata)->sync_max_offset))
-                                esp_cmd(esp, ESP_CMD_FLUSH);
-                        break;
-
-                };
-        } else {
-                ESPLOG(("esp%d: disconnect, resetting bus\n", esp->esp_id));
-                return do_reset_bus;
-        }
-
-        /* If we sent out a synchronous negotiation message, update
-         * our state.
-         */
-        if (esp->cur_msgout[2] == EXTENDED_MESSAGE &&
-            esp->cur_msgout[4] == EXTENDED_SDTR) {
-                esp->snip = 1; /* anal retentiveness... */
-        }
-
-        esp->prevmsgout = esp->cur_msgout[0];
-        esp->msgout_len = 0;
-        esp_advance_phase(esp->current_SC, in_the_dark);
-        return esp_do_phase_determine(esp);
-}
-
-static int esp_bus_unexpected(struct esp *esp)
-{
-        ESPLOG(("esp%d: command in weird state %2x\n",
-                esp->esp_id, esp->current_SC->SCp.phase));
-        return do_reset_bus;
-}
-
-static espfunc_t bus_vector[] = {
-        esp_do_data_finale,
-        esp_do_data_finale,
-        esp_bus_unexpected,
-        esp_do_msgin,
-        esp_do_msgincont,
-        esp_do_msgindone,
-        esp_do_msgout,
-        esp_do_msgoutdone,
-        esp_do_cmdbegin,
-        esp_do_cmddone,
-        esp_do_status,
-        esp_do_freebus,
-        esp_do_phase_determine,
-        esp_bus_unexpected,
-        esp_bus_unexpected,
-        esp_bus_unexpected,
-};
-
-/* This is the second tier in our dual-level SCSI state machine. */
-static int esp_work_bus(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr = esp->current_SC;
-        unsigned int phase;
-
-        ESPBUS(("esp_work_bus: "));
-        if (!SCptr) {
-                ESPBUS(("reconnect\n"));
-                return esp_do_reconnect(esp);
-        }
-        phase = SCptr->SCp.phase;
-        if ((phase & 0xf0) == in_phases_mask)
-                return bus_vector[(phase & 0x0f)](esp);
-        else if ((phase & 0xf0) == in_slct_mask)
-                return esp_select_complete(esp);
-        else
-                return esp_bus_unexpected(esp);
-}
-
-static espfunc_t isvc_vector[] = {
-        NULL,
-        esp_do_phase_determine,
-        esp_do_resetbus,
-        esp_finish_reset,
-        esp_work_bus
-};
-
-/* Main interrupt handler for an esp adapter. */
-static void esp_handle(struct esp *esp)
-{
-        struct scsi_cmnd *SCptr;
-        int what_next = do_intr_end;
-
-        SCptr = esp->current_SC;
-
-        /* Check for errors. */
-        esp->sreg = sbus_readb(esp->eregs + ESP_STATUS);
-        esp->sreg &= (~ESP_STAT_INTR);
-        if (esp->erev == fashme) {
-                esp->sreg2 = sbus_readb(esp->eregs + ESP_STATUS2);
-                esp->seqreg = (sbus_readb(esp->eregs + ESP_SSTEP) & ESP_STEP_VBITS);
-        }
-
-        if (esp->sreg & (ESP_STAT_SPAM)) {
-                /* Gross error, could be due to one of:
-                 *
-                 * - top of fifo overwritten, could be because
-                 *   we tried to do a synchronous transfer with
-                 *   an offset greater than ESP fifo size
-                 *
-                 * - top of command register overwritten
-                 *
-                 * - DMA setup to go in one direction, SCSI
-                 *   bus points in the other, whoops
-                 *
-                 * - weird phase change during asynchronous
-                 *   data phase while we are initiator
-                 */
-                ESPLOG(("esp%d: Gross error sreg=%2x\n", esp->esp_id, esp->sreg));
-
-                /* If a command is live on the bus we cannot safely
-                 * reset the bus, so we'll just let the pieces fall
-                 * where they may.  Here we are hoping that the
-                 * target will be able to cleanly go away soon
-                 * so we can safely reset things.
-                 */
-                if (!SCptr) {
-                        ESPLOG(("esp%d: No current cmd during gross error, "
-                                "resetting bus\n", esp->esp_id));
-                        what_next = do_reset_bus;
-                        goto state_machine;
-                }
-        }
-
-        if (sbus_readl(esp->dregs + DMA_CSR) & DMA_HNDL_ERROR) {
-                /* A DMA gate array error.  Here we must
-                 * be seeing one of two things.  Either the
-                 * virtual to physical address translation
-                 * on the SBUS could not occur, else the
-                 * translation it did get pointed to a bogus
-                 * page.  Ho hum...
-                 */
-                ESPLOG(("esp%d: DMA error %08x\n", esp->esp_id,
-                        sbus_readl(esp->dregs + DMA_CSR)));
-
-                /* DMA gate array itself must be reset to clear the
-                 * error condition.
-                 */
-                esp_reset_dma(esp);
-
-                what_next = do_reset_bus;
-                goto state_machine;
-        }
-
-        esp->ireg = sbus_readb(esp->eregs + ESP_INTRPT);   /* Unlatch intr reg */
-
-        if (esp->erev == fashme) {
-                /* This chip is really losing. */
-                ESPHME(("HME["));
-
-                ESPHME(("sreg2=%02x,", esp->sreg2));
-                /* Must latch fifo before reading the interrupt
-                 * register else garbage ends up in the FIFO
-                 * which confuses the driver utterly.
-                 */
-                if (!(esp->sreg2 & ESP_STAT2_FEMPTY) ||
-                    (esp->sreg2 & ESP_STAT2_F1BYTE)) {
-                        ESPHME(("fifo_workaround]"));
-                        hme_fifo_read(esp);
-                } else {
-                        ESPHME(("no_fifo_workaround]"));
-                }
-        }
-
-        /* No current cmd is only valid at this point when there are
-         * commands off the bus or we are trying a reset.
-         */
-        if (!SCptr && !esp->disconnected_SC && !(esp->ireg & ESP_INTR_SR)) {
-                /* Panic is safe, since current_SC is null. */
-                ESPLOG(("esp%d: no command in esp_handle()\n", esp->esp_id));
-                panic("esp_handle: current_SC == penguin within interrupt!");
-        }
-
-        if (esp->ireg & (ESP_INTR_IC)) {
-                /* Illegal command fed to ESP.  Outside of obvious
-                 * software bugs that could cause this, there is
-                 * a condition with esp100 where we can confuse the
-                 * ESP into an erroneous illegal command interrupt
-                 * because it does not scrape the FIFO properly
-                 * for reselection.  See esp100_reconnect_hwbug()
-                 * to see how we try very hard to avoid this.
-                 */
-                ESPLOG(("esp%d: invalid command\n", esp->esp_id));
-
-                esp_dump_state(esp);
-
-                if (SCptr != NULL) {
-                        /* Devices with very buggy firmware can drop BSY
-                         * during a scatter list interrupt when using sync
-                         * mode transfers.  We continue the transfer as
-                         * expected, the target drops the bus, the ESP
-                         * gets confused, and we get a illegal command
-                         * interrupt because the bus is in the disconnected
-                         * state now and ESP_CMD_TI is only allowed when
-                         * a nexus is alive on the bus.
-                         */
-                        ESPLOG(("esp%d: Forcing async and disabling disconnect for "
-                                "target %d\n", esp->esp_id, SCptr->device->id));
-                        SCptr->device->borken = 1; /* foo on you */
-                }
-
-                what_next = do_reset_bus;
-        } else if (!(esp->ireg & ~(ESP_INTR_FDONE | ESP_INTR_BSERV | ESP_INTR_DC))) {
-                if (SCptr) {
-                        unsigned int phase = SCptr->SCp.phase;
-
-                        if (phase & in_phases_mask) {
-                                what_next = esp_work_bus(esp);
-                        } else if (phase & in_slct_mask) {
-                                what_next = esp_select_complete(esp);
-                        } else {
-                                ESPLOG(("esp%d: interrupt for no good reason...\n",
-                                        esp->esp_id));
-                                what_next = do_intr_end;
-                        }
-                } else {
-                        ESPLOG(("esp%d: BSERV or FDONE or DC while SCptr==NULL\n",
-                                esp->esp_id));
-                        what_next = do_reset_bus;
-                }
-        } else if (esp->ireg & ESP_INTR_SR) {
-                ESPLOG(("esp%d: SCSI bus reset interrupt\n", esp->esp_id));
-                what_next = do_reset_complete;
-        } else if (esp->ireg & (ESP_INTR_S | ESP_INTR_SATN)) {
-                ESPLOG(("esp%d: AIEEE we have been selected by another initiator!\n",
-                        esp->esp_id));
-                what_next = do_reset_bus;
-        } else if (esp->ireg & ESP_INTR_RSEL) {
-                if (SCptr == NULL) {
-                        /* This is ok. */
-                        what_next = esp_do_reconnect(esp);
-                } else if (SCptr->SCp.phase & in_slct_mask) {
-                        /* Only selection code knows how to clean
-                         * up properly.
-                         */
-                        ESPDISC(("Reselected during selection attempt\n"));
-                        what_next = esp_select_complete(esp);
-                } else {
-                        ESPLOG(("esp%d: Reselected while bus is busy\n",
-                                esp->esp_id));
-                        what_next = do_reset_bus;
-                }
-        }
-
-        /* This is tier-one in our dual level SCSI state machine. */
-state_machine:
-        while (what_next != do_intr_end) {
-                if (what_next >= do_phase_determine &&
-                    what_next < do_intr_end) {
-                        what_next = isvc_vector[what_next](esp);
-                } else {
-                        /* state is completely lost ;-( */
-                        ESPLOG(("esp%d: interrupt engine loses state, resetting bus\n",
-                                esp->esp_id));
-                        what_next = do_reset_bus;
-                }
-        }
-}
-
-/* Service only the ESP described by dev_id. */
-static irqreturn_t esp_intr(int irq, void *dev_id)
-{
-        struct esp *esp = dev_id;
-        unsigned long flags;
-
-        spin_lock_irqsave(esp->ehost->host_lock, flags);
-        if (ESP_IRQ_P(esp->dregs)) {
-                ESP_INTSOFF(esp->dregs);
-
-                ESPIRQ(("I[%d:%d](", smp_processor_id(), esp->esp_id));
-                esp_handle(esp);
-                ESPIRQ((")"));
-
-                ESP_INTSON(esp->dregs);
-        }
-        spin_unlock_irqrestore(esp->ehost->host_lock, flags);
-
-        return IRQ_HANDLED;
-}
-
-static int esp_slave_alloc(struct scsi_device *SDptr)
-{
-        struct esp_device *esp_dev =
-                kmalloc(sizeof(struct esp_device), GFP_ATOMIC);
-
-        if (!esp_dev)
-                return -ENOMEM;
-        memset(esp_dev, 0, sizeof(struct esp_device));
-        SDptr->hostdata = esp_dev;
-        return 0;
-}
-
-static void esp_slave_destroy(struct scsi_device *SDptr)
-{
-        struct esp *esp = (struct esp *) SDptr->host->hostdata;
-
-        esp->targets_present &= ~(1 << SDptr->id);
-        kfree(SDptr->hostdata);
-        SDptr->hostdata = NULL;
-}
-
-static struct scsi_host_template esp_template = {
-        .module                 = THIS_MODULE,
-        .name                   = "esp",
-        .info                   = esp_info,
-        .slave_alloc            = esp_slave_alloc,
-        .slave_destroy          = esp_slave_destroy,
-        .queuecommand           = esp_queue,
-        .eh_abort_handler       = esp_abort,
-        .eh_bus_reset_handler   = esp_reset,
-        .can_queue              = 7,
-        .this_id                = 7,
-        .sg_tablesize           = SG_ALL,
-        .cmd_per_lun            = 1,
-        .use_clustering         = ENABLE_CLUSTERING,
-        .proc_name              = "esp",
-        .proc_info              = esp_proc_info,
-};
-
-#ifndef CONFIG_SUN4
-static struct of_device_id esp_match[] = {
-        {
-                .name = "SUNW,esp",
-                .data = &esp_template,
-        },
-        {
-                .name = "SUNW,fas",
-                .data = &esp_template,
-        },
-        {
-                .name = "esp",
-                .data = &esp_template,
-        },
-        {},
-};
-MODULE_DEVICE_TABLE(of, esp_match);
-
-static struct of_platform_driver esp_sbus_driver = {
-        .name           = "esp",
-        .match_table    = esp_match,
-        .probe          = esp_sbus_probe,
-        .remove         = __devexit_p(esp_sbus_remove),
-};
-#endif
-
-static int __init esp_init(void)
-{
-#ifdef CONFIG_SUN4
-        return esp_sun4_probe(&esp_template);
-#else
-        return of_register_driver(&esp_sbus_driver, &sbus_bus_type);
-#endif
-}
-
-static void __exit esp_exit(void)
-{
-#ifdef CONFIG_SUN4
-        esp_sun4_remove();
-#else
-        of_unregister_driver(&esp_sbus_driver);
-#endif
-}
-
-MODULE_DESCRIPTION("ESP Sun SCSI driver");
-MODULE_AUTHOR("David S. Miller (davem@davemloft.net)");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(DRV_VERSION);
-
-module_init(esp_init);
-module_exit(esp_exit);
diff --git a/drivers/scsi/esp.h b/drivers/scsi/esp.h
deleted file mode 100644
index a98cda9121fc..000000000000
--- a/drivers/scsi/esp.h
+++ /dev/null
@@ -1,406 +0,0 @@
-/* $Id: esp.h,v 1.29 2001/12/11 04:55:47 davem Exp $
- * esp.h:  Defines and structures for the Sparc ESP (Enhanced SCSI
- *         Processor) driver under Linux.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- */
-
-#ifndef _SPARC_ESP_H
-#define _SPARC_ESP_H
-
-/* For dvma controller register definitions. */
-#include <asm/dma.h>
-
-/* The ESP SCSI controllers have their register sets in three
- * "classes":
- *
- * 1) Registers which are both read and write.
- * 2) Registers which are read only.
- * 3) Registers which are write only.
- *
- * Yet, they all live within the same IO space.
- */
-
-/* All the ESP registers are one byte each and are accessed longwords
- * apart with a big-endian ordering to the bytes.
- */
-                                        /* Access    Description              Offset */
-#define ESP_TCLOW       0x00UL          /* rw  Low bits of the transfer count 0x00   */
-#define ESP_TCMED       0x04UL          /* rw  Mid bits of the transfer count 0x04   */
-#define ESP_FDATA       0x08UL          /* rw  FIFO data bits                 0x08   */
-#define ESP_CMD         0x0cUL          /* rw  SCSI command bits              0x0c   */
-#define ESP_STATUS      0x10UL          /* ro  ESP status register            0x10   */
-#define ESP_BUSID       ESP_STATUS      /* wo  Bus ID for select/reselect     0x10   */
-#define ESP_INTRPT      0x14UL          /* ro  Kind of interrupt              0x14   */
-#define ESP_TIMEO       ESP_INTRPT      /* wo  Timeout value for select/resel 0x14   */
-#define ESP_SSTEP       0x18UL          /* ro  Sequence step register         0x18   */
-#define ESP_STP         ESP_SSTEP       /* wo  Transfer period per sync       0x18   */
-#define ESP_FFLAGS      0x1cUL          /* ro  Bits of current FIFO info      0x1c   */
-#define ESP_SOFF        ESP_FFLAGS      /* wo  Sync offset                    0x1c   */
-#define ESP_CFG1        0x20UL          /* rw  First configuration register   0x20   */
-#define ESP_CFACT       0x24UL          /* wo  Clock conversion factor        0x24   */
-#define ESP_STATUS2     ESP_CFACT       /* ro  HME status2 register           0x24   */
-#define ESP_CTEST       0x28UL          /* wo  Chip test register             0x28   */
-#define ESP_CFG2        0x2cUL          /* rw  Second configuration register  0x2c   */
-#define ESP_CFG3        0x30UL          /* rw  Third configuration register   0x30   */
-#define ESP_TCHI        0x38UL          /* rw  High bits of transfer count    0x38   */
-#define ESP_UID         ESP_TCHI        /* ro  Unique ID code                 0x38   */
-#define FAS_RLO         ESP_TCHI        /* rw  HME extended counter           0x38   */
-#define ESP_FGRND       0x3cUL          /* rw  Data base for fifo             0x3c   */
-#define FAS_RHI         ESP_FGRND       /* rw  HME extended counter           0x3c   */
-#define ESP_REG_SIZE    0x40UL
-
-/* Various revisions of the ESP board. */
-enum esp_rev {
-        esp100     = 0x00,  /* NCR53C90 - very broken */
-        esp100a    = 0x01,  /* NCR53C90A */
-        esp236     = 0x02,
-        fas236     = 0x03,
-        fas100a    = 0x04,
-        fast       = 0x05,
-        fashme     = 0x06,
-        espunknown = 0x07
-};
-
-/* We allocate one of these for each scsi device and attach it to
- * SDptr->hostdata for use in the driver
- */
-struct esp_device {
-  unsigned char sync_min_period;
-  unsigned char sync_max_offset;
-  unsigned sync:1;
-  unsigned wide:1;
-  unsigned disconnect:1;
-};
-
-struct scsi_cmnd;
-
-/* We get one of these for each ESP probed. */
-struct esp {
-        void __iomem            *eregs;         /* ESP controller registers */
-        void __iomem            *dregs;         /* DMA controller registers */
-        struct sbus_dma         *dma;           /* DMA controller sw state */
-        struct Scsi_Host        *ehost;         /* Backpointer to SCSI Host */
-        struct sbus_dev         *sdev;          /* Pointer to SBus entry */
-
-        /* ESP Configuration Registers */
-        u8                      config1;        /* Copy of the 1st config register */
-        u8                      config2;        /* Copy of the 2nd config register */
-        u8                      config3[16];    /* Copy of the 3rd config register */
-
-        /* The current command we are sending to the ESP chip.  This esp_command
-         * ptr needs to be mapped in DVMA area so we can send commands and read
-         * from the ESP fifo without burning precious CPU cycles.  Programmed I/O
-         * sucks when we have the DVMA to do it for us.  The ESP is stupid and will
-         * only send out 6, 10, and 12 byte SCSI commands, others we need to send
-         * one byte at a time.  esp_slowcmd being set says that we are doing one
-         * of the command types ESP doesn't understand, esp_scmdp keeps track of
-         * which byte we are sending, esp_scmdleft says how many bytes to go.
-         */
-        volatile u8             *esp_command;    /* Location of command (CPU view)  */
-        __u32                   esp_command_dvma;/* Location of command (DVMA view) */
-        unsigned char           esp_clen;        /* Length of this command */
-        unsigned char           esp_slowcmd;
-        unsigned char           *esp_scmdp;
-        unsigned char           esp_scmdleft;
-
-        /* The following are used to determine the cause of an IRQ. Upon every
-         * IRQ entry we synchronize these with the hardware registers.
-         */
-        u8                      ireg;           /* Copy of ESP interrupt register */
-        u8                      sreg;           /* Copy of ESP status register */
-        u8                      seqreg;         /* Copy of ESP sequence step register */
-        u8                      sreg2;          /* Copy of HME status2 register */
-
-        /* To save register writes to the ESP, which can be expensive, we
-         * keep track of the previous value that various registers had for
-         * the last target we connected to.  If they are the same for the
-         * current target, we skip the register writes as they are not needed.
-         */
-        u8                      prev_soff, prev_stp;
-        u8                      prev_cfg3, __cache_pad;
-
-        /* We also keep a cache of the previous FAS/HME DMA CSR register value.  */
-        u32                     prev_hme_dmacsr;
-
-        /* The HME is the biggest piece of shit I have ever seen. */
-        u8                      hme_fifo_workaround_buffer[16 * 2];
-        u8                      hme_fifo_workaround_count;
-
-        /* For each target we keep track of save/restore data
-         * pointer information.  This needs to be updated majorly
-         * when we add support for tagged queueing.  -DaveM
-         */
-        struct esp_pointers {
-                char                    *saved_ptr;
-                struct scatterlist      *saved_buffer;
-                int                     saved_this_residual;
-                int                     saved_buffers_residual;
-        } data_pointers[16] /*XXX [MAX_TAGS_PER_TARGET]*/;
-
-        /* Clock periods, frequencies, synchronization, etc. */
-        unsigned int            cfreq;          /* Clock frequency in HZ */
-        unsigned int            cfact;          /* Clock conversion factor */
-        unsigned int            raw_cfact;      /* Raw copy from probing */
-        unsigned int            ccycle;         /* One ESP clock cycle */
-        unsigned int            ctick;          /* One ESP clock time */
-        unsigned int            radelay;        /* FAST chip req/ack delay */
-        unsigned int            neg_defp;       /* Default negotiation period */
-        unsigned int            sync_defp;      /* Default sync transfer period */
-        unsigned int            max_period;     /* longest our period can be */
-        unsigned int            min_period;     /* shortest period we can withstand */
-
-        struct esp              *next;          /* Next ESP we probed or NULL */
-        char                    prom_name[64];  /* Name of ESP device from prom */
-        int                     prom_node;      /* Prom node where ESP found */
-        int                     esp_id;         /* Unique per-ESP ID number */
-
-        /* For slow to medium speed input clock rates we shoot for 5mb/s,
-         * but for high input clock rates we try to do 10mb/s although I
-         * don't think a transfer can even run that fast with an ESP even
-         * with DMA2 scatter gather pipelining.
-         */
-#define SYNC_DEFP_SLOW            0x32   /* 5mb/s  */
-#define SYNC_DEFP_FAST            0x19   /* 10mb/s */
-
-        unsigned int            snip;           /* Sync. negotiation in progress */
-        unsigned int            wnip;           /* WIDE negotiation in progress */
-        unsigned int            targets_present;/* targets spoken to before */
-
-        int             current_transfer_size;  /* Set at beginning of data dma */
-
-        u8                      espcmdlog[32];  /* Log of current esp cmds sent. */
-        u8                      espcmdent;      /* Current entry in esp cmd log. */
-
-        /* Misc. info about this ESP */
-        enum esp_rev            erev;           /* ESP revision */
-        int                     irq;            /* SBus IRQ for this ESP */
-        int                     scsi_id;        /* Who am I as initiator? */
-        int                     scsi_id_mask;   /* Bitmask of 'me'. */
-        int                     diff;           /* Differential SCSI bus? */
-        int                     bursts;         /* Burst sizes our DVMA supports */
-
-        /* Our command queues, only one cmd lives in the current_SC queue. */
-        struct scsi_cmnd        *issue_SC;      /* Commands to be issued */
-        struct scsi_cmnd        *current_SC;    /* Who is currently working the bus */
-        struct scsi_cmnd        *disconnected_SC;/* Commands disconnected from the bus */
-
-        /* Message goo */
-        u8                      cur_msgout[16];
-        u8                      cur_msgin[16];
-        u8                      prevmsgout, prevmsgin;
-        u8                      msgout_len, msgin_len;
-        u8                      msgout_ctr, msgin_ctr;
-
-        /* States that we cannot keep in the per cmd structure because they
-         * cannot be assosciated with any specific command.
-         */
-        u8                      resetting_bus;
-        wait_queue_head_t       reset_queue;
-};
-
-/* Bitfield meanings for the above registers. */
-
-/* ESP config reg 1, read-write, found on all ESP chips */
-#define ESP_CONFIG1_ID        0x07             /* My BUS ID bits */
-#define ESP_CONFIG1_CHTEST    0x08             /* Enable ESP chip tests */
-#define ESP_CONFIG1_PENABLE   0x10             /* Enable parity checks */
-#define ESP_CONFIG1_PARTEST   0x20             /* Parity test mode enabled? */
-#define ESP_CONFIG1_SRRDISAB  0x40             /* Disable SCSI reset reports */
-#define ESP_CONFIG1_SLCABLE   0x80             /* Enable slow cable mode */
-
-/* ESP config reg 2, read-write, found only on esp100a+esp200+esp236 chips */
-#define ESP_CONFIG2_DMAPARITY 0x01             /* enable DMA Parity (200,236) */
-#define ESP_CONFIG2_REGPARITY 0x02             /* enable reg Parity (200,236) */
-#define ESP_CONFIG2_BADPARITY 0x04             /* Bad parity target abort  */
-#define ESP_CONFIG2_SCSI2ENAB 0x08             /* Enable SCSI-2 features (tmode only) */
-#define ESP_CONFIG2_HI        0x10             /* High Impedance DREQ ???  */
-#define ESP_CONFIG2_HMEFENAB  0x10             /* HME features enable */
-#define ESP_CONFIG2_BCM       0x20             /* Enable byte-ctrl (236)   */
-#define ESP_CONFIG2_DISPINT   0x20             /* Disable pause irq (hme) */
-#define ESP_CONFIG2_FENAB     0x40             /* Enable features (fas100,esp216)      */
-#define ESP_CONFIG2_SPL       0x40             /* Enable status-phase latch (esp236)   */
-#define ESP_CONFIG2_MKDONE    0x40             /* HME magic feature */
-#define ESP_CONFIG2_HME32     0x80             /* HME 32 extended */
-#define ESP_CONFIG2_MAGIC     0xe0             /* Invalid bits... */
-
-/* ESP config register 3 read-write, found only esp236+fas236+fas100a+hme chips */
-#define ESP_CONFIG3_FCLOCK    0x01             /* FAST SCSI clock rate (esp100a/hme) */
-#define ESP_CONFIG3_TEM       0x01             /* Enable thresh-8 mode (esp/fas236)  */
-#define ESP_CONFIG3_FAST      0x02             /* Enable FAST SCSI     (esp100a/hme) */
-#define ESP_CONFIG3_ADMA      0x02             /* Enable alternate-dma (esp/fas236)  */
-#define ESP_CONFIG3_TENB      0x04             /* group2 SCSI2 support (esp100a/hme) */
-#define ESP_CONFIG3_SRB       0x04             /* Save residual byte   (esp/fas236)  */
-#define ESP_CONFIG3_TMS       0x08             /* Three-byte msg's ok  (esp100a/hme) */
-#define ESP_CONFIG3_FCLK      0x08             /* Fast SCSI clock rate (esp/fas236)  */
-#define ESP_CONFIG3_IDMSG     0x10             /* ID message checking  (esp100a/hme) */
-#define ESP_CONFIG3_FSCSI     0x10             /* Enable FAST SCSI     (esp/fas236)  */
-#define ESP_CONFIG3_GTM       0x20             /* group2 SCSI2 support (esp/fas236)  */
-#define ESP_CONFIG3_IDBIT3    0x20             /* Bit 3 of HME SCSI-ID (hme)         */
-#define ESP_CONFIG3_TBMS      0x40             /* Three-byte msg's ok  (esp/fas236)  */
-#define ESP_CONFIG3_EWIDE     0x40             /* Enable Wide-SCSI     (hme)         */
-#define ESP_CONFIG3_IMS       0x80             /* ID msg chk'ng        (esp/fas236)  */
-#define ESP_CONFIG3_OBPUSH    0x80             /* Push odd-byte to dma (hme)         */
-
-/* ESP command register read-write */
-/* Group 1 commands:  These may be sent at any point in time to the ESP
- *                    chip.  None of them can generate interrupts 'cept
- *                    the "SCSI bus reset" command if you have not disabled
- *                    SCSI reset interrupts in the config1 ESP register.
- */
-#define ESP_CMD_NULL          0x00             /* Null command, ie. a nop */
-#define ESP_CMD_FLUSH         0x01             /* FIFO Flush */
-#define ESP_CMD_RC            0x02             /* Chip reset */
-#define ESP_CMD_RS            0x03             /* SCSI bus reset */
-
-/* Group 2 commands:  ESP must be an initiator and connected to a target
- *                    for these commands to work.
- */
-#define ESP_CMD_TI            0x10             /* Transfer Information */
-#define ESP_CMD_ICCSEQ        0x11             /* Initiator cmd complete sequence */
-#define ESP_CMD_MOK           0x12             /* Message okie-dokie */
-#define ESP_CMD_TPAD          0x18             /* Transfer Pad */
-#define ESP_CMD_SATN          0x1a             /* Set ATN */
-#define ESP_CMD_RATN          0x1b             /* De-assert ATN */
-
-/* Group 3 commands:  ESP must be in the MSGOUT or MSGIN state and be connected
- *                    to a target as the initiator for these commands to work.
- */
-#define ESP_CMD_SMSG          0x20             /* Send message */
-#define ESP_CMD_SSTAT         0x21             /* Send status */
-#define ESP_CMD_SDATA         0x22             /* Send data */
-#define ESP_CMD_DSEQ          0x23             /* Discontinue Sequence */
-#define ESP_CMD_TSEQ          0x24             /* Terminate Sequence */
-#define ESP_CMD_TCCSEQ        0x25             /* Target cmd cmplt sequence */
-#define ESP_CMD_DCNCT         0x27             /* Disconnect */
-#define ESP_CMD_RMSG          0x28             /* Receive Message */
-#define ESP_CMD_RCMD          0x29             /* Receive Command */
-#define ESP_CMD_RDATA         0x2a             /* Receive Data */
-#define ESP_CMD_RCSEQ         0x2b             /* Receive cmd sequence */
-
-/* Group 4 commands:  The ESP must be in the disconnected state and must
- *                    not be connected to any targets as initiator for
- *                    these commands to work.
- */
-#define ESP_CMD_RSEL          0x40             /* Reselect */
-#define ESP_CMD_SEL           0x41             /* Select w/o ATN */
-#define ESP_CMD_SELA          0x42             /* Select w/ATN */
-#define ESP_CMD_SELAS         0x43             /* Select w/ATN & STOP */
-#define ESP_CMD_ESEL          0x44             /* Enable selection */
-#define ESP_CMD_DSEL          0x45             /* Disable selections */
-#define ESP_CMD_SA3           0x46             /* Select w/ATN3 */
-#define ESP_CMD_RSEL3         0x47             /* Reselect3 */
-
-/* This bit enables the ESP's DMA on the SBus */
-#define ESP_CMD_DMA           0x80             /* Do DMA? */
-
-
-/* ESP status register read-only */
-#define ESP_STAT_PIO          0x01             /* IO phase bit */
-#define ESP_STAT_PCD          0x02             /* CD phase bit */
-#define ESP_STAT_PMSG         0x04             /* MSG phase bit */
-#define ESP_STAT_PMASK        0x07             /* Mask of phase bits */
-#define ESP_STAT_TDONE        0x08             /* Transfer Completed */
-#define ESP_STAT_TCNT         0x10             /* Transfer Counter Is Zero */
-#define ESP_STAT_PERR         0x20             /* Parity error */
-#define ESP_STAT_SPAM         0x40             /* Real bad error */
-/* This indicates the 'interrupt pending' condition on esp236, it is a reserved
- * bit on other revs of the ESP.
- */
-#define ESP_STAT_INTR         0x80             /* Interrupt */
-
-/* HME only: status 2 register */
-#define ESP_STAT2_SCHBIT      0x01 /* Upper bits 3-7 of sstep enabled */
-#define ESP_STAT2_FFLAGS      0x02 /* The fifo flags are now latched */
-#define ESP_STAT2_XCNT        0x04 /* The transfer counter is latched */
-#define ESP_STAT2_CREGA       0x08 /* The command reg is active now */
-#define ESP_STAT2_WIDE        0x10 /* Interface on this adapter is wide */
-#define ESP_STAT2_F1BYTE      0x20 /* There is one byte at top of fifo */
-#define ESP_STAT2_FMSB        0x40 /* Next byte in fifo is most significant */
-#define ESP_STAT2_FEMPTY      0x80 /* FIFO is empty */
-
-/* The status register can be masked with ESP_STAT_PMASK and compared
- * with the following values to determine the current phase the ESP
- * (at least thinks it) is in.  For our purposes we also add our own
- * software 'done' bit for our phase management engine.
- */
-#define ESP_DOP   (0)                                       /* Data Out  */
-#define ESP_DIP   (ESP_STAT_PIO)                            /* Data In   */
-#define ESP_CMDP  (ESP_STAT_PCD)                            /* Command   */
-#define ESP_STATP (ESP_STAT_PCD|ESP_STAT_PIO)               /* Status    */
-#define ESP_MOP   (ESP_STAT_PMSG|ESP_STAT_PCD)              /* Message Out */
-#define ESP_MIP   (ESP_STAT_PMSG|ESP_STAT_PCD|ESP_STAT_PIO) /* Message In */
-
-/* ESP interrupt register read-only */
-#define ESP_INTR_S            0x01             /* Select w/o ATN */
-#define ESP_INTR_SATN         0x02             /* Select w/ATN */
-#define ESP_INTR_RSEL         0x04             /* Reselected */
-#define ESP_INTR_FDONE        0x08             /* Function done */
-#define ESP_INTR_BSERV        0x10             /* Bus service */
-#define ESP_INTR_DC           0x20             /* Disconnect */
-#define ESP_INTR_IC           0x40             /* Illegal command given */
-#define ESP_INTR_SR           0x80             /* SCSI bus reset detected */
-
-/* Interrupt status macros */
-#define ESP_SRESET_IRQ(esp)  ((esp)->intreg & (ESP_INTR_SR))
-#define ESP_ILLCMD_IRQ(esp)  ((esp)->intreg & (ESP_INTR_IC))
-#define ESP_SELECT_WITH_ATN_IRQ(esp)     ((esp)->intreg & (ESP_INTR_SATN))
-#define ESP_SELECT_WITHOUT_ATN_IRQ(esp)  ((esp)->intreg & (ESP_INTR_S))
-#define ESP_SELECTION_IRQ(esp)  ((ESP_SELECT_WITH_ATN_IRQ(esp)) ||         \
-                                 (ESP_SELECT_WITHOUT_ATN_IRQ(esp)))
-#define ESP_RESELECTION_IRQ(esp)         ((esp)->intreg & (ESP_INTR_RSEL))
-
-/* ESP sequence step register read-only */
-#define ESP_STEP_VBITS        0x07             /* Valid bits */
-#define ESP_STEP_ASEL         0x00             /* Selection&Arbitrate cmplt */
-#define ESP_STEP_SID          0x01             /* One msg byte sent */
-#define ESP_STEP_NCMD         0x02             /* Was not in command phase */
-#define ESP_STEP_PPC          0x03             /* Early phase chg caused cmnd
-                                                * bytes to be lost
-                                                */
-#define ESP_STEP_FINI4        0x04             /* Command was sent ok */
-
-/* Ho hum, some ESP's set the step register to this as well... */
-#define ESP_STEP_FINI5        0x05
-#define ESP_STEP_FINI6        0x06
-#define ESP_STEP_FINI7        0x07
-
-/* ESP chip-test register read-write */
-#define ESP_TEST_TARG         0x01             /* Target test mode */
-#define ESP_TEST_INI          0x02             /* Initiator test mode */
-#define ESP_TEST_TS           0x04             /* Tristate test mode */
-
-/* ESP unique ID register read-only, found on fas236+fas100a only */
-#define ESP_UID_F100A         0x00             /* ESP FAS100A  */
-#define ESP_UID_F236          0x02             /* ESP FAS236   */
-#define ESP_UID_REV           0x07             /* ESP revision */
-#define ESP_UID_FAM           0xf8             /* ESP family   */
-
-/* ESP fifo flags register read-only */
-/* Note that the following implies a 16 byte FIFO on the ESP. */
-#define ESP_FF_FBYTES         0x1f             /* Num bytes in FIFO */
-#define ESP_FF_ONOTZERO       0x20             /* offset ctr not zero (esp100) */
-#define ESP_FF_SSTEP          0xe0             /* Sequence step */
-
-/* ESP clock conversion factor register write-only */
-#define ESP_CCF_F0            0x00             /* 35.01MHz - 40MHz */
-#define ESP_CCF_NEVER         0x01             /* Set it to this and die */
-#define ESP_CCF_F2            0x02             /* 10MHz */
-#define ESP_CCF_F3            0x03             /* 10.01MHz - 15MHz */
-#define ESP_CCF_F4            0x04             /* 15.01MHz - 20MHz */
-#define ESP_CCF_F5            0x05             /* 20.01MHz - 25MHz */
-#define ESP_CCF_F6            0x06             /* 25.01MHz - 30MHz */
-#define ESP_CCF_F7            0x07             /* 30.01MHz - 35MHz */
-
-/* HME only... */
-#define ESP_BUSID_RESELID     0x10
-#define ESP_BUSID_CTR32BIT    0x40
-
-#define ESP_BUS_TIMEOUT        275             /* In milli-seconds */
-#define ESP_TIMEO_CONST       8192
-#define ESP_NEG_DEFP(mhz, cfact) \
-        ((ESP_BUS_TIMEOUT * ((mhz) / 1000)) / (8192 * (cfact)))
-#define ESP_MHZ_TO_CYCLE(mhertz)  ((1000000000) / ((mhertz) / 1000))
-#define ESP_TICK(ccf, cycle)  ((7682 * (ccf) * (cycle) / 1000))
-
-#endif /* !(_SPARC_ESP_H) */
diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
new file mode 100644
index 000000000000..3cd5bf723da4
--- /dev/null
+++ b/drivers/scsi/esp_scsi.c
@@ -0,0 +1,2710 @@
+/* esp_scsi.c: ESP SCSI driver.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/list.h>
+#include <linux/completion.h>
+#include <linux/kallsyms.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+
+#include <asm/irq.h>
+#include <asm/io.h>
+#include <asm/dma.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_tcq.h>
+#include <scsi/scsi_dbg.h>
+#include <scsi/scsi_transport_spi.h>
+
+#include "esp_scsi.h"
+
+#define DRV_MODULE_NAME         "esp"
+#define PFX DRV_MODULE_NAME     ": "
+#define DRV_VERSION             "2.000"
+#define DRV_MODULE_RELDATE      "April 19, 2007"
+
+/* SCSI bus reset settle time in seconds.  */
+static int esp_bus_reset_settle = 3;
+
+static u32 esp_debug;
+#define ESP_DEBUG_INTR          0x00000001
+#define ESP_DEBUG_SCSICMD       0x00000002
+#define ESP_DEBUG_RESET         0x00000004
+#define ESP_DEBUG_MSGIN         0x00000008
+#define ESP_DEBUG_MSGOUT        0x00000010
+#define ESP_DEBUG_CMDDONE       0x00000020
+#define ESP_DEBUG_DISCONNECT    0x00000040
+#define ESP_DEBUG_DATASTART     0x00000080
+#define ESP_DEBUG_DATADONE      0x00000100
+#define ESP_DEBUG_RECONNECT     0x00000200
+#define ESP_DEBUG_AUTOSENSE     0x00000400
+
+#define esp_log_intr(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_INTR) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_reset(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_RESET) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_msgin(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_MSGIN) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_msgout(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_MSGOUT) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_cmddone(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_CMDDONE) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_disconnect(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_DISCONNECT) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_datastart(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_DATASTART) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_datadone(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_DATADONE) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_reconnect(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_RECONNECT) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_log_autosense(f, a...) \
+do {    if (esp_debug & ESP_DEBUG_AUTOSENSE) \
+                printk(f, ## a); \
+} while (0)
+
+#define esp_read8(REG)          esp->ops->esp_read8(esp, REG)
+#define esp_write8(VAL,REG)     esp->ops->esp_write8(esp, VAL, REG)
+
+static void esp_log_fill_regs(struct esp *esp,
+                              struct esp_event_ent *p)
+{
+        p->sreg = esp->sreg;
+        p->seqreg = esp->seqreg;
+        p->sreg2 = esp->sreg2;
+        p->ireg = esp->ireg;
+        p->select_state = esp->select_state;
+        p->event = esp->event;
+}
+
+void scsi_esp_cmd(struct esp *esp, u8 val)
+{
+        struct esp_event_ent *p;
+        int idx = esp->esp_event_cur;
+
+        p = &esp->esp_event_log[idx];
+        p->type = ESP_EVENT_TYPE_CMD;
+        p->val = val;
+        esp_log_fill_regs(esp, p);
+
+        esp->esp_event_cur = (idx + 1) & (ESP_EVENT_LOG_SZ - 1);
+
+        esp_write8(val, ESP_CMD);
+}
+EXPORT_SYMBOL(scsi_esp_cmd);
+
+static void esp_event(struct esp *esp, u8 val)
+{
+        struct esp_event_ent *p;
+        int idx = esp->esp_event_cur;
+
+        p = &esp->esp_event_log[idx];
+        p->type = ESP_EVENT_TYPE_EVENT;
+        p->val = val;
+        esp_log_fill_regs(esp, p);
+
+        esp->esp_event_cur = (idx + 1) & (ESP_EVENT_LOG_SZ - 1);
+
+        esp->event = val;
+}
+
+static void esp_dump_cmd_log(struct esp *esp)
+{
+        int idx = esp->esp_event_cur;
+        int stop = idx;
+
+        printk(KERN_INFO PFX "esp%d: Dumping command log\n",
+               esp->host->unique_id);
+        do {
+                struct esp_event_ent *p = &esp->esp_event_log[idx];
+
+                printk(KERN_INFO PFX "esp%d: ent[%d] %s ",
+                       esp->host->unique_id, idx,
+                       p->type == ESP_EVENT_TYPE_CMD ? "CMD" : "EVENT");
+
+                printk("val[%02x] sreg[%02x] seqreg[%02x] "
+                       "sreg2[%02x] ireg[%02x] ss[%02x] event[%02x]\n",
+                       p->val, p->sreg, p->seqreg,
+                       p->sreg2, p->ireg, p->select_state, p->event);
+
+                idx = (idx + 1) & (ESP_EVENT_LOG_SZ - 1);
+        } while (idx != stop);
+}
+
+static void esp_flush_fifo(struct esp *esp)
+{
+        scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+        if (esp->rev == ESP236) {
+                int lim = 1000;
+
+                while (esp_read8(ESP_FFLAGS) & ESP_FF_FBYTES) {
+                        if (--lim == 0) {
+                                printk(KERN_ALERT PFX "esp%d: ESP_FF_BYTES "
+                                       "will not clear!\n",
+                                       esp->host->unique_id);
+                                break;
+                        }
+                        udelay(1);
+                }
+        }
+}
+
+static void hme_read_fifo(struct esp *esp)
+{
+        int fcnt = esp_read8(ESP_FFLAGS) & ESP_FF_FBYTES;
+        int idx = 0;
+
+        while (fcnt--) {
+                esp->fifo[idx++] = esp_read8(ESP_FDATA);
+                esp->fifo[idx++] = esp_read8(ESP_FDATA);
+        }
+        if (esp->sreg2 & ESP_STAT2_F1BYTE) {
+                esp_write8(0, ESP_FDATA);
+                esp->fifo[idx++] = esp_read8(ESP_FDATA);
+                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+        }
+        esp->fifo_cnt = idx;
+}
+
+static void esp_set_all_config3(struct esp *esp, u8 val)
+{
+        int i;
+
+        for (i = 0; i < ESP_MAX_TARGET; i++)
+                esp->target[i].esp_config3 = val;
+}
+
+/* Reset the ESP chip, _not_ the SCSI bus. */
+static void esp_reset_esp(struct esp *esp)
+{
+        u8 family_code, version;
+
+        /* Now reset the ESP chip */
+        scsi_esp_cmd(esp, ESP_CMD_RC);
+        scsi_esp_cmd(esp, ESP_CMD_NULL | ESP_CMD_DMA);
+        scsi_esp_cmd(esp, ESP_CMD_NULL | ESP_CMD_DMA);
+
+        /* Reload the configuration registers */
+        esp_write8(esp->cfact, ESP_CFACT);
+
+        esp->prev_stp = 0;
+        esp_write8(esp->prev_stp, ESP_STP);
+
+        esp->prev_soff = 0;
+        esp_write8(esp->prev_soff, ESP_SOFF);
+
+        esp_write8(esp->neg_defp, ESP_TIMEO);
+
+        /* This is the only point at which it is reliable to read
+         * the ID-code for a fast ESP chip variants.
+         */
+        esp->max_period = ((35 * esp->ccycle) / 1000);
+        if (esp->rev == FAST) {
+                version = esp_read8(ESP_UID);
+                family_code = (version & 0xf8) >> 3;
+                if (family_code == 0x02)
+                        esp->rev = FAS236;
+                else if (family_code == 0x0a)
+                        esp->rev = FASHME; /* Version is usually '5'. */
+                else
+                        esp->rev = FAS100A;
+                esp->min_period = ((4 * esp->ccycle) / 1000);
+        } else {
+                esp->min_period = ((5 * esp->ccycle) / 1000);
+        }
+        esp->max_period = (esp->max_period + 3)>>2;
+        esp->min_period = (esp->min_period + 3)>>2;
+
+        esp_write8(esp->config1, ESP_CFG1);
+        switch (esp->rev) {
+        case ESP100:
+                /* nothing to do */
+                break;
+
+        case ESP100A:
+                esp_write8(esp->config2, ESP_CFG2);
+                break;
+
+        case ESP236:
+                /* Slow 236 */
+                esp_write8(esp->config2, ESP_CFG2);
+                esp->prev_cfg3 = esp->target[0].esp_config3;
+                esp_write8(esp->prev_cfg3, ESP_CFG3);
+                break;
+
+        case FASHME:
+                esp->config2 |= (ESP_CONFIG2_HME32 | ESP_CONFIG2_HMEFENAB);
+                /* fallthrough... */
+
+        case FAS236:
+                /* Fast 236 or HME */
+                esp_write8(esp->config2, ESP_CFG2);
+                if (esp->rev == FASHME) {
+                        u8 cfg3 = esp->target[0].esp_config3;
+
+                        cfg3 |= ESP_CONFIG3_FCLOCK | ESP_CONFIG3_OBPUSH;
+                        if (esp->scsi_id >= 8)
+                                cfg3 |= ESP_CONFIG3_IDBIT3;
+                        esp_set_all_config3(esp, cfg3);
+                } else {
+                        u32 cfg3 = esp->target[0].esp_config3;
+
+                        cfg3 |= ESP_CONFIG3_FCLK;
+                        esp_set_all_config3(esp, cfg3);
+                }
+                esp->prev_cfg3 = esp->target[0].esp_config3;
+                esp_write8(esp->prev_cfg3, ESP_CFG3);
+                if (esp->rev == FASHME) {
+                        esp->radelay = 80;
+                } else {
+                        if (esp->flags & ESP_FLAG_DIFFERENTIAL)
+                                esp->radelay = 0;
+                        else
+                                esp->radelay = 96;
+                }
+                break;
+
+        case FAS100A:
+                /* Fast 100a */
+                esp_write8(esp->config2, ESP_CFG2);
+                esp_set_all_config3(esp,
+                                    (esp->target[0].esp_config3 |
+                                     ESP_CONFIG3_FCLOCK));
+                esp->prev_cfg3 = esp->target[0].esp_config3;
+                esp_write8(esp->prev_cfg3, ESP_CFG3);
+                esp->radelay = 32;
+                break;
+
+        default:
+                break;
+        }
+
+        /* Eat any bitrot in the chip */
+        esp_read8(ESP_INTRPT);
+        udelay(100);
+}
+
+static void esp_map_dma(struct esp *esp, struct scsi_cmnd *cmd)
+{
+        struct esp_cmd_priv *spriv = ESP_CMD_PRIV(cmd);
+        struct scatterlist *sg = cmd->request_buffer;
+        int dir = cmd->sc_data_direction;
+        int total, i;
+
+        if (dir == DMA_NONE)
+                return;
+
+        BUG_ON(cmd->use_sg == 0);
+
+        spriv->u.num_sg = esp->ops->map_sg(esp, sg,
+                                           cmd->use_sg, dir);
+        spriv->cur_residue = sg_dma_len(sg);
+        spriv->cur_sg = sg;
+
+        total = 0;
+        for (i = 0; i < spriv->u.num_sg; i++)
+                total += sg_dma_len(&sg[i]);
+        spriv->tot_residue = total;
+}
+
+static dma_addr_t esp_cur_dma_addr(struct esp_cmd_entry *ent,
+                                   struct scsi_cmnd *cmd)
+{
+        struct esp_cmd_priv *p = ESP_CMD_PRIV(cmd);
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                return ent->sense_dma +
+                        (ent->sense_ptr - cmd->sense_buffer);
+        }
+
+        return sg_dma_address(p->cur_sg) +
+                (sg_dma_len(p->cur_sg) -
+                 p->cur_residue);
+}
+
+static unsigned int esp_cur_dma_len(struct esp_cmd_entry *ent,
+                                    struct scsi_cmnd *cmd)
+{
+        struct esp_cmd_priv *p = ESP_CMD_PRIV(cmd);
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                return SCSI_SENSE_BUFFERSIZE -
+                        (ent->sense_ptr - cmd->sense_buffer);
+        }
+        return p->cur_residue;
+}
+
+static void esp_advance_dma(struct esp *esp, struct esp_cmd_entry *ent,
+                            struct scsi_cmnd *cmd, unsigned int len)
+{
+        struct esp_cmd_priv *p = ESP_CMD_PRIV(cmd);
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                ent->sense_ptr += len;
+                return;
+        }
+
+        p->cur_residue -= len;
+        p->tot_residue -= len;
+        if (p->cur_residue < 0 || p->tot_residue < 0) {
+                printk(KERN_ERR PFX "esp%d: Data transfer overflow.\n",
+                       esp->host->unique_id);
+                printk(KERN_ERR PFX "esp%d: cur_residue[%d] tot_residue[%d] "
+                       "len[%u]\n",
+                       esp->host->unique_id,
+                       p->cur_residue, p->tot_residue, len);
+                p->cur_residue = 0;
+                p->tot_residue = 0;
+        }
+        if (!p->cur_residue && p->tot_residue) {
+                p->cur_sg++;
+                p->cur_residue = sg_dma_len(p->cur_sg);
+        }
+}
+
+static void esp_unmap_dma(struct esp *esp, struct scsi_cmnd *cmd)
+{
+        struct esp_cmd_priv *spriv = ESP_CMD_PRIV(cmd);
+        int dir = cmd->sc_data_direction;
+
+        if (dir == DMA_NONE)
+                return;
+
+        esp->ops->unmap_sg(esp, cmd->request_buffer,
+                           spriv->u.num_sg, dir);
+}
+
+static void esp_save_pointers(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        struct scsi_cmnd *cmd = ent->cmd;
+        struct esp_cmd_priv *spriv = ESP_CMD_PRIV(cmd);
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                ent->saved_sense_ptr = ent->sense_ptr;
+                return;
+        }
+        ent->saved_cur_residue = spriv->cur_residue;
+        ent->saved_cur_sg = spriv->cur_sg;
+        ent->saved_tot_residue = spriv->tot_residue;
+}
+
+static void esp_restore_pointers(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        struct scsi_cmnd *cmd = ent->cmd;
+        struct esp_cmd_priv *spriv = ESP_CMD_PRIV(cmd);
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                ent->sense_ptr = ent->saved_sense_ptr;
+                return;
+        }
+        spriv->cur_residue = ent->saved_cur_residue;
+        spriv->cur_sg = ent->saved_cur_sg;
+        spriv->tot_residue = ent->saved_tot_residue;
+}
+
+static void esp_check_command_len(struct esp *esp, struct scsi_cmnd *cmd)
+{
+        if (cmd->cmd_len == 6 ||
+            cmd->cmd_len == 10 ||
+            cmd->cmd_len == 12) {
+                esp->flags &= ~ESP_FLAG_DOING_SLOWCMD;
+        } else {
+                esp->flags |= ESP_FLAG_DOING_SLOWCMD;
+        }
+}
+
+static void esp_write_tgt_config3(struct esp *esp, int tgt)
+{
+        if (esp->rev > ESP100A) {
+                u8 val = esp->target[tgt].esp_config3;
+
+                if (val != esp->prev_cfg3) {
+                        esp->prev_cfg3 = val;
+                        esp_write8(val, ESP_CFG3);
+                }
+        }
+}
+
+static void esp_write_tgt_sync(struct esp *esp, int tgt)
+{
+        u8 off = esp->target[tgt].esp_offset;
+        u8 per = esp->target[tgt].esp_period;
+
+        if (off != esp->prev_soff) {
+                esp->prev_soff = off;
+                esp_write8(off, ESP_SOFF);
+        }
+        if (per != esp->prev_stp) {
+                esp->prev_stp = per;
+                esp_write8(per, ESP_STP);
+        }
+}
+
+static u32 esp_dma_length_limit(struct esp *esp, u32 dma_addr, u32 dma_len)
+{
+        if (esp->rev == FASHME) {
+                /* Arbitrary segment boundaries, 24-bit counts.  */
+                if (dma_len > (1U << 24))
+                        dma_len = (1U << 24);
+        } else {
+                u32 base, end;
+
+                /* ESP chip limits other variants by 16-bits of transfer
+                 * count.  Actually on FAS100A and FAS236 we could get
+                 * 24-bits of transfer count by enabling ESP_CONFIG2_FENAB
+                 * in the ESP_CFG2 register but that causes other unwanted
+                 * changes so we don't use it currently.
+                 */
+                if (dma_len > (1U << 16))
+                        dma_len = (1U << 16);
+
+                /* All of the DMA variants hooked up to these chips
+                 * cannot handle crossing a 24-bit address boundary.
+                 */
+                base = dma_addr & ((1U << 24) - 1U);
+                end = base + dma_len;
+                if (end > (1U << 24))
+                        end = (1U <<24);
+                dma_len = end - base;
+        }
+        return dma_len;
+}
+
+static int esp_need_to_nego_wide(struct esp_target_data *tp)
+{
+        struct scsi_target *target = tp->starget;
+
+        return spi_width(target) != tp->nego_goal_width;
+}
+
+static int esp_need_to_nego_sync(struct esp_target_data *tp)
+{
+        struct scsi_target *target = tp->starget;
+
+        /* When offset is zero, period is "don't care".  */
+        if (!spi_offset(target) && !tp->nego_goal_offset)
+                return 0;
+
+        if (spi_offset(target) == tp->nego_goal_offset &&
+            spi_period(target) == tp->nego_goal_period)
+                return 0;
+
+        return 1;
+}
+
+static int esp_alloc_lun_tag(struct esp_cmd_entry *ent,
+                             struct esp_lun_data *lp)
+{
+        if (!ent->tag[0]) {
+                /* Non-tagged, slot already taken?  */
+                if (lp->non_tagged_cmd)
+                        return -EBUSY;
+
+                if (lp->hold) {
+                        /* We are being held by active tagged
+                         * commands.
+                         */
+                        if (lp->num_tagged)
+                                return -EBUSY;
+
+                        /* Tagged commands completed, we can unplug
+                         * the queue and run this untagged command.
+                         */
+                        lp->hold = 0;
+                } else if (lp->num_tagged) {
+                        /* Plug the queue until num_tagged decreases
+                         * to zero in esp_free_lun_tag.
+                         */
+                        lp->hold = 1;
+                        return -EBUSY;
+                }
+
+                lp->non_tagged_cmd = ent;
+                return 0;
+        } else {
+                /* Tagged command, see if blocked by a
+                 * non-tagged one.
+                 */
+                if (lp->non_tagged_cmd || lp->hold)
+                        return -EBUSY;
+        }
+
+        BUG_ON(lp->tagged_cmds[ent->tag[1]]);
+
+        lp->tagged_cmds[ent->tag[1]] = ent;
+        lp->num_tagged++;
+
+        return 0;
+}
+
+static void esp_free_lun_tag(struct esp_cmd_entry *ent,
+                             struct esp_lun_data *lp)
+{
+        if (ent->tag[0]) {
+                BUG_ON(lp->tagged_cmds[ent->tag[1]] != ent);
+                lp->tagged_cmds[ent->tag[1]] = NULL;
+                lp->num_tagged--;
+        } else {
+                BUG_ON(lp->non_tagged_cmd != ent);
+                lp->non_tagged_cmd = NULL;
+        }
+}
+
+/* When a contingent allegiance conditon is created, we force feed a
+ * REQUEST_SENSE command to the device to fetch the sense data.  I
+ * tried many other schemes, relying on the scsi error handling layer
+ * to send out the REQUEST_SENSE automatically, but this was difficult
+ * to get right especially in the presence of applications like smartd
+ * which use SG_IO to send out their own REQUEST_SENSE commands.
+ */
+static void esp_autosense(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        struct scsi_cmnd *cmd = ent->cmd;
+        struct scsi_device *dev = cmd->device;
+        int tgt, lun;
+        u8 *p, val;
+
+        tgt = dev->id;
+        lun = dev->lun;
+
+
+        if (!ent->sense_ptr) {
+                esp_log_autosense("esp%d: Doing auto-sense for "
+                                  "tgt[%d] lun[%d]\n",
+                                  esp->host->unique_id, tgt, lun);
+
+                ent->sense_ptr = cmd->sense_buffer;
+                ent->sense_dma = esp->ops->map_single(esp,
+                                                      ent->sense_ptr,
+                                                      SCSI_SENSE_BUFFERSIZE,
+                                                      DMA_FROM_DEVICE);
+        }
+        ent->saved_sense_ptr = ent->sense_ptr;
+
+        esp->active_cmd = ent;
+
+        p = esp->command_block;
+        esp->msg_out_len = 0;
+
+        *p++ = IDENTIFY(0, lun);
+        *p++ = REQUEST_SENSE;
+        *p++ = ((dev->scsi_level <= SCSI_2) ?
+                (lun << 5) : 0);
+        *p++ = 0;
+        *p++ = 0;
+        *p++ = SCSI_SENSE_BUFFERSIZE;
+        *p++ = 0;
+
+        esp->select_state = ESP_SELECT_BASIC;
+
+        val = tgt;
+        if (esp->rev == FASHME)
+                val |= ESP_BUSID_RESELID | ESP_BUSID_CTR32BIT;
+        esp_write8(val, ESP_BUSID);
+
+        esp_write_tgt_sync(esp, tgt);
+        esp_write_tgt_config3(esp, tgt);
+
+        val = (p - esp->command_block);
+
+        if (esp->rev == FASHME)
+                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+        esp->ops->send_dma_cmd(esp, esp->command_block_dma,
+                               val, 16, 0, ESP_CMD_DMA | ESP_CMD_SELA);
+}
+
+static struct esp_cmd_entry *find_and_prep_issuable_command(struct esp *esp)
+{
+        struct esp_cmd_entry *ent;
+
+        list_for_each_entry(ent, &esp->queued_cmds, list) {
+                struct scsi_cmnd *cmd = ent->cmd;
+                struct scsi_device *dev = cmd->device;
+                struct esp_lun_data *lp = dev->hostdata;
+
+                if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                        ent->tag[0] = 0;
+                        ent->tag[1] = 0;
+                        return ent;
+                }
+
+                if (!scsi_populate_tag_msg(cmd, &ent->tag[0])) {
+                        ent->tag[0] = 0;
+                        ent->tag[1] = 0;
+                }
+
+                if (esp_alloc_lun_tag(ent, lp) < 0)
+                        continue;
+
+                return ent;
+        }
+
+        return NULL;
+}
+
+static void esp_maybe_execute_command(struct esp *esp)
+{
+        struct esp_target_data *tp;
+        struct esp_lun_data *lp;
+        struct scsi_device *dev;
+        struct scsi_cmnd *cmd;
+        struct esp_cmd_entry *ent;
+        int tgt, lun, i;
+        u32 val, start_cmd;
+        u8 *p;
+
+        if (esp->active_cmd ||
+            (esp->flags & ESP_FLAG_RESETTING))
+                return;
+
+        ent = find_and_prep_issuable_command(esp);
+        if (!ent)
+                return;
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                esp_autosense(esp, ent);
+                return;
+        }
+
+        cmd = ent->cmd;
+        dev = cmd->device;
+        tgt = dev->id;
+        lun = dev->lun;
+        tp = &esp->target[tgt];
+        lp = dev->hostdata;
+
+        list_del(&ent->list);
+        list_add(&ent->list, &esp->active_cmds);
+
+        esp->active_cmd = ent;
+
+        esp_map_dma(esp, cmd);
+        esp_save_pointers(esp, ent);
+
+        esp_check_command_len(esp, cmd);
+
+        p = esp->command_block;
+
+        esp->msg_out_len = 0;
+        if (tp->flags & ESP_TGT_CHECK_NEGO) {
+                /* Need to negotiate.  If the target is broken
+                 * go for synchronous transfers and non-wide.
+                 */
+                if (tp->flags & ESP_TGT_BROKEN) {
+                        tp->flags &= ~ESP_TGT_DISCONNECT;
+                        tp->nego_goal_period = 0;
+                        tp->nego_goal_offset = 0;
+                        tp->nego_goal_width = 0;
+                        tp->nego_goal_tags = 0;
+                }
+
+                /* If the settings are not changing, skip this.  */
+                if (spi_width(tp->starget) == tp->nego_goal_width &&
+                    spi_period(tp->starget) == tp->nego_goal_period &&
+                    spi_offset(tp->starget) == tp->nego_goal_offset) {
+                        tp->flags &= ~ESP_TGT_CHECK_NEGO;
+                        goto build_identify;
+                }
+
+                if (esp->rev == FASHME && esp_need_to_nego_wide(tp)) {
+                        esp->msg_out_len =
+                                spi_populate_width_msg(&esp->msg_out[0],
+                                                       (tp->nego_goal_width ?
+                                                        1 : 0));
+                        tp->flags |= ESP_TGT_NEGO_WIDE;
+                } else if (esp_need_to_nego_sync(tp)) {
+                        esp->msg_out_len =
+                                spi_populate_sync_msg(&esp->msg_out[0],
+                                                      tp->nego_goal_period,
+                                                      tp->nego_goal_offset);
+                        tp->flags |= ESP_TGT_NEGO_SYNC;
+                } else {
+                        tp->flags &= ~ESP_TGT_CHECK_NEGO;
+                }
+
+                /* Process it like a slow command.  */
+                if (tp->flags & (ESP_TGT_NEGO_WIDE | ESP_TGT_NEGO_SYNC))
+                        esp->flags |= ESP_FLAG_DOING_SLOWCMD;
+        }
+
+build_identify:
+        /* If we don't have a lun-data struct yet, we're probing
+         * so do not disconnect.  Also, do not disconnect unless
+         * we have a tag on this command.
+         */
+        if (lp && (tp->flags & ESP_TGT_DISCONNECT) && ent->tag[0])
+                *p++ = IDENTIFY(1, lun);
+        else
+                *p++ = IDENTIFY(0, lun);
+
+        if (ent->tag[0] && esp->rev == ESP100) {
+                /* ESP100 lacks select w/atn3 command, use select
+                 * and stop instead.
+                 */
+                esp->flags |= ESP_FLAG_DOING_SLOWCMD;
+        }
+
+        if (!(esp->flags & ESP_FLAG_DOING_SLOWCMD)) {
+                start_cmd = ESP_CMD_DMA | ESP_CMD_SELA;
+                if (ent->tag[0]) {
+                        *p++ = ent->tag[0];
+                        *p++ = ent->tag[1];
+
+                        start_cmd = ESP_CMD_DMA | ESP_CMD_SA3;
+                }
+
+                for (i = 0; i < cmd->cmd_len; i++)
+                        *p++ = cmd->cmnd[i];
+
+                esp->select_state = ESP_SELECT_BASIC;
+        } else {
+                esp->cmd_bytes_left = cmd->cmd_len;
+                esp->cmd_bytes_ptr = &cmd->cmnd[0];
+
+                if (ent->tag[0]) {
+                        for (i = esp->msg_out_len - 1;
+                             i >= 0; i--)
+                                esp->msg_out[i + 2] = esp->msg_out[i];
+                        esp->msg_out[0] = ent->tag[0];
+                        esp->msg_out[1] = ent->tag[1];
+                        esp->msg_out_len += 2;
+                }
+
+                start_cmd = ESP_CMD_DMA | ESP_CMD_SELAS;
+                esp->select_state = ESP_SELECT_MSGOUT;
+        }
+        val = tgt;
+        if (esp->rev == FASHME)
+                val |= ESP_BUSID_RESELID | ESP_BUSID_CTR32BIT;
+        esp_write8(val, ESP_BUSID);
+
+        esp_write_tgt_sync(esp, tgt);
+        esp_write_tgt_config3(esp, tgt);
+
+        val = (p - esp->command_block);
+
+        if (esp_debug & ESP_DEBUG_SCSICMD) {
+                printk("ESP: tgt[%d] lun[%d] scsi_cmd [ ", tgt, lun);
+                for (i = 0; i < cmd->cmd_len; i++)
+                        printk("%02x ", cmd->cmnd[i]);
+                printk("]\n");
+        }
+
+        if (esp->rev == FASHME)
+                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+        esp->ops->send_dma_cmd(esp, esp->command_block_dma,
+                               val, 16, 0, start_cmd);
+}
+
+static struct esp_cmd_entry *esp_get_ent(struct esp *esp)
+{
+        struct list_head *head = &esp->esp_cmd_pool;
+        struct esp_cmd_entry *ret;
+
+        if (list_empty(head)) {
+                ret = kzalloc(sizeof(struct esp_cmd_entry), GFP_ATOMIC);
+        } else {
+                ret = list_entry(head->next, struct esp_cmd_entry, list);
+                list_del(&ret->list);
+                memset(ret, 0, sizeof(*ret));
+        }
+        return ret;
+}
+
+static void esp_put_ent(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        list_add(&ent->list, &esp->esp_cmd_pool);
+}
+
+static void esp_cmd_is_done(struct esp *esp, struct esp_cmd_entry *ent,
+                            struct scsi_cmnd *cmd, unsigned int result)
+{
+        struct scsi_device *dev = cmd->device;
+        int tgt = dev->id;
+        int lun = dev->lun;
+
+        esp->active_cmd = NULL;
+        esp_unmap_dma(esp, cmd);
+        esp_free_lun_tag(ent, dev->hostdata);
+        cmd->result = result;
+
+        if (ent->eh_done) {
+                complete(ent->eh_done);
+                ent->eh_done = NULL;
+        }
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                esp->ops->unmap_single(esp, ent->sense_dma,
+                                       SCSI_SENSE_BUFFERSIZE, DMA_FROM_DEVICE);
+                ent->sense_ptr = NULL;
+
+                /* Restore the message/status bytes to what we actually
+                 * saw originally.  Also, report that we are providing
+                 * the sense data.
+                 */
+                cmd->result = ((DRIVER_SENSE << 24) |
+                               (DID_OK << 16) |
+                               (COMMAND_COMPLETE << 8) |
+                               (SAM_STAT_CHECK_CONDITION << 0));
+
+                ent->flags &= ~ESP_CMD_FLAG_AUTOSENSE;
+                if (esp_debug & ESP_DEBUG_AUTOSENSE) {
+                        int i;
+
+                        printk("esp%d: tgt[%d] lun[%d] AUTO SENSE[ ",
+                               esp->host->unique_id, tgt, lun);
+                        for (i = 0; i < 18; i++)
+                                printk("%02x ", cmd->sense_buffer[i]);
+                        printk("]\n");
+                }
+        }
+
+        cmd->scsi_done(cmd);
+
+        list_del(&ent->list);
+        esp_put_ent(esp, ent);
+
+        esp_maybe_execute_command(esp);
+}
+
+static unsigned int compose_result(unsigned int status, unsigned int message,
+                                   unsigned int driver_code)
+{
+        return (status | (message << 8) | (driver_code << 16));
+}
+
+static void esp_event_queue_full(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        struct scsi_device *dev = ent->cmd->device;
+        struct esp_lun_data *lp = dev->hostdata;
+
+        scsi_track_queue_full(dev, lp->num_tagged - 1);
+}
+
+static int esp_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
+{
+        struct scsi_device *dev = cmd->device;
+        struct esp *esp = host_to_esp(dev->host);
+        struct esp_cmd_priv *spriv;
+        struct esp_cmd_entry *ent;
+
+        ent = esp_get_ent(esp);
+        if (!ent)
+                return SCSI_MLQUEUE_HOST_BUSY;
+
+        ent->cmd = cmd;
+
+        cmd->scsi_done = done;
+
+        spriv = ESP_CMD_PRIV(cmd);
+        spriv->u.dma_addr = ~(dma_addr_t)0x0;
+
+        list_add_tail(&ent->list, &esp->queued_cmds);
+
+        esp_maybe_execute_command(esp);
+
+        return 0;
+}
+
+static int esp_check_gross_error(struct esp *esp)
+{
+        if (esp->sreg & ESP_STAT_SPAM) {
+                /* Gross Error, could be one of:
+                 * - top of fifo overwritten
+                 * - top of command register overwritten
+                 * - DMA programmed with wrong direction
+                 * - improper phase change
+                 */
+                printk(KERN_ERR PFX "esp%d: Gross error sreg[%02x]\n",
+                       esp->host->unique_id, esp->sreg);
+                /* XXX Reset the chip. XXX */
+                return 1;
+        }
+        return 0;
+}
+
+static int esp_check_spur_intr(struct esp *esp)
+{
+        switch (esp->rev) {
+        case ESP100:
+        case ESP100A:
+                /* The interrupt pending bit of the status register cannot
+                 * be trusted on these revisions.
+                 */
+                esp->sreg &= ~ESP_STAT_INTR;
+                break;
+
+        default:
+                if (!(esp->sreg & ESP_STAT_INTR)) {
+                        esp->ireg = esp_read8(ESP_INTRPT);
+                        if (esp->ireg & ESP_INTR_SR)
+                                return 1;
+
+                        /* If the DMA is indicating interrupt pending and the
+                         * ESP is not, the only possibility is a DMA error.
+                         */
+                        if (!esp->ops->dma_error(esp)) {
+                                printk(KERN_ERR PFX "esp%d: Spurious irq, "
+                                       "sreg=%x.\n",
+                                       esp->host->unique_id, esp->sreg);
+                                return -1;
+                        }
+
+                        printk(KERN_ERR PFX "esp%d: DMA error\n",
+                               esp->host->unique_id);
+
+                        /* XXX Reset the chip. XXX */
+                        return -1;
+                }
+                break;
+        }
+
+        return 0;
+}
+
+static void esp_schedule_reset(struct esp *esp)
+{
+        esp_log_reset("ESP: esp_schedule_reset() from %p\n",
+                      __builtin_return_address(0));
+        esp->flags |= ESP_FLAG_RESETTING;
+        esp_event(esp, ESP_EVENT_RESET);
+}
+
+/* In order to avoid having to add a special half-reconnected state
+ * into the driver we just sit here and poll through the rest of
+ * the reselection process to get the tag message bytes.
+ */
+static struct esp_cmd_entry *esp_reconnect_with_tag(struct esp *esp,
+                                                    struct esp_lun_data *lp)
+{
+        struct esp_cmd_entry *ent;
+        int i;
+
+        if (!lp->num_tagged) {
+                printk(KERN_ERR PFX "esp%d: Reconnect w/num_tagged==0\n",
+                       esp->host->unique_id);
+                return NULL;
+        }
+
+        esp_log_reconnect("ESP: reconnect tag, ");
+
+        for (i = 0; i < ESP_QUICKIRQ_LIMIT; i++) {
+                if (esp->ops->irq_pending(esp))
+                        break;
+        }
+        if (i == ESP_QUICKIRQ_LIMIT) {
+                printk(KERN_ERR PFX "esp%d: Reconnect IRQ1 timeout\n",
+                       esp->host->unique_id);
+                return NULL;
+        }
+
+        esp->sreg = esp_read8(ESP_STATUS);
+        esp->ireg = esp_read8(ESP_INTRPT);
+
+        esp_log_reconnect("IRQ(%d:%x:%x), ",
+                          i, esp->ireg, esp->sreg);
+
+        if (esp->ireg & ESP_INTR_DC) {
+                printk(KERN_ERR PFX "esp%d: Reconnect, got disconnect.\n",
+                       esp->host->unique_id);
+                return NULL;
+        }
+
+        if ((esp->sreg & ESP_STAT_PMASK) != ESP_MIP) {
+                printk(KERN_ERR PFX "esp%d: Reconnect, not MIP sreg[%02x].\n",
+                       esp->host->unique_id, esp->sreg);
+                return NULL;
+        }
+
+        /* DMA in the tag bytes... */
+        esp->command_block[0] = 0xff;
+        esp->command_block[1] = 0xff;
+        esp->ops->send_dma_cmd(esp, esp->command_block_dma,
+                               2, 2, 1, ESP_CMD_DMA | ESP_CMD_TI);
+
+        /* ACK the msssage.  */
+        scsi_esp_cmd(esp, ESP_CMD_MOK);
+
+        for (i = 0; i < ESP_RESELECT_TAG_LIMIT; i++) {
+                if (esp->ops->irq_pending(esp)) {
+                        esp->sreg = esp_read8(ESP_STATUS);
+                        esp->ireg = esp_read8(ESP_INTRPT);
+                        if (esp->ireg & ESP_INTR_FDONE)
+                                break;
+                }
+                udelay(1);
+        }
+        if (i == ESP_RESELECT_TAG_LIMIT) {
+                printk(KERN_ERR PFX "esp%d: Reconnect IRQ2 timeout\n",
+                       esp->host->unique_id);
+                return NULL;
+        }
+        esp->ops->dma_drain(esp);
+        esp->ops->dma_invalidate(esp);
+
+        esp_log_reconnect("IRQ2(%d:%x:%x) tag[%x:%x]\n",
+                          i, esp->ireg, esp->sreg,
+                          esp->command_block[0],
+                          esp->command_block[1]);
+
+        if (esp->command_block[0] < SIMPLE_QUEUE_TAG ||
+            esp->command_block[0] > ORDERED_QUEUE_TAG) {
+                printk(KERN_ERR PFX "esp%d: Reconnect, bad tag "
+                       "type %02x.\n",
+                       esp->host->unique_id, esp->command_block[0]);
+                return NULL;
+        }
+
+        ent = lp->tagged_cmds[esp->command_block[1]];
+        if (!ent) {
+                printk(KERN_ERR PFX "esp%d: Reconnect, no entry for "
+                       "tag %02x.\n",
+                       esp->host->unique_id, esp->command_block[1]);
+                return NULL;
+        }
+
+        return ent;
+}
+
+static int esp_reconnect(struct esp *esp)
+{
+        struct esp_cmd_entry *ent;
+        struct esp_target_data *tp;
+        struct esp_lun_data *lp;
+        struct scsi_device *dev;
+        int target, lun;
+
+        BUG_ON(esp->active_cmd);
+        if (esp->rev == FASHME) {
+                /* FASHME puts the target and lun numbers directly
+                 * into the fifo.
+                 */
+                target = esp->fifo[0];
+                lun = esp->fifo[1] & 0x7;
+        } else {
+                u8 bits = esp_read8(ESP_FDATA);
+
+                /* Older chips put the lun directly into the fifo, but
+                 * the target is given as a sample of the arbitration
+                 * lines on the bus at reselection time.  So we should
+                 * see the ID of the ESP and the one reconnecting target
+                 * set in the bitmap.
+                 */
+                if (!(bits & esp->scsi_id_mask))
+                        goto do_reset;
+                bits &= ~esp->scsi_id_mask;
+                if (!bits || (bits & (bits - 1)))
+                        goto do_reset;
+
+                target = ffs(bits) - 1;
+                lun = (esp_read8(ESP_FDATA) & 0x7);
+
+                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+                if (esp->rev == ESP100) {
+                        u8 ireg = esp_read8(ESP_INTRPT);
+                        /* This chip has a bug during reselection that can
+                         * cause a spurious illegal-command interrupt, which
+                         * we simply ACK here.  Another possibility is a bus
+                         * reset so we must check for that.
+                         */
+                        if (ireg & ESP_INTR_SR)
+                                goto do_reset;
+                }
+                scsi_esp_cmd(esp, ESP_CMD_NULL);
+        }
+
+        esp_write_tgt_sync(esp, target);
+        esp_write_tgt_config3(esp, target);
+
+        scsi_esp_cmd(esp, ESP_CMD_MOK);
+
+        if (esp->rev == FASHME)
+                esp_write8(target | ESP_BUSID_RESELID | ESP_BUSID_CTR32BIT,
+                           ESP_BUSID);
+
+        tp = &esp->target[target];
+        dev = __scsi_device_lookup_by_target(tp->starget, lun);
+        if (!dev) {
+                printk(KERN_ERR PFX "esp%d: Reconnect, no lp "
+                       "tgt[%u] lun[%u]\n",
+                       esp->host->unique_id, target, lun);
+                goto do_reset;
+        }
+        lp = dev->hostdata;
+
+        ent = lp->non_tagged_cmd;
+        if (!ent) {
+                ent = esp_reconnect_with_tag(esp, lp);
+                if (!ent)
+                        goto do_reset;
+        }
+
+        esp->active_cmd = ent;
+
+        if (ent->flags & ESP_CMD_FLAG_ABORT) {
+                esp->msg_out[0] = ABORT_TASK_SET;
+                esp->msg_out_len = 1;
+                scsi_esp_cmd(esp, ESP_CMD_SATN);
+        }
+
+        esp_event(esp, ESP_EVENT_CHECK_PHASE);
+        esp_restore_pointers(esp, ent);
+        esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+        return 1;
+
+do_reset:
+        esp_schedule_reset(esp);
+        return 0;
+}
+
+static int esp_finish_select(struct esp *esp)
+{
+        struct esp_cmd_entry *ent;
+        struct scsi_cmnd *cmd;
+        u8 orig_select_state;
+
+        orig_select_state = esp->select_state;
+
+        /* No longer selecting.  */
+        esp->select_state = ESP_SELECT_NONE;
+
+        esp->seqreg = esp_read8(ESP_SSTEP) & ESP_STEP_VBITS;
+        ent = esp->active_cmd;
+        cmd = ent->cmd;
+
+        if (esp->ops->dma_error(esp)) {
+                /* If we see a DMA error during or as a result of selection,
+                 * all bets are off.
+                 */
+                esp_schedule_reset(esp);
+                esp_cmd_is_done(esp, ent, cmd, (DID_ERROR << 16));
+                return 0;
+        }
+
+        esp->ops->dma_invalidate(esp);
+
+        if (esp->ireg == (ESP_INTR_RSEL | ESP_INTR_FDONE)) {
+                struct esp_target_data *tp = &esp->target[cmd->device->id];
+
+                /* Carefully back out of the selection attempt.  Release
+                 * resources (such as DMA mapping & TAG) and reset state (such
+                 * as message out and command delivery variables).
+                 */
+                if (!(ent->flags & ESP_CMD_FLAG_AUTOSENSE)) {
+                        esp_unmap_dma(esp, cmd);
+                        esp_free_lun_tag(ent, cmd->device->hostdata);
+                        tp->flags &= ~(ESP_TGT_NEGO_SYNC | ESP_TGT_NEGO_WIDE);
+                        esp->flags &= ~ESP_FLAG_DOING_SLOWCMD;
+                        esp->cmd_bytes_ptr = NULL;
+                        esp->cmd_bytes_left = 0;
+                } else {
+                        esp->ops->unmap_single(esp, ent->sense_dma,
+                                               SCSI_SENSE_BUFFERSIZE,
+                                               DMA_FROM_DEVICE);
+                        ent->sense_ptr = NULL;
+                }
+
+                /* Now that the state is unwound properly, put back onto
+                 * the issue queue.  This command is no longer active.
+                 */
+                list_del(&ent->list);
+                list_add(&ent->list, &esp->queued_cmds);
+                esp->active_cmd = NULL;
+
+                /* Return value ignored by caller, it directly invokes
+                 * esp_reconnect().
+                 */
+                return 0;
+        }
+
+        if (esp->ireg == ESP_INTR_DC) {
+                struct scsi_device *dev = cmd->device;
+
+                /* Disconnect.  Make sure we re-negotiate sync and
+                 * wide parameters if this target starts responding
+                 * again in the future.
+                 */
+                esp->target[dev->id].flags |= ESP_TGT_CHECK_NEGO;
+
+                scsi_esp_cmd(esp, ESP_CMD_ESEL);
+                esp_cmd_is_done(esp, ent, cmd, (DID_BAD_TARGET << 16));
+                return 1;
+        }
+
+        if (esp->ireg == (ESP_INTR_FDONE | ESP_INTR_BSERV)) {
+                /* Selection successful.  On pre-FAST chips we have
+                 * to do a NOP and possibly clean out the FIFO.
+                 */
+                if (esp->rev <= ESP236) {
+                        int fcnt = esp_read8(ESP_FFLAGS) & ESP_FF_FBYTES;
+
+                        scsi_esp_cmd(esp, ESP_CMD_NULL);
+
+                        if (!fcnt &&
+                            (!esp->prev_soff ||
+                             ((esp->sreg & ESP_STAT_PMASK) != ESP_DIP)))
+                                esp_flush_fifo(esp);
+                }
+
+                /* If we are doing a slow command, negotiation, etc.
+                 * we'll do the right thing as we transition to the
+                 * next phase.
+                 */
+                esp_event(esp, ESP_EVENT_CHECK_PHASE);
+                return 0;
+        }
+
+        printk("ESP: Unexpected selection completion ireg[%x].\n",
+               esp->ireg);
+        esp_schedule_reset(esp);
+        return 0;
+}
+
+static int esp_data_bytes_sent(struct esp *esp, struct esp_cmd_entry *ent,
+                               struct scsi_cmnd *cmd)
+{
+        int fifo_cnt, ecount, bytes_sent, flush_fifo;
+
+        fifo_cnt = esp_read8(ESP_FFLAGS) & ESP_FF_FBYTES;
+        if (esp->prev_cfg3 & ESP_CONFIG3_EWIDE)
+                fifo_cnt <<= 1;
+
+        ecount = 0;
+        if (!(esp->sreg & ESP_STAT_TCNT)) {
+                ecount = ((unsigned int)esp_read8(ESP_TCLOW) |
+                          (((unsigned int)esp_read8(ESP_TCMED)) << 8));
+                if (esp->rev == FASHME)
+                        ecount |= ((unsigned int)esp_read8(FAS_RLO)) << 16;
+        }
+
+        bytes_sent = esp->data_dma_len;
+        bytes_sent -= ecount;
+
+        if (!(ent->flags & ESP_CMD_FLAG_WRITE))
+                bytes_sent -= fifo_cnt;
+
+        flush_fifo = 0;
+        if (!esp->prev_soff) {
+                /* Synchronous data transfer, always flush fifo. */
+                flush_fifo = 1;
+        } else {
+                if (esp->rev == ESP100) {
+                        u32 fflags, phase;
+
+                        /* ESP100 has a chip bug where in the synchronous data
+                         * phase it can mistake a final long REQ pulse from the
+                         * target as an extra data byte.  Fun.
+                         *
+                         * To detect this case we resample the status register
+                         * and fifo flags.  If we're still in a data phase and
+                         * we see spurious chunks in the fifo, we return error
+                         * to the caller which should reset and set things up
+                         * such that we only try future transfers to this
+                         * target in synchronous mode.
+                         */
+                        esp->sreg = esp_read8(ESP_STATUS);
+                        phase = esp->sreg & ESP_STAT_PMASK;
+                        fflags = esp_read8(ESP_FFLAGS);
+
+                        if ((phase == ESP_DOP &&
+                             (fflags & ESP_FF_ONOTZERO)) ||
+                            (phase == ESP_DIP &&
+                             (fflags & ESP_FF_FBYTES)))
+                                return -1;
+                }
+                if (!(ent->flags & ESP_CMD_FLAG_WRITE))
+                        flush_fifo = 1;
+        }
+
+        if (flush_fifo)
+                esp_flush_fifo(esp);
+
+        return bytes_sent;
+}
+
+static void esp_setsync(struct esp *esp, struct esp_target_data *tp,
+                        u8 scsi_period, u8 scsi_offset,
+                        u8 esp_stp, u8 esp_soff)
+{
+        spi_period(tp->starget) = scsi_period;
+        spi_offset(tp->starget) = scsi_offset;
+        spi_width(tp->starget) = (tp->flags & ESP_TGT_WIDE) ? 1 : 0;
+
+        if (esp_soff) {
+                esp_stp &= 0x1f;
+                esp_soff |= esp->radelay;
+                if (esp->rev >= FAS236) {
+                        u8 bit = ESP_CONFIG3_FSCSI;
+                        if (esp->rev >= FAS100A)
+                                bit = ESP_CONFIG3_FAST;
+
+                        if (scsi_period < 50) {
+                                if (esp->rev == FASHME)
+                                        esp_soff &= ~esp->radelay;
+                                tp->esp_config3 |= bit;
+                        } else {
+                                tp->esp_config3 &= ~bit;
+                        }
+                        esp->prev_cfg3 = tp->esp_config3;
+                        esp_write8(esp->prev_cfg3, ESP_CFG3);
+                }
+        }
+
+        tp->esp_period = esp->prev_stp = esp_stp;
+        tp->esp_offset = esp->prev_soff = esp_soff;
+
+        esp_write8(esp_soff, ESP_SOFF);
+        esp_write8(esp_stp, ESP_STP);
+
+        tp->flags &= ~(ESP_TGT_NEGO_SYNC | ESP_TGT_CHECK_NEGO);
+
+        spi_display_xfer_agreement(tp->starget);
+}
+
+static void esp_msgin_reject(struct esp *esp)
+{
+        struct esp_cmd_entry *ent = esp->active_cmd;
+        struct scsi_cmnd *cmd = ent->cmd;
+        struct esp_target_data *tp;
+        int tgt;
+
+        tgt = cmd->device->id;
+        tp = &esp->target[tgt];
+
+        if (tp->flags & ESP_TGT_NEGO_WIDE) {
+                tp->flags &= ~(ESP_TGT_NEGO_WIDE | ESP_TGT_WIDE);
+
+                if (!esp_need_to_nego_sync(tp)) {
+                        tp->flags &= ~ESP_TGT_CHECK_NEGO;
+                        scsi_esp_cmd(esp, ESP_CMD_RATN);
+                } else {
+                        esp->msg_out_len =
+                                spi_populate_sync_msg(&esp->msg_out[0],
+                                                      tp->nego_goal_period,
+                                                      tp->nego_goal_offset);
+                        tp->flags |= ESP_TGT_NEGO_SYNC;
+                        scsi_esp_cmd(esp, ESP_CMD_SATN);
+                }
+                return;
+        }
+
+        if (tp->flags & ESP_TGT_NEGO_SYNC) {
+                tp->flags &= ~(ESP_TGT_NEGO_SYNC | ESP_TGT_CHECK_NEGO);
+                tp->esp_period = 0;
+                tp->esp_offset = 0;
+                esp_setsync(esp, tp, 0, 0, 0, 0);
+                scsi_esp_cmd(esp, ESP_CMD_RATN);
+                return;
+        }
+
+        esp->msg_out[0] = ABORT_TASK_SET;
+        esp->msg_out_len = 1;
+        scsi_esp_cmd(esp, ESP_CMD_SATN);
+}
+
+static void esp_msgin_sdtr(struct esp *esp, struct esp_target_data *tp)
+{
+        u8 period = esp->msg_in[3];
+        u8 offset = esp->msg_in[4];
+        u8 stp;
+
+        if (!(tp->flags & ESP_TGT_NEGO_SYNC))
+                goto do_reject;
+
+        if (offset > 15)
+                goto do_reject;
+
+        if (offset) {
+                int rounded_up, one_clock;
+
+                if (period > esp->max_period) {
+                        period = offset = 0;
+                        goto do_sdtr;
+                }
+                if (period < esp->min_period)
+                        goto do_reject;
+
+                one_clock = esp->ccycle / 1000;
+                rounded_up = (period << 2);
+                rounded_up = (rounded_up + one_clock - 1) / one_clock;
+                stp = rounded_up;
+                if (stp && esp->rev >= FAS236) {
+                        if (stp >= 50)
+                                stp--;
+                }
+        } else {
+                stp = 0;
+        }
+
+        esp_setsync(esp, tp, period, offset, stp, offset);
+        return;
+
+do_reject:
+        esp->msg_out[0] = MESSAGE_REJECT;
+        esp->msg_out_len = 1;
+        scsi_esp_cmd(esp, ESP_CMD_SATN);
+        return;
+
+do_sdtr:
+        tp->nego_goal_period = period;
+        tp->nego_goal_offset = offset;
+        esp->msg_out_len =
+                spi_populate_sync_msg(&esp->msg_out[0],
+                                      tp->nego_goal_period,
+                                      tp->nego_goal_offset);
+        scsi_esp_cmd(esp, ESP_CMD_SATN);
+}
+
+static void esp_msgin_wdtr(struct esp *esp, struct esp_target_data *tp)
+{
+        int size = 8 << esp->msg_in[3];
+        u8 cfg3;
+
+        if (esp->rev != FASHME)
+                goto do_reject;
+
+        if (size != 8 && size != 16)
+                goto do_reject;
+
+        if (!(tp->flags & ESP_TGT_NEGO_WIDE))
+                goto do_reject;
+
+        cfg3 = tp->esp_config3;
+        if (size == 16) {
+                tp->flags |= ESP_TGT_WIDE;
+                cfg3 |= ESP_CONFIG3_EWIDE;
+        } else {
+                tp->flags &= ~ESP_TGT_WIDE;
+                cfg3 &= ~ESP_CONFIG3_EWIDE;
+        }
+        tp->esp_config3 = cfg3;
+        esp->prev_cfg3 = cfg3;
+        esp_write8(cfg3, ESP_CFG3);
+
+        tp->flags &= ~ESP_TGT_NEGO_WIDE;
+
+        spi_period(tp->starget) = 0;
+        spi_offset(tp->starget) = 0;
+        if (!esp_need_to_nego_sync(tp)) {
+                tp->flags &= ~ESP_TGT_CHECK_NEGO;
+                scsi_esp_cmd(esp, ESP_CMD_RATN);
+        } else {
+                esp->msg_out_len =
+                        spi_populate_sync_msg(&esp->msg_out[0],
+                                              tp->nego_goal_period,
+                                              tp->nego_goal_offset);
+                tp->flags |= ESP_TGT_NEGO_SYNC;
+                scsi_esp_cmd(esp, ESP_CMD_SATN);
+        }
+        return;
+
+do_reject:
+        esp->msg_out[0] = MESSAGE_REJECT;
+        esp->msg_out_len = 1;
+        scsi_esp_cmd(esp, ESP_CMD_SATN);
+}
+
+static void esp_msgin_extended(struct esp *esp)
+{
+        struct esp_cmd_entry *ent = esp->active_cmd;
+        struct scsi_cmnd *cmd = ent->cmd;
+        struct esp_target_data *tp;
+        int tgt = cmd->device->id;
+
+        tp = &esp->target[tgt];
+        if (esp->msg_in[2] == EXTENDED_SDTR) {
+                esp_msgin_sdtr(esp, tp);
+                return;
+        }
+        if (esp->msg_in[2] == EXTENDED_WDTR) {
+                esp_msgin_wdtr(esp, tp);
+                return;
+        }
+
+        printk("ESP: Unexpected extended msg type %x\n",
+               esp->msg_in[2]);
+
+        esp->msg_out[0] = ABORT_TASK_SET;
+        esp->msg_out_len = 1;
+        scsi_esp_cmd(esp, ESP_CMD_SATN);
+}
+
+/* Analyze msgin bytes received from target so far.  Return non-zero
+ * if there are more bytes needed to complete the message.
+ */
+static int esp_msgin_process(struct esp *esp)
+{
+        u8 msg0 = esp->msg_in[0];
+        int len = esp->msg_in_len;
+
+        if (msg0 & 0x80) {
+                /* Identify */
+                printk("ESP: Unexpected msgin identify\n");
+                return 0;
+        }
+
+        switch (msg0) {
+        case EXTENDED_MESSAGE:
+                if (len == 1)
+                        return 1;
+                if (len < esp->msg_in[1] + 2)
+                        return 1;
+                esp_msgin_extended(esp);
+                return 0;
+
+        case IGNORE_WIDE_RESIDUE: {
+                struct esp_cmd_entry *ent;
+                struct esp_cmd_priv *spriv;
+                if (len == 1)
+                        return 1;
+
+                if (esp->msg_in[1] != 1)
+                        goto do_reject;
+
+                ent = esp->active_cmd;
+                spriv = ESP_CMD_PRIV(ent->cmd);
+
+                if (spriv->cur_residue == sg_dma_len(spriv->cur_sg)) {
+                        spriv->cur_sg--;
+                        spriv->cur_residue = 1;
+                } else
+                        spriv->cur_residue++;
+                spriv->tot_residue++;
+                return 0;
+        }
+        case NOP:
+                return 0;
+        case RESTORE_POINTERS:
+                esp_restore_pointers(esp, esp->active_cmd);
+                return 0;
+        case SAVE_POINTERS:
+                esp_save_pointers(esp, esp->active_cmd);
+                return 0;
+
+        case COMMAND_COMPLETE:
+        case DISCONNECT: {
+                struct esp_cmd_entry *ent = esp->active_cmd;
+
+                ent->message = msg0;
+                esp_event(esp, ESP_EVENT_FREE_BUS);
+                esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                return 0;
+        }
+        case MESSAGE_REJECT:
+                esp_msgin_reject(esp);
+                return 0;
+
+        default:
+        do_reject:
+                esp->msg_out[0] = MESSAGE_REJECT;
+                esp->msg_out_len = 1;
+                scsi_esp_cmd(esp, ESP_CMD_SATN);
+                return 0;
+        }
+}
+
+static int esp_process_event(struct esp *esp)
+{
+        int write;
+
+again:
+        write = 0;
+        switch (esp->event) {
+        case ESP_EVENT_CHECK_PHASE:
+                switch (esp->sreg & ESP_STAT_PMASK) {
+                case ESP_DOP:
+                        esp_event(esp, ESP_EVENT_DATA_OUT);
+                        break;
+                case ESP_DIP:
+                        esp_event(esp, ESP_EVENT_DATA_IN);
+                        break;
+                case ESP_STATP:
+                        esp_flush_fifo(esp);
+                        scsi_esp_cmd(esp, ESP_CMD_ICCSEQ);
+                        esp_event(esp, ESP_EVENT_STATUS);
+                        esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                        return 1;
+
+                case ESP_MOP:
+                        esp_event(esp, ESP_EVENT_MSGOUT);
+                        break;
+
+                case ESP_MIP:
+                        esp_event(esp, ESP_EVENT_MSGIN);
+                        break;
+
+                case ESP_CMDP:
+                        esp_event(esp, ESP_EVENT_CMD_START);
+                        break;
+
+                default:
+                        printk("ESP: Unexpected phase, sreg=%02x\n",
+                               esp->sreg);
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+                goto again;
+                break;
+
+        case ESP_EVENT_DATA_IN:
+                write = 1;
+                /* fallthru */
+
+        case ESP_EVENT_DATA_OUT: {
+                struct esp_cmd_entry *ent = esp->active_cmd;
+                struct scsi_cmnd *cmd = ent->cmd;
+                dma_addr_t dma_addr = esp_cur_dma_addr(ent, cmd);
+                unsigned int dma_len = esp_cur_dma_len(ent, cmd);
+
+                if (esp->rev == ESP100)
+                        scsi_esp_cmd(esp, ESP_CMD_NULL);
+
+                if (write)
+                        ent->flags |= ESP_CMD_FLAG_WRITE;
+                else
+                        ent->flags &= ~ESP_CMD_FLAG_WRITE;
+
+                dma_len = esp_dma_length_limit(esp, dma_addr, dma_len);
+                esp->data_dma_len = dma_len;
+
+                if (!dma_len) {
+                        printk(KERN_ERR PFX "esp%d: DMA length is zero!\n",
+                               esp->host->unique_id);
+                        printk(KERN_ERR PFX "esp%d: cur adr[%08x] len[%08x]\n",
+                               esp->host->unique_id,
+                               esp_cur_dma_addr(ent, cmd),
+                               esp_cur_dma_len(ent, cmd));
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+
+                esp_log_datastart("ESP: start data addr[%08x] len[%u] "
+                                  "write(%d)\n",
+                                  dma_addr, dma_len, write);
+
+                esp->ops->send_dma_cmd(esp, dma_addr, dma_len, dma_len,
+                                       write, ESP_CMD_DMA | ESP_CMD_TI);
+                esp_event(esp, ESP_EVENT_DATA_DONE);
+                break;
+        }
+        case ESP_EVENT_DATA_DONE: {
+                struct esp_cmd_entry *ent = esp->active_cmd;
+                struct scsi_cmnd *cmd = ent->cmd;
+                int bytes_sent;
+
+                if (esp->ops->dma_error(esp)) {
+                        printk("ESP: data done, DMA error, resetting\n");
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+
+                if (ent->flags & ESP_CMD_FLAG_WRITE) {
+                        /* XXX parity errors, etc. XXX */
+
+                        esp->ops->dma_drain(esp);
+                }
+                esp->ops->dma_invalidate(esp);
+
+                if (esp->ireg != ESP_INTR_BSERV) {
+                        /* We should always see exactly a bus-service
+                         * interrupt at the end of a successful transfer.
+                         */
+                        printk("ESP: data done, not BSERV, resetting\n");
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+
+                bytes_sent = esp_data_bytes_sent(esp, ent, cmd);
+
+                esp_log_datadone("ESP: data done flgs[%x] sent[%d]\n",
+                                 ent->flags, bytes_sent);
+
+                if (bytes_sent < 0) {
+                        /* XXX force sync mode for this target XXX */
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+
+                esp_advance_dma(esp, ent, cmd, bytes_sent);
+                esp_event(esp, ESP_EVENT_CHECK_PHASE);
+                goto again;
+                break;
+        }
+
+        case ESP_EVENT_STATUS: {
+                struct esp_cmd_entry *ent = esp->active_cmd;
+
+                if (esp->ireg & ESP_INTR_FDONE) {
+                        ent->status = esp_read8(ESP_FDATA);
+                        ent->message = esp_read8(ESP_FDATA);
+                        scsi_esp_cmd(esp, ESP_CMD_MOK);
+                } else if (esp->ireg == ESP_INTR_BSERV) {
+                        ent->status = esp_read8(ESP_FDATA);
+                        ent->message = 0xff;
+                        esp_event(esp, ESP_EVENT_MSGIN);
+                        return 0;
+                }
+
+                if (ent->message != COMMAND_COMPLETE) {
+                        printk("ESP: Unexpected message %x in status\n",
+                               ent->message);
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+
+                esp_event(esp, ESP_EVENT_FREE_BUS);
+                esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                break;
+        }
+        case ESP_EVENT_FREE_BUS: {
+                struct esp_cmd_entry *ent = esp->active_cmd;
+                struct scsi_cmnd *cmd = ent->cmd;
+
+                if (ent->message == COMMAND_COMPLETE ||
+                    ent->message == DISCONNECT)
+                        scsi_esp_cmd(esp, ESP_CMD_ESEL);
+
+                if (ent->message == COMMAND_COMPLETE) {
+                        esp_log_cmddone("ESP: Command done status[%x] "
+                                        "message[%x]\n",
+                                        ent->status, ent->message);
+                        if (ent->status == SAM_STAT_TASK_SET_FULL)
+                                esp_event_queue_full(esp, ent);
+
+                        if (ent->status == SAM_STAT_CHECK_CONDITION &&
+                            !(ent->flags & ESP_CMD_FLAG_AUTOSENSE)) {
+                                ent->flags |= ESP_CMD_FLAG_AUTOSENSE;
+                                esp_autosense(esp, ent);
+                        } else {
+                                esp_cmd_is_done(esp, ent, cmd,
+                                                compose_result(ent->status,
+                                                               ent->message,
+                                                               DID_OK));
+                        }
+                } else if (ent->message == DISCONNECT) {
+                        esp_log_disconnect("ESP: Disconnecting tgt[%d] "
+                                           "tag[%x:%x]\n",
+                                           cmd->device->id,
+                                           ent->tag[0], ent->tag[1]);
+
+                        esp->active_cmd = NULL;
+                        esp_maybe_execute_command(esp);
+                } else {
+                        printk("ESP: Unexpected message %x in freebus\n",
+                               ent->message);
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+                if (esp->active_cmd)
+                        esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                break;
+        }
+        case ESP_EVENT_MSGOUT: {
+                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+
+                if (esp_debug & ESP_DEBUG_MSGOUT) {
+                        int i;
+                        printk("ESP: Sending message [ ");
+                        for (i = 0; i < esp->msg_out_len; i++)
+                                printk("%02x ", esp->msg_out[i]);
+                        printk("]\n");
+                }
+
+                if (esp->rev == FASHME) {
+                        int i;
+
+                        /* Always use the fifo.  */
+                        for (i = 0; i < esp->msg_out_len; i++) {
+                                esp_write8(esp->msg_out[i], ESP_FDATA);
+                                esp_write8(0, ESP_FDATA);
+                        }
+                        scsi_esp_cmd(esp, ESP_CMD_TI);
+                } else {
+                        if (esp->msg_out_len == 1) {
+                                esp_write8(esp->msg_out[0], ESP_FDATA);
+                                scsi_esp_cmd(esp, ESP_CMD_TI);
+                        } else {
+                                /* Use DMA. */
+                                memcpy(esp->command_block,
+                                       esp->msg_out,
+                                       esp->msg_out_len);
+
+                                esp->ops->send_dma_cmd(esp,
+                                                       esp->command_block_dma,
+                                                       esp->msg_out_len,
+                                                       esp->msg_out_len,
+                                                       0,
+                                                       ESP_CMD_DMA|ESP_CMD_TI);
+                        }
+                }
+                esp_event(esp, ESP_EVENT_MSGOUT_DONE);
+                break;
+        }
+        case ESP_EVENT_MSGOUT_DONE:
+                if (esp->rev == FASHME) {
+                        scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+                } else {
+                        if (esp->msg_out_len > 1)
+                                esp->ops->dma_invalidate(esp);
+                }
+
+                if (!(esp->ireg & ESP_INTR_DC)) {
+                        if (esp->rev != FASHME)
+                                scsi_esp_cmd(esp, ESP_CMD_NULL);
+                }
+                esp_event(esp, ESP_EVENT_CHECK_PHASE);
+                goto again;
+        case ESP_EVENT_MSGIN:
+                if (esp->ireg & ESP_INTR_BSERV) {
+                        if (esp->rev == FASHME) {
+                                if (!(esp_read8(ESP_STATUS2) &
+                                      ESP_STAT2_FEMPTY))
+                                        scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+                        } else {
+                                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+                                if (esp->rev == ESP100)
+                                        scsi_esp_cmd(esp, ESP_CMD_NULL);
+                        }
+                        scsi_esp_cmd(esp, ESP_CMD_TI);
+                        esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                        return 1;
+                }
+                if (esp->ireg & ESP_INTR_FDONE) {
+                        u8 val;
+
+                        if (esp->rev == FASHME)
+                                val = esp->fifo[0];
+                        else
+                                val = esp_read8(ESP_FDATA);
+                        esp->msg_in[esp->msg_in_len++] = val;
+
+                        esp_log_msgin("ESP: Got msgin byte %x\n", val);
+
+                        if (!esp_msgin_process(esp))
+                                esp->msg_in_len = 0;
+
+                        if (esp->rev == FASHME)
+                                scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+
+                        scsi_esp_cmd(esp, ESP_CMD_MOK);
+
+                        if (esp->event != ESP_EVENT_FREE_BUS)
+                                esp_event(esp, ESP_EVENT_CHECK_PHASE);
+                } else {
+                        printk("ESP: MSGIN neither BSERV not FDON, resetting");
+                        esp_schedule_reset(esp);
+                        return 0;
+                }
+                break;
+        case ESP_EVENT_CMD_START:
+                memcpy(esp->command_block, esp->cmd_bytes_ptr,
+                       esp->cmd_bytes_left);
+                if (esp->rev == FASHME)
+                        scsi_esp_cmd(esp, ESP_CMD_FLUSH);
+                esp->ops->send_dma_cmd(esp, esp->command_block_dma,
+                                       esp->cmd_bytes_left, 16, 0,
+                                       ESP_CMD_DMA | ESP_CMD_TI);
+                esp_event(esp, ESP_EVENT_CMD_DONE);
+                esp->flags |= ESP_FLAG_QUICKIRQ_CHECK;
+                break;
+        case ESP_EVENT_CMD_DONE:
+                esp->ops->dma_invalidate(esp);
+                if (esp->ireg & ESP_INTR_BSERV) {
+                        esp_event(esp, ESP_EVENT_CHECK_PHASE);
+                        goto again;
+                }
+                esp_schedule_reset(esp);
+                return 0;
+                break;
+
+        case ESP_EVENT_RESET:
+                scsi_esp_cmd(esp, ESP_CMD_RS);
+                break;
+
+        default:
+                printk("ESP: Unexpected event %x, resetting\n",
+                       esp->event);
+                esp_schedule_reset(esp);
+                return 0;
+                break;
+        }
+        return 1;
+}
+
+static void esp_reset_cleanup_one(struct esp *esp, struct esp_cmd_entry *ent)
+{
+        struct scsi_cmnd *cmd = ent->cmd;
+
+        esp_unmap_dma(esp, cmd);
+        esp_free_lun_tag(ent, cmd->device->hostdata);
+        cmd->result = DID_RESET << 16;
+
+        if (ent->flags & ESP_CMD_FLAG_AUTOSENSE) {
+                esp->ops->unmap_single(esp, ent->sense_dma,
+                                       SCSI_SENSE_BUFFERSIZE, DMA_FROM_DEVICE);
+                ent->sense_ptr = NULL;
+        }
+
+        cmd->scsi_done(cmd);
+        list_del(&ent->list);
+        esp_put_ent(esp, ent);
+}
+
+static void esp_clear_hold(struct scsi_device *dev, void *data)
+{
+        struct esp_lun_data *lp = dev->hostdata;
+
+        BUG_ON(lp->num_tagged);
+        lp->hold = 0;
+}
+
+static void esp_reset_cleanup(struct esp *esp)
+{
+        struct esp_cmd_entry *ent, *tmp;
+        int i;
+
+        list_for_each_entry_safe(ent, tmp, &esp->queued_cmds, list) {
+                struct scsi_cmnd *cmd = ent->cmd;
+
+                list_del(&ent->list);
+                cmd->result = DID_RESET << 16;
+                cmd->scsi_done(cmd);
+                esp_put_ent(esp, ent);
+        }
+
+        list_for_each_entry_safe(ent, tmp, &esp->active_cmds, list) {
+                if (ent == esp->active_cmd)
+                        esp->active_cmd = NULL;
+                esp_reset_cleanup_one(esp, ent);
+        }
+
+        BUG_ON(esp->active_cmd != NULL);
+
+        /* Force renegotiation of sync/wide transfers.  */
+        for (i = 0; i < ESP_MAX_TARGET; i++) {
+                struct esp_target_data *tp = &esp->target[i];
+
+                tp->esp_period = 0;
+                tp->esp_offset = 0;
+                tp->esp_config3 &= ~(ESP_CONFIG3_EWIDE |
+                                     ESP_CONFIG3_FSCSI |
+                                     ESP_CONFIG3_FAST);
+                tp->flags &= ~ESP_TGT_WIDE;
+                tp->flags |= ESP_TGT_CHECK_NEGO;
+
+                if (tp->starget)
+                        starget_for_each_device(tp->starget, NULL,
+                                                esp_clear_hold);
+        }
+}
+
+/* Runs under host->lock */
+static void __esp_interrupt(struct esp *esp)
+{
+        int finish_reset, intr_done;
+        u8 phase;
+
+        esp->sreg = esp_read8(ESP_STATUS);
+
+        if (esp->flags & ESP_FLAG_RESETTING) {
+                finish_reset = 1;
+        } else {
+                if (esp_check_gross_error(esp))
+                        return;
+
+                finish_reset = esp_check_spur_intr(esp);
+                if (finish_reset < 0)
+                        return;
+        }
+
+        esp->ireg = esp_read8(ESP_INTRPT);
+
+        if (esp->ireg & ESP_INTR_SR)
+                finish_reset = 1;
+
+        if (finish_reset) {
+                esp_reset_cleanup(esp);
+                if (esp->eh_reset) {
+                        complete(esp->eh_reset);
+                        esp->eh_reset = NULL;
+                }
+                return;
+        }
+
+        phase = (esp->sreg & ESP_STAT_PMASK);
+        if (esp->rev == FASHME) {
+                if (((phase != ESP_DIP && phase != ESP_DOP) &&
+                     esp->select_state == ESP_SELECT_NONE &&
+                     esp->event != ESP_EVENT_STATUS &&
+                     esp->event != ESP_EVENT_DATA_DONE) ||
+                    (esp->ireg & ESP_INTR_RSEL)) {
+                        esp->sreg2 = esp_read8(ESP_STATUS2);
+                        if (!(esp->sreg2 & ESP_STAT2_FEMPTY) ||
+                            (esp->sreg2 & ESP_STAT2_F1BYTE))
+                                hme_read_fifo(esp);
+                }
+        }
+
+        esp_log_intr("ESP: intr sreg[%02x] seqreg[%02x] "
+                     "sreg2[%02x] ireg[%02x]\n",
+                     esp->sreg, esp->seqreg, esp->sreg2, esp->ireg);
+
+        intr_done = 0;
+
+        if (esp->ireg & (ESP_INTR_S | ESP_INTR_SATN | ESP_INTR_IC)) {
+                printk("ESP: unexpected IREG %02x\n", esp->ireg);
+                if (esp->ireg & ESP_INTR_IC)
+                        esp_dump_cmd_log(esp);
+
+                esp_schedule_reset(esp);
+        } else {
+                if (!(esp->ireg & ESP_INTR_RSEL)) {
+                        /* Some combination of FDONE, BSERV, DC.  */
+                        if (esp->select_state != ESP_SELECT_NONE)
+                                intr_done = esp_finish_select(esp);
+                } else if (esp->ireg & ESP_INTR_RSEL) {
+                        if (esp->active_cmd)
+                                (void) esp_finish_select(esp);
+                        intr_done = esp_reconnect(esp);
+                }
+        }
+        while (!intr_done)
+                intr_done = esp_process_event(esp);
+}
+
+irqreturn_t scsi_esp_intr(int irq, void *dev_id)
+{
+        struct esp *esp = dev_id;
+        unsigned long flags;
+        irqreturn_t ret;
+
+        spin_lock_irqsave(esp->host->host_lock, flags);
+        ret = IRQ_NONE;
+        if (esp->ops->irq_pending(esp)) {
+                ret = IRQ_HANDLED;
+                for (;;) {
+                        int i;
+
+                        __esp_interrupt(esp);
+                        if (!(esp->flags & ESP_FLAG_QUICKIRQ_CHECK))
+                                break;
+                        esp->flags &= ~ESP_FLAG_QUICKIRQ_CHECK;
+
+                        for (i = 0; i < ESP_QUICKIRQ_LIMIT; i++) {
+                                if (esp->ops->irq_pending(esp))
+                                        break;
+                        }
+                        if (i == ESP_QUICKIRQ_LIMIT)
+                                break;
+                }
+        }
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL(scsi_esp_intr);
+
+static void __devinit esp_get_revision(struct esp *esp)
+{
+        u8 val;
+
+        esp->config1 = (ESP_CONFIG1_PENABLE | (esp->scsi_id & 7));
+        esp->config2 = (ESP_CONFIG2_SCSI2ENAB | ESP_CONFIG2_REGPARITY);
+        esp_write8(esp->config2, ESP_CFG2);
+
+        val = esp_read8(ESP_CFG2);
+        val &= ~ESP_CONFIG2_MAGIC;
+        if (val != (ESP_CONFIG2_SCSI2ENAB | ESP_CONFIG2_REGPARITY)) {
+                /* If what we write to cfg2 does not come back, cfg2 is not
+                 * implemented, therefore this must be a plain esp100.
+                 */
+                esp->rev = ESP100;
+        } else {
+                esp->config2 = 0;
+                esp_set_all_config3(esp, 5);
+                esp->prev_cfg3 = 5;
+                esp_write8(esp->config2, ESP_CFG2);
+                esp_write8(0, ESP_CFG3);
+                esp_write8(esp->prev_cfg3, ESP_CFG3);
+
+                val = esp_read8(ESP_CFG3);
+                if (val != 5) {
+                        /* The cfg2 register is implemented, however
+                         * cfg3 is not, must be esp100a.
+                         */
+                        esp->rev = ESP100A;
+                } else {
+                        esp_set_all_config3(esp, 0);
+                        esp->prev_cfg3 = 0;
+                        esp_write8(esp->prev_cfg3, ESP_CFG3);
+
+                        /* All of cfg{1,2,3} implemented, must be one of
+                         * the fas variants, figure out which one.
+                         */
+                        if (esp->cfact == 0 || esp->cfact > ESP_CCF_F5) {
+                                esp->rev = FAST;
+                                esp->sync_defp = SYNC_DEFP_FAST;
+                        } else {
+                                esp->rev = ESP236;
+                        }
+                        esp->config2 = 0;
+                        esp_write8(esp->config2, ESP_CFG2);
+                }
+        }
+}
+
+static void __devinit esp_init_swstate(struct esp *esp)
+{
+        int i;
+
+        INIT_LIST_HEAD(&esp->queued_cmds);
+        INIT_LIST_HEAD(&esp->active_cmds);
+        INIT_LIST_HEAD(&esp->esp_cmd_pool);
+
+        /* Start with a clear state, domain validation (via ->slave_configure,
+         * spi_dv_device()) will attempt to enable SYNC, WIDE, and tagged
+         * commands.
+         */
+        for (i = 0 ; i < ESP_MAX_TARGET; i++) {
+                esp->target[i].flags = 0;
+                esp->target[i].nego_goal_period = 0;
+                esp->target[i].nego_goal_offset = 0;
+                esp->target[i].nego_goal_width = 0;
+                esp->target[i].nego_goal_tags = 0;
+        }
+}
+
+/* This places the ESP into a known state at boot time. */
+static void __devinit esp_bootup_reset(struct esp *esp)
+{
+        u8 val;
+
+        /* Reset the DMA */
+        esp->ops->reset_dma(esp);
+
+        /* Reset the ESP */
+        esp_reset_esp(esp);
+
+        /* Reset the SCSI bus, but tell ESP not to generate an irq */
+        val = esp_read8(ESP_CFG1);
+        val |= ESP_CONFIG1_SRRDISAB;
+        esp_write8(val, ESP_CFG1);
+
+        scsi_esp_cmd(esp, ESP_CMD_RS);
+        udelay(400);
+
+        esp_write8(esp->config1, ESP_CFG1);
+
+        /* Eat any bitrot in the chip and we are done... */
+        esp_read8(ESP_INTRPT);
+}
+
+static void __devinit esp_set_clock_params(struct esp *esp)
+{
+        int fmhz;
+        u8 ccf;
+
+        /* This is getting messy but it has to be done correctly or else
+         * you get weird behavior all over the place.  We are trying to
+         * basically figure out three pieces of information.
+         *
+         * a) Clock Conversion Factor
+         *
+         *    This is a representation of the input crystal clock frequency
+         *    going into the ESP on this machine.  Any operation whose timing
+         *    is longer than 400ns depends on this value being correct.  For
+         *    example, you'll get blips for arbitration/selection during high
+         *    load or with multiple targets if this is not set correctly.
+         *
+         * b) Selection Time-Out
+         *
+         *    The ESP isn't very bright and will arbitrate for the bus and try
+         *    to select a target forever if you let it.  This value tells the
+         *    ESP when it has taken too long to negotiate and that it should
+         *    interrupt the CPU so we can see what happened.  The value is
+         *    computed as follows (from NCR/Symbios chip docs).
+         *
+         *          (Time Out Period) *  (Input Clock)
+         *    STO = ----------------------------------
+         *          (8192) * (Clock Conversion Factor)
+         *
+         *    We use a time out period of 250ms (ESP_BUS_TIMEOUT).
+         *
+         * c) Imperical constants for synchronous offset and transfer period
+         *    register values
+         *
+         *    This entails the smallest and largest sync period we could ever
+         *    handle on this ESP.
+         */
+        fmhz = esp->cfreq;
+
+        ccf = ((fmhz / 1000000) + 4) / 5;
+        if (ccf == 1)
+                ccf = 2;
+
+        /* If we can't find anything reasonable, just assume 20MHZ.
+         * This is the clock frequency of the older sun4c's where I've
+         * been unable to find the clock-frequency PROM property.  All
+         * other machines provide useful values it seems.
+         */
+        if (fmhz <= 5000000 || ccf < 1 || ccf > 8) {
+                fmhz = 20000000;
+                ccf = 4;
+        }
+
+        esp->cfact = (ccf == 8 ? 0 : ccf);
+        esp->cfreq = fmhz;
+        esp->ccycle = ESP_MHZ_TO_CYCLE(fmhz);
+        esp->ctick = ESP_TICK(ccf, esp->ccycle);
+        esp->neg_defp = ESP_NEG_DEFP(fmhz, ccf);
+        esp->sync_defp = SYNC_DEFP_SLOW;
+}
+
+static const char *esp_chip_names[] = {
+        "ESP100",
+        "ESP100A",
+        "ESP236",
+        "FAS236",
+        "FAS100A",
+        "FAST",
+        "FASHME",
+};
+
+static struct scsi_transport_template *esp_transport_template;
+
+int __devinit scsi_esp_register(struct esp *esp, struct device *dev)
+{
+        static int instance;
+        int err;
+
+        esp->host->transportt = esp_transport_template;
+        esp->host->max_lun = ESP_MAX_LUN;
+        esp->host->cmd_per_lun = 2;
+
+        esp_set_clock_params(esp);
+
+        esp_get_revision(esp);
+
+        esp_init_swstate(esp);
+
+        esp_bootup_reset(esp);
+
+        printk(KERN_INFO PFX "esp%u, regs[%1p:%1p] irq[%u]\n",
+               esp->host->unique_id, esp->regs, esp->dma_regs,
+               esp->host->irq);
+        printk(KERN_INFO PFX "esp%u is a %s, %u MHz (ccf=%u), SCSI ID %u\n",
+               esp->host->unique_id, esp_chip_names[esp->rev],
+               esp->cfreq / 1000000, esp->cfact, esp->scsi_id);
+
+        /* Let the SCSI bus reset settle. */
+        ssleep(esp_bus_reset_settle);
+
+        err = scsi_add_host(esp->host, dev);
+        if (err)
+                return err;
+
+        esp->host->unique_id = instance++;
+
+        scsi_scan_host(esp->host);
+
+        return 0;
+}
+EXPORT_SYMBOL(scsi_esp_register);
+
+void __devexit scsi_esp_unregister(struct esp *esp)
+{
+        scsi_remove_host(esp->host);
+}
+EXPORT_SYMBOL(scsi_esp_unregister);
+
+static int esp_slave_alloc(struct scsi_device *dev)
+{
+        struct esp *esp = host_to_esp(dev->host);
+        struct esp_target_data *tp = &esp->target[dev->id];
+        struct esp_lun_data *lp;
+
+        lp = kzalloc(sizeof(*lp), GFP_KERNEL);
+        if (!lp)
+                return -ENOMEM;
+        dev->hostdata = lp;
+
+        tp->starget = dev->sdev_target;
+
+        spi_min_period(tp->starget) = esp->min_period;
+        spi_max_offset(tp->starget) = 15;
+
+        if (esp->flags & ESP_FLAG_WIDE_CAPABLE)
+                spi_max_width(tp->starget) = 1;
+        else
+                spi_max_width(tp->starget) = 0;
+
+        return 0;
+}
+
+static int esp_slave_configure(struct scsi_device *dev)
+{
+        struct esp *esp = host_to_esp(dev->host);
+        struct esp_target_data *tp = &esp->target[dev->id];
+        int goal_tags, queue_depth;
+
+        goal_tags = 0;
+
+        if (dev->tagged_supported) {
+                /* XXX make this configurable somehow XXX */
+                goal_tags = ESP_DEFAULT_TAGS;
+
+                if (goal_tags > ESP_MAX_TAG)
+                        goal_tags = ESP_MAX_TAG;
+        }
+
+        queue_depth = goal_tags;
+        if (queue_depth < dev->host->cmd_per_lun)
+                queue_depth = dev->host->cmd_per_lun;
+
+        if (goal_tags) {
+                scsi_set_tag_type(dev, MSG_ORDERED_TAG);
+                scsi_activate_tcq(dev, queue_depth);
+        } else {
+                scsi_deactivate_tcq(dev, queue_depth);
+        }
+        tp->flags |= ESP_TGT_DISCONNECT;
+
+        if (!spi_initial_dv(dev->sdev_target))
+                spi_dv_device(dev);
+
+        return 0;
+}
+
+static void esp_slave_destroy(struct scsi_device *dev)
+{
+        struct esp_lun_data *lp = dev->hostdata;
+
+        kfree(lp);
+        dev->hostdata = NULL;
+}
+
+static int esp_eh_abort_handler(struct scsi_cmnd *cmd)
+{
+        struct esp *esp = host_to_esp(cmd->device->host);
+        struct esp_cmd_entry *ent, *tmp;
+        struct completion eh_done;
+        unsigned long flags;
+
+        /* XXX This helps a lot with debugging but might be a bit
+         * XXX much for the final driver.
+         */
+        spin_lock_irqsave(esp->host->host_lock, flags);
+        printk(KERN_ERR PFX "esp%d: Aborting command [%p:%02x]\n",
+               esp->host->unique_id, cmd, cmd->cmnd[0]);
+        ent = esp->active_cmd;
+        if (ent)
+                printk(KERN_ERR PFX "esp%d: Current command [%p:%02x]\n",
+                       esp->host->unique_id, ent->cmd, ent->cmd->cmnd[0]);
+        list_for_each_entry(ent, &esp->queued_cmds, list) {
+                printk(KERN_ERR PFX "esp%d: Queued command [%p:%02x]\n",
+                       esp->host->unique_id, ent->cmd, ent->cmd->cmnd[0]);
+        }
+        list_for_each_entry(ent, &esp->active_cmds, list) {
+                printk(KERN_ERR PFX "esp%d: Active command [%p:%02x]\n",
+                       esp->host->unique_id, ent->cmd, ent->cmd->cmnd[0]);
+        }
+        esp_dump_cmd_log(esp);
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+        spin_lock_irqsave(esp->host->host_lock, flags);
+
+        ent = NULL;
+        list_for_each_entry(tmp, &esp->queued_cmds, list) {
+                if (tmp->cmd == cmd) {
+                        ent = tmp;
+                        break;
+                }
+        }
+
+        if (ent) {
+                /* Easiest case, we didn't even issue the command
+                 * yet so it is trivial to abort.
+                 */
+                list_del(&ent->list);
+
+                cmd->result = DID_ABORT << 16;
+                cmd->scsi_done(cmd);
+
+                esp_put_ent(esp, ent);
+
+                goto out_success;
+        }
+
+        init_completion(&eh_done);
+
+        ent = esp->active_cmd;
+        if (ent && ent->cmd == cmd) {
+                /* Command is the currently active command on
+                 * the bus.  If we already have an output message
+                 * pending, no dice.
+                 */
+                if (esp->msg_out_len)
+                        goto out_failure;
+
+                /* Send out an abort, encouraging the target to
+                 * go to MSGOUT phase by asserting ATN.
+                 */
+                esp->msg_out[0] = ABORT_TASK_SET;
+                esp->msg_out_len = 1;
+                ent->eh_done = &eh_done;
+
+                scsi_esp_cmd(esp, ESP_CMD_SATN);
+        } else {
+                /* The command is disconnected.  This is not easy to
+                 * abort.  For now we fail and let the scsi error
+                 * handling layer go try a scsi bus reset or host
+                 * reset.
+                 *
+                 * What we could do is put together a scsi command
+                 * solely for the purpose of sending an abort message
+                 * to the target.  Coming up with all the code to
+                 * cook up scsi commands, special case them everywhere,
+                 * etc. is for questionable gain and it would be better
+                 * if the generic scsi error handling layer could do at
+                 * least some of that for us.
+                 *
+                 * Anyways this is an area for potential future improvement
+                 * in this driver.
+                 */
+                goto out_failure;
+        }
+
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+        if (!wait_for_completion_timeout(&eh_done, 5 * HZ)) {
+                spin_lock_irqsave(esp->host->host_lock, flags);
+                ent->eh_done = NULL;
+                spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+                return FAILED;
+        }
+
+        return SUCCESS;
+
+out_success:
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+        return SUCCESS;
+
+out_failure:
+        /* XXX This might be a good location to set ESP_TGT_BROKEN
+         * XXX since we know which target/lun in particular is
+         * XXX causing trouble.
+         */
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+        return FAILED;
+}
+
+static int esp_eh_bus_reset_handler(struct scsi_cmnd *cmd)
+{
+        struct esp *esp = host_to_esp(cmd->device->host);
+        struct completion eh_reset;
+        unsigned long flags;
+
+        init_completion(&eh_reset);
+
+        spin_lock_irqsave(esp->host->host_lock, flags);
+
+        esp->eh_reset = &eh_reset;
+
+        /* XXX This is too simple... We should add lots of
+         * XXX checks here so that if we find that the chip is
+         * XXX very wedged we return failure immediately so
+         * XXX that we can perform a full chip reset.
+         */
+        esp->flags |= ESP_FLAG_RESETTING;
+        scsi_esp_cmd(esp, ESP_CMD_RS);
+
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+        ssleep(esp_bus_reset_settle);
+
+        if (!wait_for_completion_timeout(&eh_reset, 5 * HZ)) {
+                spin_lock_irqsave(esp->host->host_lock, flags);
+                esp->eh_reset = NULL;
+                spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+                return FAILED;
+        }
+
+        return SUCCESS;
+}
+
+/* All bets are off, reset the entire device.  */
+static int esp_eh_host_reset_handler(struct scsi_cmnd *cmd)
+{
+        struct esp *esp = host_to_esp(cmd->device->host);
+        unsigned long flags;
+
+        spin_lock_irqsave(esp->host->host_lock, flags);
+        esp_bootup_reset(esp);
+        esp_reset_cleanup(esp);
+        spin_unlock_irqrestore(esp->host->host_lock, flags);
+
+        ssleep(esp_bus_reset_settle);
+
+        return SUCCESS;
+}
+
+static const char *esp_info(struct Scsi_Host *host)
+{
+        return "esp";
+}
+
+struct scsi_host_template scsi_esp_template = {
+        .module                 = THIS_MODULE,
+        .name                   = "esp",
+        .info                   = esp_info,
+        .queuecommand           = esp_queuecommand,
+        .slave_alloc            = esp_slave_alloc,
+        .slave_configure        = esp_slave_configure,
+        .slave_destroy          = esp_slave_destroy,
+        .eh_abort_handler       = esp_eh_abort_handler,
+        .eh_bus_reset_handler   = esp_eh_bus_reset_handler,
+        .eh_host_reset_handler  = esp_eh_host_reset_handler,
+        .can_queue              = 7,
+        .this_id                = 7,
+        .sg_tablesize           = SG_ALL,
+        .use_clustering         = ENABLE_CLUSTERING,
+        .max_sectors            = 0xffff,
+        .skip_settle_delay      = 1,
+};
+EXPORT_SYMBOL(scsi_esp_template);
+
+static void esp_get_signalling(struct Scsi_Host *host)
+{
+        struct esp *esp = host_to_esp(host);
+        enum spi_signal_type type;
+
+        if (esp->flags & ESP_FLAG_DIFFERENTIAL)
+                type = SPI_SIGNAL_HVD;
+        else
+                type = SPI_SIGNAL_SE;
+
+        spi_signalling(host) = type;
+}
+
+static void esp_set_offset(struct scsi_target *target, int offset)
+{
+        struct Scsi_Host *host = dev_to_shost(target->dev.parent);
+        struct esp *esp = host_to_esp(host);
+        struct esp_target_data *tp = &esp->target[target->id];
+
+        tp->nego_goal_offset = offset;
+        tp->flags |= ESP_TGT_CHECK_NEGO;
+}
+
+static void esp_set_period(struct scsi_target *target, int period)
+{
+        struct Scsi_Host *host = dev_to_shost(target->dev.parent);
+        struct esp *esp = host_to_esp(host);
+        struct esp_target_data *tp = &esp->target[target->id];
+
+        tp->nego_goal_period = period;
+        tp->flags |= ESP_TGT_CHECK_NEGO;
+}
+
+static void esp_set_width(struct scsi_target *target, int width)
+{
+        struct Scsi_Host *host = dev_to_shost(target->dev.parent);
+        struct esp *esp = host_to_esp(host);
+        struct esp_target_data *tp = &esp->target[target->id];
+
+        tp->nego_goal_width = (width ? 1 : 0);
+        tp->flags |= ESP_TGT_CHECK_NEGO;
+}
+
+static struct spi_function_template esp_transport_ops = {
+        .set_offset             = esp_set_offset,
+        .show_offset            = 1,
+        .set_period             = esp_set_period,
+        .show_period            = 1,
+        .set_width              = esp_set_width,
+        .show_width             = 1,
+        .get_signalling         = esp_get_signalling,
+};
+
+static int __init esp_init(void)
+{
+        BUILD_BUG_ON(sizeof(struct scsi_pointer) <
+                     sizeof(struct esp_cmd_priv));
+
+        esp_transport_template = spi_attach_transport(&esp_transport_ops);
+        if (!esp_transport_template)
+                return -ENODEV;
+
+        return 0;
+}
+
+static void __exit esp_exit(void)
+{
+        spi_release_transport(esp_transport_template);
+}
+
+MODULE_DESCRIPTION("ESP SCSI driver core");
+MODULE_AUTHOR("David S. Miller (davem@davemloft.net)");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+
+module_param(esp_bus_reset_settle, int, 0);
+MODULE_PARM_DESC(esp_bus_reset_settle,
+                 "ESP scsi bus reset delay in seconds");
+
+module_param(esp_debug, int, 0);
+MODULE_PARM_DESC(esp_debug,
+"ESP bitmapped debugging message enable value:\n"
+"       0x00000001      Log interrupt events\n"
+"       0x00000002      Log scsi commands\n"
+"       0x00000004      Log resets\n"
+"       0x00000008      Log message in events\n"
+"       0x00000010      Log message out events\n"
+"       0x00000020      Log command completion\n"
+"       0x00000040      Log disconnects\n"
+"       0x00000080      Log data start\n"
+"       0x00000100      Log data done\n"
+"       0x00000200      Log reconnects\n"
+"       0x00000400      Log auto-sense data\n"
+);
+
+module_init(esp_init);
+module_exit(esp_exit);
diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
new file mode 100644
index 000000000000..8d4a6690401f
--- /dev/null
+++ b/drivers/scsi/esp_scsi.h
@@ -0,0 +1,560 @@
+/* esp_scsi.h: Defines and structures for the ESP drier.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#ifndef _ESP_SCSI_H
+#define _ESP_SCSI_H
+
+                                        /* Access    Description      Offset */
+#define ESP_TCLOW       0x00UL          /* rw  Low bits transfer count 0x00  */
+#define ESP_TCMED       0x01UL          /* rw  Mid bits transfer count 0x04  */
+#define ESP_FDATA       0x02UL          /* rw  FIFO data bits          0x08  */
+#define ESP_CMD         0x03UL          /* rw  SCSI command bits       0x0c  */
+#define ESP_STATUS      0x04UL          /* ro  ESP status register     0x10  */
+#define ESP_BUSID       ESP_STATUS      /* wo  BusID for sel/resel     0x10  */
+#define ESP_INTRPT      0x05UL          /* ro  Kind of interrupt       0x14  */
+#define ESP_TIMEO       ESP_INTRPT      /* wo  Timeout for sel/resel   0x14  */
+#define ESP_SSTEP       0x06UL          /* ro  Sequence step register  0x18  */
+#define ESP_STP         ESP_SSTEP       /* wo  Transfer period/sync    0x18  */
+#define ESP_FFLAGS      0x07UL          /* ro  Bits current FIFO info  0x1c  */
+#define ESP_SOFF        ESP_FFLAGS      /* wo  Sync offset             0x1c  */
+#define ESP_CFG1        0x08UL          /* rw  First cfg register      0x20  */
+#define ESP_CFACT       0x09UL          /* wo  Clock conv factor       0x24  */
+#define ESP_STATUS2     ESP_CFACT       /* ro  HME status2 register    0x24  */
+#define ESP_CTEST       0x0aUL          /* wo  Chip test register      0x28  */
+#define ESP_CFG2        0x0bUL          /* rw  Second cfg register     0x2c  */
+#define ESP_CFG3        0x0cUL          /* rw  Third cfg register      0x30  */
+#define ESP_TCHI        0x0eUL          /* rw  High bits transf count  0x38  */
+#define ESP_UID         ESP_TCHI        /* ro  Unique ID code          0x38  */
+#define FAS_RLO         ESP_TCHI        /* rw  HME extended counter    0x38  */
+#define ESP_FGRND       0x0fUL          /* rw  Data base for fifo      0x3c  */
+#define FAS_RHI         ESP_FGRND       /* rw  HME extended counter    0x3c  */
+
+#define SBUS_ESP_REG_SIZE       0x40UL
+
+/* Bitfield meanings for the above registers. */
+
+/* ESP config reg 1, read-write, found on all ESP chips */
+#define ESP_CONFIG1_ID        0x07      /* My BUS ID bits */
+#define ESP_CONFIG1_CHTEST    0x08      /* Enable ESP chip tests */
+#define ESP_CONFIG1_PENABLE   0x10      /* Enable parity checks */
+#define ESP_CONFIG1_PARTEST   0x20      /* Parity test mode enabled? */
+#define ESP_CONFIG1_SRRDISAB  0x40      /* Disable SCSI reset reports */
+#define ESP_CONFIG1_SLCABLE   0x80      /* Enable slow cable mode */
+
+/* ESP config reg 2, read-write, found only on esp100a+esp200+esp236 chips */
+#define ESP_CONFIG2_DMAPARITY 0x01      /* enable DMA Parity (200,236) */
+#define ESP_CONFIG2_REGPARITY 0x02      /* enable reg Parity (200,236) */
+#define ESP_CONFIG2_BADPARITY 0x04      /* Bad parity target abort  */
+#define ESP_CONFIG2_SCSI2ENAB 0x08      /* Enable SCSI-2 features (tgtmode) */
+#define ESP_CONFIG2_HI        0x10      /* High Impedance DREQ ???  */
+#define ESP_CONFIG2_HMEFENAB  0x10      /* HME features enable */
+#define ESP_CONFIG2_BCM       0x20      /* Enable byte-ctrl (236)   */
+#define ESP_CONFIG2_DISPINT   0x20      /* Disable pause irq (hme) */
+#define ESP_CONFIG2_FENAB     0x40      /* Enable features (fas100,216) */
+#define ESP_CONFIG2_SPL       0x40      /* Enable status-phase latch (236) */
+#define ESP_CONFIG2_MKDONE    0x40      /* HME magic feature */
+#define ESP_CONFIG2_HME32     0x80      /* HME 32 extended */
+#define ESP_CONFIG2_MAGIC     0xe0      /* Invalid bits... */
+
+/* ESP config register 3 read-write, found only esp236+fas236+fas100a+hme chips */
+#define ESP_CONFIG3_FCLOCK    0x01     /* FAST SCSI clock rate (esp100a/hme) */
+#define ESP_CONFIG3_TEM       0x01     /* Enable thresh-8 mode (esp/fas236)  */
+#define ESP_CONFIG3_FAST      0x02     /* Enable FAST SCSI     (esp100a/hme) */
+#define ESP_CONFIG3_ADMA      0x02     /* Enable alternate-dma (esp/fas236)  */
+#define ESP_CONFIG3_TENB      0x04     /* group2 SCSI2 support (esp100a/hme) */
+#define ESP_CONFIG3_SRB       0x04     /* Save residual byte   (esp/fas236)  */
+#define ESP_CONFIG3_TMS       0x08     /* Three-byte msg's ok  (esp100a/hme) */
+#define ESP_CONFIG3_FCLK      0x08     /* Fast SCSI clock rate (esp/fas236)  */
+#define ESP_CONFIG3_IDMSG     0x10     /* ID message checking  (esp100a/hme) */
+#define ESP_CONFIG3_FSCSI     0x10     /* Enable FAST SCSI     (esp/fas236)  */
+#define ESP_CONFIG3_GTM       0x20     /* group2 SCSI2 support (esp/fas236)  */
+#define ESP_CONFIG3_IDBIT3    0x20     /* Bit 3 of HME SCSI-ID (hme)         */
+#define ESP_CONFIG3_TBMS      0x40     /* Three-byte msg's ok  (esp/fas236)  */
+#define ESP_CONFIG3_EWIDE     0x40     /* Enable Wide-SCSI     (hme)         */
+#define ESP_CONFIG3_IMS       0x80     /* ID msg chk'ng        (esp/fas236)  */
+#define ESP_CONFIG3_OBPUSH    0x80     /* Push odd-byte to dma (hme)         */
+
+/* ESP command register read-write */
+/* Group 1 commands:  These may be sent at any point in time to the ESP
+ *                    chip.  None of them can generate interrupts 'cept
+ *                    the "SCSI bus reset" command if you have not disabled
+ *                    SCSI reset interrupts in the config1 ESP register.
+ */
+#define ESP_CMD_NULL          0x00     /* Null command, ie. a nop */
+#define ESP_CMD_FLUSH         0x01     /* FIFO Flush */
+#define ESP_CMD_RC            0x02     /* Chip reset */
+#define ESP_CMD_RS            0x03     /* SCSI bus reset */
+
+/* Group 2 commands:  ESP must be an initiator and connected to a target
+ *                    for these commands to work.
+ */
+#define ESP_CMD_TI            0x10     /* Transfer Information */
+#define ESP_CMD_ICCSEQ        0x11     /* Initiator cmd complete sequence */
+#define ESP_CMD_MOK           0x12     /* Message okie-dokie */
+#define ESP_CMD_TPAD          0x18     /* Transfer Pad */
+#define ESP_CMD_SATN          0x1a     /* Set ATN */
+#define ESP_CMD_RATN          0x1b     /* De-assert ATN */
+
+/* Group 3 commands:  ESP must be in the MSGOUT or MSGIN state and be connected
+ *                    to a target as the initiator for these commands to work.
+ */
+#define ESP_CMD_SMSG          0x20     /* Send message */
+#define ESP_CMD_SSTAT         0x21     /* Send status */
+#define ESP_CMD_SDATA         0x22     /* Send data */
+#define ESP_CMD_DSEQ          0x23     /* Discontinue Sequence */
+#define ESP_CMD_TSEQ          0x24     /* Terminate Sequence */
+#define ESP_CMD_TCCSEQ        0x25     /* Target cmd cmplt sequence */
+#define ESP_CMD_DCNCT         0x27     /* Disconnect */
+#define ESP_CMD_RMSG          0x28     /* Receive Message */
+#define ESP_CMD_RCMD          0x29     /* Receive Command */
+#define ESP_CMD_RDATA         0x2a     /* Receive Data */
+#define ESP_CMD_RCSEQ         0x2b     /* Receive cmd sequence */
+
+/* Group 4 commands:  The ESP must be in the disconnected state and must
+ *                    not be connected to any targets as initiator for
+ *                    these commands to work.
+ */
+#define ESP_CMD_RSEL          0x40     /* Reselect */
+#define ESP_CMD_SEL           0x41     /* Select w/o ATN */
+#define ESP_CMD_SELA          0x42     /* Select w/ATN */
+#define ESP_CMD_SELAS         0x43     /* Select w/ATN & STOP */
+#define ESP_CMD_ESEL          0x44     /* Enable selection */
+#define ESP_CMD_DSEL          0x45     /* Disable selections */
+#define ESP_CMD_SA3           0x46     /* Select w/ATN3 */
+#define ESP_CMD_RSEL3         0x47     /* Reselect3 */
+
+/* This bit enables the ESP's DMA on the SBus */
+#define ESP_CMD_DMA           0x80     /* Do DMA? */
+
+/* ESP status register read-only */
+#define ESP_STAT_PIO          0x01     /* IO phase bit */
+#define ESP_STAT_PCD          0x02     /* CD phase bit */
+#define ESP_STAT_PMSG         0x04     /* MSG phase bit */
+#define ESP_STAT_PMASK        0x07     /* Mask of phase bits */
+#define ESP_STAT_TDONE        0x08     /* Transfer Completed */
+#define ESP_STAT_TCNT         0x10     /* Transfer Counter Is Zero */
+#define ESP_STAT_PERR         0x20     /* Parity error */
+#define ESP_STAT_SPAM         0x40     /* Real bad error */
+/* This indicates the 'interrupt pending' condition on esp236, it is a reserved
+ * bit on other revs of the ESP.
+ */
+#define ESP_STAT_INTR         0x80             /* Interrupt */
+
+/* The status register can be masked with ESP_STAT_PMASK and compared
+ * with the following values to determine the current phase the ESP
+ * (at least thinks it) is in.  For our purposes we also add our own
+ * software 'done' bit for our phase management engine.
+ */
+#define ESP_DOP   (0)                                       /* Data Out  */
+#define ESP_DIP   (ESP_STAT_PIO)                            /* Data In   */
+#define ESP_CMDP  (ESP_STAT_PCD)                            /* Command   */
+#define ESP_STATP (ESP_STAT_PCD|ESP_STAT_PIO)               /* Status    */
+#define ESP_MOP   (ESP_STAT_PMSG|ESP_STAT_PCD)              /* Message Out */
+#define ESP_MIP   (ESP_STAT_PMSG|ESP_STAT_PCD|ESP_STAT_PIO) /* Message In */
+
+/* HME only: status 2 register */
+#define ESP_STAT2_SCHBIT      0x01 /* Upper bits 3-7 of sstep enabled */
+#define ESP_STAT2_FFLAGS      0x02 /* The fifo flags are now latched */
+#define ESP_STAT2_XCNT        0x04 /* The transfer counter is latched */
+#define ESP_STAT2_CREGA       0x08 /* The command reg is active now */
+#define ESP_STAT2_WIDE        0x10 /* Interface on this adapter is wide */
+#define ESP_STAT2_F1BYTE      0x20 /* There is one byte at top of fifo */
+#define ESP_STAT2_FMSB        0x40 /* Next byte in fifo is most significant */
+#define ESP_STAT2_FEMPTY      0x80 /* FIFO is empty */
+
+/* ESP interrupt register read-only */
+#define ESP_INTR_S            0x01     /* Select w/o ATN */
+#define ESP_INTR_SATN         0x02     /* Select w/ATN */
+#define ESP_INTR_RSEL         0x04     /* Reselected */
+#define ESP_INTR_FDONE        0x08     /* Function done */
+#define ESP_INTR_BSERV        0x10     /* Bus service */
+#define ESP_INTR_DC           0x20     /* Disconnect */
+#define ESP_INTR_IC           0x40     /* Illegal command given */
+#define ESP_INTR_SR           0x80     /* SCSI bus reset detected */
+
+/* ESP sequence step register read-only */
+#define ESP_STEP_VBITS        0x07     /* Valid bits */
+#define ESP_STEP_ASEL         0x00     /* Selection&Arbitrate cmplt */
+#define ESP_STEP_SID          0x01     /* One msg byte sent */
+#define ESP_STEP_NCMD         0x02     /* Was not in command phase */
+#define ESP_STEP_PPC          0x03     /* Early phase chg caused cmnd
+                                        * bytes to be lost
+                                        */
+#define ESP_STEP_FINI4        0x04     /* Command was sent ok */
+
+/* Ho hum, some ESP's set the step register to this as well... */
+#define ESP_STEP_FINI5        0x05
+#define ESP_STEP_FINI6        0x06
+#define ESP_STEP_FINI7        0x07
+
+/* ESP chip-test register read-write */
+#define ESP_TEST_TARG         0x01     /* Target test mode */
+#define ESP_TEST_INI          0x02     /* Initiator test mode */
+#define ESP_TEST_TS           0x04     /* Tristate test mode */
+
+/* ESP unique ID register read-only, found on fas236+fas100a only */
+#define ESP_UID_F100A         0x00     /* ESP FAS100A  */
+#define ESP_UID_F236          0x02     /* ESP FAS236   */
+#define ESP_UID_REV           0x07     /* ESP revision */
+#define ESP_UID_FAM           0xf8     /* ESP family   */
+
+/* ESP fifo flags register read-only */
+/* Note that the following implies a 16 byte FIFO on the ESP. */
+#define ESP_FF_FBYTES         0x1f     /* Num bytes in FIFO */
+#define ESP_FF_ONOTZERO       0x20     /* offset ctr not zero (esp100) */
+#define ESP_FF_SSTEP          0xe0     /* Sequence step */
+
+/* ESP clock conversion factor register write-only */
+#define ESP_CCF_F0            0x00     /* 35.01MHz - 40MHz */
+#define ESP_CCF_NEVER         0x01     /* Set it to this and die */
+#define ESP_CCF_F2            0x02     /* 10MHz */
+#define ESP_CCF_F3            0x03     /* 10.01MHz - 15MHz */
+#define ESP_CCF_F4            0x04     /* 15.01MHz - 20MHz */
+#define ESP_CCF_F5            0x05     /* 20.01MHz - 25MHz */
+#define ESP_CCF_F6            0x06     /* 25.01MHz - 30MHz */
+#define ESP_CCF_F7            0x07     /* 30.01MHz - 35MHz */
+
+/* HME only... */
+#define ESP_BUSID_RESELID     0x10
+#define ESP_BUSID_CTR32BIT    0x40
+
+#define ESP_BUS_TIMEOUT        250     /* In milli-seconds */
+#define ESP_TIMEO_CONST       8192
+#define ESP_NEG_DEFP(mhz, cfact) \
+        ((ESP_BUS_TIMEOUT * ((mhz) / 1000)) / (8192 * (cfact)))
+#define ESP_MHZ_TO_CYCLE(mhertz)  ((1000000000) / ((mhertz) / 1000))
+#define ESP_TICK(ccf, cycle)  ((7682 * (ccf) * (cycle) / 1000))
+
+/* For slow to medium speed input clock rates we shoot for 5mb/s, but for high
+ * input clock rates we try to do 10mb/s although I don't think a transfer can
+ * even run that fast with an ESP even with DMA2 scatter gather pipelining.
+ */
+#define SYNC_DEFP_SLOW            0x32   /* 5mb/s  */
+#define SYNC_DEFP_FAST            0x19   /* 10mb/s */
+
+struct esp_cmd_priv {
+        union {
+                dma_addr_t      dma_addr;
+                int             num_sg;
+        } u;
+
+        unsigned int            cur_residue;
+        struct scatterlist      *cur_sg;
+        unsigned int            tot_residue;
+};
+#define ESP_CMD_PRIV(CMD)       ((struct esp_cmd_priv *)(&(CMD)->SCp))
+
+enum esp_rev {
+        ESP100     = 0x00,  /* NCR53C90 - very broken */
+        ESP100A    = 0x01,  /* NCR53C90A */
+        ESP236     = 0x02,
+        FAS236     = 0x03,
+        FAS100A    = 0x04,
+        FAST       = 0x05,
+        FASHME     = 0x06,
+};
+
+struct esp_cmd_entry {
+        struct list_head        list;
+
+        struct scsi_cmnd        *cmd;
+
+        unsigned int            saved_cur_residue;
+        struct scatterlist      *saved_cur_sg;
+        unsigned int            saved_tot_residue;
+
+        u8                      flags;
+#define ESP_CMD_FLAG_WRITE      0x01 /* DMA is a write */
+#define ESP_CMD_FLAG_ABORT      0x02 /* being aborted */
+#define ESP_CMD_FLAG_AUTOSENSE  0x04 /* Doing automatic REQUEST_SENSE */
+
+        u8                      tag[2];
+
+        u8                      status;
+        u8                      message;
+
+        unsigned char           *sense_ptr;
+        unsigned char           *saved_sense_ptr;
+        dma_addr_t              sense_dma;
+
+        struct completion       *eh_done;
+};
+
+/* XXX make this configurable somehow XXX */
+#define ESP_DEFAULT_TAGS        16
+
+#define ESP_MAX_TARGET          16
+#define ESP_MAX_LUN             8
+#define ESP_MAX_TAG             256
+
+struct esp_lun_data {
+        struct esp_cmd_entry    *non_tagged_cmd;
+        int                     num_tagged;
+        int                     hold;
+        struct esp_cmd_entry    *tagged_cmds[ESP_MAX_TAG];
+};
+
+struct esp_target_data {
+        /* These are the ESP_STP, ESP_SOFF, and ESP_CFG3 register values which
+         * match the currently negotiated settings for this target.  The SCSI
+         * protocol values are maintained in spi_{offset,period,wide}(starget).
+         */
+        u8                      esp_period;
+        u8                      esp_offset;
+        u8                      esp_config3;
+
+        u8                      flags;
+#define ESP_TGT_WIDE            0x01
+#define ESP_TGT_DISCONNECT      0x02
+#define ESP_TGT_NEGO_WIDE       0x04
+#define ESP_TGT_NEGO_SYNC       0x08
+#define ESP_TGT_CHECK_NEGO      0x40
+#define ESP_TGT_BROKEN          0x80
+
+        /* When ESP_TGT_CHECK_NEGO is set, on the next scsi command to this
+         * device we will try to negotiate the following parameters.
+         */
+        u8                      nego_goal_period;
+        u8                      nego_goal_offset;
+        u8                      nego_goal_width;
+        u8                      nego_goal_tags;
+
+        struct scsi_target      *starget;
+};
+
+struct esp_event_ent {
+        u8                      type;
+#define ESP_EVENT_TYPE_EVENT    0x01
+#define ESP_EVENT_TYPE_CMD      0x02
+        u8                      val;
+
+        u8                      sreg;
+        u8                      seqreg;
+        u8                      sreg2;
+        u8                      ireg;
+        u8                      select_state;
+        u8                      event;
+        u8                      __pad;
+};
+
+struct esp;
+struct esp_driver_ops {
+        /* Read and write the ESP 8-bit registers.  On some
+         * applications of the ESP chip the registers are at 4-byte
+         * instead of 1-byte intervals.
+         */
+        void (*esp_write8)(struct esp *esp, u8 val, unsigned long reg);
+        u8 (*esp_read8)(struct esp *esp, unsigned long reg);
+
+        /* Map and unmap DMA memory.  Eventually the driver will be
+         * converted to the generic DMA API as soon as SBUS is able to
+         * cope with that.  At such time we can remove this.
+         */
+        dma_addr_t (*map_single)(struct esp *esp, void *buf,
+                                 size_t sz, int dir);
+        int (*map_sg)(struct esp *esp, struct scatterlist *sg,
+                      int num_sg, int dir);
+        void (*unmap_single)(struct esp *esp, dma_addr_t addr,
+                             size_t sz, int dir);
+        void (*unmap_sg)(struct esp *esp, struct scatterlist *sg,
+                         int num_sg, int dir);
+
+        /* Return non-zero if there is an IRQ pending.  Usually this
+         * status bit lives in the DMA controller sitting in front of
+         * the ESP.  This has to be accurate or else the ESP interrupt
+         * handler will not run.
+         */
+        int (*irq_pending)(struct esp *esp);
+
+        /* Reset the DMA engine entirely.  On return, ESP interrupts
+         * should be enabled.  Often the interrupt enabling is
+         * controlled in the DMA engine.
+         */
+        void (*reset_dma)(struct esp *esp);
+
+        /* Drain any pending DMA in the DMA engine after a transfer.
+         * This is for writes to memory.
+         */
+        void (*dma_drain)(struct esp *esp);
+
+        /* Invalidate the DMA engine after a DMA transfer.  */
+        void (*dma_invalidate)(struct esp *esp);
+
+        /* Setup an ESP command that will use a DMA transfer.
+         * The 'esp_count' specifies what transfer length should be
+         * programmed into the ESP transfer counter registers, whereas
+         * the 'dma_count' is the length that should be programmed into
+         * the DMA controller.  Usually they are the same.  If 'write'
+         * is non-zero, this transfer is a write into memory.  'cmd'
+         * holds the ESP command that should be issued by calling
+         * scsi_esp_cmd() at the appropriate time while programming
+         * the DMA hardware.
+         */
+        void (*send_dma_cmd)(struct esp *esp, u32 dma_addr, u32 esp_count,
+                             u32 dma_count, int write, u8 cmd);
+
+        /* Return non-zero if the DMA engine is reporting an error
+         * currently.
+         */
+        int (*dma_error)(struct esp *esp);
+};
+
+#define ESP_MAX_MSG_SZ          8
+#define ESP_EVENT_LOG_SZ        32
+
+#define ESP_QUICKIRQ_LIMIT      100
+#define ESP_RESELECT_TAG_LIMIT  2500
+
+struct esp {
+        void __iomem            *regs;
+        void __iomem            *dma_regs;
+
+        const struct esp_driver_ops *ops;
+
+        struct Scsi_Host        *host;
+        void                    *dev;
+
+        struct esp_cmd_entry    *active_cmd;
+
+        struct list_head        queued_cmds;
+        struct list_head        active_cmds;
+
+        u8                      *command_block;
+        dma_addr_t              command_block_dma;
+
+        unsigned int            data_dma_len;
+
+        /* The following are used to determine the cause of an IRQ. Upon every
+         * IRQ entry we synchronize these with the hardware registers.
+         */
+        u8                      sreg;
+        u8                      seqreg;
+        u8                      sreg2;
+        u8                      ireg;
+
+        u32                     prev_hme_dmacsr;
+        u8                      prev_soff;
+        u8                      prev_stp;
+        u8                      prev_cfg3;
+        u8                      __pad;
+
+        struct list_head        esp_cmd_pool;
+
+        struct esp_target_data  target[ESP_MAX_TARGET];
+
+        int                     fifo_cnt;
+        u8                      fifo[16];
+
+        struct esp_event_ent    esp_event_log[ESP_EVENT_LOG_SZ];
+        int                     esp_event_cur;
+
+        u8                      msg_out[ESP_MAX_MSG_SZ];
+        int                     msg_out_len;
+
+        u8                      msg_in[ESP_MAX_MSG_SZ];
+        int                     msg_in_len;
+
+        u8                      bursts;
+        u8                      config1;
+        u8                      config2;
+
+        u8                      scsi_id;
+        u32                     scsi_id_mask;
+
+        enum esp_rev            rev;
+
+        u32                     flags;
+#define ESP_FLAG_DIFFERENTIAL   0x00000001
+#define ESP_FLAG_RESETTING      0x00000002
+#define ESP_FLAG_DOING_SLOWCMD  0x00000004
+#define ESP_FLAG_WIDE_CAPABLE   0x00000008
+#define ESP_FLAG_QUICKIRQ_CHECK 0x00000010
+
+        u8                      select_state;
+#define ESP_SELECT_NONE         0x00 /* Not selecting */
+#define ESP_SELECT_BASIC        0x01 /* Select w/o MSGOUT phase */
+#define ESP_SELECT_MSGOUT       0x02 /* Select with MSGOUT */
+
+        /* When we are not selecting, we are expecting an event.  */
+        u8                      event;
+#define ESP_EVENT_NONE          0x00
+#define ESP_EVENT_CMD_START     0x01
+#define ESP_EVENT_CMD_DONE      0x02
+#define ESP_EVENT_DATA_IN       0x03
+#define ESP_EVENT_DATA_OUT      0x04
+#define ESP_EVENT_DATA_DONE     0x05
+#define ESP_EVENT_MSGIN         0x06
+#define ESP_EVENT_MSGIN_MORE    0x07
+#define ESP_EVENT_MSGIN_DONE    0x08
+#define ESP_EVENT_MSGOUT        0x09
+#define ESP_EVENT_MSGOUT_DONE   0x0a
+#define ESP_EVENT_STATUS        0x0b
+#define ESP_EVENT_FREE_BUS      0x0c
+#define ESP_EVENT_CHECK_PHASE   0x0d
+#define ESP_EVENT_RESET         0x10
+
+        /* Probed in esp_get_clock_params() */
+        u32                     cfact;
+        u32                     cfreq;
+        u32                     ccycle;
+        u32                     ctick;
+        u32                     neg_defp;
+        u32                     sync_defp;
+
+        /* Computed in esp_reset_esp() */
+        u32                     max_period;
+        u32                     min_period;
+        u32                     radelay;
+
+        /* Slow command state.  */
+        u8                      *cmd_bytes_ptr;
+        int                     cmd_bytes_left;
+
+        struct completion       *eh_reset;
+
+        struct sbus_dma         *dma;
+};
+
+#define host_to_esp(host)       ((struct esp *)(host)->hostdata)
+
+/* A front-end driver for the ESP chip should do the following in
+ * it's device probe routine:
+ * 1) Allocate the host and private area using scsi_host_alloc()
+ *    with size 'sizeof(struct esp)'.  The first argument to
+ *    scsi_host_alloc() should be &scsi_esp_template.
+ * 2) Set host->max_id as appropriate.
+ * 3) Set esp->host to the scsi_host itself, and esp->dev
+ *    to the device object pointer.
+ * 4) Hook up esp->ops to the front-end implementation.
+ * 5) If the ESP chip supports wide transfers, set ESP_FLAG_WIDE_CAPABLE
+ *    in esp->flags.
+ * 6) Map the DMA and ESP chip registers.
+ * 7) DMA map the ESP command block, store the DMA address
+ *    in esp->command_block_dma.
+ * 8) Register the scsi_esp_intr() interrupt handler.
+ * 9) Probe for and provide the following chip properties:
+ *    esp->scsi_id (assign to esp->host->this_id too)
+ *    esp->scsi_id_mask
+ *    If ESP bus is differential, set ESP_FLAG_DIFFERENTIAL
+ *    esp->cfreq
+ *    DMA burst bit mask in esp->bursts, if necessary
+ * 10) Perform any actions necessary before the ESP device can
+ *     be programmed for the first time.  On some configs, for
+ *     example, the DMA engine has to be reset before ESP can
+ *     be programmed.
+ * 11) If necessary, call dev_set_drvdata() as needed.
+ * 12) Call scsi_esp_register() with prepared 'esp' structure
+ *     and a device pointer if possible.
+ * 13) Check scsi_esp_register() return value, release all resources
+ *     if an error was returned.
+ */
+extern struct scsi_host_template scsi_esp_template;
+extern int scsi_esp_register(struct esp *, struct device *);
+
+extern void scsi_esp_unregister(struct esp *);
+extern irqreturn_t scsi_esp_intr(int, void *);
+extern void scsi_esp_cmd(struct esp *, u8);
+
+#endif /* !(_ESP_SCSI_H) */
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index 9f10689905a8..c4195ea869e9 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -1403,7 +1403,7 @@ static int __devinit qpti_sbus_probe(struct of_device *dev, const struct of_devi
         struct scsi_host_template *tpnt = match->data;
         struct Scsi_Host *host;
         struct qlogicpti *qpti;
-        char *fcode;
+        const char *fcode;
 
         /* Sometimes Antares cards come up not completely
          * setup, and we get a report of a zero IRQ.
diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c
index 1b59b27e887f..4bf9aa547c78 100644
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -50,7 +50,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb)
         while (skb->len >= NLMSG_SPACE(0)) {
                 err = 0;
 
-                nlh = (struct nlmsghdr *) skb->data;
+                nlh = nlmsg_hdr(skb);
                 if ((nlh->nlmsg_len < (sizeof(*nlh) + sizeof(*hdr))) ||
                     (skb->len < nlh->nlmsg_len)) {
                         printk(KERN_WARNING "%s: discarding partial skb\n",
@@ -168,7 +168,8 @@ scsi_netlink_init(void)
         }
 
         scsi_nl_sock = netlink_kernel_create(NETLINK_SCSITRANSPORT,
-                                SCSI_NL_GRP_CNT, scsi_nl_rcv, THIS_MODULE);
+                                SCSI_NL_GRP_CNT, scsi_nl_rcv, NULL,
+                                THIS_MODULE);
         if (!scsi_nl_sock) {
                 printk(KERN_ERR "%s: register of recieve handler failed\n",
                                 __FUNCTION__);
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index ce0d14af33c8..aabaa0576ab4 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -1081,7 +1081,7 @@ iscsi_if_rx(struct sock *sk, int len)
                         struct nlmsghdr *nlh;
                         struct iscsi_uevent *ev;
 
-                        nlh = (struct nlmsghdr *)skb->data;
+                        nlh = nlmsg_hdr(skb);
                         if (nlh->nlmsg_len < sizeof(*nlh) ||
                             skb->len < nlh->nlmsg_len) {
                                 break;
@@ -1435,7 +1435,7 @@ static __init int iscsi_transport_init(void)
         if (err)
                 goto unregister_conn_class;
 
-        nls = netlink_kernel_create(NETLINK_ISCSI, 1, iscsi_if_rx,
+        nls = netlink_kernel_create(NETLINK_ISCSI, 1, iscsi_if_rx, NULL,
                         THIS_MODULE);
         if (!nls) {
                 err = -ENOBUFS;
diff --git a/drivers/scsi/sun_esp.c b/drivers/scsi/sun_esp.c
new file mode 100644
index 000000000000..8c766bcd1095
--- /dev/null
+++ b/drivers/scsi/sun_esp.c
@@ -0,0 +1,634 @@
+/* sun_esp.c: ESP front-end for Sparc SBUS systems.
+ *
+ * Copyright (C) 2007 David S. Miller (davem@davemloft.net)
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/init.h>
+
+#include <asm/irq.h>
+#include <asm/io.h>
+#include <asm/dma.h>
+
+#include <asm/sbus.h>
+
+#include <scsi/scsi_host.h>
+
+#include "esp_scsi.h"
+
+#define DRV_MODULE_NAME         "sun_esp"
+#define PFX DRV_MODULE_NAME     ": "
+#define DRV_VERSION             "1.000"
+#define DRV_MODULE_RELDATE      "April 19, 2007"
+
+#define dma_read32(REG) \
+        sbus_readl(esp->dma_regs + (REG))
+#define dma_write32(VAL, REG) \
+        sbus_writel((VAL), esp->dma_regs + (REG))
+
+static int __devinit esp_sbus_find_dma(struct esp *esp, struct sbus_dev *dma_sdev)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct sbus_dma *dma;
+
+        if (dma_sdev != NULL) {
+                for_each_dvma(dma) {
+                        if (dma->sdev == dma_sdev)
+                                break;
+                }
+        } else {
+                for_each_dvma(dma) {
+                        if (dma->sdev == NULL)
+                                break;
+
+                        /* If bus + slot are the same and it has the
+                         * correct OBP name, it's ours.
+                         */
+                        if (sdev->bus == dma->sdev->bus &&
+                            sdev->slot == dma->sdev->slot &&
+                            (!strcmp(dma->sdev->prom_name, "dma") ||
+                             !strcmp(dma->sdev->prom_name, "espdma")))
+                                break;
+                }
+        }
+
+        if (dma == NULL) {
+                printk(KERN_ERR PFX "[%s] Cannot find dma.\n",
+                       sdev->ofdev.node->full_name);
+                return -ENODEV;
+        }
+        esp->dma = dma;
+        esp->dma_regs = dma->regs;
+
+        return 0;
+
+}
+
+static int __devinit esp_sbus_map_regs(struct esp *esp, int hme)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct resource *res;
+
+        /* On HME, two reg sets exist, first is DVMA,
+         * second is ESP registers.
+         */
+        if (hme)
+                res = &sdev->resource[1];
+        else
+                res = &sdev->resource[0];
+
+        esp->regs = sbus_ioremap(res, 0, SBUS_ESP_REG_SIZE, "ESP");
+        if (!esp->regs)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static int __devinit esp_sbus_map_command_block(struct esp *esp)
+{
+        struct sbus_dev *sdev = esp->dev;
+
+        esp->command_block = sbus_alloc_consistent(sdev, 16,
+                                                   &esp->command_block_dma);
+        if (!esp->command_block)
+                return -ENOMEM;
+        return 0;
+}
+
+static int __devinit esp_sbus_register_irq(struct esp *esp)
+{
+        struct Scsi_Host *host = esp->host;
+        struct sbus_dev *sdev = esp->dev;
+
+        host->irq = sdev->irqs[0];
+        return request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp);
+}
+
+static void __devinit esp_get_scsi_id(struct esp *esp)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct device_node *dp = sdev->ofdev.node;
+
+        esp->scsi_id = of_getintprop_default(dp, "initiator-id", 0xff);
+        if (esp->scsi_id != 0xff)
+                goto done;
+
+        esp->scsi_id = of_getintprop_default(dp, "scsi-initiator-id", 0xff);
+        if (esp->scsi_id != 0xff)
+                goto done;
+
+        if (!sdev->bus) {
+                /* SUN4 */
+                esp->scsi_id = 7;
+                goto done;
+        }
+
+        esp->scsi_id = of_getintprop_default(sdev->bus->ofdev.node,
+                                             "scsi-initiator-id", 7);
+
+done:
+        esp->host->this_id = esp->scsi_id;
+        esp->scsi_id_mask = (1 << esp->scsi_id);
+}
+
+static void __devinit esp_get_differential(struct esp *esp)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct device_node *dp = sdev->ofdev.node;
+
+        if (of_find_property(dp, "differential", NULL))
+                esp->flags |= ESP_FLAG_DIFFERENTIAL;
+        else
+                esp->flags &= ~ESP_FLAG_DIFFERENTIAL;
+}
+
+static void __devinit esp_get_clock_params(struct esp *esp)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct device_node *dp = sdev->ofdev.node;
+        struct device_node *bus_dp;
+        int fmhz;
+
+        bus_dp = NULL;
+        if (sdev != NULL && sdev->bus != NULL)
+                bus_dp = sdev->bus->ofdev.node;
+
+        fmhz = of_getintprop_default(dp, "clock-frequency", 0);
+        if (fmhz == 0)
+                fmhz = (!bus_dp) ? 0 :
+                        of_getintprop_default(bus_dp, "clock-frequency", 0);
+
+        esp->cfreq = fmhz;
+}
+
+static void __devinit esp_get_bursts(struct esp *esp, struct sbus_dev *dma)
+{
+        struct sbus_dev *sdev = esp->dev;
+        struct device_node *dp = sdev->ofdev.node;
+        u8 bursts;
+
+        bursts = of_getintprop_default(dp, "burst-sizes", 0xff);
+        if (dma) {
+                struct device_node *dma_dp = dma->ofdev.node;
+                u8 val = of_getintprop_default(dma_dp, "burst-sizes", 0xff);
+                if (val != 0xff)
+                        bursts &= val;
+        }
+
+        if (sdev->bus) {
+                u8 val = of_getintprop_default(sdev->bus->ofdev.node,
+                                               "burst-sizes", 0xff);
+                if (val != 0xff)
+                        bursts &= val;
+        }
+
+        if (bursts == 0xff ||
+            (bursts & DMA_BURST16) == 0 ||
+            (bursts & DMA_BURST32) == 0)
+                bursts = (DMA_BURST32 - 1);
+
+        esp->bursts = bursts;
+}
+
+static void __devinit esp_sbus_get_props(struct esp *esp, struct sbus_dev *espdma)
+{
+        esp_get_scsi_id(esp);
+        esp_get_differential(esp);
+        esp_get_clock_params(esp);
+        esp_get_bursts(esp, espdma);
+}
+
+static void sbus_esp_write8(struct esp *esp, u8 val, unsigned long reg)
+{
+        sbus_writeb(val, esp->regs + (reg * 4UL));
+}
+
+static u8 sbus_esp_read8(struct esp *esp, unsigned long reg)
+{
+        return sbus_readb(esp->regs + (reg * 4UL));
+}
+
+static dma_addr_t sbus_esp_map_single(struct esp *esp, void *buf,
+                                      size_t sz, int dir)
+{
+        return sbus_map_single(esp->dev, buf, sz, dir);
+}
+
+static int sbus_esp_map_sg(struct esp *esp, struct scatterlist *sg,
+                                  int num_sg, int dir)
+{
+        return sbus_map_sg(esp->dev, sg, num_sg, dir);
+}
+
+static void sbus_esp_unmap_single(struct esp *esp, dma_addr_t addr,
+                                  size_t sz, int dir)
+{
+        sbus_unmap_single(esp->dev, addr, sz, dir);
+}
+
+static void sbus_esp_unmap_sg(struct esp *esp, struct scatterlist *sg,
+                              int num_sg, int dir)
+{
+        sbus_unmap_sg(esp->dev, sg, num_sg, dir);
+}
+
+static int sbus_esp_irq_pending(struct esp *esp)
+{
+        if (dma_read32(DMA_CSR) & (DMA_HNDL_INTR | DMA_HNDL_ERROR))
+                return 1;
+        return 0;
+}
+
+static void sbus_esp_reset_dma(struct esp *esp)
+{
+        int can_do_burst16, can_do_burst32, can_do_burst64;
+        int can_do_sbus64, lim;
+        u32 val;
+
+        can_do_burst16 = (esp->bursts & DMA_BURST16) != 0;
+        can_do_burst32 = (esp->bursts & DMA_BURST32) != 0;
+        can_do_burst64 = 0;
+        can_do_sbus64 = 0;
+        if (sbus_can_dma_64bit(esp->dev))
+                can_do_sbus64 = 1;
+        if (sbus_can_burst64(esp->sdev))
+                can_do_burst64 = (esp->bursts & DMA_BURST64) != 0;
+
+        /* Put the DVMA into a known state. */
+        if (esp->dma->revision != dvmahme) {
+                val = dma_read32(DMA_CSR);
+                dma_write32(val | DMA_RST_SCSI, DMA_CSR);
+                dma_write32(val & ~DMA_RST_SCSI, DMA_CSR);
+        }
+        switch (esp->dma->revision) {
+        case dvmahme:
+                dma_write32(DMA_RESET_FAS366, DMA_CSR);
+                dma_write32(DMA_RST_SCSI, DMA_CSR);
+
+                esp->prev_hme_dmacsr = (DMA_PARITY_OFF | DMA_2CLKS |
+                                        DMA_SCSI_DISAB | DMA_INT_ENAB);
+
+                esp->prev_hme_dmacsr &= ~(DMA_ENABLE | DMA_ST_WRITE |
+                                          DMA_BRST_SZ);
+
+                if (can_do_burst64)
+                        esp->prev_hme_dmacsr |= DMA_BRST64;
+                else if (can_do_burst32)
+                        esp->prev_hme_dmacsr |= DMA_BRST32;
+
+                if (can_do_sbus64) {
+                        esp->prev_hme_dmacsr |= DMA_SCSI_SBUS64;
+                        sbus_set_sbus64(esp->dev, esp->bursts);
+                }
+
+                lim = 1000;
+                while (dma_read32(DMA_CSR) & DMA_PEND_READ) {
+                        if (--lim == 0) {
+                                printk(KERN_ALERT PFX "esp%d: DMA_PEND_READ "
+                                       "will not clear!\n",
+                                       esp->host->unique_id);
+                                break;
+                        }
+                        udelay(1);
+                }
+
+                dma_write32(0, DMA_CSR);
+                dma_write32(esp->prev_hme_dmacsr, DMA_CSR);
+
+                dma_write32(0, DMA_ADDR);
+                break;
+
+        case dvmarev2:
+                if (esp->rev != ESP100) {
+                        val = dma_read32(DMA_CSR);
+                        dma_write32(val | DMA_3CLKS, DMA_CSR);
+                }
+                break;
+
+        case dvmarev3:
+                val = dma_read32(DMA_CSR);
+                val &= ~DMA_3CLKS;
+                val |= DMA_2CLKS;
+                if (can_do_burst32) {
+                        val &= ~DMA_BRST_SZ;
+                        val |= DMA_BRST32;
+                }
+                dma_write32(val, DMA_CSR);
+                break;
+
+        case dvmaesc1:
+                val = dma_read32(DMA_CSR);
+                val |= DMA_ADD_ENABLE;
+                val &= ~DMA_BCNT_ENAB;
+                if (!can_do_burst32 && can_do_burst16) {
+                        val |= DMA_ESC_BURST;
+                } else {
+                        val &= ~(DMA_ESC_BURST);
+                }
+                dma_write32(val, DMA_CSR);
+                break;
+
+        default:
+                break;
+        }
+
+        /* Enable interrupts.  */
+        val = dma_read32(DMA_CSR);
+        dma_write32(val | DMA_INT_ENAB, DMA_CSR);
+}
+
+static void sbus_esp_dma_drain(struct esp *esp)
+{
+        u32 csr;
+        int lim;
+
+        if (esp->dma->revision == dvmahme)
+                return;
+
+        csr = dma_read32(DMA_CSR);
+        if (!(csr & DMA_FIFO_ISDRAIN))
+                return;
+
+        if (esp->dma->revision != dvmarev3 && esp->dma->revision != dvmaesc1)
+                dma_write32(csr | DMA_FIFO_STDRAIN, DMA_CSR);
+
+        lim = 1000;
+        while (dma_read32(DMA_CSR) & DMA_FIFO_ISDRAIN) {
+                if (--lim == 0) {
+                        printk(KERN_ALERT PFX "esp%d: DMA will not drain!\n",
+                               esp->host->unique_id);
+                        break;
+                }
+                udelay(1);
+        }
+}
+
+static void sbus_esp_dma_invalidate(struct esp *esp)
+{
+        if (esp->dma->revision == dvmahme) {
+                dma_write32(DMA_RST_SCSI, DMA_CSR);
+
+                esp->prev_hme_dmacsr = ((esp->prev_hme_dmacsr |
+                                         (DMA_PARITY_OFF | DMA_2CLKS |
+                                          DMA_SCSI_DISAB | DMA_INT_ENAB)) &
+                                        ~(DMA_ST_WRITE | DMA_ENABLE));
+
+                dma_write32(0, DMA_CSR);
+                dma_write32(esp->prev_hme_dmacsr, DMA_CSR);
+
+                /* This is necessary to avoid having the SCSI channel
+                 * engine lock up on us.
+                 */
+                dma_write32(0, DMA_ADDR);
+        } else {
+                u32 val;
+                int lim;
+
+                lim = 1000;
+                while ((val = dma_read32(DMA_CSR)) & DMA_PEND_READ) {
+                        if (--lim == 0) {
+                                printk(KERN_ALERT PFX "esp%d: DMA will not "
+                                       "invalidate!\n", esp->host->unique_id);
+                                break;
+                        }
+                        udelay(1);
+                }
+
+                val &= ~(DMA_ENABLE | DMA_ST_WRITE | DMA_BCNT_ENAB);
+                val |= DMA_FIFO_INV;
+                dma_write32(val, DMA_CSR);
+                val &= ~DMA_FIFO_INV;
+                dma_write32(val, DMA_CSR);
+        }
+}
+
+static void sbus_esp_send_dma_cmd(struct esp *esp, u32 addr, u32 esp_count,
+                                  u32 dma_count, int write, u8 cmd)
+{
+        u32 csr;
+
+        BUG_ON(!(cmd & ESP_CMD_DMA));
+
+        sbus_esp_write8(esp, (esp_count >> 0) & 0xff, ESP_TCLOW);
+        sbus_esp_write8(esp, (esp_count >> 8) & 0xff, ESP_TCMED);
+        if (esp->rev == FASHME) {
+                sbus_esp_write8(esp, (esp_count >> 16) & 0xff, FAS_RLO);
+                sbus_esp_write8(esp, 0, FAS_RHI);
+
+                scsi_esp_cmd(esp, cmd);
+
+                csr = esp->prev_hme_dmacsr;
+                csr |= DMA_SCSI_DISAB | DMA_ENABLE;
+                if (write)
+                        csr |= DMA_ST_WRITE;
+                else
+                        csr &= ~DMA_ST_WRITE;
+                esp->prev_hme_dmacsr = csr;
+
+                dma_write32(dma_count, DMA_COUNT);
+                dma_write32(addr, DMA_ADDR);
+                dma_write32(csr, DMA_CSR);
+        } else {
+                csr = dma_read32(DMA_CSR);
+                csr |= DMA_ENABLE;
+                if (write)
+                        csr |= DMA_ST_WRITE;
+                else
+                        csr &= ~DMA_ST_WRITE;
+                dma_write32(csr, DMA_CSR);
+                if (esp->dma->revision == dvmaesc1) {
+                        u32 end = PAGE_ALIGN(addr + dma_count + 16U);
+                        dma_write32(end - addr, DMA_COUNT);
+                }
+                dma_write32(addr, DMA_ADDR);
+
+                scsi_esp_cmd(esp, cmd);
+        }
+
+}
+
+static int sbus_esp_dma_error(struct esp *esp)
+{
+        u32 csr = dma_read32(DMA_CSR);
+
+        if (csr & DMA_HNDL_ERROR)
+                return 1;
+
+        return 0;
+}
+
+static const struct esp_driver_ops sbus_esp_ops = {
+        .esp_write8     =       sbus_esp_write8,
+        .esp_read8      =       sbus_esp_read8,
+        .map_single     =       sbus_esp_map_single,
+        .map_sg         =       sbus_esp_map_sg,
+        .unmap_single   =       sbus_esp_unmap_single,
+        .unmap_sg       =       sbus_esp_unmap_sg,
+        .irq_pending    =       sbus_esp_irq_pending,
+        .reset_dma      =       sbus_esp_reset_dma,
+        .dma_drain      =       sbus_esp_dma_drain,
+        .dma_invalidate =       sbus_esp_dma_invalidate,
+        .send_dma_cmd   =       sbus_esp_send_dma_cmd,
+        .dma_error      =       sbus_esp_dma_error,
+};
+
+static int __devinit esp_sbus_probe_one(struct device *dev,
+                                        struct sbus_dev *esp_dev,
+                                        struct sbus_dev *espdma,
+                                        struct sbus_bus *sbus,
+                                        int hme)
+{
+        struct scsi_host_template *tpnt = &scsi_esp_template;
+        struct Scsi_Host *host;
+        struct esp *esp;
+        int err;
+
+        host = scsi_host_alloc(tpnt, sizeof(struct esp));
+
+        err = -ENOMEM;
+        if (!host)
+                goto fail;
+
+        host->max_id = (hme ? 16 : 8);
+        esp = host_to_esp(host);
+
+        esp->host = host;
+        esp->dev = esp_dev;
+        esp->ops = &sbus_esp_ops;
+
+        if (hme)
+                esp->flags |= ESP_FLAG_WIDE_CAPABLE;
+
+        err = esp_sbus_find_dma(esp, espdma);
+        if (err < 0)
+                goto fail_unlink;
+
+        err = esp_sbus_map_regs(esp, hme);
+        if (err < 0)
+                goto fail_unlink;
+
+        err = esp_sbus_map_command_block(esp);
+        if (err < 0)
+                goto fail_unmap_regs;
+
+        err = esp_sbus_register_irq(esp);
+        if (err < 0)
+                goto fail_unmap_command_block;
+
+        esp_sbus_get_props(esp, espdma);
+
+        /* Before we try to touch the ESP chip, ESC1 dma can
+         * come up with the reset bit set, so make sure that
+         * is clear first.
+         */
+        if (esp->dma->revision == dvmaesc1) {
+                u32 val = dma_read32(DMA_CSR);
+
+                dma_write32(val & ~DMA_RST_SCSI, DMA_CSR);
+        }
+
+        dev_set_drvdata(&esp_dev->ofdev.dev, esp);
+
+        err = scsi_esp_register(esp, dev);
+        if (err)
+                goto fail_free_irq;
+
+        return 0;
+
+fail_free_irq:
+        free_irq(host->irq, esp);
+fail_unmap_command_block:
+        sbus_free_consistent(esp->dev, 16,
+                             esp->command_block,
+                             esp->command_block_dma);
+fail_unmap_regs:
+        sbus_iounmap(esp->regs, SBUS_ESP_REG_SIZE);
+fail_unlink:
+        scsi_host_put(host);
+fail:
+        return err;
+}
+
+static int __devinit esp_sbus_probe(struct of_device *dev, const struct of_device_id *match)
+{
+        struct sbus_dev *sdev = to_sbus_device(&dev->dev);
+        struct device_node *dp = dev->node;
+        struct sbus_dev *dma_sdev = NULL;
+        int hme = 0;
+
+        if (dp->parent &&
+            (!strcmp(dp->parent->name, "espdma") ||
+             !strcmp(dp->parent->name, "dma")))
+                dma_sdev = sdev->parent;
+        else if (!strcmp(dp->name, "SUNW,fas")) {
+                dma_sdev = sdev;
+                hme = 1;
+        }
+
+        return esp_sbus_probe_one(&dev->dev, sdev, dma_sdev,
+                                  sdev->bus, hme);
+}
+
+static int __devexit esp_sbus_remove(struct of_device *dev)
+{
+        struct esp *esp = dev_get_drvdata(&dev->dev);
+        unsigned int irq = esp->host->irq;
+        u32 val;
+
+        scsi_esp_unregister(esp);
+
+        /* Disable interrupts.  */
+        val = dma_read32(DMA_CSR);
+        dma_write32(val & ~DMA_INT_ENAB, DMA_CSR);
+
+        free_irq(irq, esp);
+        sbus_free_consistent(esp->dev, 16,
+                             esp->command_block,
+                             esp->command_block_dma);
+        sbus_iounmap(esp->regs, SBUS_ESP_REG_SIZE);
+
+        scsi_host_put(esp->host);
+
+        return 0;
+}
+
+static struct of_device_id esp_match[] = {
+        {
+                .name = "SUNW,esp",
+        },
+        {
+                .name = "SUNW,fas",
+        },
+        {
+                .name = "esp",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, esp_match);
+
+static struct of_platform_driver esp_sbus_driver = {
+        .name           = "esp",
+        .match_table    = esp_match,
+        .probe          = esp_sbus_probe,
+        .remove         = __devexit_p(esp_sbus_remove),
+};
+
+static int __init sunesp_init(void)
+{
+        return of_register_driver(&esp_sbus_driver, &sbus_bus_type);
+}
+
+static void __exit sunesp_exit(void)
+{
+        of_unregister_driver(&esp_sbus_driver);
+}
+
+MODULE_DESCRIPTION("Sun ESP SCSI driver");
+MODULE_AUTHOR("David S. Miller (davem@davemloft.net)");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
+
+module_init(sunesp_init);
+module_exit(sunesp_exit);
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index c129a0e8e807..90621c3312bc 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1310,7 +1310,8 @@ static unsigned int check_modem_status(struct uart_8250_port *up)
 {
         unsigned int status = serial_in(up, UART_MSR);
 
-        if (status & UART_MSR_ANY_DELTA && up->ier & UART_IER_MSI) {
+        if (status & UART_MSR_ANY_DELTA && up->ier & UART_IER_MSI &&
+            up->port.info != NULL) {
                 if (status & UART_MSR_TERI)
                         up->port.icount.rng++;
                 if (status & UART_MSR_DDSR)
@@ -1333,8 +1334,9 @@ static inline void
 serial8250_handle_port(struct uart_8250_port *up)
 {
         unsigned int status;
+        unsigned long flags;
 
-        spin_lock(&up->port.lock);
+        spin_lock_irqsave(&up->port.lock, flags);
 
         status = serial_inp(up, UART_LSR);
 
@@ -1346,7 +1348,7 @@ serial8250_handle_port(struct uart_8250_port *up)
         if (status & UART_LSR_THRE)
                 transmit_chars(up);
 
-        spin_unlock(&up->port.lock);
+        spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 /*
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index 41431d0d5512..246c5572667b 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -164,7 +164,7 @@ static void free_port_memory(struct icom_port *icom_port)
         }
 }
 
-static int __init get_port_memory(struct icom_port *icom_port)
+static int __devinit get_port_memory(struct icom_port *icom_port)
 {
         int index;
         unsigned long stgAddr;
@@ -1380,7 +1380,7 @@ static void icom_port_active(struct icom_port *icom_port, struct icom_adapter *i
                             0x8024 + 2 - 2 * (icom_port->port - 2);
         }
 }
-static int __init icom_load_ports(struct icom_adapter *icom_adapter)
+static int __devinit icom_load_ports(struct icom_adapter *icom_adapter)
 {
         struct icom_port *icom_port;
         int port_num;
@@ -1473,7 +1473,7 @@ static void icom_remove_adapter(struct icom_adapter *icom_adapter)
                 }
         }
 
-        free_irq(icom_adapter->irq_number, (void *) icom_adapter);
+        free_irq(icom_adapter->pci_dev->irq, (void *) icom_adapter);
         iounmap(icom_adapter->base_addr);
         icom_free_adapter(icom_adapter);
         pci_release_regions(icom_adapter->pci_dev);
@@ -1539,7 +1539,6 @@ static int __devinit icom_probe(struct pci_dev *dev,
         }
 
          icom_adapter->base_addr_pci = pci_resource_start(dev, 0);
-         icom_adapter->irq_number = dev->irq;
          icom_adapter->pci_dev = dev;
          icom_adapter->version = ent->driver_data;
          icom_adapter->subsystem_id = ent->subdevice;
@@ -1570,7 +1569,7 @@ static int __devinit icom_probe(struct pci_dev *dev,
                 icom_port = &icom_adapter->port_info[index];
 
                 if (icom_port->status == ICOM_PORT_ACTIVE) {
-                        icom_port->uart_port.irq = icom_port->adapter->irq_number;
+                        icom_port->uart_port.irq = icom_port->adapter->pci_dev->irq;
                         icom_port->uart_port.type = PORT_ICOM;
                         icom_port->uart_port.iotype = UPIO_MEM;
                         icom_port->uart_port.membase =
diff --git a/drivers/serial/icom.h b/drivers/serial/icom.h
index 798f1ef23712..e8578d8cd35e 100644
--- a/drivers/serial/icom.h
+++ b/drivers/serial/icom.h
@@ -258,7 +258,6 @@ struct icom_port {
 struct icom_adapter {
         void __iomem * base_addr;
         unsigned long base_addr_pci;
-        unsigned char irq_number;
         struct pci_dev *pci_dev;
         struct icom_port port_info[4];
         int index;
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 96a852aa1903..bfd44177a215 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1387,8 +1387,8 @@ static enum su_type __devinit su_get_type(struct device_node *dp)
         struct device_node *ap = of_find_node_by_path("/aliases");
 
         if (ap) {
-                char *keyb = of_get_property(ap, "keyboard", NULL);
-                char *ms = of_get_property(ap, "mouse", NULL);
+                const char *keyb = of_get_property(ap, "keyboard", NULL);
+                const char *ms = of_get_property(ap, "mouse", NULL);
 
                 if (keyb) {
                         if (dp == of_find_node_by_path(keyb))
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index ec63b0ee0743..d3e2c5f90a26 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -343,7 +343,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
                 UDSL_ASSERT(sarb->tail + ATM_CELL_PAYLOAD <= sarb->end);
         }
 
-        memcpy(sarb->tail, source + ATM_CELL_HEADER, ATM_CELL_PAYLOAD);
+        memcpy(skb_tail_pointer(sarb), source + ATM_CELL_HEADER, ATM_CELL_PAYLOAD);
         __skb_put(sarb, ATM_CELL_PAYLOAD);
 
         if (pti & 1) {
@@ -370,7 +370,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
                         goto out;
                 }
 
-                if (crc32_be(~0, sarb->tail - pdu_length, pdu_length) != 0xc704dd7b) {
+                if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
                         atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
                                   __func__, vcc);
                         atomic_inc(&vcc->stats->rx_err);
@@ -396,7 +396,9 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
                         goto out;       /* atm_charge increments rx_drop */
                 }
 
-                memcpy(skb->data, sarb->tail - pdu_length, length);
+                skb_copy_to_linear_data(skb,
+                                        skb_tail_pointer(sarb) - pdu_length,
+                                        length);
                 __skb_put(skb, length);
 
                 vdbg("%s: sending skb 0x%p, skb->len %u, skb->truesize %u",
@@ -484,7 +486,7 @@ static unsigned int usbatm_write_cells(struct usbatm_data *instance,
                 ptr[4] = 0xec;
                 ptr += ATM_CELL_HEADER;
 
-                memcpy(ptr, skb->data, data_len);
+                skb_copy_from_linear_data(skb, ptr, data_len);
                 ptr += data_len;
                 __skb_pull(skb, data_len);
 
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 04e6b8508fb6..8f9f217e0a68 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -1766,7 +1766,6 @@ static void rx_complete (struct usb_ep *ep, struct usb_request *req)
                         break;
                 }
 
-                skb->dev = dev->net;
                 skb->protocol = eth_type_trans (skb, dev->net);
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += skb->len;
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index 5808ea082459..d5ef97bc4d01 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -298,7 +298,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 if (ax_skb) {
                         ax_skb->len = size;
                         ax_skb->data = packet;
-                        ax_skb->tail = packet + size;
+                        skb_set_tail_pointer(ax_skb, size);
                         usbnet_skb_return(dev, ax_skb);
                 } else {
                         return 0;
@@ -338,7 +338,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
             && ((headroom + tailroom) >= (4 + padlen))) {
                 if ((headroom < 4) || (tailroom < padlen)) {
                         skb->data = memmove(skb->head + 4, skb->data, skb->len);
-                        skb->tail = skb->data + skb->len;
+                        skb_set_tail_pointer(skb, skb->len);
                 }
         } else {
                 struct sk_buff *skb2;
@@ -352,11 +352,11 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         skb_push(skb, 4);
         packet_len = (((skb->len - 4) ^ 0x0000ffff) << 16) + (skb->len - 4);
         cpu_to_le32s(&packet_len);
-        memcpy(skb->data, &packet_len, sizeof(packet_len));
+        skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
 
         if ((skb->len % 512) == 0) {
                 cpu_to_le32s(&padbytes);
-                memcpy( skb->tail, &padbytes, sizeof(padbytes));
+                memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                 skb_put(skb, sizeof(padbytes));
         }
         return skb;
diff --git a/drivers/usb/net/catc.c b/drivers/usb/net/catc.c
index 4852012735f6..ffec2e01b896 100644
--- a/drivers/usb/net/catc.c
+++ b/drivers/usb/net/catc.c
@@ -255,7 +255,6 @@ static void catc_rx_done(struct urb *urb)
                 if (!(skb = dev_alloc_skb(pkt_len)))
                         return;
 
-                skb->dev = catc->netdev;
                 eth_copy_and_sum(skb, pkt_start + pkt_offset, pkt_len, 0);
                 skb_put(skb, pkt_len);
 
@@ -419,7 +418,7 @@ static int catc_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         catc->tx_ptr = (((catc->tx_ptr - 1) >> 6) + 1) << 6;
         tx_buf = catc->tx_buf[catc->tx_idx] + catc->tx_ptr;
         *((u16*)tx_buf) = (catc->is_f5u011) ? cpu_to_be16((u16)skb->len) : cpu_to_le16((u16)skb->len);
-        memcpy(tx_buf + 2, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, tx_buf + 2, skb->len);
         catc->tx_ptr += skb->len + 2;
 
         if (!test_and_set_bit(TX_RUNNING, &catc->flags))
diff --git a/drivers/usb/net/gl620a.c b/drivers/usb/net/gl620a.c
index d257a8e026d6..031cf5ca4dbb 100644
--- a/drivers/usb/net/gl620a.c
+++ b/drivers/usb/net/gl620a.c
@@ -157,7 +157,7 @@ genelink_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                 if ((headroom < (4 + 4*1)) || (tailroom < padlen)) {
                         skb->data = memmove(skb->head + (4 + 4*1),
                                              skb->data, skb->len);
-                        skb->tail = skb->data + skb->len;
+                        skb_set_tail_pointer(skb, skb->len);
                 }
         } else {
                 struct sk_buff  *skb2;
diff --git a/drivers/usb/net/kaweth.c b/drivers/usb/net/kaweth.c
index de95268ae4b8..a0cc05d21a6a 100644
--- a/drivers/usb/net/kaweth.c
+++ b/drivers/usb/net/kaweth.c
@@ -636,8 +636,6 @@ static void kaweth_usb_receive(struct urb *urb)
 
                 skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
 
-                skb->dev = net;
-
                 eth_copy_and_sum(skb, kaweth->rx_buf + 2, pkt_len, 0);
 
                 skb_put(skb, pkt_len);
diff --git a/drivers/usb/net/net1080.c b/drivers/usb/net/net1080.c
index ccebfdef4751..19bf8dae70c9 100644
--- a/drivers/usb/net/net1080.c
+++ b/drivers/usb/net/net1080.c
@@ -520,7 +520,7 @@ net1080_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                         skb->data = memmove(skb->head
                                                 + sizeof (struct nc_header),
                                             skb->data, skb->len);
-                        skb->tail = skb->data + len;
+                        skb_set_tail_pointer(skb, len);
                         goto encapsulate;
                 }
         }
diff --git a/drivers/usb/net/pegasus.c b/drivers/usb/net/pegasus.c
index d48c024cff59..1ad4ee54b186 100644
--- a/drivers/usb/net/pegasus.c
+++ b/drivers/usb/net/pegasus.c
@@ -316,6 +316,7 @@ static int update_eth_regs_async(pegasus_t * pegasus)
         return ret;
 }
 
+/* Returns 0 on success, error on failure */
 static int read_mii_word(pegasus_t * pegasus, __u8 phy, __u8 indx, __u16 * regd)
 {
         int i;
@@ -574,7 +575,6 @@ static void fill_skb_pool(pegasus_t * pegasus)
                  */
                 if (pegasus->rx_pool[i] == NULL)
                         return;
-                pegasus->rx_pool[i]->dev = pegasus->net;
                 skb_reserve(pegasus->rx_pool[i], 2);
         }
 }
@@ -847,10 +847,16 @@ static void intr_callback(struct urb *urb)
                  * d[0].NO_CARRIER kicks in only with failed TX.
                  * ... so monitoring with MII may be safest.
                  */
-                if (d[0] & NO_CARRIER)
-                        netif_carrier_off(net); 
-                else
-                        netif_carrier_on(net);
+                if (pegasus->features & TRUST_LINK_STATUS) {
+                        if (d[5] & LINK_STATUS)
+                                netif_carrier_on(net);
+                        else
+                                netif_carrier_off(net);
+                } else {
+                        /* Never set carrier _on_ based on ! NO_CARRIER */
+                        if (d[0] & NO_CARRIER)
+                                netif_carrier_off(net); 
+                }
 
                 /* bytes 3-4 == rx_lostpkt, reg 2E/2F */
                 pegasus->stats.rx_missed_errors += ((d[3] & 0x7f) << 8) | d[4];
@@ -883,7 +889,7 @@ static int pegasus_start_xmit(struct sk_buff *skb, struct net_device *net)
         netif_stop_queue(net);
 
         ((__le16 *) pegasus->tx_buff)[0] = cpu_to_le16(l16);
-        memcpy(pegasus->tx_buff + 2, skb->data, skb->len);
+        skb_copy_from_linear_data(skb, pegasus->tx_buff + 2, skb->len);
         usb_fill_bulk_urb(pegasus->tx_urb, pegasus->usb,
                           usb_sndbulkpipe(pegasus->usb, 2),
                           pegasus->tx_buff, count,
@@ -950,7 +956,7 @@ static void set_carrier(struct net_device *net)
         pegasus_t *pegasus = netdev_priv(net);
         u16 tmp;
 
-        if (!read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
+        if (read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
                 return;
 
         if (tmp & BMSR_LSTATUS)
@@ -1408,8 +1414,10 @@ static void pegasus_disconnect(struct usb_interface *intf)
         unlink_all_urbs(pegasus);
         free_all_urbs(pegasus);
         free_skb_pool(pegasus);
-        if (pegasus->rx_skb)
+        if (pegasus->rx_skb != NULL) {
                 dev_kfree_skb(pegasus->rx_skb);
+                pegasus->rx_skb = NULL;
+        }
         free_netdev(pegasus->net);
 }
 
diff --git a/drivers/usb/net/pegasus.h b/drivers/usb/net/pegasus.h
index c7467823cd1c..c7aadb413e8c 100644
--- a/drivers/usb/net/pegasus.h
+++ b/drivers/usb/net/pegasus.h
@@ -11,6 +11,7 @@
 
 #define PEGASUS_II              0x80000000
 #define HAS_HOME_PNA            0x40000000
+#define TRUST_LINK_STATUS       0x20000000
 
 #define PEGASUS_MTU             1536
 #define RX_SKBS                 4
@@ -203,7 +204,7 @@ PEGASUS_DEV( "AEI USB Fast Ethernet Adapter", VENDOR_AEILAB, 0x1701,
 PEGASUS_DEV( "Allied Telesyn Int. AT-USB100", VENDOR_ALLIEDTEL, 0xb100,
                 DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Belkin F5D5050 USB Ethernet", VENDOR_BELKIN, 0x0121,
-                DEFAULT_GPIO_RESET | PEGASUS_II )
+                DEFAULT_GPIO_RESET | PEGASUS_II | TRUST_LINK_STATUS )
 PEGASUS_DEV( "Billionton USB-100", VENDOR_BILLIONTON, 0x0986,
                 DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "Billionton USBLP-100", VENDOR_BILLIONTON, 0x0987,
diff --git a/drivers/usb/net/rndis_host.c b/drivers/usb/net/rndis_host.c
index 39a21c74fdf4..1d36772ba6e1 100644
--- a/drivers/usb/net/rndis_host.c
+++ b/drivers/usb/net/rndis_host.c
@@ -588,7 +588,7 @@ rndis_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
                 if (likely((sizeof *hdr) <= room)) {
                         skb->data = memmove(skb->head + sizeof *hdr,
                                             skb->data, len);
-                        skb->tail = skb->data + len;
+                        skb_set_tail_pointer(skb, len);
                         goto fill;
                 }
         }
diff --git a/drivers/usb/net/rtl8150.c b/drivers/usb/net/rtl8150.c
index ea153dc9b0ac..fa598f0340cf 100644
--- a/drivers/usb/net/rtl8150.c
+++ b/drivers/usb/net/rtl8150.c
@@ -646,7 +646,6 @@ static void fill_skb_pool(rtl8150_t *dev)
                 if (!skb) {
                         return;
                 }
-                skb->dev = dev->netdev;
                 skb_reserve(skb, 2);
                 dev->rx_skb_pool[i] = skb;
         }
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index de69b183bd2f..0c5465a7909b 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -203,7 +203,6 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
 {
         int     status;
 
-        skb->dev = dev->net;
         skb->protocol = eth_type_trans (skb, dev->net);
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += skb->len;
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index e4f0dd00ae85..8372ace4a0d9 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -139,7 +139,7 @@ config FB_TILEBLITTING
          This is particularly important to one driver, matroxfb.  If
          unsure, say N.
 
-comment "Frambuffer hardware drivers"
+comment "Frame buffer hardware drivers"
         depends on FB
 
 config FB_CIRRUS
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index d7627fc4f11e..8514f2a6f060 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -2899,7 +2899,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                         struct fb_info *info, unsigned long addr)
 {
         struct atyfb_par *par = info->par;
-        struct pcidev_cookie *pcp;
+        struct device_node *dp;
         char prop[128];
         int node, len, i, j, ret;
         u32 mem, chip_id;
@@ -3037,8 +3037,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                         node = 0;
         }
 
-        pcp = pdev->sysdata;
-        if (node == pcp->prom_node->node) {
+        dp = pci_device_to_OF_node(pdev);
+        if (node == dp->node) {
                 struct fb_var_screeninfo *var = &default_var;
                 unsigned int N, P, Q, M, T, R;
                 u32 v_total, h_total;
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 1bf6f42eb400..a4b3fd185de7 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -410,7 +410,7 @@ static int  __devinit radeon_find_mem_vbios(struct radeonfb_info *rinfo)
 }
 #endif
 
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
 /*
  * Read XTAL (ref clock), SCLK and MCLK from Open Firmware device
  * tree. Hopefully, ATI OF driver is kind enough to fill these
@@ -440,7 +440,7 @@ static int __devinit radeon_read_xtal_OF (struct radeonfb_info *rinfo)
 
         return 0;
 }
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
 
 /*
  * Read PLL infos from chip registers
@@ -645,7 +645,7 @@ static void __devinit radeon_get_pllinfo(struct radeonfb_info *rinfo)
         rinfo->pll.ref_div = INPLL(PPLL_REF_DIV) & PPLL_REF_DIV_MASK;
 
 
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
         /*
          * Retrieve PLL infos from Open Firmware first
          */
@@ -653,7 +653,7 @@ static void __devinit radeon_get_pllinfo(struct radeonfb_info *rinfo)
                 printk(KERN_INFO "radeonfb: Retrieved PLL infos from Open Firmware\n");
                 goto found;
         }
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
 
         /*
          * Check out if we have an X86 which gave us some PLL informations
@@ -2231,7 +2231,7 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
             rinfo->family == CHIP_FAMILY_RS200)
                 rinfo->errata |= CHIP_ERRATA_PLL_DELAY;
 
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
         /* On PPC, we obtain the OF device-node pointer to the firmware
          * data for this chip
          */
@@ -2240,6 +2240,8 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
                 printk(KERN_WARNING "radeonfb (%s): Cannot match card to OF node !\n",
                        pci_name(rinfo->pdev));
 
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
+#ifdef CONFIG_PPC_OF
         /* On PPC, the firmware sets up a memory mapping that tends
          * to cause lockups when enabling the engine. We reconfigure
          * the card internal memory mappings properly
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/aty/radeon_monitor.c
index 38c7dbf8c151..737b5c09dbdb 100644
--- a/drivers/video/aty/radeon_monitor.c
+++ b/drivers/video/aty/radeon_monitor.c
@@ -52,7 +52,7 @@ static char *radeon_get_mon_name(int type)
 }
 
 
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
 /*
  * Try to find monitor informations & EDID data out of the Open Firmware
  * device-tree. This also contains some "hacks" to work around a few machine
@@ -156,7 +156,7 @@ static int __devinit radeon_probe_OF_head(struct radeonfb_info *rinfo, int head_
         }
         return MT_NONE;
 }
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
 
 
 static int __devinit radeon_get_panel_info_BIOS(struct radeonfb_info *rinfo)
@@ -495,11 +495,11 @@ void __devinit radeon_probe_screens(struct radeonfb_info *rinfo,
                  * Old single head cards
                  */
                 if (!rinfo->has_CRTC2) {
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
                         if (rinfo->mon1_type == MT_NONE)
                                 rinfo->mon1_type = radeon_probe_OF_head(rinfo, 0,
                                                                         &rinfo->mon1_EDID);
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
 #ifdef CONFIG_FB_RADEON_I2C
                         if (rinfo->mon1_type == MT_NONE)
                                 rinfo->mon1_type =
@@ -544,11 +544,11 @@ void __devinit radeon_probe_screens(struct radeonfb_info *rinfo,
                 /*
                  * Probe primary head (DVI or laptop internal panel)
                  */
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
                 if (rinfo->mon1_type == MT_NONE)
                         rinfo->mon1_type = radeon_probe_OF_head(rinfo, 0,
                                                                 &rinfo->mon1_EDID);
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || CONFIG_SPARC */
 #ifdef CONFIG_FB_RADEON_I2C
                 if (rinfo->mon1_type == MT_NONE)
                         rinfo->mon1_type = radeon_probe_i2c_connector(rinfo, ddc_dvi,
@@ -572,11 +572,11 @@ void __devinit radeon_probe_screens(struct radeonfb_info *rinfo,
                 /*
                  * Probe secondary head (mostly VGA, can be DVI)
                  */
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
                 if (rinfo->mon2_type == MT_NONE)
                         rinfo->mon2_type = radeon_probe_OF_head(rinfo, 1,
                                                                 &rinfo->mon2_EDID);
-#endif /* CONFIG_PPC_OF */
+#endif /* CONFIG_PPC_OF || defined(CONFIG_SPARC) */
 #ifdef CONFIG_FB_RADEON_I2C
                 if (rinfo->mon2_type == MT_NONE)
                         rinfo->mon2_type = radeon_probe_i2c_connector(rinfo, ddc_vga,
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index d5ff224a6258..319000360285 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -16,7 +16,7 @@
 
 #include <asm/io.h>
 
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
 #include <asm/prom.h>
 #endif
 
@@ -292,7 +292,7 @@ struct radeonfb_info {
         unsigned long           fb_local_base;
 
         struct pci_dev          *pdev;
-#ifdef CONFIG_PPC_OF
+#if defined(CONFIG_PPC_OF) || defined(CONFIG_SPARC)
         struct device_node      *of_node;
 #endif
 
diff --git a/drivers/video/cg3.c b/drivers/video/cg3.c
index 767c850f8eb7..f042428a84f4 100644
--- a/drivers/video/cg3.c
+++ b/drivers/video/cg3.c
@@ -266,7 +266,7 @@ static void __devinit cg3_init_fix(struct fb_info *info, int linebytes,
 static void __devinit cg3_rdi_maybe_fixup_var(struct fb_var_screeninfo *var,
                                               struct device_node *dp)
 {
-        char *params;
+        const char *params;
         char *p;
         int ww, hh;
 
diff --git a/drivers/video/igafb.c b/drivers/video/igafb.c
index 90592fb59156..eb1a4812ad1d 100644
--- a/drivers/video/igafb.c
+++ b/drivers/video/igafb.c
@@ -44,8 +44,8 @@
 
 #include <asm/io.h>
 
-#ifdef __sparc__
-#include <asm/pbm.h>
+#ifdef CONFIG_SPARC
+#include <asm/prom.h>
 #include <asm/pcic.h>
 #endif
 
@@ -96,7 +96,7 @@ struct fb_var_screeninfo default_var = {
         .vmode          = FB_VMODE_NONINTERLACED
 };
 
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
 struct fb_var_screeninfo default_var_1024x768 __initdata = {
         /* 1024x768, 75 Hz, Non-Interlaced (78.75 MHz dotclock) */
         .xres           = 1024,
@@ -188,7 +188,7 @@ static inline void iga_outb(struct iga_par *par, unsigned char val,
         pci_outb(par, val, reg+1);
 }
 
-#endif /* __sparc__ */
+#endif /* CONFIG_SPARC */
 
 /*
  *  Very important functionality for the JavaEngine1 computer:
@@ -217,7 +217,7 @@ static void iga_blank_border(struct iga_par *par)
                 iga_outb(par, 0, IGA_EXT_CNTRL, IGA_IDX_OVERSCAN_COLOR + i);
 }
 
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
 static int igafb_mmap(struct fb_info *info,
                       struct vm_area_struct *vma)
 {
@@ -271,7 +271,7 @@ static int igafb_mmap(struct fb_info *info,
         vma->vm_flags |= VM_IO;
         return 0;
 }
-#endif /* __sparc__ */
+#endif /* CONFIG_SPARC */
 
 static int igafb_setcolreg(unsigned regno, unsigned red, unsigned green,
                            unsigned blue, unsigned transp,
@@ -323,7 +323,7 @@ static struct fb_ops igafb_ops = {
         .fb_fillrect    = cfb_fillrect,
         .fb_copyarea    = cfb_copyarea,
         .fb_imageblit   = cfb_imageblit,
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
         .fb_mmap        = igafb_mmap,
 #endif
 };
@@ -424,7 +424,7 @@ int __init igafb_init(void)
 
         par->frame_buffer_phys = addr & PCI_BASE_ADDRESS_MEM_MASK;
 
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
         /*
          * The following is sparc specific and this is why:
          *
@@ -477,8 +477,8 @@ int __init igafb_init(void)
          * Set default vmode and cmode from PROM properties.
          */
         {
-                struct pcidev_cookie *cookie = pdev->sysdata;
-                int node = cookie->prom_node;
+                struct device_node *dp = pci_device_to_OF_node(pdev);
+                int node = dp->node;
                 int width = prom_getintdefault(node, "width", 1024);
                 int height = prom_getintdefault(node, "height", 768);
                 int depth = prom_getintdefault(node, "depth", 8);
@@ -534,7 +534,7 @@ int __init igafb_init(void)
                 kfree(info);
         }
 
-#ifdef __sparc__
+#ifdef CONFIG_SPARC
             /*
              * Add /dev/fb mmap values.
              */
@@ -552,7 +552,7 @@ int __init igafb_init(void)
             par->mmap_map[1].size = PAGE_SIZE * 2; /* X wants 2 pages */
             par->mmap_map[1].prot_mask = SRMMU_CACHE;
             par->mmap_map[1].prot_flag = SRMMU_WRITE;
-#endif /* __sparc__ */
+#endif /* CONFIG_SPARC */
 
         return 0;
 }